@softure-ai/mcp-access 0.1.12 → 0.1.14

package/CHANGELOG.md

@@ -4,6 +4,38 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mcp-access@x.y.z`).
 
+## 0.1.14
+
+- `issueToken` can replace an app's own token-issue action (#386):
+  - `mcpAccess({ clientServerName })` (default `serverName`): the name the setup snippets register the server under
+    (`claude mcp add`, the JSON configs, the assistant prompt), so users keep the entry they already added.
+  - The `beforeIssue` gate refuses with its own text: `refuseIssue(code, message)` (`/next`, an `Err` with a
+    `message`), or a thrown `PublicError` (code `mcp-access.issue_refused`). `IssueTokenFormState`'s error carries it
+    as `message`, which `TokenManager` shows instead of the code's copy. `McpIssueRefusal` (root) and
+    `IssueGateResult` (`/next`) are exported.
+  - `IssuedToken.expiresAt` (ISO 8601) next to `expiresText`.
+
+## 0.1.13
+
+- Token and grant dates use core's `formatCalendarDay` on the day in the app's zone; same output. Requires
+  `@softure-ai/core` `^0.1.9` (#312).
+- What an adopting app wrote around the endpoint ships with the package (#315):
+  - `toolResult`, `toolError` and `withToolErrors(work, { hints, label })` (`/server`): a thrown error reaches the
+    assistant only as a `PublicError` message or a hint, and the log only by kind, never with its SQL.
+  - `actionTool(handler, { message, hints })` (`/server`): a server action as a write tool, its arguments sent as
+    the form the action reads.
+  - `@softure-ai/mcp-access/stdio`: `serveMcpStdio({ config, createServer, userIdEnv, allowWrites })` serves the
+    factory over stdio for the account in `MCP_USER_ID`, or the only account; `/stdio/register` resolves
+    `server-only` to an empty module for `node`/`tsx --import`.
+  - `@softure-ai/mcp-access/testing`: `expectToolCatalogMatchesServer(config, createServer)` and
+    `getToolCatalogDifferences`. Catalog tools take optional localized `title` and `example`.
+  - `DEFAULT_MCP_ACCESS_ROUTES` from the root entry; the manifest uses it.
+  - `issueToken(previous, form, { beforeIssue })` (`/next`) for a gate before a token is issued, with the codes
+    `mcp-access.issue_refused` and `mcp-access.write_refused` (copy in en and pl); `McpAccessPage` takes an
+    optional `issueAction`. `issueTokenAction` is unchanged.
+  - `pruneMcpAccess(ctx)` (`/server`) and the `softure-mcp prune` command (bin, `/cli`) for a daily job such as a
+    deploy `maintain` hook.
+
 ## 0.1.12
 
 - Without a `resolveAppOrigin` option, the app origin comes from core's `resolveAppOrigin` (#311): a listed origin
@@ -12,6 +44,8 @@ production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../
   answers `null` for a host that is no host). The consent decision still reads `Host` only. Discovery documents vary
   on `x-forwarded-host` too.
 - `getRequestOrigins(config, path)` is exported from `@softure-ai/mcp-access/next`. Needs `@softure-ai/core` 0.1.8.
+- `MCP_RATE_LIMIT_BUCKETS` declares `key: "ip"` on `mcp` and `mcp-oauth` (security 0.1.8 bucket kinds).
+- Requires `@softure-ai/security` `^0.1.8`: earlier versions refuse the `key` field.
 
 ## 0.1.11
 

package/README.md

@@ -38,6 +38,9 @@ limit check made race-free.
     count against `maxTokensPerUser` and are not listed with the hand-issued ones.
 - Tokens an app issued before adopting the module keep working through `legacyTokenPattern`.
 - Server functions for scripts and other hosts, and a health check for `GET /api/health`.
+- For the app's own server: tool result helpers with a safe error boundary and server actions as write tools
+  (`/server`), a stdio entry for local assistants (`/stdio`), a catalog parity check (`/testing`), a gate before a
+  token is issued (`issueToken`, `/next`) and the `softure-mcp prune` command for a daily cleanup (§4, §5).
 
 ## 2. Installation
 
@@ -74,7 +77,8 @@ mcpAccess({
 | Option | Type | Default | Meaning |
 | --- | --- | --- | --- |
 | `serverName` | `string` | required | The name clients list the server under (lowercase, digits, inner dashes; no quotes needed in a shell). |
-| `tools` | `{ name, access: "read" \| "write", description: { en, pl? } }[]` | `[]` | The catalog the token page shows. Keep it next to the factory; the example app tests that both list the same tools. |
+| `clientServerName` | `string` | `serverName` | The name the setup snippets register the server under (`claude mcp add`, the JSON configs, the assistant prompt), same pattern. Set it when users already added the server under another name: a new name gives everyone who reconnects a second entry. |
+| `tools` | `{ name, access: "read" \| "write", description: { en, pl? }, title?: { en, pl? }, example?: { en, pl? } }[]` | `[]` | The catalog the token page shows. `title` (a display name) and `example` (a request a person could make) are for agent docs that read the catalog. Keep it next to the factory; `expectToolCatalogMatchesServer` (`/testing`) checks that both list the same tools. |
 | `allowWrites` | `boolean` | `false` | Lets write tokens be issued and used. Off, the page offers no write tokens and every token reads only. |
 | `tokenLifetimeDays` | `integer` 1–365 | `90` | How long a hand-issued token works. There is no renewal: the user issues a new one. |
 | `maxTokensPerUser` | `integer` 1–100 | `20` | Unexpired tokens one account may hold. Counted under a per-user lock, so parallel requests cannot overshoot. |
@@ -88,7 +92,7 @@ mcpAccess({
 | `oauth.metadata` | `{ authorizationServer?, protectedResource? }`, each an object or `(origins) => object` | — | Extra keys of the discovery documents (`jwks_uri`, `service_documentation`, `resource_documentation`, `agent_auth`…). Generated keys win; a static object that sets one is refused at startup. The protected resource document takes the app's `resource_name` (default: `serverName`). |
 | `resolveAppOrigin` | `(request) => string \| null` | — | The app origin of one request, ahead of the config's `origins` block (prefer that block: every module reads it). `readRequestOrigin` reads it from `Host`. Null falls back to the block's rule; anything but a bare http(s) origin throws. |
 | `resourceOrigins` | `string[]` (≤ 16 http(s) origins) | `[]` | Other public hosts of the app, e.g. the apex next to `app.`: the root protected resource metadata asked on one of them names it as `resource`, and the OAuth endpoints accept it as `resource`. |
-| `routes` | `{ page?, endpoint?, oauthConsent?, oauthDecision?, oauthToken?, oauthRegister? }` | `/account/mcp`, `/api/mcp`, `/oauth/authorize`, `/api/oauth/authorize`, `/api/oauth/token`, `/api/oauth/register` | Move the page, the endpoint or the OAuth paths; URLs in the setup and the metadata are the app origin (`appOrigin`, or `resolveAppOrigin`'s) + the path. |
+| `routes` | `{ page?, endpoint?, oauthConsent?, oauthDecision?, oauthToken?, oauthRegister? }` | `DEFAULT_MCP_ACCESS_ROUTES` (root entry): `/account/mcp`, `/api/mcp`, `/oauth/authorize`, `/api/oauth/authorize`, `/api/oauth/token`, `/api/oauth/register` | Move the page, the endpoint or the OAuth paths; URLs in the setup and the metadata are the app origin (`appOrigin`, or `resolveAppOrigin`'s) + the path. |
 | `messages` | partial `en` / `pl` | — | Copy overrides. |
 
 `allowWrites` is a deploy decision, so read it from the environment rather than hard-coding it:
@@ -138,6 +142,126 @@ Answers to 2025-era clients come as one SSE `message` event, to 2026-07-28 clien
 mid-call notifications (progress, logging) are dropped. Keep `/api/mcp` out of a proxy guard that
 redirects to the login page: the endpoint authenticates by token, not by cookie.
 
+### Writing tools
+
+`/server` answers tools safely, so a failure never hands the assistant a query or an error's text:
+
+```ts
+import { actionTool, toolResult, withToolErrors } from "@softure-ai/mcp-access/server";
+
+server.registerTool("list_orders", { description: "Lists your orders." }, () =>
+  withToolErrors(() => findOrders(db, userId), { label: "list_orders", hints: { "orders.locked": "The shop is closed for stock-taking." } }),
+);
+if (canWrite) {
+  server.registerTool("place_order", { inputSchema: z.object({ sku: z.string(), quantity: z.number() }) }, actionTool(
+    (form) => placeOrderAction({ status: "idle" }, form),
+    { message: "Order placed.", hints: { "orders.out_of_stock": "That item is out of stock." } },
+  ));
+}
+```
+
+- `toolResult(value)`: a string as text, anything else as JSON. `toolError(message)`: the same with `isError`.
+- `withToolErrors(work, { hints?, label? })`: a `CallToolResult` passes; a result value is unwrapped (`ok` → its
+  value, else the hint for its error code, else the code); any other value becomes `toolResult`. A thrown
+  `PublicError` (core) gives its message. Anything else is logged by kind only (`errorLogLabel`, never the SQL or
+  its parameters) and answered with the hint for its `safeError` code (`core.database_failed`, `core.unexpected`),
+  else a fixed English text.
+- `actionTool(handler, { message?, hints?, label? })`: the server action behind a form as a write tool, so both
+  share one validation path. The arguments become `FormData` (numbers as text, `true` as `"on"`, `false` and `null`
+  left out, arrays one entry per item, dates as ISO, objects as JSON). A `{ ok: false, error }` or
+  `{ status: "error", error }` state is a tool error through the hints; otherwise the answer is `message` (text or
+  `(state) => text`), else the state as JSON.
+
+### Stdio
+
+A local assistant on the machine that holds the database can run the same factory over stdio, without a token:
+
+```ts
+// scripts/mcp-stdio.ts
+import { serveMcpStdio } from "@softure-ai/mcp-access/stdio";
+import config from "../softure.config";
+import { createServer } from "../lib/mcp-server";
+
+const started = await serveMcpStdio({ config, createServer, allowWrites: process.env.MCP_ALLOW_WRITES === "1" });
+if (!started.ok) {
+  console.error(started.error.message);
+  process.exitCode = 1;
+}
+```
+
+```bash
+claude mcp add acme -e MCP_USER_ID=<account id> -- npx tsx --import @softure-ai/mcp-access/stdio/register scripts/mcp-stdio.ts
+```
+
+- The account: `MCP_USER_ID` (or `userIdEnv`) when set, which must name an account; else the only account in the
+  database. With several accounts and no id the entry refuses (`mcp-access.stdio_account_ambiguous`): it never
+  picks one.
+- `canWrite` needs `allowWrites: true` here and the app's `allowWrites`. The token id is `"stdio"`.
+- The database opens like a package command's (`database.handle`, else `database.url`) and closes with the
+  connection. Messages go to stderr; stdout is the protocol.
+- `@softure-ai/mcp-access/stdio/register` (`--import`) resolves `server-only` to an empty module, so a factory
+  written for Next runs in plain Node. It needs Node 22.15 or later (`module.registerHooks`).
+
+### Catalog parity
+
+```ts
+// lib/mcp-server.test.ts
+import { expectToolCatalogMatchesServer } from "@softure-ai/mcp-access/testing";
+
+it("lists the same tools as the server", () => expectToolCatalogMatchesServer(config, createServer));
+```
+
+It lists the server's tools for a read-only and a write identity and throws naming every configured tool the
+server lacks, every registered tool the catalog lacks, and every write tool a read-only token gets.
+`getToolCatalogDifferences` returns the same as lists.
+
+### Gating token issue
+
+An app that checks something before a token is issued (a plan that includes write access) calls `issueToken` from
+its own server action instead of copying `issueTokenAction`:
+
+```ts
+// app/account/mcp/actions.ts
+"use server";
+import { err, ok } from "@softure-ai/core";
+import { issueToken } from "@softure-ai/mcp-access/next";
+import type { IssueTokenFormState } from "@softure-ai/mcp-access";
+
+export async function issueGatedToken(previous: IssueTokenFormState, form: FormData) {
+  return issueToken(previous, form, {
+    beforeIssue: async ({ userId, canWrite }) => (canWrite && !(await hasWritePlan(userId)) ? err("mcp-access.write_refused") : ok()),
+  });
+}
+```
+
+```tsx
+// app/account/mcp/page.tsx
+import { McpAccessPage } from "@softure-ai/mcp-access/next";
+import { issueGatedToken } from "./actions";
+
+export default function Page() {
+  return <McpAccessPage issueAction={issueGatedToken} />;
+}
+```
+
+The gate runs after the session check and before anything is issued. `mcp-access.write_refused` and
+`mcp-access.issue_refused` have copy in `messages.errors["mcp-access"]` (override it per app). A gate with a sentence
+per reason returns `refuseIssue(code, message)` (`/next`) or throws a `PublicError` (core, code `mcp-access.issue_refused`): the
+form state carries the text as `message` and `TokenManager` shows it instead of the code's copy (a blank text falls
+back to it). Any other thrown error becomes a `safeError` code. The gate stays in the app's code, out of
+`softure.config.ts`.
+
+```ts
+beforeIssue: async ({ userId }) => {
+  const plan = await getPlan(userId);
+  if (plan.trialEnded) return refuseIssue("mcp-access.issue_refused", t("billing.trialEnded"));
+  return ok();
+},
+```
+
+The issued token carries `expiresText` (formatted in the app's locale and zone) and `expiresAt` (ISO 8601), for an
+app that renders the expiry itself.
+
 `TokenManager` (`@softure-ai/mcp-access/ui`) takes the actions `issueTokenAction` and
 `revokeTokenAction` (`/next`) as props for an app that composes its own page, and `grants` with
 `revokeGrantAction` for the connected apps list.
@@ -226,7 +350,7 @@ whose last argument they are; `OAuthClientRow` is exported from the package root
 | `last_used_at` | Written on verification at most once a minute; informational only. |
 
 Issuing deletes the issuer's expired tokens; `pruneAccessTokens(ctx)` (`/server`) deletes every
-expired token, for a scheduled job. Rollback: in the migration header.
+expired token, for a scheduled job (see "Scheduled pruning" below). Rollback: in the migration header.
 
 `migrations/0002_create_oauth_grants.sql` creates `mcp.oauth_clients` (client id, name, redirect
 URIs, auth method, sha256 of a confidential client's secret), `mcp.oauth_authorization_codes`
@@ -236,6 +360,18 @@ expiry, last use), and adds `access_tokens.grant_id` (null for hand-issued token
 with the account. `pruneOAuthRecords(ctx)` deletes expired codes, grants whose refresh token has
 expired (with their access tokens) and clients registered over a day ago that hold no grant.
 
+### Scheduled pruning
+
+`pruneMcpAccess(ctx)` (`/server`) runs both prunes and counts what each removed. The `softure-mcp prune` command
+runs it with the app's config (loaded like `softure migrate`, or from an app script through `runMcpAccessCli` from
+`/cli`) and prints one line. Run it daily, e.g. as a `maintain` hook of `@softure-ai/deploy`:
+
+```json
+{ "hooks": { "maintain": [{ "name": "mcp-prune", "compose": ["exec", "-T", "app", "npx", "softure-mcp", "prune"] }] } }
+```
+
+An app that pruned inline on every token exchange can drop that code.
+
 ### Adopting an app's own tables
 
 An app that ran its own `public.access_tokens` (with `grant_id`) and `oauth_clients`,
@@ -280,7 +416,8 @@ the `tools` option, per locale.
 
 ## 10. Hooks
 
-The MCP server factory passed to `createMcpRoute` is the module's only hook. `/server` also exports
+The MCP server factory passed to `createMcpRoute` (and to `serveMcpStdio`) and the `beforeIssue` gate of
+`issueToken` are the module's hooks. `/server` also exports
 `createMcpEndpoint({ createServer })`, a `(ctx, request) => Response` for hosts other than Next, and
 `issueAccessToken`, `listAccessTokens`, `revokeAccessToken`, `verifyAccessToken` and
 `pruneAccessTokens` for scripts. For OAuth: `listOAuthGrants`, `revokeOAuthGrant`,

package/dist/cli/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/cli/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":""}

package/dist/cli/bin.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// The `softure-mcp` executable. All logic lives in command.ts and run.ts, which the tests call directly.
+import { runMcpAccessCommand } from "./command.js";
+process.exitCode = await runMcpAccessCommand({ argv: process.argv.slice(2), cwd: process.cwd() });
+//# sourceMappingURL=bin.js.map

package/dist/cli/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA,yGAAyG;AACzG,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,CAAC,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC"}

package/dist/cli/command.d.ts

@@ -0,0 +1,9 @@
+import { type CliOutput } from "./run.js";
+export interface RunMcpAccessCommandOptions {
+    readonly argv: readonly string[];
+    readonly cwd: string;
+    readonly output?: CliOutput;
+}
+/** Loads the config (unless only help is asked for) and runs `runMcpAccessCli`. */
+export declare function runMcpAccessCommand(options: RunMcpAccessCommandOptions): Promise<number>;
+//# sourceMappingURL=command.d.ts.map

package/dist/cli/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/cli/command.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8D,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAEtG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AASD,mFAAmF;AACnF,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB9F"}

package/dist/cli/command.js

@@ -0,0 +1,30 @@
+// The `softure-mcp` bin. It loads the app's config through `@softure-ai/core/cli`, like `softure-mail`
+// (@softure-ai/mailing): the file must be loadable by Node itself (`.js`/`.mjs`, or `.ts` where Node
+// strips types). Anything else uses an app script with `runMcpAccessCli` instead (see run.ts).
+import { loadAppConfig, takeConfigOption } from "@softure-ai/core/cli";
+import { EXIT_FAILED, EXIT_USAGE, MCP_ACCESS_USAGE, runMcpAccessCli } from "./run.js";
+const APP_SCRIPT = { runner: "runMcpAccessCli", packageName: "@softure-ai/mcp-access" };
+const consoleOutput = {
+    log: (line) => console.log(line),
+    error: (line) => console.error(line),
+};
+/** Loads the config (unless only help is asked for) and runs `runMcpAccessCli`. */
+export async function runMcpAccessCommand(options) {
+    const output = options.output ?? consoleOutput;
+    const taken = takeConfigOption(options.argv);
+    if (!taken.ok) {
+        output.error(`softure-mcp: ${taken.problem}`);
+        output.error(MCP_ACCESS_USAGE);
+        return EXIT_USAGE;
+    }
+    const { configPath, argv } = taken;
+    if (argv[0] !== "prune")
+        return runMcpAccessCli({ argv, output });
+    const loaded = await loadAppConfig({ cwd: options.cwd, configPath, appScript: APP_SCRIPT });
+    if (!loaded.ok) {
+        output.error(`softure-mcp: ${loaded.problem}`);
+        return EXIT_FAILED;
+    }
+    return runMcpAccessCli({ config: loaded.config, argv, output });
+}
+//# sourceMappingURL=command.js.map

package/dist/cli/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/cli/command.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,qGAAqG;AACrG,+FAA+F;AAC/F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,UAAU,CAAC;AAQtG,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;AAExF,MAAM,aAAa,GAAc;IAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;CACrC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAmC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+export { runMcpAccessCommand, type RunMcpAccessCommandOptions } from "./command.js";
+export { EXIT_FAILED, EXIT_OK, EXIT_USAGE, MCP_ACCESS_USAGE, runMcpAccessCli, type CliOutput, type RunMcpAccessCliOptions } from "./run.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,4 @@
+// `@softure-ai/mcp-access/cli`: the `softure-mcp` command for app scripts and container bundles.
+export { runMcpAccessCommand } from "./command.js";
+export { EXIT_FAILED, EXIT_OK, EXIT_USAGE, MCP_ACCESS_USAGE, runMcpAccessCli } from "./run.js";
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,OAAO,EAAE,mBAAmB,EAAmC,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAA+C,MAAM,UAAU,CAAC"}

package/dist/cli/run.d.ts

@@ -0,0 +1,24 @@
+import { type Clock, type SoftureConfig, type SoftureDatabaseConfig } from "@softure-ai/core";
+import { type CommandDatabase } from "@softure-ai/db";
+export interface CliOutput {
+    readonly log: (line: string) => void;
+    readonly error: (line: string) => void;
+}
+export interface RunMcpAccessCliOptions {
+    /** The app's config; only help needs none. */
+    readonly config?: SoftureConfig;
+    /** The arguments after the executable, e.g. `["prune"]`. */
+    readonly argv: readonly string[];
+    readonly output?: CliOutput;
+    /** Default: the wall clock. */
+    readonly clock?: Clock;
+    /** Default: the config's `database.handle`, else a connection on `database.url`. */
+    readonly openDatabase?: (database: SoftureDatabaseConfig) => Promise<CommandDatabase>;
+}
+export declare const EXIT_OK = 0;
+export declare const EXIT_FAILED = 1;
+export declare const EXIT_USAGE = 2;
+export declare const MCP_ACCESS_USAGE = "Usage:\n  softure-mcp prune    deletes expired access tokens, authorization codes, grants and abandoned clients";
+/** Runs one command and answers its exit code. */
+export declare function runMcpAccessCli(options: RunMcpAccessCliOptions): Promise<number>;
+//# sourceMappingURL=run.d.ts.map

package/dist/cli/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAQA,OAAO,EAA8B,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC1H,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAG3E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,qBAAqB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACvF;AAED,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B,eAAO,MAAM,gBAAgB,oHAC2E,CAAC;AAOzG,kDAAkD;AAClD,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAatF"}

package/dist/cli/run.js

@@ -0,0 +1,58 @@
+// `softure-mcp`: the module's maintenance command. `prune` deletes expired access tokens and dead OAuth
+// records (`pruneMcpAccess`), for a daily job such as a deploy `maintain` hook. The app passes its
+// validated config, so the same function serves the bin and an app script a bundler packs:
+//
+//   // scripts/mcp.ts
+//   import { runMcpAccessCli } from "@softure-ai/mcp-access/cli";
+//   import config from "../softure.config";
+//   process.exitCode = await runMcpAccessCli({ config, argv: process.argv.slice(2) });
+import { errorLogLabel, systemClock } from "@softure-ai/core";
+import { openCommandDatabase } from "@softure-ai/db";
+import { pruneMcpAccess } from "../server/prune.js";
+export const EXIT_OK = 0;
+export const EXIT_FAILED = 1;
+export const EXIT_USAGE = 2;
+export const MCP_ACCESS_USAGE = `Usage:
+  softure-mcp prune    deletes expired access tokens, authorization codes, grants and abandoned clients`;
+const consoleOutput = {
+    log: (line) => console.log(line),
+    error: (line) => console.error(line),
+};
+/** Runs one command and answers its exit code. */
+export async function runMcpAccessCli(options) {
+    const output = options.output ?? consoleOutput;
+    const [command, ...rest] = options.argv;
+    if (command === undefined || command === "--help" || command === "help") {
+        output.log(MCP_ACCESS_USAGE);
+        return EXIT_OK;
+    }
+    if (command !== "prune" || rest.length > 0) {
+        output.error(command === "prune" ? `softure-mcp prune: unexpected argument "${rest[0] ?? ""}"` : `softure-mcp: unknown command "${command}"`);
+        output.error(MCP_ACCESS_USAGE);
+        return EXIT_USAGE;
+    }
+    return prune(options, output);
+}
+async function prune(options, output) {
+    const database = options.config?.database ?? null;
+    if (options.config === undefined || database === null) {
+        output.error("softure-mcp prune: the config has no database; set database.url in softure.config");
+        return EXIT_FAILED;
+    }
+    let opened;
+    try {
+        opened = await (options.openDatabase ?? ((settings) => openCommandDatabase(settings, { max: 1 })))(database);
+        const removed = await pruneMcpAccess({ db: opened.handle.db, clock: options.clock ?? systemClock, config: options.config });
+        output.log(`softure-mcp prune: removed ${String(removed.accessTokens)} access tokens, ${String(removed.codes)} authorization codes, ${String(removed.grants)} grants, ${String(removed.clients)} clients`);
+        return EXIT_OK;
+    }
+    catch (error) {
+        // The kind only: a driver message can carry the database address or credentials.
+        output.error(`softure-mcp prune: failed: ${errorLogLabel(error)}`);
+        return EXIT_FAILED;
+    }
+    finally {
+        await opened?.close();
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/cli/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,mGAAmG;AACnG,2FAA2F;AAC3F,EAAE;AACF,sBAAsB;AACtB,kEAAkE;AAClE,4CAA4C;AAC5C,uFAAuF;AACvF,OAAO,EAAE,aAAa,EAAE,WAAW,EAA8D,MAAM,kBAAkB,CAAC;AAC1H,OAAO,EAAE,mBAAmB,EAAwB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAmBpD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,MAAM,CAAC,MAAM,gBAAgB,GAAG;wGACwE,CAAC;AAEzG,MAAM,aAAa,GAAc;IAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;CACrC,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,2CAA2C,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,iCAAiC,OAAO,GAAG,CAAC,CAAC;QAC9I,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,OAA+B,EAAE,MAAiB;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAClG,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5H,MAAM,CAAC,GAAG,CACR,8BAA8B,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAC/L,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,MAAM,CAAC,KAAK,CAAC,8BAA8B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/contract.d.ts

@@ -1,7 +1,16 @@
-import type { CoreErrorCode } from "@softure-ai/core";
+import type { CoreErrorCode, Err } from "@softure-ai/core";
 export type McpAccessErrorCode = "mcp-access.name_required" | "mcp-access.name_too_long" | "mcp-access.token_limit_reached" | "mcp-access.token_not_found" | "mcp-access.grant_not_found";
-/** Every code the token page can show: its own, a missing session and the generic ones. */
-export type TokenFormErrorCode = McpAccessErrorCode | "auth.unauthenticated" | CoreErrorCode;
+/** What an app's `beforeIssue` gate may answer instead of letting a token be issued. */
+export type McpIssueRefusalCode = "mcp-access.issue_refused" | "mcp-access.write_refused";
+/**
+ * A gate's refusal with the app's own text for the user ("Your trial has ended."), shown instead of the
+ * code's copy: an `Err` with a `message`, made by `refuseIssue` (`/next`).
+ */
+export interface McpIssueRefusal extends Err<McpIssueRefusalCode> {
+    readonly message: string;
+}
+/** Every code the token page can show: its own, a gate's refusal, a missing session and the generic ones. */
+export type TokenFormErrorCode = McpAccessErrorCode | McpIssueRefusalCode | "auth.unauthenticated" | CoreErrorCode;
 /** What the app's MCP server factory receives for one request. */
 export interface McpServerIdentity {
     /** The auth user id of the token's owner: every query of the server is scoped to it. */
@@ -34,6 +43,7 @@ export type AccessTokenStatus = {
 };
 /** Ready-to-paste setup for MCP clients, built around the plaintext token. */
 export interface McpClientSetup {
+    /** The name the client lists the server under: `clientServerName`, else `serverName`. */
     readonly serverName: string;
     readonly endpointUrl: string;
     /** `claude mcp add …` for Claude Code, with the token in it. */
@@ -56,6 +66,8 @@ export interface IssuedToken {
     readonly canWrite: boolean;
     /** The expiry, already formatted in the app's locale and time zone. */
     readonly expiresText: string;
+    /** The expiry as ISO 8601, for an app that formats it itself. */
+    readonly expiresAt: string;
     readonly setup: McpClientSetup;
 }
 /** What the issue action returns to its form (`useActionState`). */
@@ -64,9 +76,12 @@ export type IssueTokenFormState = {
 } | {
     readonly status: "ok";
     readonly issued: IssuedToken;
-} | {
+}
+/** `message`: the app's own refusal text from the `beforeIssue` gate, shown instead of the code's copy. */
+ | {
     readonly status: "error";
     readonly error: TokenFormErrorCode;
+    readonly message?: string;
 };
 /** A connected app (an OAuth grant) as its owner sees it. */
 export interface OAuthGrantView {

package/dist/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,gCAAgC,GAChC,4BAA4B,GAC5B,4BAA4B,CAAC;AAEjC,2FAA2F;AAC3F,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,aAAa,CAAC;AAE7F,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sGAAsG;IACtG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CAClC;AAED,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,iGAAiG;GAC/F;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjC,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,kGAAkG;AAClG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAErE,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CAClC;AAED,0DAA0D;AAC1D,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAErE,sEAAsE;AACtE,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,MAAM,kBAAkB,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,gCAAgC,GAChC,4BAA4B,GAC5B,4BAA4B,CAAC;AAEjC,wFAAwF;AACxF,MAAM,MAAM,mBAAmB,GAAG,0BAA0B,GAAG,0BAA0B,CAAC;AAE1F;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,GAAG,CAAC,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,6GAA6G;AAC7G,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,sBAAsB,GAAG,aAAa,CAAC;AAEnH,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sGAAsG;IACtG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,uFAAuF;AACvF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CAClC;AAED,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,iGAAiG;GAC/F;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjC,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,oFAAoF;IACpF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,kGAAkG;AAClG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE;AACzD,2GAA2G;GACzG;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CAClC;AAED,0DAA0D;AAC1D,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAErE,sEAAsE;AACtE,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC"}

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export declare const MCP_RATE_LIMIT_BUCKETS: {
     readonly mcp: {
         readonly limit: 200;
         readonly windowMinutes: 15;
+        readonly key: "ip";
     };
     /**
      * OAuth registration (per address) and token requests (per address and client id), when
@@ -17,6 +18,7 @@ export declare const MCP_RATE_LIMIT_BUCKETS: {
     readonly "mcp-oauth": {
         readonly limit: 60;
         readonly windowMinutes: 15;
+        readonly key: "ip";
     };
 };
 /**
@@ -24,12 +26,12 @@ export declare const MCP_RATE_LIMIT_BUCKETS: {
  * `mcpAccess({ serverName: "acme", tools: [{ name: "list_orders", access: "read", description: { en: "Lists your orders." } }] })`.
  */
 export declare const mcpAccess: import("@softure-ai/core").ModuleFactory<{
-    page: string;
-    endpoint: string;
-    oauthConsent: string;
-    oauthDecision: string;
-    oauthToken: string;
-    oauthRegister: string;
+    page: "/account/mcp";
+    endpoint: "/api/mcp";
+    oauthConsent: "/oauth/authorize";
+    oauthDecision: "/api/oauth/authorize";
+    oauthToken: "/api/oauth/token";
+    oauthRegister: "/api/oauth/register";
 }, {
     page: {
         title: string;
@@ -124,6 +126,8 @@ export declare const mcpAccess: import("@softure-ai/core").ModuleFactory<{
             token_limit_reached: string;
             token_not_found: string;
             grant_not_found: string;
+            issue_refused: string;
+            write_refused: string;
         };
         auth: {
             unauthenticated: string;
@@ -135,6 +139,7 @@ export declare const mcpAccess: import("@softure-ai/core").ModuleFactory<{
     };
 }, import("zod").ZodObject<{
     serverName: import("zod").ZodString;
+    clientServerName: import("zod").ZodOptional<import("zod").ZodString>;
     tools: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodObject<{
         name: import("zod").ZodString;
         access: import("zod").ZodEnum<{
@@ -145,6 +150,14 @@ export declare const mcpAccess: import("@softure-ai/core").ModuleFactory<{
             en: "en";
             pl: "pl";
         }> & import("zod/v4/core").$partial, import("zod").ZodString>;
+        title: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodEnum<{
+            en: "en";
+            pl: "pl";
+        }> & import("zod/v4/core").$partial, import("zod").ZodString>>;
+        example: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodEnum<{
+            en: "en";
+            pl: "pl";
+        }> & import("zod/v4/core").$partial, import("zod").ZodString>>;
     }, import("zod/v4/core").$strict>>>;
     allowWrites: import("zod").ZodDefault<import("zod").ZodBoolean>;
     tokenLifetimeDays: import("zod").ZodDefault<import("zod").ZodInt>;
@@ -166,9 +179,10 @@ export declare const mcpAccess: import("@softure-ai/core").ModuleFactory<{
     }, import("zod/v4/core").$strict>>;
 }, import("zod/v4/core").$strict>>;
 export { getAuthorizationHeader, getClaudeCodeCommand, getClaudeCodeLink, getDesktopConfig, getJsonConfig, getMcpClientSetup, type McpClientSetupInput, } from "./client-setup.js";
-export type { AccessTokenStatus, AccessTokenView, IssuedToken, IssueTokenFormState, McpAccessErrorCode, McpClientSetup, McpServerIdentity, OAuthGrantView, RevokeGrantFormState, RevokeTokenFormState, TokenFormErrorCode, } from "./contract.js";
+export type { AccessTokenStatus, AccessTokenView, IssuedToken, IssueTokenFormState, McpAccessErrorCode, McpIssueRefusal, McpIssueRefusalCode, McpClientSetup, McpServerIdentity, OAuthGrantView, RevokeGrantFormState, RevokeTokenFormState, TokenFormErrorCode, } from "./contract.js";
 export { getTokenErrorMessage, mcpAccessMessages, type McpAccessMessages } from "./messages/index.js";
 export { MAX_PRESENTED_TOKEN_LENGTH, MAX_TOKEN_NAME_LENGTH, SERVER_NAME_PATTERN, TOOL_NAME_PATTERN, GENERATED_AUTHORIZATION_SERVER_KEYS, GENERATED_PROTECTED_RESOURCE_KEYS, type McpAccessOptions, type McpAccessOptionsInput, type McpAppOriginResolver, type McpMetadataExtension, type McpOAuthOptions, type McpToolAccess, type McpToolDefinition, type McpToolDefinitionInput, } from "./options.js";
+export { DEFAULT_MCP_ACCESS_ROUTES } from "./routes.js";
 export { readRequestOrigin, type McpOriginRequest, type McpOrigins } from "./origins.js";
 export { accessTokens, oauthAuthorizationCodes, oauthClients, oauthGrants, type OAuthClientRow, type OAuthTokenEndpointAuthMethod } from "./schema.js";
 export { getAccessTokenStatus, type AccessTokenStatusOptions } from "./token-status.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,eAAe,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;IAEjC;;;;OAIG;;;;;CAEK,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAmCpB,CAAC;AAEH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,mCAAmC,EACnC,iCAAiC,EACjC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,KAAK,4BAA4B,EAAE,MAAM,aAAa,CAAC;AACvJ,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,SAAS,eAAe,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;IAEjC;;;;OAIG;;;;;;CAE8D,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCA4BpB,CAAC;AAEH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,mCAAmC,EACnC,iCAAiC,EACjC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,KAAK,4BAA4B,EAAE,MAAM,aAAa,CAAC;AACvJ,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAC"}