@robosystems/core 0.5.9 → 0.6.1

package/components/console/ConsoleContent.js

@@ -406,58 +406,50 @@ export function ConsoleContent({ config }) {
         }
     };
     const showMcpSetup = async () => {
-        addSystemMessage('Creating MCP API key...', true);
+        addSystemMessage('Creating graph-scoped connector key...', true);
         const apiUrl = process.env.NEXT_PUBLIC_ROBOSYSTEMS_API_URL ||
             'https://api.robosystems.ai';
+        const { mcp } = config;
+        const contextId = graphId || mcp.contextIdFallback;
         try {
-            const { createUserApiKey } = await import('@robosystems/client/sdk');
-            const response = await createUserApiKey({
-                body: {
-                    name: `MCP - Console Generated - ${new Date().toLocaleDateString()}`,
-                },
-            });
-            if (!response.data) {
-                throw new Error('Failed to create API key');
-            }
-            const apiKey = response.data.key;
-            const { mcp } = config;
-            const contextId = graphId || mcp.contextIdFallback;
+            const { createMcpConnectorUrl } = await import('../../lib/mcp-connector');
             // The graph id lives in the URL path and never becomes a tool argument,
             // so one connector is anchored to exactly one graph. Multi-graph users
             // add one connector per graph, which is why the name carries the id.
-            const mcpUrl = `${apiUrl}/v1/graphs/${contextId}/mcp`;
+            // The key is graph-scoped: valid only for this graph, revocable in
+            // Settings → API Keys, and rejected on every account-level surface.
+            const connector = await createMcpConnectorUrl(contextId, { apiUrl });
             const connectorName = `${mcp.serverName}-${contextId}`;
             const exampleLines = mcp.exampleQuestions
                 .map((q) => `  • "${q}"`)
                 .join('\n');
             addSystemMessage(`MCP Setup Instructions:\n` +
                 `═══════════════════════════════════════════════════════════════\n\n` +
-                `API Key Created Successfully!\n\n` +
-                `One URL, one header — no install required.\n\n` +
-                `   URL:    ${mcpUrl}\n` +
-                `   Header: X-API-Key: ${apiKey}\n\n` +
+                `Graph-scoped API key created — it works only for ${contextId}\n` +
+                `and can be revoked anytime in Settings → API Keys.\n\n` +
                 `Claude (claude.ai / Desktop)\n` +
-                `  Settings → Connectors → Add custom connector, then paste the URL\n` +
-                `  above and add the header.\n\n` +
+                `  Settings → Connectors → Add custom connector, then paste this\n` +
+                `  URL (the key rides inside it — no header field needed):\n` +
+                `  ${connector.url}\n\n` +
                 `Claude Code\n` +
                 `  claude mcp add --transport http ${connectorName} \\\n` +
-                `    ${mcpUrl} \\\n` +
-                `    --header "X-API-Key: ${apiKey}"\n\n` +
+                `    ${connector.endpoint} \\\n` +
+                `    --header "X-API-Key: ${connector.apiKey}"\n\n` +
                 `Cursor / VS Code (mcp.json)\n` +
                 `  "${connectorName}": {\n` +
-                `    "url": "${mcpUrl}",\n` +
-                `    "headers": { "X-API-Key": "${apiKey}" }\n` +
+                `    "url": "${connector.endpoint}",\n` +
+                `    "headers": { "X-API-Key": "${connector.apiKey}" }\n` +
                 `  }\n\n` +
                 `Once connected, ask Claude questions like:\n` +
                 `${exampleLines}\n\n` +
-                `Clients without HTTP transport support can use the legacy stdio\n` +
-                `bridge: https://github.com/RoboFinSystems/robosystems-mcp-client\n\n` +
-                `Keep this API key secure! It has full access to your account.`, true);
+                `Clients without HTTP transport support can use the stdio bridge\n` +
+                `in proxy mode: https://github.com/RoboFinSystems/robosystems-mcp-client\n\n` +
+                `The connector URL contains the key — treat it like a password.`, true);
         }
         catch (error) {
-            addErrorMessage(`Failed to create API key: ${error.message || 'Unknown error'}\n\n` +
+            addErrorMessage(`Failed to create connector key: ${error.message || 'Unknown error'}\n\n` +
                 `You can create an API key in Settings and connect with:\n` +
-                `  URL:    ${apiUrl}/v1/graphs/${graphId || config.mcp.contextIdFallback}/mcp\n` +
+                `  URL:    ${apiUrl}/v1/graphs/${contextId}/mcp\n` +
                 `  Header: X-API-Key: <your key>`);
         }
     };

package/index.d.ts

@@ -4,7 +4,7 @@ export { clearUserCookies, clearUserLocalStorage, clearUserSessionStorage, listU
 export { AppSwitcher, AuthGuard, AuthProvider, SignInForm, SignUpForm, useAuth, } from './auth-components';
 export { useApiError, useMediaQuery, useToast, useUser, useUserLimits, type ToastMessage, } from './hooks';
 export { createGraphContext, createGraphProvider, createUseGraphContext, EntityProvider, GraphContext, GraphProvider, OrgProvider, ServiceOfferingsProvider, SidebarProvider, useEntity, useGraphContext, useOrg, useServiceOfferings, useSidebarContext, type EntityContextValue, type EntityProviderProps, type GraphContextValue, type GraphProviderProps, type GraphState, type OrgContextState, type OrgContextValue, type OrgProviderProps, type ServiceOfferings, } from './contexts';
-export { clientGraphCookie, clientSidebarCookie, entityCookie, graphCookie, sidebarCookie, type EntityCookie, type GraphCookie, type SidebarCookie, } from './lib';
+export { clientGraphCookie, clientSidebarCookie, createMcpConnectorUrl, entityCookie, graphCookie, sidebarCookie, type EntityCookie, type GraphCookie, type McpConnectorUrl, type SidebarCookie, } from './lib';
 export { generateEntityUri, isUUID, UUID_REGEX } from './utils';
 export { clearGraphSelection, getGraphSelection, persistGraphSelection, } from './actions/graph-actions';
 export { clearEntitySelection, getEntitySelection, persistEntitySelection, } from './actions/entity-actions';

package/index.js

@@ -20,7 +20,7 @@ OrgProvider,
 // Service offerings context
 ServiceOfferingsProvider, SidebarProvider, useEntity, useGraphContext, useOrg, useServiceOfferings, useSidebarContext, } from './contexts';
 // Export lib utilities
-export { clientGraphCookie, clientSidebarCookie, entityCookie, graphCookie, sidebarCookie, } from './lib';
+export { clientGraphCookie, clientSidebarCookie, createMcpConnectorUrl, entityCookie, graphCookie, sidebarCookie, } from './lib';
 // Export utils
 export { generateEntityUri, isUUID, UUID_REGEX } from './utils';
 // Export server actions

package/lib/index.d.ts

@@ -1,3 +1,4 @@
 export { clientSidebarCookie, sidebarCookie, type SidebarCookie, } from './sidebar-cookie';
 export { clientGraphCookie, graphCookie, type GraphCookie, } from './graph-cookie';
 export { entityCookie, type EntityCookie } from './entity-cookie';
+export { createMcpConnectorUrl, type McpConnectorUrl } from './mcp-connector';

package/lib/index.js

@@ -1,3 +1,4 @@
 export { clientSidebarCookie, sidebarCookie, } from './sidebar-cookie';
 export { clientGraphCookie, graphCookie, } from './graph-cookie';
 export { entityCookie } from './entity-cookie';
+export { createMcpConnectorUrl } from './mcp-connector';

package/lib/mcp-connector.d.ts

@@ -0,0 +1,29 @@
+export interface McpConnectorUrl {
+    /** Pasteable connector URL with the graph-scoped key embedded as `?token=` */
+    url: string;
+    /** Bare MCP endpoint URL (no credential) — for header-capable clients */
+    endpoint: string;
+    /** The plaintext graph-scoped API key (returned once at mint) */
+    apiKey: string;
+    /** Name the key was created under (visible in Settings → API Keys) */
+    keyName: string;
+    graphId: string;
+}
+/**
+ * Mint a graph-scoped API key and assemble the MCP connector URL for it.
+ *
+ * The URL is for clients that cannot send custom headers (claude.ai /
+ * Claude Desktop custom connectors): the scoped key travels as a `token`
+ * query parameter, which the server honors only on the MCP endpoint and
+ * only for keys scoped to that URL's graph — account-wide keys are
+ * rejected there. The key works for exactly this graph (and its
+ * subgraphs), is rejected on every account-level surface, and can be
+ * revoked from Settings → API Keys like any other key.
+ *
+ * Header-capable clients (Claude Code, Cursor, VS Code) should use the
+ * bare `endpoint` with the key in an `X-API-Key` header instead.
+ */
+export declare function createMcpConnectorUrl(graphId: string, options?: {
+    apiUrl?: string;
+    name?: string;
+}): Promise<McpConnectorUrl>;

package/lib/mcp-connector.js

@@ -0,0 +1,35 @@
+const DEFAULT_API_URL = 'https://api.robosystems.ai';
+/**
+ * Mint a graph-scoped API key and assemble the MCP connector URL for it.
+ *
+ * The URL is for clients that cannot send custom headers (claude.ai /
+ * Claude Desktop custom connectors): the scoped key travels as a `token`
+ * query parameter, which the server honors only on the MCP endpoint and
+ * only for keys scoped to that URL's graph — account-wide keys are
+ * rejected there. The key works for exactly this graph (and its
+ * subgraphs), is rejected on every account-level surface, and can be
+ * revoked from Settings → API Keys like any other key.
+ *
+ * Header-capable clients (Claude Code, Cursor, VS Code) should use the
+ * bare `endpoint` with the key in an `X-API-Key` header instead.
+ */
+export async function createMcpConnectorUrl(graphId, options = {}) {
+    var _a, _b;
+    const { createUserApiKey } = await import('@robosystems/client/sdk');
+    const apiUrl = ((_a = options.apiUrl) !== null && _a !== void 0 ? _a : DEFAULT_API_URL).replace(/\/$/, '');
+    const keyName = (_b = options.name) !== null && _b !== void 0 ? _b : `MCP Connector - ${graphId} - ${new Date().toLocaleDateString()}`;
+    const response = await createUserApiKey({
+        body: { name: keyName, graph_id: graphId },
+    });
+    if (!response.data) {
+        throw new Error('Failed to create connector API key');
+    }
+    const endpoint = `${apiUrl}/v1/graphs/${graphId}/mcp`;
+    return {
+        url: `${endpoint}?token=${response.data.key}`,
+        endpoint,
+        apiKey: response.data.key,
+        keyName,
+        graphId,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.5.9",
+  "version": "0.6.1",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,
@@ -27,7 +27,7 @@
     "tailwind-merge": "^3"
   },
   "peerDependencies": {
-    "@robosystems/client": ">=0.6.2 <2",
+    "@robosystems/client": ">=1.2 <2",
     "flowbite-react": "^0.12.5",
     "next": ">=15 <17",
     "react": ">=18 <20",

package/ui-components/api-keys/ApiKeyTable.js

@@ -13,5 +13,5 @@ const defaultFormatDate = (date) => {
 export const ApiKeyTable = ({ apiKeys = [], onRevokeKey, theme, formatDate = defaultFormatDate, }) => {
     // Defensive check to ensure apiKeys is always an array
     const safeApiKeys = Array.isArray(apiKeys) ? apiKeys : [];
-    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs(Table, { className: "table-fixed", children: [_jsxs(TableHead, { children: [_jsx(TableHeadCell, { className: "w-[40%]", children: "Name" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Created" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Last Used" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Status" }), _jsx(TableHeadCell, { className: "w-[15%] text-right", children: "Actions" })] }), _jsx(TableBody, { className: "divide-y", children: safeApiKeys.map((key) => (_jsxs(TableRow, { className: "dark:border-zinc-700", children: [_jsx(TableCell, { className: "font-medium text-zinc-900 dark:text-zinc-100", children: _jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx(HiKey, { className: "h-5 w-5 shrink-0 text-zinc-600 dark:text-zinc-400" }), _jsx("span", { className: "truncate", title: key.name, children: key.name }), key.isSystem && (_jsx("span", { className: "bg-primary-100 text-primary-800 dark:bg-primary-900 dark:text-primary-300 shrink-0 rounded-full px-2.5 py-0.5 text-xs font-medium", children: "System" }))] }) }), _jsx(TableCell, { className: "whitespace-nowrap text-zinc-600 dark:text-zinc-400", children: formatDate(key.createdAt) }), _jsx(TableCell, { className: "whitespace-nowrap text-zinc-600 dark:text-zinc-400", children: formatDate(key.lastUsedAt) }), _jsx(TableCell, { className: "whitespace-nowrap", children: key.isActive ? (_jsxs("div", { className: "inline-flex items-center rounded-full bg-green-100 px-2 py-0.5 text-xs font-medium text-green-800 dark:bg-green-800 dark:text-green-100", children: [_jsx(HiCheckCircle, { className: "mr-1 h-3 w-3" }), "Active"] })) : (_jsxs("div", { className: "inline-flex items-center rounded-full bg-red-100 px-2 py-0.5 text-xs font-medium text-red-800 dark:bg-red-800 dark:text-red-100", children: [_jsx(HiExclamationCircle, { className: "mr-1 h-3 w-3" }), "Revoked"] })) }), _jsx(TableCell, { className: "text-right", children: _jsx("div", { className: "inline-flex justify-end", children: _jsx(Dropdown, { theme: theme === null || theme === void 0 ? void 0 : theme.dropdown, label: "", dismissOnClick: true, renderTrigger: () => (_jsx(Button, { theme: theme === null || theme === void 0 ? void 0 : theme.button, size: "sm", pill: true, className: "bg-zinc-100 text-zinc-900 hover:bg-zinc-200 dark:bg-zinc-700 dark:text-zinc-100 dark:hover:bg-zinc-600", children: _jsx(HiDotsVertical, { className: "h-4 w-4" }) })), children: _jsx(DropdownItem, { onClick: () => onRevokeKey(key.id), disabled: !key.isActive || key.isSystem, icon: HiTrash, className: "hover:bg-zinc-100 dark:hover:bg-zinc-700", children: "Revoke" }) }) }) })] }, key.id))) })] }) }));
+    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs(Table, { className: "table-fixed", children: [_jsxs(TableHead, { children: [_jsx(TableHeadCell, { className: "w-[40%]", children: "Name" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Created" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Last Used" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Status" }), _jsx(TableHeadCell, { className: "w-[15%] text-right", children: "Actions" })] }), _jsx(TableBody, { className: "divide-y", children: safeApiKeys.map((key) => (_jsxs(TableRow, { className: "dark:border-zinc-700", children: [_jsx(TableCell, { className: "font-medium text-zinc-900 dark:text-zinc-100", children: _jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx(HiKey, { className: "h-5 w-5 shrink-0 text-zinc-600 dark:text-zinc-400" }), _jsx("span", { className: "truncate", title: key.name, children: key.name }), key.isSystem && (_jsx("span", { className: "bg-primary-100 text-primary-800 dark:bg-primary-900 dark:text-primary-300 shrink-0 rounded-full px-2.5 py-0.5 text-xs font-medium", children: "System" })), key.graphId && (_jsx("span", { className: "max-w-40 shrink-0 truncate rounded-full bg-blue-100 px-2.5 py-0.5 text-xs font-medium text-blue-800 dark:bg-blue-900 dark:text-blue-300", title: `Scoped to graph ${key.graphId} — valid only for that graph and its subgraphs`, children: key.graphId }))] }) }), _jsx(TableCell, { className: "whitespace-nowrap text-zinc-600 dark:text-zinc-400", children: formatDate(key.createdAt) }), _jsx(TableCell, { className: "whitespace-nowrap text-zinc-600 dark:text-zinc-400", children: formatDate(key.lastUsedAt) }), _jsx(TableCell, { className: "whitespace-nowrap", children: key.isActive ? (_jsxs("div", { className: "inline-flex items-center rounded-full bg-green-100 px-2 py-0.5 text-xs font-medium text-green-800 dark:bg-green-800 dark:text-green-100", children: [_jsx(HiCheckCircle, { className: "mr-1 h-3 w-3" }), "Active"] })) : (_jsxs("div", { className: "inline-flex items-center rounded-full bg-red-100 px-2 py-0.5 text-xs font-medium text-red-800 dark:bg-red-800 dark:text-red-100", children: [_jsx(HiExclamationCircle, { className: "mr-1 h-3 w-3" }), "Revoked"] })) }), _jsx(TableCell, { className: "text-right", children: _jsx("div", { className: "inline-flex justify-end", children: _jsx(Dropdown, { theme: theme === null || theme === void 0 ? void 0 : theme.dropdown, label: "", dismissOnClick: true, renderTrigger: () => (_jsx(Button, { theme: theme === null || theme === void 0 ? void 0 : theme.button, size: "sm", pill: true, className: "bg-zinc-100 text-zinc-900 hover:bg-zinc-200 dark:bg-zinc-700 dark:text-zinc-100 dark:hover:bg-zinc-600", children: _jsx(HiDotsVertical, { className: "h-4 w-4" }) })), children: _jsx(DropdownItem, { onClick: () => onRevokeKey(key.id), disabled: !key.isActive || key.isSystem, icon: HiTrash, className: "hover:bg-zinc-100 dark:hover:bg-zinc-700", children: "Revoke" }) }) }) })] }, key.id))) })] }) }));
 };