@winstonsayno/mcp-gateway 2.2.0 → 2.4.0

package/CHANGELOG.md

@@ -9,6 +9,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.0] - 2026-10-07
+
+Upstream catalog / registry with one-click add.
+
+### Added
+- **`catalog:`** — built-in entries for the reference MCP servers (filesystem, memory, everything,
+  sequential-thinking, fetch, git, time, GitHub remote) plus `sources` (JSON files or URLs) merged by id.
+- **One-click install** (`catalog.install: true`, off by default): `POST /api/v1/catalog/:id/install` with `serverId`,
+  `env` (process env for stdio, `${VAR}` substitution for remote `url` / `headers`) and `args`; validation of required
+  inputs; `409` on id clashes. `DELETE /api/v1/catalog/servers/:id` removes it. Operator keys only.
+- `catalog.serversFile` persists installed servers (atomic write, mode 600) and loads them on start; they survive hot
+  reloads; config-file ids win on clashes.
+- **Dashboard**: *Add a server* card on the Servers tab (prompts for id, env and args; shows where an entry is
+  installed), also in the demo (read-only).
+- Exports: `Catalog`, `InstalledServers`, `BUILTIN_CATALOG`, `buildServerConfig`, `loadCatalogSource`.
+
+## [2.3.0] - 2026-10-07
+
+Tenants / workspaces with role-based access control.
+
+### Added
+- **`tenants:`** — workspaces that own servers (`servers` globs) and members (client id globs) with roles
+  **owner / admin / viewer**. Members are confined to their tenants' servers on top of their key / token scope; tool
+  calls (REST and `/mcp`) need `admin` or `owner` on the server's tenant (viewers are read-only: `403` / `-32003`).
+  Clients outside every tenant keep operator access.
+- Tenant-aware approvals: admins / owners list and decide held calls for their tenants' servers only.
+- **API**: `GET /api/v1/tenants[/:id]`, `PUT /api/v1/tenants/:id/members`, `DELETE /api/v1/tenants/:id/members/:client`
+  (owners / operators; last owner protected; runtime changes are not persisted). MCP sessions pick up membership
+  changes.
+- **Dashboard**: *Workspaces* card (role badges, member role selectors for owners), also in the demo.
+- Hot reloadable; exports `withTenantScope`, `membershipsOf`, `roleIn`, `canCall`, `ROLE_RANK`.
+
 ## [2.2.0] - 2026-10-07
 
 Tool result caching and in-flight de-duplication.

package/README.md

@@ -579,6 +579,24 @@ await gateway.start();
 process.on('SIGTERM', () => gateway.stop());
 ```
 
+## What's New in v2.4
+
+| Feature | Description |
+|---------|-------------|
+| **Upstream catalog** | built-in reference servers + your own JSON catalogs (`catalog.sources`) |
+| **One-click add** | dashboard *Add a server* / `POST /api/v1/catalog/:id/install`, optional persistence (`serversFile`) |
+
+Details: [CHANGELOG](CHANGELOG.md).
+
+## What's New in v2.3
+
+| Feature | Description |
+|---------|-------------|
+| **Tenants** | `tenants:` workspaces owning servers, with members matched by client id |
+| **RBAC** | owner / admin / viewer roles enforced on REST, `/mcp` and approvals; dashboard *Workspaces* card |
+
+Details: [CHANGELOG](CHANGELOG.md).
+
 ## What's New in v2.2
 
 | Feature | Description |

package/dashboard/index.html

@@ -423,6 +423,10 @@ tbody tr:hover { background: var(--surface-2); }
       <h2><span data-i18n="approvals">Pending approvals</span><span class="right" id="approvalsNote"></span></h2>
       <ul class="stream" id="approvals"></ul>
     </div>
+    <div class="card" id="tenantsCard" hidden style="margin-bottom:14px">
+      <h2><span data-i18n="tenants">Workspaces</span><span class="right" id="tenantsNote"></span></h2>
+      <ul class="stream" id="tenants"></ul>
+    </div>
     <div class="grid kpis stagger" id="kpis"></div>
     <div class="grid two" style="margin-top:14px">
       <div class="card">
@@ -456,6 +460,10 @@ tbody tr:hover { background: var(--surface-2); }
     <div class="page-head"><div><h1 data-i18n="srvTitle">Servers & tools</h1><p data-i18n="srvSub">Upstream MCP servers behind this gateway</p></div>
       <button class="btn sm" id="srvRefresh" type="button"><svg class="spin" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M21 12a9 9 0 1 1-3-6.7"/></svg><span data-i18n="refresh">Refresh</span></button></div>
     <div class="grid servers stagger" id="servers"></div>
+    <div class="card" id="catalogCard" hidden style="margin-top:14px">
+      <h2><span data-i18n="catalog">Add a server</span><span class="right muted" id="catalogNote"></span></h2>
+      <ul class="stream" id="catalog"></ul>
+    </div>
   </section>
 
   <!-- Playground -->
@@ -569,7 +577,7 @@ const I18N = {
     remember: 'Remember on this device', saveConnect: 'Save & connect', clear: 'Clear', close: 'Close',
     tabOverview: 'Overview', tabServers: 'Servers', tabPlayground: 'Playground', tabHistory: 'History', tabConnect: 'Connect',
     ovTitle: 'Overview', ovSub: 'Live traffic through the gateway', window: 'Time window',
-    reqRate: 'Request rate', requests: 'Requests', errors: 'Errors', latency: 'Latency', topTools: 'Top tools', perKey: 'Usage per key', perServer: 'Calls per server', approvals: 'Pending approvals', approve: 'Approve', deny: 'Deny', approved: 'Approved', denied: 'Denied', expires: 'expires',
+    reqRate: 'Request rate', requests: 'Requests', errors: 'Errors', latency: 'Latency', topTools: 'Top tools', perKey: 'Usage per key', perServer: 'Calls per server', approvals: 'Pending approvals', tenants: 'Workspaces', catalog: 'Add a server', add: 'Add', added: 'Server added', installOff: 'read-only (catalog.install is off)', installedAs: 'installed as', role: 'Role', members: 'members', roleSaved: 'Role updated', approve: 'Approve', deny: 'Deny', approved: 'Approved', denied: 'Denied', expires: 'expires',
     errRate: 'Error rate', liveStream: 'Live requests', pause: 'Pause', health: 'Server health',
     kRpm: 'Requests / min', kP50: 'p50 latency', kP95: 'p95 latency', kErr: 'Error rate', kSrv: 'Servers online',
     kTotal: '{n} in window', kP99: 'p99 {v}', kErrN: '{n} failed', kTools: '{n} tools',
@@ -614,7 +622,7 @@ const I18N = {
     remember: '在此设备上记住', saveConnect: '保存并连接', clear: '清除', close: '关闭',
     tabOverview: '总览', tabServers: '服务器', tabPlayground: '调试台', tabHistory: '历史', tabConnect: '接入',
     ovTitle: '总览', ovSub: '网关实时流量', window: '时间范围',
-    reqRate: '请求速率', requests: '请求', errors: '错误', latency: '延迟', topTools: '热门工具', perKey: '各密钥用量', perServer: '各服务器调用', approvals: '待审批调用', approve: '批准', deny: '拒绝', approved: '已批准', denied: '已拒绝', expires: '到期',
+    reqRate: '请求速率', requests: '请求', errors: '错误', latency: '延迟', topTools: '热门工具', perKey: '各密钥用量', perServer: '各服务器调用', approvals: '待审批调用', tenants: '工作区', catalog: '添加服务器', add: '添加', added: '已添加服务器', installOff: '只读（未开启 catalog.install）', installedAs: '已安装为', role: '角色', members: '成员', roleSaved: '角色已更新', approve: '批准', deny: '拒绝', approved: '已批准', denied: '已拒绝', expires: '到期',
     errRate: '错误率', liveStream: '实时请求', pause: '暂停', health: '服务器健康',
     kRpm: '每分钟请求', kP50: 'p50 延迟', kP95: 'p95 延迟', kErr: '错误率', kSrv: '在线服务器',
     kTotal: '窗口内 {n} 次', kP99: 'p99 {v}', kErrN: '{n} 次失败', kTools: '{n} 个工具',
@@ -967,6 +975,70 @@ document.addEventListener('click', async (e) => {
   loadApprovals();
 });
 
+// Tenants / workspaces (RBAC): hidden unless the gateway has tenants the caller can see.
+async function loadTenants() {
+  const card = $('#tenantsCard');
+  let r;
+  try { r = await api('/tenants'); } catch { card.hidden = true; return; }
+  const list = r.tenants || [];
+  card.hidden = list.length === 0;
+  $('#tenantsNote').textContent = list.length ? `${r.clientId}` : '';
+  const roles = ['owner', 'admin', 'viewer'];
+  $('#tenants').innerHTML = list.map((tn) => {
+    const manage = tn.role === 'owner' || tn.role === 'operator';
+    const members = (tn.members || []).map((m) => manage
+      ? `<span class="pill mono">${esc(m.client)} <select class="input" style="padding:0 4px;height:22px" data-tenant="${esc(tn.id)}" data-client="${esc(m.client)}" aria-label="${esc(t('role'))}">${roles.map((x) => `<option value="${x}"${x === m.role ? ' selected' : ''}>${x}</option>`).join('')}</select></span>`
+      : `<span class="pill mono">${esc(m.client)} · ${esc(m.role)}</span>`).join(' ');
+    return `<li><div style="flex:1;min-width:0"><b>${esc(tn.name)}</b> <span class="badge ${tn.role === 'viewer' ? '' : 'ok'}">${esc(tn.role || '')}</span>
+      <span class="muted"> · ${esc((tn.serverIds || []).join(', ') || tn.servers.join(', '))}</span>
+      ${members ? `<div style="margin-top:6px;display:flex;flex-wrap:wrap;gap:6px">${members}</div>` : ''}</div></li>`;
+  }).join('');
+}
+document.addEventListener('change', async (e) => {
+  const sel = e.target.closest && e.target.closest('select[data-tenant]');
+  if (!sel) return;
+  try {
+    await api(`/tenants/${encodeURIComponent(sel.dataset.tenant)}/members`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ client: sel.dataset.client, role: sel.value }) });
+    toast(t('roleSaved'));
+  } catch (err) { toast(err.message || String(err)); }
+  loadTenants();
+});
+
+// Upstream catalog: one-click add of well-known MCP servers (operators; needs catalog.install: true).
+async function loadCatalog() {
+  const card = $('#catalogCard');
+  let r;
+  try { r = await api('/catalog'); } catch { card.hidden = true; return; }
+  const list = r.entries || [];
+  card.hidden = list.length === 0;
+  state.catalog = r;
+  $('#catalogNote').textContent = r.install ? '' : t('installOff');
+  $('#catalog').innerHTML = list.map((e) => `<li><div style="flex:1;min-width:0"><b>${esc(e.name)}</b> <span class="badge">${esc(e.template.transport)}</span>
+    ${(e.installed || []).length ? `<span class="badge ok">${esc(t('installedAs'))} ${esc(e.installed.join(', '))}</span>` : ''}
+    <div class="muted" style="font-size:12.5px">${esc(e.description || '')}${e.homepage ? ` · <a href="${esc(e.homepage)}" target="_blank" rel="noopener noreferrer">docs</a>` : ''}</div></div>
+    ${r.install ? `<button class="btn sm primary" type="button" data-install="${esc(e.id)}">${esc(t('add'))}</button>` : ''}</li>`).join('');
+}
+document.addEventListener('click', async (e) => {
+  const b = e.target.closest && e.target.closest('[data-install]');
+  if (!b) return;
+  const entry = (state.catalog?.entries || []).find((x) => x.id === b.dataset.install);
+  if (!entry) return;
+  const serverId = prompt('Server id', entry.installed && entry.installed.length ? `${entry.id}-2` : entry.id);
+  if (!serverId) return;
+  const env = {};
+  for (const v of entry.env || []) { const val = prompt(`${v.name}${v.description ? ` — ${v.description}` : ''}`, ''); if (val === null) return; if (val) env[v.name] = val; }
+  const args = [];
+  for (const a of entry.args || []) { const val = prompt(`${a.name}${a.description ? ` — ${a.description}` : ''}`, a.default || ''); if (val === null) return; args.push(val); }
+  b.classList.add('loading');
+  try {
+    await api(`/catalog/${encodeURIComponent(entry.id)}/install`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ serverId, env, args }) });
+    toast(t('added'));
+    loadServers();
+  } catch (err) { toast(err.message || String(err)); }
+  b.classList.remove('loading');
+  loadCatalog();
+});
+
 async function loadServers() {
   const btn = $('#srvRefresh'); btn.classList.add('loading');
   try {
@@ -1644,6 +1716,9 @@ reloadAll().then(() => {
 });
 // Refresh the slower-moving pieces in the background.
 setInterval(() => { if (!document.hidden) loadApprovals(); }, 3000);
+loadTenants();
+loadCatalog();
+setInterval(() => { if (!document.hidden) loadTenants(); }, 30000);
 setInterval(() => { if (!document.hidden) { loadServers(); if (state.live === 'live') loadStats().catch(() => {}); } }, 10000);
 document.addEventListener('visibilitychange', () => { if (!document.hidden && state.live !== 'live') startLive(); });
 })();

package/dist/auth/scopes.d.ts

@@ -25,6 +25,15 @@ export interface AccessScope {
     tools?: string[];
     /** Own rate limit for this client (replaces the global `rateLimit`). */
     rateLimit?: RateLimitConfig;
+    /** Tenant confinement: union of the client's tenants' server globs (see auth/tenants). */
+    tenantServers?: string[];
+    /** Servers of tenants where the client is admin / owner (tool calls allowed). */
+    writableServers?: string[];
+    /** The client's tenant memberships. */
+    tenants?: Array<{
+        id: string;
+        role: 'owner' | 'admin' | 'viewer';
+    }>;
 }
 export declare const JWT_SERVERS_CLAIM = "mcp_servers";
 export declare const JWT_TOOLS_CLAIM = "mcp_tools";

package/dist/auth/scopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGnE,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAC/C,eAAO,MAAM,eAAe,cAAc,CAAC;AAI3C,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGzF;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMzG;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC,EAC9E,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,KAAK,EAAE,SAAS,CAAC,EAAE,GAClB,CAAC,EAAE,CAGL;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAEpE;AAUD,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAUtE"}
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGnE,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uCAAuC;IACvC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAC/C,eAAO,MAAM,eAAe,cAAc,CAAC;AAI3C,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIzF;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMzG;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC,EAC9E,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,KAAK,EAAE,SAAS,CAAC,EAAE,GAClB,CAAC,EAAE,CAGL;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAEpE;AAUD,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAUtE"}

package/dist/auth/scopes.js

@@ -23,6 +23,8 @@ export const JWT_TOOLS_CLAIM = 'mcp_tools';
 const matches = (value, patterns) => patterns.some((p) => globToRegExp(p).test(value));
 /** Whether the scope lets the client use `serverId` at all. */
 export function isServerInScope(scope, serverId) {
+    if (scope?.tenantServers && !matches(serverId, scope.tenantServers))
+        return false;
     if (!scope?.servers)
         return true;
     return matches(serverId, scope.servers);
@@ -39,13 +41,13 @@ export function isToolInScope(scope, serverId, toolName) {
     return scope.tools.some((p) => globToRegExp(p).test(p.includes('/') ? qualified : toolName));
 }
 export function filterToolsByScope(scope, tools) {
-    if (!scope || (!scope.servers && !scope.tools))
+    if (!isRestricted(scope))
         return [...tools];
     return tools.filter((t) => isToolInScope(scope, t.serverId, t.name));
 }
 /** Whether a scope restricts anything (unrestricted clients skip filtering). */
 export function isRestricted(scope) {
-    return !!scope && (scope.servers !== undefined || scope.tools !== undefined);
+    return !!scope && (scope.servers !== undefined || scope.tools !== undefined || scope.tenantServers !== undefined);
 }
 function claimList(value) {
     if (value === undefined || value === null)

package/dist/auth/scopes.js.map

@@ -1 +1 @@
-{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAWvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,QAA2B,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAElH,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAA8B,EAAE,QAAgB;IAC9E,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,KAA8B,EAAE,QAAgB,EAAE,QAAgB;IAC9F,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAC5C,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA8B,EAC9B,KAAmB;IAEnB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzG,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,0EAA0E;IAC1E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAiBvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,QAA2B,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAElH,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAA8B,EAAE,QAAgB;IAC9E,IAAI,KAAK,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,KAA8B,EAAE,QAAgB,EAAE,QAAgB;IAC9F,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAC5C,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA8B,EAC9B,KAAmB;IAEnB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzG,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,0EAA0E;IAC1E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth/tenants.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Tenants (workspaces) with role-based access control.
+ *
+ * A tenant groups upstream servers (`servers` globs) and members. A member is
+ * matched by client id glob (`key:alice`, `jwt:user-*`, `oauth:…`) and has one
+ * role per tenant:
+ *
+ *  | role   | sees the tenant's servers | calls tools, manages approvals / cache | manages members |
+ *  |--------|:--:|:--:|:--:|
+ *  | viewer | ✓ |   |   |
+ *  | admin  | ✓ | ✓ |   |
+ *  | owner  | ✓ | ✓ | ✓ |
+ *
+ * A client that belongs to at least one tenant is confined to the union of its
+ * tenants' servers (on top of its own key / token scope), and may only call
+ * tools on servers of tenants where it is `admin` or `owner`. Clients that
+ * belong to no tenant keep their 1.x behaviour (operators).
+ *
+ * @module auth/tenants
+ */
+import type { TenantConfig, TenantRole } from '../utils/types.js';
+import type { AccessScope } from './scopes.js';
+export declare const ROLE_RANK: Record<TenantRole, number>;
+export interface Membership {
+    tenant: string;
+    name?: string;
+    role: TenantRole;
+    servers: string[];
+}
+/** The role of a client in a tenant (highest matching member entry). */
+export declare function roleIn(tenant: TenantConfig, clientId: string | undefined): TenantRole | undefined;
+export declare function membershipsOf(tenants: readonly TenantConfig[] | undefined, clientId: string | undefined): Membership[];
+/** Add tenant confinement to a client's scope (unchanged for clients in no tenant). */
+export declare function withTenantScope(tenants: readonly TenantConfig[] | undefined, clientId: string | undefined, scope: AccessScope | undefined): AccessScope | undefined;
+/** Whether the scope may call tools on `serverId` (viewers are read-only). */
+export declare function canCall(scope: AccessScope | undefined, serverId: string): boolean;
+/** Highest role the scope holds in any tenant (undefined = not a tenant member). */
+export declare function highestRole(scope: AccessScope | undefined): TenantRole | undefined;
+/** Validation message for a tenants block (undefined = valid). */
+export declare function invalidTenants(tenants: readonly TenantConfig[] | undefined): string | undefined;
+//# sourceMappingURL=tenants.d.ts.map

package/dist/auth/tenants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../src/auth/tenants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAqC,CAAC;AAEvF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAID,wEAAwE;AACxE,wBAAgB,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAOjG;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,EAAE,CAOtH;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,EAC5C,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,WAAW,GAAG,SAAS,GAC7B,WAAW,GAAG,SAAS,CASzB;AAED,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGjF;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAIlF;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAO/F"}

package/dist/auth/tenants.js

@@ -0,0 +1,79 @@
+/**
+ * Tenants (workspaces) with role-based access control.
+ *
+ * A tenant groups upstream servers (`servers` globs) and members. A member is
+ * matched by client id glob (`key:alice`, `jwt:user-*`, `oauth:…`) and has one
+ * role per tenant:
+ *
+ *  | role   | sees the tenant's servers | calls tools, manages approvals / cache | manages members |
+ *  |--------|:--:|:--:|:--:|
+ *  | viewer | ✓ |   |   |
+ *  | admin  | ✓ | ✓ |   |
+ *  | owner  | ✓ | ✓ | ✓ |
+ *
+ * A client that belongs to at least one tenant is confined to the union of its
+ * tenants' servers (on top of its own key / token scope), and may only call
+ * tools on servers of tenants where it is `admin` or `owner`. Clients that
+ * belong to no tenant keep their 1.x behaviour (operators).
+ *
+ * @module auth/tenants
+ */
+import { globToRegExp } from '../utils/tool-filter.js';
+export const ROLE_RANK = { viewer: 1, admin: 2, owner: 3 };
+const matches = (value, patterns) => patterns.some((p) => globToRegExp(p).test(value));
+/** The role of a client in a tenant (highest matching member entry). */
+export function roleIn(tenant, clientId) {
+    const id = clientId ?? 'anonymous';
+    let best;
+    for (const m of tenant.members ?? []) {
+        if (globToRegExp(m.client).test(id) && (!best || ROLE_RANK[m.role] > ROLE_RANK[best]))
+            best = m.role;
+    }
+    return best;
+}
+export function membershipsOf(tenants, clientId) {
+    const out = [];
+    for (const t of tenants ?? []) {
+        const role = roleIn(t, clientId);
+        if (role)
+            out.push({ tenant: t.id, name: t.name, role, servers: t.servers });
+    }
+    return out;
+}
+/** Add tenant confinement to a client's scope (unchanged for clients in no tenant). */
+export function withTenantScope(tenants, clientId, scope) {
+    const ms = membershipsOf(tenants, clientId);
+    if (ms.length === 0)
+        return scope;
+    return {
+        ...(scope ?? {}),
+        tenantServers: [...new Set(ms.flatMap((m) => m.servers))],
+        writableServers: [...new Set(ms.filter((m) => ROLE_RANK[m.role] >= ROLE_RANK.admin).flatMap((m) => m.servers))],
+        tenants: ms.map((m) => ({ id: m.tenant, role: m.role })),
+    };
+}
+/** Whether the scope may call tools on `serverId` (viewers are read-only). */
+export function canCall(scope, serverId) {
+    if (!scope?.writableServers)
+        return true;
+    return matches(serverId, scope.writableServers);
+}
+/** Highest role the scope holds in any tenant (undefined = not a tenant member). */
+export function highestRole(scope) {
+    let best;
+    for (const t of scope?.tenants ?? [])
+        if (!best || ROLE_RANK[t.role] > ROLE_RANK[best])
+            best = t.role;
+    return best;
+}
+/** Validation message for a tenants block (undefined = valid). */
+export function invalidTenants(tenants) {
+    const ids = new Set();
+    for (const t of tenants ?? []) {
+        if (ids.has(t.id))
+            return `duplicate tenant id "${t.id}"`;
+        ids.add(t.id);
+    }
+    return undefined;
+}
+//# sourceMappingURL=tenants.js.map

package/dist/auth/tenants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.js","sourceRoot":"","sources":["../../src/auth/tenants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIvD,MAAM,CAAC,MAAM,SAAS,GAA+B,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AASvF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,QAA2B,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAElH,wEAAwE;AACxE,MAAM,UAAU,MAAM,CAAC,MAAoB,EAAE,QAA4B;IACvE,MAAM,EAAE,GAAG,QAAQ,IAAI,WAAW,CAAC;IACnC,IAAI,IAA4B,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA4C,EAAE,QAA4B;IACtG,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjC,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAC7B,OAA4C,EAC5C,QAA4B,EAC5B,KAA8B;IAE9B,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO;QACL,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAChB,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/G,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,OAAO,CAAC,KAA8B,EAAE,QAAgB;IACtE,IAAI,CAAC,KAAK,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,KAA8B;IACxD,IAAI,IAA4B,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,OAAO,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACtG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAA4C;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,OAAO,wBAAwB,CAAC,CAAC,EAAE,GAAG,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/catalog/index.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Upstream catalog / registry: templates for well-known MCP servers that an
+ * operator can add with one click (dashboard) or one request
+ * (`POST /api/v1/catalog/:id/install`).
+ *
+ * The built-in entries cover the reference servers; `catalog.sources` adds
+ * entries from JSON files or URLs (`{ "entries": [...] }` or an array).
+ * Installing is off unless `catalog.install: true` — it spawns processes.
+ * Installed servers are kept in `catalog.serversFile` (JSON) when set, and
+ * loaded again on start.
+ *
+ * @module catalog
+ */
+import type { CatalogConfig, McpServerConfig } from '../utils/types.js';
+export interface CatalogEnvVar {
+    name: string;
+    description?: string;
+    required?: boolean;
+    secret?: boolean;
+}
+export interface CatalogEntry {
+    id: string;
+    name: string;
+    description: string;
+    homepage?: string;
+    tags?: string[];
+    /** Server config template (`id` / `name` come from the install request). */
+    template: Omit<McpServerConfig, 'id' | 'name'>;
+    /** Environment variables (stdio) or `${VAR}` placeholders the template needs. */
+    env?: CatalogEnvVar[];
+    /** Extra positional args the user must supply (e.g. allowed directories). */
+    args?: Array<{
+        name: string;
+        description?: string;
+        required?: boolean;
+        default?: string;
+    }>;
+    source?: string;
+}
+/** Built-in catalog (reference MCP servers). */
+export declare const BUILTIN_CATALOG: CatalogEntry[];
+/** Load entries from one source (file path relative to `baseDir`, or http(s) URL). */
+export declare function loadCatalogSource(source: string, baseDir?: string, fetchImpl?: typeof fetch): Promise<CatalogEntry[]>;
+export declare class Catalog {
+    private config;
+    private readonly baseDir;
+    private entries;
+    constructor(config: () => CatalogConfig | undefined, baseDir?: () => string | undefined);
+    /** (Re)load `catalog.sources`; failures are logged and skipped. */
+    refresh(fetchImpl?: typeof fetch): Promise<void>;
+    list(): readonly CatalogEntry[];
+    get(id: string): CatalogEntry | undefined;
+    installEnabled(): boolean;
+}
+export interface InstallRequest {
+    /** Server id (default: the entry id). */
+    serverId?: string;
+    name?: string;
+    /** Values for `entry.env` (stdio: process env; remote: `${VAR}` substitution). */
+    env?: Record<string, string>;
+    /** Values for `entry.args`, in order. */
+    args?: string[];
+    tags?: string[];
+}
+/** Build a server config from a catalog entry. Throws with a user-facing message on missing input. */
+export declare function buildServerConfig(entry: CatalogEntry, req: InstallRequest): McpServerConfig;
+/** Servers installed from the catalog, persisted in `catalog.serversFile`. */
+export declare class InstalledServers {
+    private readonly file;
+    private servers;
+    constructor(file: () => string | undefined);
+    load(): McpServerConfig[];
+    list(): readonly McpServerConfig[];
+    add(s: McpServerConfig): Promise<void>;
+    remove(id: string): Promise<boolean>;
+    private save;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/catalog/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/catalog/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGxE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;IAC/C,iFAAiF;IACjF,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,gDAAgD;AAChD,eAAO,MAAM,eAAe,EAAE,YAAY,EAoEzC,CAAC;AAQF,sFAAsF;AACtF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAgB,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAczI;AAED,qBAAa,OAAO;IAGN,OAAO,CAAC,MAAM;IAAmC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFrF,OAAO,CAAC,OAAO,CAAwC;gBAEnC,MAAM,EAAE,MAAM,aAAa,GAAG,SAAS,EAAmB,OAAO,GAAE,MAAM,MAAM,GAAG,SAA2B;IAEjI,mEAAmE;IAC7D,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBtD,IAAI,IAAI,SAAS,YAAY,EAAE;IAI/B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAIzC,cAAc,IAAI,OAAO;CAG1B;AAED,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,sGAAsG;AACtG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,GAAG,eAAe,CAgC3F;AAED,8EAA8E;AAC9E,qBAAa,gBAAgB;IAGf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,OAAO,CAAyB;gBAEX,IAAI,EAAE,MAAM,MAAM,GAAG,SAAS;IAE3D,IAAI,IAAI,eAAe,EAAE;IAazB,IAAI,IAAI,SAAS,eAAe,EAAE;IAI5B,GAAG,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAQ5B,IAAI;CAOnB"}