@opengeni/capabilities 0.1.1 → 0.3.0-canary.0

package/README.md

@@ -13,11 +13,27 @@ Security defaults:
 
 - credentials are resolved for one exact destination and verified before use;
 - header, query, and cookie placements are bounded and validated atomically;
-- Google/Microsoft preset OAuth stays in the normal encrypted Connection spine;
+- curated Google/Microsoft Integration Definition OAuth stays in the normal encrypted Connection spine;
 - redirects are never followed on credential-bearing requests;
 - response bodies, schemas, operation counts, and deadlines are bounded;
 - mutating operations are marked approval-required by default;
 - a safe read/query may refresh and retry exactly once on `401`, while a
   mutation is never replayed after an ambiguous provider authorization result;
   and
-- errors contain structural recovery facts, never provider bodies or secrets.
+- errors contain structural recovery facts, never provider bodies or secrets.
+
+## Local MCP bridge kit
+
+`src/mcp-bridge.ts` defines the shared contract for provider APIs exposed as
+in-process MCP servers. A bridge declares a secret-free catalog identity,
+actual authority class, reviewed tool-surface class, 1-32 exact HTTPS
+destinations, and the safe-read-only replay rule. Adapter matching is generic
+and fails closed on ambiguity. The descriptor is not authorization: each
+adapter still revalidates its Connection or host-owned authority before every
+provider request.
+
+The Gmail REST adapter is the static reviewed example. OpenAPI and GraphQL
+Integration Definitions keep their existing local MCP adapters without
+claiming this descriptor. Google Drive remains one functional Integration row
+with its existing Connection and facet authority. See
+`docs/design/first-party-mcp-bridges.md`.

package/THIRD_PARTY_NOTICES

@@ -2,8 +2,8 @@ This package contains adapted portions of Executor (https://github.com/executorj
 copyright (c) 2026 Rhys Sullivan, used under the MIT License.
 
 The adapted concepts include deterministic MCP tool identifiers, OpenAPI and
-GraphQL extraction/invocation boundaries, auth-placement modeling, provider
-preset normalization, and MCP manifest projection. Executor's Effect/FumaDB
+GraphQL extraction/invocation boundaries, auth-placement modeling, curated
+Integration Definition normalization, and MCP manifest projection. Executor's Effect/FumaDB
 application architecture, persistence, secret stores, runtime hosts, and UI
 state are not included.
 

package/dist/graphql.d.ts

@@ -12,7 +12,7 @@ export interface GraphqlOperationBinding {
 }
 export type GraphqlRevision = IntegrationRevision<GraphqlOperationBinding, "graphql">;
 export interface CompileGraphqlOptions {
-    readonly integrationId: string;
+    readonly definitionId: string;
     readonly endpoint: string;
     readonly name?: string;
     readonly sourceUrl?: string;

package/dist/index.d.ts

@@ -2,7 +2,9 @@ export * from "./auth.js";
 export * from "./graphql.js";
 export * from "./http.js";
 export * from "./mcp-manifest.js";
+export * from "./mcp-bridge.js";
 export * from "./openapi.js";
-export * from "./providers.js";
+export * from "./integration-definitions.js";
+export * from "./integration-presentations.js";
 export * from "./revision.js";
 export * from "./types.js";