@protobase/client 0.33.4 → 0.34.1

package/dist/account-security.d.ts

@@ -25,6 +25,19 @@ export type Passkey = {
   createdAt?: string;
   backedUp: boolean;
 };
+/**
+ * An app the person allowed to act as them, such as an MCP client: its client id, the name it gave itself, when they
+ * last allowed it, and as what: each role (its label) and organization (its name) they allowed it with.
+ */
+export type ConnectedApp = {
+  clientId: string;
+  name?: string;
+  allowedAt: string;
+  access: {
+    role: string;
+    organization?: string;
+  }[];
+};
 /** A new authenticator app: the `otpauth://` URI it scans, and the backup codes that work once each instead of a code. */
 export type AuthenticatorSetup = {
   totpURI: string;
@@ -55,6 +68,10 @@ export declare const accountSecurity: (client: BetterAuthClient) => {
    * `?error=<code>` when the link did not go through, for example `account_already_linked_to_different_user`.
    */
   linkProvider: (provider: string, callbackURL: string) => Promise<string>;
+  /** The apps the person allowed to act as them, newest first; on an app with MCP on. */
+  connectedApps: () => Promise<ConnectedApp[]>;
+  /** Disconnects an app: it is forgotten, and its access ends within 15 minutes; it has to ask again to come back. */
+  disconnectApp: (clientId: string) => Promise<void>;
   /** New backup codes for the authenticator app; the old ones stop working. */
   newBackupCodes: (password?: string) => Promise<string[]>;
 };

package/dist/account-security.js

@@ -85,6 +85,20 @@ const accountSecurity = (client) => ({
 		if (error || !data?.url) throw authError(error, "Could not start linking the account");
 		return data.url;
 	},
+	/** The apps the person allowed to act as them, newest first; on an app with MCP on. */
+	connectedApps: async () => {
+		const { data, error } = await client.$fetch("/account/connected-apps");
+		if (error || !data) throw authError(error, "Could not read your connected apps");
+		return data.apps;
+	},
+	/** Disconnects an app: it is forgotten, and its access ends within 15 minutes; it has to ask again to come back. */
+	disconnectApp: async (clientId) => {
+		const { error } = await client.$fetch("/account/connected-apps/disconnect", {
+			method: "POST",
+			body: { clientId }
+		});
+		if (error) throw authError(error, "Could not disconnect the app");
+	},
 	/** New backup codes for the authenticator app; the old ones stop working. */
 	newBackupCodes: async (password) => {
 		const { data, error } = await client.twoFactor.generateBackupCodes(password ? { password } : {});

package/dist/auth-types.d.ts

@@ -35,8 +35,9 @@ export type SamlSignIn = {
  * `sendSignUpCode`); `socialProviders` the ids of the sign-in providers, for example
  * `github`; `platformSignIn` the one of them the platform adds; `samlProviders` the app's SAML identity providers; `staffSignIn` the operator provider's name when its staff
  * can sign in as people; `organizations` when the app has them; `anonymous` when visitors may browse what the project's
- * anonymous role reads without signing in; `plugins` those the app loads before anyone signs in; `locale` the language
- * the app sets for everyone, which the screens before `/meta` are in.
+ * anonymous role reads without signing in; `mcp` when MCP clients can connect, so the account page lists them; `plugins`
+ * those the app loads before anyone signs in; `locale` the language the app sets for everyone, which the screens before
+ * `/meta` are in.
  */
 export type SetupStatus = {
   needsAdmin: boolean;
@@ -58,6 +59,7 @@ export type SetupStatus = {
     roles: RoleLabel[];
   };
   anonymous?: boolean;
+  mcp?: boolean;
   plugins?: PluginRef[];
   locale?: Locale;
 };

package/dist/auth.d.ts

@@ -1,5 +1,6 @@
 import { SignInPolicy, SignInPolicyState } from "./sign-in-policy.js";
-import { AccountSignIn, AuthenticatorSetup, Passkey } from "./account-security.js";
+import { AccountSignIn, AuthenticatorSetup, ConnectedApp, Passkey } from "./account-security.js";
+import { ConnectingClient } from "./connect.js";
 import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsFound } from "./organizations.js";
 import { ActiveRole } from "./roles.js";
 import { AuthUser, RoleLabel, SetupStatus, SignInResult, TwoFactorMethod } from "./auth-types.js";
@@ -24,7 +25,7 @@ export declare const tokenExpiry: (token: string) => number;
  * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
  * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
  * sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
- * signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), and a short-lived
+ * signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), allowing an outside app such as an MCP client (`connect`), and a short-lived
  * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
  */
 export declare const createAuthSession: (options?: AuthSessionOptions) => {
@@ -60,8 +61,19 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
     turnOffTwoFactor: (password?: string) => Promise<void>;
     linkedProviders: () => Promise<string[]>;
     linkProvider: (provider: string, callbackURL: string) => Promise<string>;
+    connectedApps: () => Promise<ConnectedApp[]>;
+    disconnectApp: (clientId: string) => Promise<void>;
     newBackupCodes: (password?: string) => Promise<string[]>;
   };
+  connect: {
+    client: (clientId: string) => Promise<ConnectingClient>;
+    resume: (oauthQuery: string) => Promise<{
+      url: string;
+    }>;
+    answer: (accept: boolean, oauthQuery: string) => Promise<{
+      url: string;
+    }>;
+  };
   organizations: {
     list: () => Promise<Organization[]>;
     current: () => Promise<CurrentOrganization>;

package/dist/auth.js

@@ -1,5 +1,6 @@
 import { AuthError, authError } from "./auth-error.js";
 import { accountSecurity } from "./account-security.js";
+import { connectClient } from "./connect.js";
 import { betterAuthClient } from "./better-auth-client.js";
 import { organizationsClient } from "./organizations.js";
 import { rolesClient } from "./roles.js";
@@ -21,7 +22,7 @@ const tokenExpiry = (token) => {
 * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
 * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
 * sign-in policy for admins (`signInPolicy`), the people who can sign in for admins (`users`), staff of the operator
-* signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), and a short-lived
+* signing in as people (`staff`), organizations (`organizations`), the role the session acts with (`roles`), allowing an outside app such as an MCP client (`connect`), and a short-lived
 * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
 */
 const createAuthSession = (options = {}) => {
@@ -83,6 +84,7 @@ const createAuthSession = (options = {}) => {
 				...body.passkeyDomains && { passkeyDomains: body.passkeyDomains },
 				...body.organizations && { organizations: body.organizations },
 				...body.anonymous && { anonymous: true },
+				...body.mcp && { mcp: true },
 				...body.plugins && body.plugins.length > 0 && { plugins: body.plugins },
 				...isLocale(body.locale) && { locale: body.locale }
 			};
@@ -149,6 +151,7 @@ const createAuthSession = (options = {}) => {
 			if (error) throw authError(error, "Could not set the password");
 		},
 		account: accountSecurity(client),
+		connect: connectClient(client),
 		organizations: organizationsClient(client, () => token({ refresh: true })),
 		roles: rolesClient(client, () => token({ refresh: true })),
 		signInPolicy: signInPolicyClient(client),

package/dist/connect.d.ts

@@ -0,0 +1,27 @@
+import { BetterAuthClient } from "./better-auth-client.js";
+//#region src/connect.d.ts
+/** What a client says about itself, as the server hands it to anyone: its id and the name it gave itself. */
+export type ConnectingClient = {
+  client_id: string;
+  client_name?: string;
+};
+/**
+ * The calls of the connect page, where someone allows an outside app, such as an MCP client, to act as them. Each
+ * takes the signed request the server sent the page (`oauthQuery`, its query) and resolves with where to go next, or
+ * rejects with `AuthError` carrying the code: `invalid_signature` for an expired request, `STAFF_CANNOT_CONNECT`,
+ * `SIGN_IN_SETUP_REQUIRED` or `ADDRESS_NOT_VERIFIED`.
+ */
+export declare const connectClient: (client: BetterAuthClient) => {
+  /** The client asking, by its id. */
+  client: (clientId: string) => Promise<ConnectingClient>;
+  /** Picks the request up for the signed-in person: the connect page again to ask them, or the client when they allowed it before. */
+  resume: (oauthQuery: string) => Promise<{
+    url: string;
+  }>;
+  /** Allows the client (`accept`) or not: where to send the browser, the client with a code or with `access_denied`. */
+  answer: (accept: boolean, oauthQuery: string) => Promise<{
+    url: string;
+  }>;
+};
+export type ConnectClient = ReturnType<typeof connectClient>;
+//#endregion

package/dist/connect.js

@@ -0,0 +1,43 @@
+import { AuthError } from "./auth-error.js";
+//#region src/connect.ts
+const connectError = (error, fallback) => new AuthError(error?.message || error?.error_description || fallback, error?.status ?? 500, error?.code ?? error?.error);
+/**
+* The calls of the connect page, where someone allows an outside app, such as an MCP client, to act as them. Each
+* takes the signed request the server sent the page (`oauthQuery`, its query) and resolves with where to go next, or
+* rejects with `AuthError` carrying the code: `invalid_signature` for an expired request, `STAFF_CANNOT_CONNECT`,
+* `SIGN_IN_SETUP_REQUIRED` or `ADDRESS_NOT_VERIFIED`.
+*/
+const connectClient = (client) => ({
+	/** The client asking, by its id. */
+	client: async (clientId) => {
+		const { data, error } = await client.$fetch("/oauth2/public-client", { query: { client_id: clientId } });
+		if (error || !data) throw connectError(error, "Could not read the app asking");
+		return data;
+	},
+	/** Picks the request up for the signed-in person: the connect page again to ask them, or the client when they allowed it before. */
+	resume: async (oauthQuery) => {
+		const { data, error } = await client.$fetch("/oauth2/continue", {
+			method: "POST",
+			body: {
+				postLogin: true,
+				oauth_query: oauthQuery
+			}
+		});
+		if (error || !data?.url) throw connectError(error, "Could not go on with the request");
+		return { url: data.url };
+	},
+	/** Allows the client (`accept`) or not: where to send the browser, the client with a code or with `access_denied`. */
+	answer: async (accept, oauthQuery) => {
+		const { data, error } = await client.$fetch("/oauth2/consent", {
+			method: "POST",
+			body: {
+				accept,
+				oauth_query: oauthQuery
+			}
+		});
+		if (error || !data?.url) throw connectError(error, "Could not answer the request");
+		return { url: data.url };
+	}
+});
+//#endregion
+export { connectClient };

package/dist/index.d.ts

@@ -9,7 +9,8 @@ import { fileUrl } from "./file-urls.js";
 import { routedClient } from "./routed-client.js";
 import { SourceMeta, sourceMeta } from "./source-meta.js";
 import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffAccessRule } from "./sign-in-policy.js";
-import { AccountSecurity, AccountSignIn, AuthenticatorSetup, Passkey, RequiredSetup } from "./account-security.js";
+import { AccountSecurity, AccountSignIn, AuthenticatorSetup, ConnectedApp, Passkey, RequiredSetup } from "./account-security.js";
+import { ConnectClient, ConnectingClient } from "./connect.js";
 import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsClient, OrganizationsFound } from "./organizations.js";
 import { ActiveRole, RoleOption, RolesClient } from "./roles.js";
 import { AuthUser, PlatformSignIn, RoleLabel, SamlSignIn, SetupStatus, SignInMethod, SignInResult, TwoFactorMethod } from "./auth-types.js";
@@ -20,4 +21,4 @@ import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimeLastUpdate, RuntimePolicy, RuntimeStatus, RuntimeUpdateStage, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, type AggregateSplitTotal, ApiError, type AppUser, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type CurrentOrganization, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type LiveChange, type LiveHandlers, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, type UserInvitation, type UserInvitationSent, type UsersClient, type UsersFound, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, type ActiveRole, type Aggregate, type AggregateGroup, type AggregateParams, type AggregateSplitTotal, ApiError, type AppUser, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CommentPage, type CommentPerson, type ConnectClient, type ConnectedApp, type ConnectingClient, type CurrentOrganization, type Facet, type FilterInput, type FormChallenge, type FormProof, type Histogram, type HistogramBucket, type HistoryChange, type HistoryPage, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type LiveChange, type LiveHandlers, type MapBounds, type MapBucket, type MapLayerModel, type MapParams, type MapResult, type MentionableUser, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type OrganizationsFound, type Passkey, type PlatformSignIn, type PluginRef, PreconditionFailedError, type ProblemDetails, type ProblemError, type PublicForm, type RecordComment, type RecordOf, type RecordPermissions, type RecordPhotos, type RelatedLabels, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimeLastUpdate, type RuntimePolicy, type RuntimeStatus, type RuntimeUpdateStage, type SamlSignIn, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type SourceMeta, type SourceRef, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type StoredFileVariant, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, type UserInvitation, type UserInvitationSent, type UsersClient, type UsersFound, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, fileUrl, filterText, isApiError, listWire, routedClient, sourceMeta, tokenExpiry };

package/dist/static-session.js

@@ -72,7 +72,14 @@ const createStaticSession = (token, user = {
 		turnOffTwoFactor: unsupported("turn off two-factor authentication"),
 		newBackupCodes: unsupported("make backup codes"),
 		linkedProviders: async () => [],
-		linkProvider: unsupported("link a sign-in provider")
+		linkProvider: unsupported("link a sign-in provider"),
+		connectedApps: async () => [],
+		disconnectApp: unsupported("disconnect an app")
+	},
+	connect: {
+		client: unsupported("allow an app"),
+		resume: unsupported("allow an app"),
+		answer: unsupported("allow an app")
 	},
 	signInPolicy: {
 		read: unsupported("read the sign-in policy"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.33.4",
+  "version": "0.34.1",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -29,10 +29,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.33.4",
-    "@protobase/schema": "0.33.4",
+    "@better-auth/passkey": "^1.7.12",
+    "@protobase/layout": "0.34.1",
+    "@protobase/schema": "0.34.1",
     "@simplewebauthn/browser": "^13.3.0",
-    "better-auth": "^1.7.7"
+    "better-auth": "^1.7.12"
   }
 }