@softure-ai/mcp-access 0.1.6 → 0.1.8

package/dist/messages/en.d.ts

@@ -58,12 +58,40 @@ export declare const en: {
         revoke: string;
         revoking: string;
     };
+    grants: {
+        title: string;
+        lead: string;
+        empty: string;
+        connectedOn: string;
+        disconnect: string;
+        disconnecting: string;
+    };
+    consent: {
+        title: string;
+        lead: string;
+        app: string;
+        returnsTo: string;
+        account: string;
+        access: string;
+        readAccess: string;
+        allowWrite: string;
+        allowWriteHint: string;
+        allow: string;
+        deny: string;
+        errorTitle: string;
+        unknownClient: string;
+        redirectMismatch: string;
+        invalidRequest: string;
+        nothingGranted: string;
+        backToApp: string;
+    };
     errors: {
         "mcp-access": {
             name_required: string;
             name_too_long: string;
             token_limit_reached: string;
             token_not_found: string;
+            grant_not_found: string;
         };
         auth: {
             unauthenticated: string;

package/dist/messages/en.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"en.d.ts","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Ed,CAAC"}
+{"version":3,"file":"en.d.ts","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuGd,CAAC"}

package/dist/messages/en.js

@@ -58,12 +58,40 @@ export const en = {
         revoke: "Revoke",
         revoking: "Revoking…",
     },
+    grants: {
+        title: "Connected apps",
+        lead: "Assistants you connected by signing in, such as claude.ai or ChatGPT. Disconnecting one stops its access at once.",
+        empty: "No app is connected.",
+        connectedOn: "Connected {date}",
+        disconnect: "Disconnect",
+        disconnecting: "Disconnecting…",
+    },
+    consent: {
+        title: "{client} wants access to your account",
+        lead: "The assistant can answer questions with your data in this app. You can disconnect it at any time on the AI assistant access page.",
+        app: "App",
+        returnsTo: "returns to {target}",
+        account: "Account",
+        access: "Access",
+        readAccess: "Read your data",
+        allowWrite: "Also allow changes",
+        allowWriteHint: "Without it, the assistant can only read.",
+        allow: "Allow",
+        deny: "Deny",
+        errorTitle: "The assistant cannot be connected",
+        unknownClient: "The app that sent you here is not registered. Connect it again from the assistant.",
+        redirectMismatch: "The return address does not match the one the app registered. Connect it again from the assistant.",
+        invalidRequest: "The app sent a connection request this app cannot accept.",
+        nothingGranted: "No access was granted.",
+        backToApp: "Back to the app ({target})",
+    },
     errors: {
         "mcp-access": {
             name_required: "Give the token a name, so you can tell it from the others.",
             name_too_long: "The name is too long.",
             token_limit_reached: "You already hold the most active tokens allowed. Revoke one before creating another.",
             token_not_found: "This token no longer exists. It may have been revoked already.",
+            grant_not_found: "This app is no longer connected.",
         },
         auth: {
             unauthenticated: "Your session has ended. Log in again.",

package/dist/messages/en.js.map

@@ -1 +1 @@
-{"version":3,"file":"en.js","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,EAAE,GAAG;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,uIAAuI;KAC9I;IACD,KAAK,EAAE;QACL,KAAK,EAAE,0BAA0B;QACjC,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,cAAc;QACrB,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,uDAAuD;QACjE,QAAQ,EAAE,eAAe;QACzB,YAAY,EAAE,0CAA0C;QACxD,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,yCAAyC;KACjD;IACD,MAAM,EAAE;QACN,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,uFAAuF;QAC7F,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,2BAA2B;QACrC,SAAS,EAAE,sCAAsC;QACjD,WAAW,EAAE,oCAAoC;QACjD,UAAU,EAAE,iGAAiG;QAC7G,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,gCAAgC;QAC9C,SAAS,EAAE,gDAAgD;QAC3D,YAAY,EAAE,6CAA6C;QAC3D,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,sBAAsB;KAC7B;IACD,KAAK,EAAE;QACL,eAAe,EAAE,6IAA6I;KAC/J;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,eAAe;QAC7B,eAAe,EAAE,kBAAkB;QACnC,aAAa,EAAE,wBAAwB;QACvC,SAAS,EAAE,oBAAoB;QAC/B,SAAS,EAAE,mBAAmB;QAC9B,SAAS,EAAE,gBAAgB;QAC3B,QAAQ,EAAE,kBAAkB;QAC5B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,aAAa,EAAE,4DAA4D;YAC3E,aAAa,EAAE,uBAAuB;YACtC,mBAAmB,EAAE,sFAAsF;YAC3G,eAAe,EAAE,gEAAgE;SAClF;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,uCAAuC;SACzD;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,0DAA0D;YAC3E,UAAU,EAAE,0DAA0D;SACvE;KACF;CACF,CAAC"}
+{"version":3,"file":"en.js","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,EAAE,GAAG;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,uIAAuI;KAC9I;IACD,KAAK,EAAE;QACL,KAAK,EAAE,0BAA0B;QACjC,KAAK,EAAE,6BAA6B;QACpC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,cAAc;QACrB,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,uDAAuD;QACjE,QAAQ,EAAE,eAAe;QACzB,YAAY,EAAE,0CAA0C;QACxD,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,yCAAyC;KACjD;IACD,MAAM,EAAE;QACN,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,uFAAuF;QAC7F,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,2BAA2B;QACrC,SAAS,EAAE,sCAAsC;QACjD,WAAW,EAAE,oCAAoC;QACjD,UAAU,EAAE,iGAAiG;QAC7G,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,gCAAgC;QAC9C,SAAS,EAAE,gDAAgD;QAC3D,YAAY,EAAE,6CAA6C;QAC3D,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,sBAAsB;KAC7B;IACD,KAAK,EAAE;QACL,eAAe,EAAE,6IAA6I;KAC/J;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,eAAe;QAC7B,eAAe,EAAE,kBAAkB;QACnC,aAAa,EAAE,wBAAwB;QACvC,SAAS,EAAE,oBAAoB;QAC/B,SAAS,EAAE,mBAAmB;QAC9B,SAAS,EAAE,gBAAgB;QAC3B,QAAQ,EAAE,kBAAkB;QAC5B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD,MAAM,EAAE;QACN,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,mHAAmH;QACzH,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,kBAAkB;QAC/B,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,gBAAgB;KAChC;IACD,OAAO,EAAE;QACP,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE,mIAAmI;QACzI,GAAG,EAAE,KAAK;QACV,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,gBAAgB;QAC5B,UAAU,EAAE,oBAAoB;QAChC,cAAc,EAAE,0CAA0C;QAC1D,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,mCAAmC;QAC/C,aAAa,EAAE,oFAAoF;QACnG,gBAAgB,EAAE,oGAAoG;QACtH,cAAc,EAAE,2DAA2D;QAC3E,cAAc,EAAE,wBAAwB;QACxC,SAAS,EAAE,4BAA4B;KACxC;IACD,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,aAAa,EAAE,4DAA4D;YAC3E,aAAa,EAAE,uBAAuB;YACtC,mBAAmB,EAAE,sFAAsF;YAC3G,eAAe,EAAE,gEAAgE;YACjF,eAAe,EAAE,kCAAkC;SACpD;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,uCAAuC;SACzD;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,0DAA0D;YAC3E,UAAU,EAAE,0DAA0D;SACvE;KACF;CACF,CAAC"}

package/dist/messages/index.d.ts

@@ -62,12 +62,40 @@ export declare const mcpAccessMessages: {
             revoke: string;
             revoking: string;
         };
+        grants: {
+            title: string;
+            lead: string;
+            empty: string;
+            connectedOn: string;
+            disconnect: string;
+            disconnecting: string;
+        };
+        consent: {
+            title: string;
+            lead: string;
+            app: string;
+            returnsTo: string;
+            account: string;
+            access: string;
+            readAccess: string;
+            allowWrite: string;
+            allowWriteHint: string;
+            allow: string;
+            deny: string;
+            errorTitle: string;
+            unknownClient: string;
+            redirectMismatch: string;
+            invalidRequest: string;
+            nothingGranted: string;
+            backToApp: string;
+        };
         errors: {
             "mcp-access": {
                 name_required: string;
                 name_too_long: string;
                 token_limit_reached: string;
                 token_not_found: string;
+                grant_not_found: string;
             };
             auth: {
                 unauthenticated: string;
@@ -138,12 +166,40 @@ export declare const mcpAccessMessages: {
             revoke: string;
             revoking: string;
         };
+        grants: {
+            title: string;
+            lead: string;
+            empty: string;
+            connectedOn: string;
+            disconnect: string;
+            disconnecting: string;
+        };
+        consent: {
+            title: string;
+            lead: string;
+            app: string;
+            returnsTo: string;
+            account: string;
+            access: string;
+            readAccess: string;
+            allowWrite: string;
+            allowWriteHint: string;
+            allow: string;
+            deny: string;
+            errorTitle: string;
+            unknownClient: string;
+            redirectMismatch: string;
+            invalidRequest: string;
+            nothingGranted: string;
+            backToApp: string;
+        };
         errors: {
             "mcp-access": {
                 name_required: string;
                 name_too_long: string;
                 token_limit_reached: string;
                 token_not_found: string;
+                grant_not_found: string;
             };
             auth: {
                 unauthenticated: string;

package/dist/messages/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/messages/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAG7B,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAa,CAAC;AAE5C,MAAM,MAAM,iBAAiB,GAAG,OAAO,EAAE,CAAC;AAE1C,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAOlG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/messages/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAG7B,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAa,CAAC;AAE5C,MAAM,MAAM,iBAAiB,GAAG,OAAO,EAAE,CAAC;AAE1C,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAOlG"}

package/dist/messages/pl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pl.d.ts","sourceRoot":"","sources":["../../src/messages/pl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAElC,eAAO,MAAM,EAAE,EAAE,OAAO,EA2EvB,CAAC"}
+{"version":3,"file":"pl.d.ts","sourceRoot":"","sources":["../../src/messages/pl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAElC,eAAO,MAAM,EAAE,EAAE,OAAO,EAuGvB,CAAC"}

package/dist/messages/pl.js

@@ -58,12 +58,40 @@ export const pl = {
         revoke: "Unieważnij",
         revoking: "Unieważnianie…",
     },
+    grants: {
+        title: "Połączone aplikacje",
+        lead: "Asystenci połączeni przez logowanie, na przykład claude.ai albo ChatGPT. Odłączenie od razu odbiera im dostęp.",
+        empty: "Żadna aplikacja nie jest połączona.",
+        connectedOn: "Połączono {date}",
+        disconnect: "Odłącz",
+        disconnecting: "Odłączanie…",
+    },
+    consent: {
+        title: "{client} prosi o dostęp do Twojego konta",
+        lead: "Asystent odpowie na pytania, korzystając z Twoich danych w tej aplikacji. Możesz go odłączyć w każdej chwili na stronie dostępu dla asystenta AI.",
+        app: "Aplikacja",
+        returnsTo: "wróci na {target}",
+        account: "Konto",
+        access: "Dostęp",
+        readAccess: "Odczyt Twoich danych",
+        allowWrite: "Pozwól też na zmiany",
+        allowWriteHint: "Bez tego asystent może tylko czytać.",
+        allow: "Zezwól",
+        deny: "Odmów",
+        errorTitle: "Nie da się połączyć asystenta",
+        unknownClient: "Aplikacja, która Cię tu przysłała, nie jest zarejestrowana. Połącz ją od nowa z poziomu asystenta.",
+        redirectMismatch: "Adres powrotu nie zgadza się z tym, który aplikacja zarejestrowała. Połącz ją od nowa z poziomu asystenta.",
+        invalidRequest: "Aplikacja wysłała żądanie połączenia, którego ta aplikacja nie może przyjąć.",
+        nothingGranted: "Nie nadano żadnego dostępu.",
+        backToApp: "Wróć do aplikacji ({target})",
+    },
     errors: {
         "mcp-access": {
             name_required: "Nadaj tokenowi nazwę, żeby odróżnić go od pozostałych.",
             name_too_long: "Nazwa jest za długa.",
             token_limit_reached: "Masz już najwięcej aktywnych tokenów, ile można. Unieważnij któryś, zanim utworzysz nowy.",
             token_not_found: "Ten token już nie istnieje. Mógł zostać unieważniony.",
+            grant_not_found: "Ta aplikacja nie jest już połączona.",
         },
         auth: {
             unauthenticated: "Twoja sesja wygasła. Zaloguj się ponownie.",

package/dist/messages/pl.js.map

@@ -1 +1 @@
-{"version":3,"file":"pl.js","sourceRoot":"","sources":["../../src/messages/pl.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,EAAE,GAAc;IAC3B,IAAI,EAAE;QACJ,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,mJAAmJ;KAC1J;IACD,KAAK,EAAE;QACL,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,oDAAoD;QAC3D,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc;QACrB,gBAAgB,EAAE,0CAA0C;KAC7D;IACD,KAAK,EAAE;QACL,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,2DAA2D;QACrE,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,sCAAsC;QACpD,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,+CAA+C;KACvD;IACD,MAAM,EAAE;QACN,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,+FAA+F;QACrG,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,8BAA8B;QACxC,SAAS,EAAE,wCAAwC;QACnD,WAAW,EAAE,oDAAoD;QACjE,UAAU,EAAE,4EAA4E;QACxF,cAAc,EAAE,sBAAsB;QACtC,YAAY,EAAE,qCAAqC;QACnD,SAAS,EAAE,iDAAiD;QAC5D,YAAY,EAAE,6CAA6C;QAC3D,WAAW,EAAE,sDAAsD;QACnE,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,qBAAqB;KAC5B;IACD,KAAK,EAAE;QACL,eAAe,EAAE,kJAAkJ;KACpK;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,mCAAmC;QAC1C,QAAQ,EAAE,cAAc;QACxB,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,QAAQ;QACjB,YAAY,EAAE,aAAa;QAC3B,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,sBAAsB;QACrC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE,kBAAkB;QAC7B,QAAQ,EAAE,uBAAuB;QACjC,SAAS,EAAE,oBAAoB;QAC/B,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,gBAAgB;KAC3B;IACD,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,aAAa,EAAE,wDAAwD;YACvE,aAAa,EAAE,sBAAsB;YACrC,mBAAmB,EAAE,2FAA2F;YAChH,eAAe,EAAE,uDAAuD;SACzE;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,4CAA4C;SAC9D;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,mEAAmE;YACpF,UAAU,EAAE,mEAAmE;SAChF;KACF;CACF,CAAC"}
+{"version":3,"file":"pl.js","sourceRoot":"","sources":["../../src/messages/pl.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,EAAE,GAAc;IAC3B,IAAI,EAAE;QACJ,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,mJAAmJ;KAC1J;IACD,KAAK,EAAE;QACL,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,oDAAoD;QAC3D,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc;QACrB,gBAAgB,EAAE,0CAA0C;KAC7D;IACD,KAAK,EAAE;QACL,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,2DAA2D;QACrE,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,sCAAsC;QACpD,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,+CAA+C;KACvD;IACD,MAAM,EAAE;QACN,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,+FAA+F;QACrG,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,8BAA8B;QACxC,SAAS,EAAE,wCAAwC;QACnD,WAAW,EAAE,oDAAoD;QACjE,UAAU,EAAE,4EAA4E;QACxF,cAAc,EAAE,sBAAsB;QACtC,YAAY,EAAE,qCAAqC;QACnD,SAAS,EAAE,iDAAiD;QAC5D,YAAY,EAAE,6CAA6C;QAC3D,WAAW,EAAE,sDAAsD;QACnE,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,qBAAqB;KAC5B;IACD,KAAK,EAAE;QACL,eAAe,EAAE,kJAAkJ;KACpK;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,mCAAmC;QAC1C,QAAQ,EAAE,cAAc;QACxB,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,QAAQ;QACjB,YAAY,EAAE,aAAa;QAC3B,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,sBAAsB;QACrC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE,kBAAkB;QAC7B,QAAQ,EAAE,uBAAuB;QACjC,SAAS,EAAE,oBAAoB;QAC/B,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,gBAAgB;KAC3B;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,gHAAgH;QACtH,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EAAE,kBAAkB;QAC/B,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,aAAa;KAC7B;IACD,OAAO,EAAE;QACP,KAAK,EAAE,0CAA0C;QACjD,IAAI,EAAE,mJAAmJ;QACzJ,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,mBAAmB;QAC9B,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,sBAAsB;QAClC,UAAU,EAAE,sBAAsB;QAClC,cAAc,EAAE,sCAAsC;QACtD,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,+BAA+B;QAC3C,aAAa,EAAE,oGAAoG;QACnH,gBAAgB,EAAE,4GAA4G;QAC9H,cAAc,EAAE,8EAA8E;QAC9F,cAAc,EAAE,6BAA6B;QAC7C,SAAS,EAAE,8BAA8B;KAC1C;IACD,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,aAAa,EAAE,wDAAwD;YACvE,aAAa,EAAE,sBAAsB;YACrC,mBAAmB,EAAE,2FAA2F;YAChH,eAAe,EAAE,uDAAuD;YACxE,eAAe,EAAE,sCAAsC;SACxD;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,4CAA4C;SAC9D;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,mEAAmE;YACpF,UAAU,EAAE,mEAAmE;SAChF;KACF;CACF,CAAC"}

package/dist/next/actions.d.ts

@@ -1,6 +1,8 @@
-import type { IssueTokenFormState, RevokeTokenFormState } from "../contract.js";
+import type { IssueTokenFormState, RevokeGrantFormState, RevokeTokenFormState } from "../contract.js";
 /** Issues a token for the signed-in user and returns its plaintext with the setup snippets, once. */
 export declare function issueTokenAction(_previous: IssueTokenFormState, formData: FormData): Promise<IssueTokenFormState>;
 /** Revokes one of the signed-in user's tokens; another account's id matches nothing. */
 export declare function revokeTokenAction(_previous: RevokeTokenFormState, formData: FormData): Promise<RevokeTokenFormState>;
+/** Disconnects one of the signed-in user's OAuth apps: the grant and its access tokens go at once. */
+export declare function revokeGrantAction(_previous: RevokeGrantFormState, formData: FormData): Promise<RevokeGrantFormState>;
 //# sourceMappingURL=actions.d.ts.map

package/dist/next/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/next/actions.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AA8BhF,qGAAqG;AACrG,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+BvH;AAED,wFAAwF;AACxF,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAc1H"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/next/actions.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AA+BtG,qGAAqG;AACrG,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiCvH;AAED,wFAAwF;AACxF,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAc1H;AAED,sGAAsG;AACtG,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAc1H"}

package/dist/next/actions.js

@@ -10,8 +10,9 @@ import { z } from "zod";
 import { getMcpClientSetup } from "../client-setup.js";
 import { MAX_TOKEN_NAME_LENGTH } from "../options.js";
 import { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "../server/options.js";
+import { revokeOAuthGrant } from "../server/oauth.js";
 import { issueAccessToken, revokeAccessToken } from "../server/tokens.js";
-import { getMcpAccessContext } from "./context.js";
+import { getMcpAccessContext, getRequestOrigins } from "./context.js";
 import { formatDate } from "./format.js";
 /** Longer values are cut: the server functions refuse them anyway, and nothing huge is echoed back. */
 const MAX_FIELD_LENGTH = MAX_TOKEN_NAME_LENGTH * 4;
@@ -41,6 +42,8 @@ export async function issueTokenAction(_previous, formData) {
     // Every field has a `catch`, so parsing cannot fail.
     const input = issueInput.parse({ name: formData.get("name"), canWrite: formData.get("canWrite") });
     try {
+        // Resolved before issuing: a failure afterwards would leave a token nobody received.
+        const endpointUrl = getMcpEndpointUrl(config, await getRequestOrigins(config, getMcpAccessRoutes(config).page));
         const result = await issueAccessToken(await getMcpAccessContext(config), { userId: user.id, name: input.name, canWrite: input.canWrite !== null });
         if (!result.ok)
             return { status: "error", error: result.error };
@@ -56,7 +59,7 @@ export async function issueTokenAction(_previous, formData) {
                 expiresText: formatMessage(messages.issued.expires, { date: formatDate(config, issued.expiresAt) }),
                 setup: getMcpClientSetup({
                     serverName: getMcpAccessOptions(config).serverName,
-                    endpointUrl: getMcpEndpointUrl(config),
+                    endpointUrl,
                     token: issued.token,
                     promptTemplate: messages.setup.assistantPrompt,
                 }),
@@ -85,4 +88,22 @@ export async function revokeTokenAction(_previous, formData) {
         return { status: "error", error: reportFailure("revoking a token", error) };
     }
 }
+/** Disconnects one of the signed-in user's OAuth apps: the grant and its access tokens go at once. */
+export async function revokeGrantAction(_previous, formData) {
+    const config = getSoftureConfig();
+    const user = await getCurrentUser();
+    if (user === null)
+        return { status: "error", error: "auth.unauthenticated" };
+    const input = revokeInput.parse({ id: formData.get("id") });
+    try {
+        const result = await revokeOAuthGrant(await getMcpAccessContext(config), { userId: user.id, grantId: input.id });
+        if (!result.ok)
+            return { status: "error", error: result.error };
+        refreshPage(config);
+        return { status: "ok" };
+    }
+    catch (error) {
+        return { status: "error", error: reportFailure("disconnecting an app", error) };
+    }
+}
 //# sourceMappingURL=actions.js.map

package/dist/next/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/next/actions.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,kGAAkG;AAClG,+FAA+F;AAC/F,2FAA2F;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uGAAuG;AACvG,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,CAAC,CAAC;AACnD,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,KAAK,CAAC,EAAE,CAAC;KACT,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE1D,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,IAAI;IACV,6FAA6F;IAC7F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;CAC5C,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAE3C,SAAS,aAAa,CAAC,SAAiB,EAAE,KAAc;IACtD,OAAO,CAAC,KAAK,CAAC,2BAA2B,SAAS,YAAY,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB;IACxC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAA8B,EAAE,QAAkB;IACvF,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAE7E,qDAAqD;IACrD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;QACnJ,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAChE,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE;gBACN,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnG,KAAK,EAAE,iBAAiB,CAAC;oBACvB,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;oBAClD,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;oBACtC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe;iBAC/C,CAAC;aACH;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAA+B,EAAE,QAAkB;IACzF,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAE7E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAChE,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/next/actions.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,kGAAkG;AAClG,+FAA+F;AAC/F,2FAA2F;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uGAAuG;AACvG,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,CAAC,CAAC;AACnD,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,KAAK,CAAC,EAAE,CAAC;KACT,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE1D,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,IAAI;IACV,6FAA6F;IAC7F,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;CAC5C,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAE3C,SAAS,aAAa,CAAC,SAAiB,EAAE,KAAc;IACtD,OAAO,CAAC,KAAK,CAAC,2BAA2B,SAAS,YAAY,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB;IACxC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAA8B,EAAE,QAAkB;IACvF,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAE7E,qDAAqD;IACrD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC;QACH,qFAAqF;QACrF,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;QACnJ,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAChE,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE;gBACN,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnG,KAAK,EAAE,iBAAiB,CAAC;oBACvB,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,UAAU;oBAClD,WAAW;oBACX,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe;iBAC/C,CAAC;aACH;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAA+B,EAAE,QAAkB;IACzF,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAE7E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAChE,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAA+B,EAAE,QAAkB;IACzF,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAE7E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAChE,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC;IAClF,CAAC;AACH,CAAC"}

package/dist/next/context.d.ts

@@ -1,4 +1,10 @@
-import { type SoftureConfig } from "@softure-ai/core";
+import type { SoftureConfig } from "@softure-ai/core";
+import type { McpOrigins } from "../origins.js";
 import type { McpAccessContext } from "../server/tokens.js";
 export declare function getMcpAccessContext(config?: SoftureConfig): Promise<McpAccessContext>;
+/**
+ * The origins of the request a page or a server action runs in, from Next's `headers()`: the same
+ * ones the route handlers resolve, so the consent page and its decision agree.
+ */
+export declare function getRequestOrigins(config: SoftureConfig, path: string): Promise<McpOrigins>;
 //# sourceMappingURL=context.d.ts.map

package/dist/next/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/next/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,wBAAsB,mBAAmB,CAAC,MAAM,GAAE,aAAkC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAM/G"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/next/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,aAAkC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAEzG;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGhG"}

package/dist/next/context.js

@@ -1,13 +1,15 @@
-// What the adapter hands the server functions: the registered config, the process-wide database
-// handle and the wall clock.
-import { systemClock } from "@softure-ai/core";
 import { getSoftureConfig } from "@softure-ai/core/next";
-import { getConfiguredDatabase } from "@softure-ai/db";
-export async function getMcpAccessContext(config = getSoftureConfig()) {
-    if (config.database === null) {
-        throw new Error("@softure-ai/mcp-access: softure.config.ts has no database; mcp-access needs one");
-    }
-    const { db } = await getConfiguredDatabase(config.database);
-    return { db, clock: systemClock, config };
+import { createMcpAccessContext } from "../server/context.js";
+import { resolveMcpOrigins } from "../server/origins.js";
+export function getMcpAccessContext(config = getSoftureConfig()) {
+    return createMcpAccessContext(config);
+}
+/**
+ * The origins of the request a page or a server action runs in, from Next's `headers()`: the same
+ * ones the route handlers resolve, so the consent page and its decision agree.
+ */
+export async function getRequestOrigins(config, path) {
+    const { headers } = await import("next/headers");
+    return resolveMcpOrigins(config, { url: new URL(path, config.appOrigin).toString(), headers: await headers() });
 }
 //# sourceMappingURL=context.js.map

package/dist/next/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/next/context.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,6BAA6B;AAC7B,OAAO,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAwB,gBAAgB,EAAE;IAClF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/next/context.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAGzD,MAAM,UAAU,mBAAmB,CAAC,SAAwB,gBAAgB,EAAE;IAC5E,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAqB,EAAE,IAAY;IACzE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACjD,OAAO,iBAAiB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;AAClH,CAAC"}

package/dist/next/index.d.ts

@@ -1,4 +1,7 @@
-export { issueTokenAction, revokeTokenAction } from "./actions.js";
+export { issueTokenAction, revokeGrantAction, revokeTokenAction } from "./actions.js";
+export { OAuthConsentPage, type OAuthConsentPageProps } from "./oauth-page.js";
+export { answerOAuthPreflight, decideOAuthAuthorizationRoute, exchangeOAuthTokenRoute, getAuthorizationServerMetadataRoute, getProtectedResourceMetadataRoute, registerOAuthClientRoute, } from "./oauth-routes.js";
+export { getMcpAccessContext } from "./context.js";
 export { McpAccessPage } from "./pages.js";
 export { createMcpRoute } from "./route.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/next/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/next/index.js

@@ -1,6 +1,9 @@
 // The Next.js adapter of @softure-ai/mcp-access: the MCP route factory, the token page and its
-// server actions (docs/02-module-standard.md §8).
-export { issueTokenAction, revokeTokenAction } from "./actions.js";
+// server actions, and the OAuth routes and consent page (docs/02-module-standard.md §8).
+export { issueTokenAction, revokeGrantAction, revokeTokenAction } from "./actions.js";
+export { OAuthConsentPage } from "./oauth-page.js";
+export { answerOAuthPreflight, decideOAuthAuthorizationRoute, exchangeOAuthTokenRoute, getAuthorizationServerMetadataRoute, getProtectedResourceMetadataRoute, registerOAuthClientRoute, } from "./oauth-routes.js";
+export { getMcpAccessContext } from "./context.js";
 export { McpAccessPage } from "./pages.js";
 export { createMcpRoute } from "./route.js";
 //# sourceMappingURL=index.js.map

package/dist/next/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,kDAAkD;AAClD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,yFAAyF;AACzF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAA8B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/next/oauth-page.d.ts

@@ -0,0 +1,7 @@
+type SearchParams = Promise<Record<string, string | string[] | undefined>>;
+export interface OAuthConsentPageProps {
+    readonly searchParams?: SearchParams;
+}
+export declare function OAuthConsentPage({ searchParams }: OAuthConsentPageProps): Promise<import("react").JSX.Element>;
+export {};
+//# sourceMappingURL=oauth-page.d.ts.map

package/dist/next/oauth-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-page.d.ts","sourceRoot":"","sources":["../../src/next/oauth-page.tsx"],"names":[],"mappings":"AAiBA,KAAK,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;CACtC;AAID,wBAAsB,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,qBAAqB,wCA0C7E"}

package/dist/next/oauth-page.js

@@ -0,0 +1,36 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+// The OAuth consent page, ready to mount with one line:
+// `export { OAuthConsentPage as default } from "@softure-ai/mcp-access/next"`.
+// The authorization endpoint clients send the person to. Without a session it redirects to the
+// login page and back with every parameter (state, challenge, resource). Errors before the client
+// and its redirect URI are confirmed are shown here, never redirected; later ones offer a link back
+// to the client, never an automatic redirect (anyone can register a redirect URI).
+import { requireUser } from "@softure-ai/auth/next";
+import { formatMessage } from "@softure-ai/core";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import { Card } from "@softure-ai/ui";
+import { notFound } from "next/navigation";
+import { getConsentPath, isOAuthEnabled, readAuthorizationParams, validateAuthorizationRequest } from "../server/oauth-http.js";
+import { describeRedirectUri } from "../server/oauth-validation.js";
+import { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes } from "../server/options.js";
+import { ConsentError, ConsentForm } from "../ui/consent-form.js";
+import { getMcpAccessContext, getRequestOrigins } from "./context.js";
+const LAYOUT_CLASS = "sft:mx-auto sft:box-border sft:w-full sft:sm:max-w-md sft:px-4 sft:py-4";
+export async function OAuthConsentPage({ searchParams }) {
+    const config = getSoftureConfig();
+    if (!isOAuthEnabled(config))
+        notFound();
+    const query = (await searchParams) ?? {};
+    const params = readAuthorizationParams({ get: (name) => query[name] });
+    const user = await requireUser({ next: getConsentPath(config, params), searchParams: query });
+    const messages = getMcpAccessMessages(config);
+    const origins = await getRequestOrigins(config, getMcpAccessRoutes(config).oauthConsent);
+    const outcome = await validateAuthorizationRequest(await getMcpAccessContext(config), params, origins);
+    if (outcome.kind !== "valid") {
+        const message = outcome.kind === "redirect-error" ? messages.consent.invalidRequest : outcome.reason === "unknown_client" ? messages.consent.unknownClient : messages.consent.redirectMismatch;
+        return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: messages.consent.errorTitle, children: _jsx(ConsentError, { message: message, ...(outcome.kind === "redirect-error" ? { backLocation: outcome.location, backTarget: describeRedirectUri(outcome.redirectUri) } : {}), messages: messages }) }) }));
+    }
+    const { client, redirectUri, isWriteRequested } = outcome.request;
+    return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: formatMessage(messages.consent.title, { client: client.clientName }), subtitle: messages.consent.lead, children: _jsx(ConsentForm, { action: getMcpAccessRoutes(config).oauthDecision, params: [...params.entries()], clientName: client.clientName, redirectTarget: describeRedirectUri(redirectUri), accountEmail: user.email, isWriteOffered: isWriteRequested && getMcpAccessOptions(config).allowWrites, messages: messages }) }) }));
+}
+//# sourceMappingURL=oauth-page.js.map

package/dist/next/oauth-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-page.js","sourceRoot":"","sources":["../../src/next/oauth-page.tsx"],"names":[],"mappings":";AAAA,wDAAwD;AACxD,+EAA+E;AAC/E,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,mFAAmF;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAChI,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQtE,MAAM,YAAY,GAAG,yEAAyE,CAAC;AAE/F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAE,YAAY,EAAyB;IAC5E,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,QAAQ,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GACX,OAAO,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjL,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,YACtC,KAAC,YAAY,IACX,OAAO,EAAE,OAAO,KACZ,CAAC,OAAO,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACvI,QAAQ,EAAE,QAAQ,GAClB,GACG,GACF,CACR,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAClE,OAAO,CACL,eAAM,SAAS,EAAE,YAAY,YAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,YAChH,KAAC,WAAW,IACV,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,aAAa,EAChD,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,EAC7B,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,cAAc,EAAE,mBAAmB,CAAC,WAAW,CAAC,EAChD,YAAY,EAAE,IAAI,CAAC,KAAK,EACxB,cAAc,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,WAAW,EAC3E,QAAQ,EAAE,QAAQ,GAClB,GACG,GACF,CACR,CAAC;AACJ,CAAC"}

package/dist/next/oauth-routes.d.ts

@@ -0,0 +1,19 @@
+import { answerOAuthPreflight } from "../server/oauth-http.js";
+/**
+ * `GET /.well-known/oauth-authorization-server`. Reads the request, so Next never renders it at
+ * build time with one origin baked in.
+ */
+export declare function getAuthorizationServerMetadataRoute(request: Request): Response;
+/**
+ * `GET /.well-known/oauth-protected-resource` and `…/oauth-protected-resource/api/mcp`: the same
+ * export at both paths; the request's path picks the variant.
+ */
+export declare function getProtectedResourceMetadataRoute(request: Request): Response;
+/** `POST /api/oauth/register`. */
+export declare function registerOAuthClientRoute(request: Request): Promise<Response>;
+/** `POST /api/oauth/token`. */
+export declare function exchangeOAuthTokenRoute(request: Request): Promise<Response>;
+/** `POST /api/oauth/authorize`: the consent form's decision, answered with `303`. */
+export declare function decideOAuthAuthorizationRoute(request: Request): Promise<Response>;
+export { answerOAuthPreflight };
+//# sourceMappingURL=oauth-routes.d.ts.map

package/dist/next/oauth-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-routes.d.ts","sourceRoot":"","sources":["../../src/next/oauth-routes.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,oBAAoB,EAQrB,MAAM,yBAAyB,CAAC;AAiBjC;;;GAGG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAE9E;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAO5E;AAED,kCAAkC;AAClC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE5E;AAED,+BAA+B;AAC/B,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE3E;AAED,qFAAqF;AACrF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAKjF;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/next/oauth-routes.js

@@ -0,0 +1,53 @@
+// The OAuth routes, each mounted with one line (README §4), e.g.
+// `app/api/oauth/token/route.ts → export { exchangeOAuthTokenRoute as POST, answerOAuthPreflight as OPTIONS } from "@softure-ai/mcp-access/next";`
+// They supply the module context (and, for the decision, the session's user) to the handlers in
+// `/server`. With `oauth.enabled` off every one answers 404.
+import { getCurrentUser } from "@softure-ai/auth/next";
+import { errorLogLabel } from "@softure-ai/core";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import { answerOAuthPreflight, getAuthorizationServerMetadata, getProtectedResourceMetadata, getRootProtectedResourceMetadata, handleAuthorizationDecision, handleClientRegistration, handleTokenRequest, serveDiscoveryDocument, } from "../server/oauth-http.js";
+import { getMcpAccessContext } from "./context.js";
+const UNAVAILABLE = { status: 503, headers: { "cache-control": "no-store" } };
+async function withContext(request, handle) {
+    let ctx;
+    try {
+        ctx = await getMcpAccessContext();
+    }
+    catch (error) {
+        console.error(`@softure-ai/mcp-access: opening the database failed: ${errorLogLabel(error)}`);
+        return Response.json({ error: "temporarily_unavailable" }, UNAVAILABLE);
+    }
+    return handle(ctx, request);
+}
+/**
+ * `GET /.well-known/oauth-authorization-server`. Reads the request, so Next never renders it at
+ * build time with one origin baked in.
+ */
+export function getAuthorizationServerMetadataRoute(request) {
+    return serveDiscoveryDocument(getSoftureConfig(), (config, origins) => getAuthorizationServerMetadata(config, origins), request);
+}
+/**
+ * `GET /.well-known/oauth-protected-resource` and `…/oauth-protected-resource/api/mcp`: the same
+ * export at both paths; the request's path picks the variant.
+ */
+export function getProtectedResourceMetadataRoute(request) {
+    const isRoot = new URL(request.url).pathname.replace(/\/+$/, "").endsWith("/oauth-protected-resource");
+    return serveDiscoveryDocument(getSoftureConfig(), isRoot ? getRootProtectedResourceMetadata : (config, origins) => getProtectedResourceMetadata(config, "endpoint", origins), request);
+}
+/** `POST /api/oauth/register`. */
+export function registerOAuthClientRoute(request) {
+    return withContext(request, handleClientRegistration);
+}
+/** `POST /api/oauth/token`. */
+export function exchangeOAuthTokenRoute(request) {
+    return withContext(request, handleTokenRequest);
+}
+/** `POST /api/oauth/authorize`: the consent form's decision, answered with `303`. */
+export function decideOAuthAuthorizationRoute(request) {
+    return withContext(request, async (ctx, req) => {
+        const user = await getCurrentUser();
+        return handleAuthorizationDecision(ctx, req, user?.id ?? null);
+    });
+}
+export { answerOAuthPreflight };
+//# sourceMappingURL=oauth-routes.js.map

package/dist/next/oauth-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-routes.js","sourceRoot":"","sources":["../../src/next/oauth-routes.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,mJAAmJ;AACnJ,gGAAgG;AAChG,6DAA6D;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;AAE9E,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,MAAsE;IACjH,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CAAC,OAAgB;IAClE,OAAO,sBAAsB,CAAC,gBAAgB,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,8BAA8B,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AACnI,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IACvG,OAAO,sBAAsB,CAC3B,gBAAgB,EAAE,EAClB,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAC1H,OAAO,CACR,CAAC;AACJ,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO,WAAW,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;AACxD,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO,WAAW,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC5D,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,OAAO,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/next/pages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":"AAuDA,wBAAsB,aAAa,yCAwBlC"}
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/next/pages.tsx"],"names":[],"mappings":"AAkEA,wBAAsB,aAAa,yCA0BlC"}

package/dist/next/pages.js

@@ -9,10 +9,11 @@ import { formatMessage } from "@softure-ai/core";
 import { getSoftureConfig } from "@softure-ai/core/next";
 import { Card } from "@softure-ai/ui";
 import { getLocalizedText, getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes } from "../server/options.js";
+import { listOAuthGrants } from "../server/oauth.js";
 import { listAccessTokens } from "../server/tokens.js";
 import { getAccessTokenStatus } from "../token-status.js";
 import { TokenManager } from "../ui/token-manager.js";
-import { issueTokenAction, revokeTokenAction } from "./actions.js";
+import { issueTokenAction, revokeGrantAction, revokeTokenAction } from "./actions.js";
 import { getMcpAccessContext } from "./context.js";
 import { formatDate, formatDateTime } from "./format.js";
 const LAYOUT_CLASS = "sft:mx-auto sft:box-border sft:w-full sft:sm:max-w-3xl sft:px-4 sft:py-4";
@@ -44,6 +45,15 @@ function toRow(token, now, config, options, messages) {
         details: [formatMessage(messages.list.createdOn, { date: formatDate(config, token.createdAt) }), expiry, lastUse],
     };
 }
+function toGrant(grant, config, options, messages) {
+    const lastUse = grant.lastUsedAt === null ? messages.list.neverUsed : formatMessage(messages.list.lastUsed, { date: formatDateTime(config, grant.lastUsedAt) });
+    return {
+        id: grant.id,
+        clientName: grant.clientName,
+        scopeText: grant.canWrite && options.allowWrites ? messages.list.readWrite : messages.list.readOnly,
+        details: [formatMessage(messages.grants.connectedOn, { date: formatDate(config, grant.createdAt) }), lastUse],
+    };
+}
 function toTool(tool, config, options, messages) {
     const accessText = tool.access === "read" ? messages.tools.read : options.allowWrites ? messages.tools.write : messages.tools.writeUnavailable;
     return { name: tool.name, description: getLocalizedText(tool.description, config.locale), accessText };
@@ -56,6 +66,7 @@ export async function McpAccessPage() {
     const ctx = await getMcpAccessContext(config);
     const now = ctx.clock.now();
     const tokens = await listAccessTokens(ctx, user.id);
-    return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: messages.page.title, subtitle: messages.page.lead, children: _jsx(TokenManager, { tools: options.tools.map((tool) => toTool(tool, config, options, messages)), tokens: tokens.map((token) => toRow(token, now, config, options, messages)), allowWrites: options.allowWrites, maxTokens: options.maxTokensPerUser, issueAction: issueTokenAction, revokeAction: revokeTokenAction, messages: messages, locale: config.locale }) }) }));
+    const grants = options.oauth.enabled ? await listOAuthGrants(ctx, user.id) : null;
+    return (_jsx("main", { className: LAYOUT_CLASS, children: _jsx(Card, { title: messages.page.title, subtitle: messages.page.lead, children: _jsx(TokenManager, { tools: options.tools.map((tool) => toTool(tool, config, options, messages)), tokens: tokens.map((token) => toRow(token, now, config, options, messages)), allowWrites: options.allowWrites, maxTokens: options.maxTokensPerUser, issueAction: issueTokenAction, revokeAction: revokeTokenAction, ...(grants === null ? {} : { grants: grants.map((grant) => toGrant(grant, config, options, messages)), revokeGrantAction }), messages: messages, locale: config.locale }) }) }));
 }
 //# sourceMappingURL=pages.js.map