@vectros-ai/mcp-server 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to `@vectros-ai/mcp-server` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org).
 
+## 0.14.0
+
+### Changed
+
+- **Repinned to `@vectros-ai/sdk` 0.39.0.**
+- **The `st_*` short-lived-token warning now states a 1-hour maximum, matching the
+  platform's narrowed cap** — it previously read "(1h default, 24h max)"; the 24h
+  ceiling no longer exists, so it now reads "(1h max)".
+
 ## 0.13.0
 
 ### Added

package/dist/cli-http.js

@@ -87,6 +87,7 @@ __export(api_exports, {
   TooManyRequestsError: () => TooManyRequestsError,
   TruncationWarningEvent: () => TruncationWarningEvent,
   UnauthorizedError: () => UnauthorizedError,
+  UserExistsResponse: () => UserExistsResponse,
   UserRequest: () => UserRequest,
   UserResponse: () => UserResponse,
   auth: () => auth_exports,
@@ -763,6 +764,14 @@ var TruncationWarningEvent;
     ContextWindowBudget: "context_window_budget"
   };
 })(TruncationWarningEvent || (TruncationWarningEvent = {}));
+var UserExistsResponse;
+((UserExistsResponse2) => {
+  UserExistsResponse2.Status = {
+    Active: "ACTIVE",
+    Suspended: "SUSPENDED",
+    Pending: "PENDING"
+  };
+})(UserExistsResponse || (UserExistsResponse = {}));
 var UserRequest;
 ((UserRequest2) => {
   UserRequest2.Status = {
@@ -2506,7 +2515,7 @@ var AuthClient = class {
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/admin/keys/scoped");
   }
   /**
-   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope.
+   * Creates a scoped API key (an `ssk_*` secret) that inherits its permissions from an existing access profile in your account. The call is idempotent on the combination of tenant, context, user, and key name: re-issuing the same request returns the existing key WITHOUT re-disclosing its raw secret. The raw key is returned ONLY in this response — store it securely, as it cannot be retrieved again. Requires the `keys:c` scope. If you use a scoped credential, `keys:c` alone is not sufficient: because the minted key is durably bound to the profile you name, the profile's effective scopes may not exceed your own, and you may only mint against a profile whose `identityOverrides` values your own identity holds. A root API key (`sk_`) is exempt from both bounds.
    *
    * @param {Vectros.CreateScopedKeyRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
@@ -3256,11 +3265,12 @@ var AuthClient = class {
     );
   }
   /**
-   * Updates an access profile. This is a partial update: any field you omit (or send as null) keeps its existing value. A profile must reference either inline `scopes` or a `roleId`, never both — so setting `scopes` clears any `roleId`, and setting `roleId` clears any inline `scopes`. The `contextId` and `principalId` are immutable. Status changes (for example active to suspended) take effect within about five minutes. If you use a scoped credential, the profile's effective scopes may not exceed your own, and its `identityOverrides` are bounded twice: you may only set a value your own identity holds, and you may only change or clear a value the profile already holds if that value is yours as well. Repointing or clearing another principal's established identity therefore returns 403. A root API key (`sk_`) is exempt. Requires the `profiles:u` scope.
+   * Updates an access profile. This is a partial update: any field you omit (or send as null) keeps its existing value. A profile must reference either inline `scopes` or a `roleId`, never both — so setting `scopes` clears any `roleId`, and setting `roleId` clears any inline `scopes`. The `contextId` and `principalId` are immutable. Status changes (for example active to suspended) take effect within about five minutes. If you use a scoped credential, the profile's effective scopes may not exceed your own, and its `identityOverrides` are bounded twice: you may only set a value your own identity holds, and you may only change or clear a value the profile already holds if that value is yours as well. Repointing or clearing another principal's established identity therefore returns 403. A root API key (`sk_`) is exempt. If you set `roleId`, it must reference a role that already exists in this context. Requires the `profiles:u` scope.
    *
    * @param {Vectros.UpdateAccessProfileRequest} request
    * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
    *
+   * @throws {@link Vectros.BadRequestError}
    * @throws {@link Vectros.ForbiddenError}
    * @throws {@link Vectros.NotFoundError}
    * @throws {@link Vectros.TooManyRequestsError}
@@ -3307,6 +3317,8 @@ var AuthClient = class {
     }
     if (_response.error.reason === "status-code") {
       switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
         case 403:
           throw new ForbiddenError(_response.error.body, _response.rawResponse);
         case 404:
@@ -3998,6 +4010,254 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/usage");
   }
+  /**
+   * Retrieves a single registered issuer by issuerId. Requires a root API key or the bootstrap's provisioning capability.
+   *
+   * @param {Vectros.GetIssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   *
+   * @example
+   *     await client.auth.getIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  getIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__getIssuer(request, requestOptions));
+  }
+  async __getIssuer(request, requestOptions) {
+    const { issuerId } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers/{issuerId}");
+  }
+  /**
+   * Deregisters a trusted third-party IdP issuer. Requires a root API key or the bootstrap's provisioning capability. Unconditional — unlike some other registry deletes on this API, this does not check for or block on any downstream reference. Any user account already created via this issuer (by a prior self-signup or accepted invite) is NOT deleted or modified, but that user can no longer obtain a NEW token this way once you deregister the issuer — every `POST /v1/auth/token/exchange` call against it will 404, with no distinction between an unknown issuer and one you just deregistered. Register a replacement issuer, or restore this one, before your users' current tokens expire if you want their access to continue uninterrupted.
+   *
+   * @param {Vectros.DeleteIssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.deleteIssuer({
+   *         issuerId: "auth0-prod"
+   *     })
+   */
+  deleteIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__deleteIssuer(request, requestOptions));
+  }
+  async __deleteIssuer(request, requestOptions) {
+    const { issuerId } = request;
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        `v1/auth/issuers/${url_exports.encodePathParam(issuerId)}`
+      ),
+      method: "DELETE",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: void 0, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(
+      _response.error,
+      _response.rawResponse,
+      "DELETE",
+      "/v1/auth/issuers/{issuerId}"
+    );
+  }
+  /**
+   * Returns the issuers registered in your tenant. Requires a root API key or the bootstrap's provisioning capability. Returns a `{data, nextCursor}` envelope.
+   *
+   * @param {Vectros.ListIssuersRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.ForbiddenError}
+   *
+   * @example
+   *     await client.auth.listIssuers()
+   */
+  listIssuers(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__listIssuers(request, requestOptions));
+  }
+  async __listIssuers(request = {}, requestOptions) {
+    const { startFrom, limit } = request;
+    const _queryParams = {
+      startFrom,
+      limit
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/issuers"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/auth/issuers");
+  }
+  /**
+   * Registers a trusted third-party IdP issuer that BYO-IdP token exchange (`POST /v1/auth/token/exchange`) may accept a `subject_token` from. Requires a root API key or the CLI bootstrap's provisioning capability — never an ordinary partner-grantable scope. Idempotent by `issuerId` within your tenant; the `(issuer, audience)` pair must not already be registered by a different issuerId/tenant.
+   *
+   * @param {Vectros.IssuerRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.registerIssuer({
+   *         issuerId: "auth0-prod",
+   *         issuer: "https://your-tenant.us.auth0.com/",
+   *         jwksUri: "https://your-tenant.us.auth0.com/.well-known/jwks.json",
+   *         audience: "https://api.your-app.example.com",
+   *         contextId: "casework"
+   *     })
+   */
+  registerIssuer(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__registerIssuer(request, requestOptions));
+  }
+  async __registerIssuer(request, requestOptions) {
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/issuers"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/issuers");
+  }
   /**
    * Returns the identity bound to your credential — your account, principal type, key id, and scope details — so you can confirm who you are authenticated as and that the credential is valid. MCP clients use this to render "signed in as ..." in a chat UI without a separate identity endpoint.
    *
@@ -4321,6 +4581,72 @@ var AuthClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/invite/resend");
   }
+  /**
+   * RFC 8693 OAuth 2.0 Token Exchange. Trades a JWT issued by a third-party identity provider you've registered (`POST /v1/auth/issuers`) for a Vectros `st_*` scoped bearer token — no Vectros credential required to call this endpoint. The exchanged token's scope is resolved entirely server-side from the matched user's access profile; this endpoint accepts no caller-supplied scope, resource, or audience parameter (RFC 8693 §2.1's `resource`/`audience`/`scope` are not used in v1 — the registered `(issuer, audience)` pair alone pins the target tenant and app context). On a first-time login (no existing Vectros identity for this subject), two opt-in binding paths exist: `invite_token` (a `PENDING` sub-user invitation), and — if the registration declares one or more self-signup policies — `signup_type` (a brand-new user is created and bound to the policy's configured role). If `invite_token` is present at all, it is the ONLY path tried — a failed invite never falls through to self-signup. Neither field is required for a subject with an existing identity. Uses the OAuth-standard error envelope (`{"error":..., "error_description":...}`, RFC 6749 §5.2), NOT this API's usual `{"message":...}` shape — its client is generic OAuth tooling, not the Vectros SDK.
+   *
+   * @param {Vectros.TokenExchangeRequest} request
+   * @param {AuthClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.UnauthorizedError}
+   * @throws {@link Vectros.ForbiddenError}
+   * @throws {@link Vectros.NotFoundError}
+   * @throws {@link Vectros.TooManyRequestsError}
+   *
+   * @example
+   *     await client.auth.exchangeToken({
+   *         grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+   *         subject_token: "subject_token",
+   *         subject_token_type: "urn:ietf:params:oauth:token-type:jwt"
+   *     })
+   */
+  exchangeToken(request, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__exchangeToken(request, requestOptions));
+  }
+  async __exchangeToken(request, requestOptions) {
+    const _headers = mergeHeaders(this._options?.headers, requestOptions?.headers);
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/auth/token/exchange"
+      ),
+      method: "POST",
+      headers: _headers,
+      contentType: "application/json",
+      queryString: url_exports.queryBuilder().mergeAdditional(requestOptions?.queryParams).build(),
+      requestType: "json",
+      body: request,
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 401:
+          throw new UnauthorizedError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        case 404:
+          throw new NotFoundError(_response.error.body, _response.rawResponse);
+        case 429:
+          throw new TooManyRequestsError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/auth/token/exchange");
+  }
 };
 var ComplianceClient = class {
   constructor(options) {
@@ -6928,6 +7254,69 @@ var IdentityClient = class {
     }
     return handleNonStatusCodeError(_response.error, _response.rawResponse, "POST", "/v1/users/lookup");
   }
+  /**
+   * Answers "does a user with this email hold an ACTIVE access profile in this app context" — a narrow existence check, not a general lookup. `exists` is false for a member whose access to this context has been suspended, not only for a member who was never granted it. The answer is scoped to the `contextId` you supply: it does not reveal whether the email exists elsewhere in your tenant or account, only whether it belongs to an active member of the named context. Returns `{exists, userId, status}` — never the full user record — so a caller asking "does X exist" cannot receive that user's payload/schema binding/etc. as a side effect. Useful for resolving an email you were handed (for example, by an org-admin adding an existing member to another org) to a `userId`, without paging through the full context membership. Requires the `users:r` scope.
+   *
+   * @param {Vectros.UserExistsByEmailRequest} request
+   * @param {IdentityClient.RequestOptions} requestOptions - Request-specific configuration.
+   *
+   * @throws {@link Vectros.BadRequestError}
+   * @throws {@link Vectros.ForbiddenError}
+   *
+   * @example
+   *     await client.identity.userExistsByEmail({
+   *         email: "user@example.com",
+   *         contextId: "myapp"
+   *     })
+   */
+  userExistsByEmail(request = {}, requestOptions) {
+    return HttpResponsePromise.fromPromise(this.__userExistsByEmail(request, requestOptions));
+  }
+  async __userExistsByEmail(request = {}, requestOptions) {
+    const { email, contextId } = request;
+    const _queryParams = {
+      email,
+      contextId
+    };
+    const _authRequest = await this._options.authProvider.getAuthRequest();
+    const _headers = mergeHeaders(
+      _authRequest.headers,
+      this._options?.headers,
+      requestOptions?.headers
+    );
+    const _response = await fetcher({
+      url: url_exports.join(
+        await Supplier.get(this._options.baseUrl) ?? await Supplier.get(this._options.environment),
+        "v1/users/exists-by-email"
+      ),
+      method: "GET",
+      headers: _headers,
+      queryString: url_exports.queryBuilder().addMany(_queryParams).mergeAdditional(requestOptions?.queryParams).build(),
+      timeoutMs: (requestOptions?.timeoutInSeconds ?? this._options?.timeoutInSeconds ?? 60) * 1e3,
+      maxRetries: requestOptions?.maxRetries ?? this._options?.maxRetries,
+      abortSignal: requestOptions?.abortSignal,
+      fetchFn: this._options?.fetch,
+      logging: this._options.logging
+    });
+    if (_response.ok) {
+      return { data: _response.body, rawResponse: _response.rawResponse };
+    }
+    if (_response.error.reason === "status-code") {
+      switch (_response.error.statusCode) {
+        case 400:
+          throw new BadRequestError(_response.error.body, _response.rawResponse);
+        case 403:
+          throw new ForbiddenError(_response.error.body, _response.rawResponse);
+        default:
+          throw new VectrosError({
+            statusCode: _response.error.statusCode,
+            body: _response.error.body,
+            rawResponse: _response.rawResponse
+          });
+      }
+    }
+    return handleNonStatusCodeError(_response.error, _response.rawResponse, "GET", "/v1/users/exists-by-email");
+  }
   /**
    * Returns the audit trail of changes to a user, most recent first. Identity history is always recorded and always available. Sensitive field values are redacted in every historical version. Returns a page in the `{data, nextCursor}` envelope. Requires the `users:r` scope.
    *
@@ -8684,15 +9073,15 @@ function warnOnSuboptimalKey(key, log) {
   } else if (key.prefix === "st") {
     log.warn(
       { prefix: key.prefix, env: key.env },
-      "short-lived token (st_*) will expire mid-session (1h default, 24h max). For long-running MCP installs, prefer a long-lived ssk_* key."
+      "short-lived token (st_*) will expire mid-session (1h max). For long-running MCP installs, prefer a long-lived ssk_* key."
     );
   }
 }
 
 // src/build-info.ts
 var BUILD_INFO = {
-  mcpServer: true ? "0.13.0" : "dev",
-  sdk: true ? "0.38.0" : "dev"
+  mcpServer: true ? "0.14.0" : "dev",
+  sdk: true ? "0.39.0" : "dev"
 };
 
 // src/log.ts