pleaxy-mcp 0.1.1 → 0.2.0

package/README.md

@@ -21,10 +21,17 @@ claude mcp add pleaxy -e PLEAXY_API_BASE_URL=https://api.pleaxy.ai -e PLEAXY_WOR
 
 The package carries a [`server.json`](server.json) for the official MCP Registry (`ai.pleaxy/pleaxy-mcp`).
 
-## Sign in as yourself
+## Apps that connect by URL
+
+Apps that can't run a command on your computer, such as claude.ai, the Claude apps and
+ChatGPT, connect to Pleaxy's hosted server at `https://mcp.pleaxy.ai/mcp`, with the same
+tools. Add it as a custom connector (in claude.ai: Settings → Connectors → Add custom
+connector; in the Claude apps or ChatGPT, their connector settings). Pleaxy opens in
+your browser: sign in, tick the workspaces and Allow. There is no API key, and nothing
+to install. It acts as you, with the same rights and the same agent requests as the
+server here. More at [pleaxy.ai/docs/mcp](https://pleaxy.ai/docs/mcp).
 
-> Not switched on at `api.pleaxy.ai` yet: until it is, `login` there says the
-> deployment doesn't offer agent sign-in, and the API-key setup below is the way in.
+## Sign in as yourself
 
 Signed in as you, the server acts as you: it sees what you see in Pleaxy and its
 changes are recorded as yours. Decisions stay yours: approving or rejecting an
@@ -36,16 +43,23 @@ Pleaxy Assistant.
 
 ```bash
 export PLEAXY_API_BASE_URL="https://api.pleaxy.ai"
-npx pleaxy-mcp login     # opens your browser to sign in; lists the workspaces it can reach
-npx pleaxy-mcp whoami    # who the server acts as
-npx pleaxy-mcp logout    # signs the agent out (also: Pleaxy → Security & Sign-in → Agents)
+npx pleaxy-mcp login     # opens Pleaxy in your browser: sign in, tick the workspaces, Allow
+npx pleaxy-mcp whoami    # who the server acts as, and the workspaces it may use
+npx pleaxy-mcp logout    # disconnects the agent (also: Pleaxy → Security & Sign-in → Agents)
 ```
 
-Then configure the server as below, with `PLEAXY_WORKSPACE_ID` and without
-`PLEAXY_API_KEY`. The sign-in is stored in `~/.config/pleaxy-mcp/credentials.json`
-(`%APPDATA%\pleaxy-mcp` on Windows), readable by you only, and lasts at most 7 days;
-then run `login` again. Resetting your password signs every agent out. A workspace
-whose company requires single sign-on isn't reachable by an agent.
+`login` opens Pleaxy itself, where you sign in as you always do (password, passkey or
+your company's single sign-on). If your last sign-in is more than 15 minutes old,
+Pleaxy asks you to sign in again first. You then choose which of your workspaces the
+agent may use and allow it. The connection lasts 30 days, or until you disconnect it,
+reset your password, or are removed from those workspaces; then run `login` again.
+
+Each tool takes a `workspace` (the `list_workspaces` tool names them), so one server
+works across every workspace you allowed. `PLEAXY_WORKSPACE_ID`, if set, is the
+default; with a single workspace allowed, that one is used. Configure the server as
+below, without `PLEAXY_API_KEY`. The sign-in is stored in
+`~/.config/pleaxy-mcp/credentials.json` (`%APPDATA%\pleaxy-mcp` on Windows), readable
+by you only.
 
 ## Setup with an API key
 
@@ -61,13 +75,13 @@ For unattended integrations that act as the workspace rather than a person.
 2. Set the three required environment variables. `PLEAXY_API_BASE_URL` is the
    API's origin only, `https://api.pleaxy.ai` - the server appends the `/v1`
    version prefix itself, so do not include it here. `PLEAXY_WORKSPACE_ID` is the **Workspace ID** shown
-   in the Pleaxy console under **Company profile → Workspace ID** (one per
+   in the Pleaxy console under **Company profile → Integrations → Developers → Workspace ID** (one per
    workspace, e.g. `reg_01k5x8p9j3q7vn2mhb4tzc6rde.buyer`); copy it as-is:
 
 ```bash
 export PLEAXY_API_BASE_URL="https://api.pleaxy.ai"
 export PLEAXY_API_KEY="<keyId>.<secret>"
-export PLEAXY_WORKSPACE_ID="<Company profile → Workspace ID>"
+export PLEAXY_WORKSPACE_ID="<Company profile → Integrations → Workspace ID>"
 ```
 
 3. Point your MCP client at it. For Claude Desktop, Cursor and most clients, add to
@@ -82,7 +96,7 @@ export PLEAXY_WORKSPACE_ID="<Company profile → Workspace ID>"
       "env": {
         "PLEAXY_API_BASE_URL": "https://api.pleaxy.ai",
         "PLEAXY_API_KEY": "<keyId>.<secret>",
-        "PLEAXY_WORKSPACE_ID": "<Company profile → Workspace ID>"
+        "PLEAXY_WORKSPACE_ID": "<Company profile → Integrations → Workspace ID>"
       }
     }
   }
@@ -114,6 +128,8 @@ REST API refuses them.
 | `reject_purchase_order` | Buyer | `POST .../purchase-orders/:poId/reject` |
 | `flip_purchase_order_to_invoice` | Supplier | `POST .../purchase-orders/:poId/flip-to-invoice` |
 | `list_purchase_requests` | Buyer | `GET .../purchase-requests` |
+| `list_request_types` | Buyer | `GET .../request-types` |
+| `get_request_type` | Buyer | `GET .../request-types/:typeId` |
 | `get_purchase_request` | Buyer | `GET .../purchase-requests/:requestId` |
 | `create_purchase_request` | Buyer | `POST .../purchase-requests` (any member may ask) |
 | `submit_purchase_request` | Buyer | `POST .../purchase-requests/:requestId/submit` |
@@ -121,6 +137,21 @@ REST API refuses them.
 | `convert_purchase_request` | Buyer | `POST .../purchase-requests/:requestId/convert` (API key only; refused signed in) |
 | `check_budget` | Buyer | `POST .../budget-control/check` |
 | `get_budget_status` | Buyer | `GET .../budget-control/status` |
+| `get_ai_spend` | Buyer | `GET .../ai-spend` |
+| `list_ai_usage_lines` | Buyer | `GET .../ai-spend/lines` |
+| `list_ai_rate_cards` | Buyer | `GET .../ai-rate-cards` |
+| `check_ai_spend` | Buyer | `POST .../ai-spend/check` |
+| `list_ai_providers` | Buyer | `GET .../ai-providers` |
+| `get_ai_po_lines` | Buyer | `GET .../ai-spend/po-lines` |
+| `get_ai_recommendations` | Buyer | `GET .../ai-spend/recommendations` |
+| `draft_spend_orders` | Buyer | `POST .../ai-spend/draft-orders` |
+| `list_ai_commitments` | Buyer | `GET .../ai-spend/commitments` |
+| `get_ai_attribution` | Buyer | `GET .../ai-spend/attribution` |
+| `list_ai_cost_centers` | Buyer | `GET .../ai-spend/cost-centers` |
+| `list_ai_spend_limits` | Buyer | `GET .../ai-spend/limits` |
+| `list_ai_seat_counts` | Buyer | `GET .../ai-spend/seats` |
+| `record_ai_seat_count` | Buyer | `PUT .../ai-spend/seats` |
+| `set_ai_spend_limit` | Buyer | `PUT .../ai-spend/limits/:poId/:lineNo` (signed in: an agent request the user confirms) |
 | `list_receipts` | Both | `GET .../purchase-orders/:poId/receipts` |
 | `confirm_receipt` | Buyer | `POST .../purchase-orders/:poId/receipts` |
 | `submit_service_entry_sheet` | Supplier | `POST .../purchase-orders/:poId/receipts` |
@@ -128,6 +159,7 @@ REST API refuses them.
 | `approve_service_entry_sheet` | Buyer (a person; an API key gets 403) | `POST .../purchase-orders/:poId/receipts/:receiptId/approve` |
 | `reject_service_entry_sheet` | Buyer (a person; an API key gets 403) | `POST .../purchase-orders/:poId/receipts/:receiptId/reject` |
 | `list_invoices` | Both | `GET /v1/workspaces/:regionId/invoices` |
+| `list_payments` | Both | `GET /v1/workspaces/:regionId/payments` |
 | `get_invoice` | Both | `GET .../invoices/:invoiceId` |
 | `link_replaced_invoices` | Buyer | `POST .../invoices/:invoiceId/replaces` |
 | `unlink_replaced_invoice` | Buyer | `DELETE .../invoices/:invoiceId/replaces/:replacedInvoiceId` |
@@ -137,11 +169,32 @@ REST API refuses them.
 | `reject_invoice` | Buyer | `POST .../invoices/:invoiceId/reject` |
 | `record_payment` | Buyer | `POST .../invoices/:invoiceId/payment-record` (needs a signed-in person: an API key gets 403) |
 | `remind_invoice` | Supplier | `POST .../invoices/:invoiceId/remind` |
-| `get_questionnaire` | Buyer | `GET .../questionnaire-template` |
-| `save_questionnaire` | Buyer | `PUT .../questionnaire-template` |
+| `confirm_payment_received` | Supplier | `POST .../invoices/:invoiceId/payment-received` (needs a signed-in person: an API key gets 403) |
+| `report_payment_problem` | Supplier | `POST .../invoices/:invoiceId/payment-problem` (needs a signed-in person: an API key gets 403) |
+| `list_questionnaire_templates` | Buyer | `GET .../questionnaire-templates` |
+| `get_invoice_bank_account` | Both | `GET .../invoices/:invoiceId/bank-account` |
+| `list_bank_accounts_to_approve` | Buyer | `GET .../bank-accounts/review` |
+| `list_screening_matches` | Buyer | `GET .../screening/review` |
+| `get_supplier_screening` | Buyer | `GET .../screening/suppliers/:connectionId` |
+| `list_supplier_risk` | Buyer | `GET .../supplier-risk` |
+| `get_supplier_risk` | Buyer | `GET .../supplier-risk/:connectionId` |
+| `list_credit_requests` | Buyer | `GET .../credit-requests` |
+| `get_credit_request` | Buyer | `GET .../credit-requests/:creditRequestId` |
+| `draft_credit_request` | Buyer | `POST .../credit-requests` |
+| `get_questionnaire` | Buyer | `GET .../questionnaire-template`, or `.../questionnaire-templates/:templateId` |
+| `save_questionnaire` | Buyer | `PUT .../questionnaire-template`, or `.../questionnaire-templates/:templateId` |
 | `get_agent_request` | Both, signed in | `GET .../agent-requests/:agentRequestId` |
+| `list_workspaces` | Both | `GET /v1/auth/me`: the workspaces the agent may use, with their Workspace IDs |
 | `whoami` | Both | `GET /v1/auth/me` (signed in) |
 
+The four AI spend tools read the AI service lines of the cloud accounts connected to
+the workspace (AWS, Google Cloud, Azure, OCI): what each invoicer, model vendor and
+model costs month to date and forecast, the daily lines behind it, Pleaxy's public
+rate cards, and whether a forecast fits the open purchase order lines and the budget.
+Direct AI providers (OpenAI, Anthropic), attribution to cost centers and
+`set_ai_spend_limit` (a decision, sent as an agent request when signed in) come with
+later releases of the API.
+
 An approval step names a person, which an API key can never be. So with a key,
 `approve_purchase_order`, `reject_purchase_order`, `approve_invoice` and
 `reject_invoice` never succeed and change nothing (the API refuses a key with
@@ -156,6 +209,13 @@ gets `403 HUMAN_SESSION_REQUIRED`. (It replaces `settle_invoice`, which the API
 retired with `410 SETTLE_REPLACED`.) Paying a supplier through Pleaxy with
 Stripe also needs a signed-in person and has no tool here.
 
+`confirm_payment_received` tells the buyer a paid invoice's money reached the
+supplier, which settles it; `report_payment_problem` says it didn't arrive or
+arrived with a different amount, with a note the buyer reads as written. Both are
+the supplier's own statements about money, so both need a person signed in: with
+an API key they get `403 HUMAN_SESSION_REQUIRED`, and signed in they only send an
+agent request.
+
 `save_questionnaire` replaces the whole supplier questionnaire, so an agent
 reads it with `get_questionnaire` first and sends back every field it keeps,
 ids unchanged. It needs a key whose role can edit questionnaires. Suppliers
@@ -170,6 +230,7 @@ Every tool carries MCP annotations (`readOnlyHint`, `destructiveHint`,
 `idempotentHint`, `openWorldHint`), so a client can tell reads from changes before
 it runs one. They describe the API-key mode, where a decision acts at once:
 approvals, rejections, `resolve_invoice_discrepancy`, `record_payment`,
+`confirm_payment_received`, `report_payment_problem`,
 `unlink_replaced_invoice`, `cancel_purchase_request` and `save_questionnaire` are marked
 destructive.
 
@@ -182,4 +243,5 @@ can't name a `contractId` yet; create an order under a contract in Pleaxy.
 
 ## Support
 
-Questions and problems: support@pleaxy.ai. Docs: https://pleaxy.ai/docs#agent.
+Questions and problems: support@pleaxy.ai. Docs: https://pleaxy.ai/docs/mcp (connecting an agent as yourself) and
+https://pleaxy.ai/docs#agent (API keys and every tool).

package/dist/api.js

@@ -1,5 +1,17 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { assertSafeOrigin } from "./auth/oauth.js";
 import { LOGIN_HINT, SignedInSession } from "./auth/session.js";
+const hostedCall = new AsyncLocalStorage();
+export function asHostedCall(token, fn) {
+    return hostedCall.run({ token }, fn);
+}
+function hosted() {
+    return hostedCall.getStore();
+}
+export function loginHint() {
+    return hosted() ? HOSTED_LOGIN_HINT : LOGIN_HINT;
+}
+export const HOSTED_LOGIN_HINT = "Ask the user to reconnect Pleaxy in this app's connector settings, which signs the agent in again.";
 const API_VERSION_PREFIX = "/v1";
 let cached;
 function config() {
@@ -14,9 +26,31 @@ function readConfig() {
         ...(apiKey ? { apiKey } : {}),
     };
 }
+const callWorkspace = new AsyncLocalStorage();
+export function inWorkspace(workspace, fn) {
+    return callWorkspace.run(workspace || undefined, fn);
+}
+function configuredWorkspace() {
+    return hosted() ? undefined : process.env.PLEAXY_WORKSPACE_ID || undefined;
+}
 function workspaceId() {
     config();
-    return required(process.env.PLEAXY_WORKSPACE_ID || undefined, "PLEAXY_WORKSPACE_ID");
+    return callWorkspace.getStore() ?? required(configuredWorkspace(), "PLEAXY_WORKSPACE_ID");
+}
+async function resolveWorkspace() {
+    config();
+    const named = callWorkspace.getStore() ?? configuredWorkspace();
+    if (named)
+        return named;
+    if (!isSignedIn())
+        return required(undefined, "PLEAXY_WORKSPACE_ID");
+    const me = await pleaxyAccountRequest("/auth/me");
+    const usable = (me.workspaces ?? []).filter((w) => w.workspaceId && !w.locked).map((w) => w.workspaceId);
+    if (usable.length === 1)
+        return usable[0];
+    throw new Error(usable.length === 0
+        ? `This agent can't use any workspace. ${loginHint()}`
+        : `Say which workspace: pass \`workspace\` (one of ${usable.join(", ")}; list_workspaces names them)${hosted() ? "" : ", or set PLEAXY_WORKSPACE_ID"}.`);
 }
 function required(value, name) {
     if (!value)
@@ -24,7 +58,7 @@ function required(value, name) {
     return value;
 }
 export function isSignedIn() {
-    return !config().apiKey;
+    return Boolean(hosted()) || !config().apiKey;
 }
 export function apiOrigin() {
     return assertSafeOrigin(config().baseUrl, "PLEAXY_API_BASE_URL");
@@ -35,6 +69,9 @@ function signedInSession() {
     return session;
 }
 async function authHeaders(force) {
+    const call = hosted();
+    if (call)
+        return { authorization: `Bearer ${call.token}` };
     const { apiKey } = config();
     if (apiKey)
         return { "x-api-key": apiKey };
@@ -44,7 +81,8 @@ export function pleaxyUrl(path) {
     return `${config().baseUrl}${API_VERSION_PREFIX}/workspaces/${workspaceId()}${path}`;
 }
 export async function pleaxyRequest(path, options = {}) {
-    return requestUrl(pleaxyUrl(path), path, options);
+    const workspace = await resolveWorkspace();
+    return requestUrl(`${config().baseUrl}${API_VERSION_PREFIX}/workspaces/${workspace}${path}`, path, options);
 }
 export async function pleaxyAccountRequest(path) {
     return requestUrl(`${config().baseUrl}${API_VERSION_PREFIX}${path}`, path, {});
@@ -59,11 +97,15 @@ async function requestUrl(url, path, options) {
     let data = await bodyOf(res);
     if (res.status === 401 && isSignedIn()) {
         if (data?.code === "AGENT_SESSION_REVOKED" || data?.code === "SESSION_REVOKED")
-            throw new Error(`${data.message ?? "This agent was signed out of Pleaxy."} ${LOGIN_HINT}`);
+            throw new Error(`${data.message ?? "This agent was signed out of Pleaxy."} ${loginHint()}`);
+        if (hosted())
+            throw new Error(`${data?.message ?? "Pleaxy refused the agent's sign-in."} ${HOSTED_LOGIN_HINT}`);
         res = await send(true);
         data = await bodyOf(res);
     }
     if (!res.ok) {
+        if (data?.code === "AGENT_WORKSPACE_NOT_GRANTED")
+            throw new Error(`${data.message ?? "This agent wasn't given that workspace."} ${hosted() ? "Ask the user to reconnect Pleaxy in this app's connector settings" : "Run `npx pleaxy-mcp login` again"} and tick it.`);
         const message = data?.message ?? res.statusText;
         throw new Error(`Pleaxy API ${options.method ?? "GET"} ${path} failed (${res.status}): ${message}`);
     }

package/dist/auth/credentials.js

@@ -1,6 +1,9 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+export function isCurrentSignIn(entry) {
+    return entry?.kind === "pleaxy" && typeof entry.tokenEndpoint === "string" && typeof entry.refreshToken === "string";
+}
 export function credentialsPath(env = process.env) {
     if (env.PLEAXY_MCP_CREDENTIALS)
         return env.PLEAXY_MCP_CREDENTIALS;
@@ -35,6 +38,10 @@ export class CredentialStore {
         this.path = path;
     }
     get(apiOrigin) {
+        const entry = this.entry(apiOrigin);
+        return isCurrentSignIn(entry) ? entry : undefined;
+    }
+    entry(apiOrigin) {
         return read(this.path).signIns[apiOrigin];
     }
     put(signIn) {

package/dist/auth/oauth.js

@@ -1,8 +1,10 @@
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
+import { hostname } from "node:os";
 export const CALLBACK_PORTS = [47615, 47616, 47617];
-export const SCOPES = "openid email api/agent";
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+export const PLEAXY_CLIENT_ID = "pleaxy-mcp";
+export const PLEAXY_SCOPE = "agent";
 export class SignInExpiredError extends Error {
 }
 export function base64url(buffer) {
@@ -12,12 +14,6 @@ export function pkcePair() {
     const verifier = base64url(randomBytes(32));
     return { verifier, challenge: base64url(createHash("sha256").update(verifier).digest()) };
 }
-export function claimsOf(jwt) {
-    const payload = jwt.split(".")[1];
-    if (!payload)
-        throw new Error("Malformed token");
-    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-}
 export function assertSafeOrigin(url, what) {
     const parsed = new URL(url);
     const local = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
@@ -25,16 +21,31 @@ export function assertSafeOrigin(url, what) {
         throw new Error(`${what} must be https (got ${parsed.origin})`);
     return parsed.origin;
 }
-export async function fetchAgentConfig(apiOrigin) {
-    const res = await fetch(`${apiOrigin}/v1/auth/agent-config`);
+export async function discoverPleaxyAuthServer(apiOrigin) {
+    const res = await fetch(`${apiOrigin}/.well-known/oauth-authorization-server`);
     if (res.status === 404)
-        throw new Error("This Pleaxy deployment doesn't offer agent sign-in. Use an API key (PLEAXY_API_KEY) instead.");
+        throw new Error(`Pleaxy at ${apiOrigin} doesn't offer agent sign-in (it has no /.well-known/oauth-authorization-server). Check PLEAXY_API_BASE_URL, or use an API key (PLEAXY_API_KEY) instead.`);
     if (!res.ok)
-        throw new Error(`Couldn't read the agent sign-in settings (${res.status}).`);
-    const body = (await res.json());
-    if (!body.clientId || !body.authDomain)
-        throw new Error("The agent sign-in settings are incomplete.");
-    return { clientId: body.clientId, authDomain: assertSafeOrigin(body.authDomain, "The sign-in domain") };
+        throw new Error(`Couldn't read Pleaxy's sign-in settings (${res.status}).`);
+    const meta = (await res.json());
+    if (meta.issuer !== apiOrigin)
+        throw new Error("Pleaxy's sign-in settings name another issuer.");
+    const sameOrigin = (value, what) => {
+        if (typeof value !== "string" || assertSafeOrigin(value, what) !== apiOrigin)
+            throw new Error(`Pleaxy's sign-in settings put ${what} elsewhere.`);
+        return value;
+    };
+    if (!Array.isArray(meta.code_challenge_methods_supported) || !meta.code_challenge_methods_supported.includes("S256"))
+        throw new Error("Pleaxy's sign-in doesn't offer PKCE S256.");
+    return {
+        issuer: apiOrigin,
+        authorizationEndpoint: sameOrigin(meta.authorization_endpoint, "the authorization endpoint"),
+        tokenEndpoint: sameOrigin(meta.token_endpoint, "the token endpoint"),
+        ...(meta.revocation_endpoint !== undefined ? { revocationEndpoint: sameOrigin(meta.revocation_endpoint, "the revocation endpoint") } : {}),
+    };
+}
+export function deviceName(raw = hostname()) {
+    return raw.replace(/[^A-Za-z0-9._-]/g, "").slice(0, 40) || "this-computer";
 }
 function tokenSetFrom(body, now) {
     if (typeof body.access_token !== "string")
@@ -42,13 +53,12 @@ function tokenSetFrom(body, now) {
     const expiresIn = typeof body.expires_in === "number" ? body.expires_in : 900;
     return {
         accessToken: body.access_token,
-        ...(typeof body.id_token === "string" ? { idToken: body.id_token } : {}),
         ...(typeof body.refresh_token === "string" ? { refreshToken: body.refresh_token } : {}),
         accessExpiresAt: Math.floor(now / 1000) + expiresIn,
     };
 }
 async function tokenRequest(config, form) {
-    const res = await fetch(`${config.authDomain}/oauth2/token`, {
+    const res = await fetch(config.tokenEndpoint, {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({ client_id: config.clientId, ...form }).toString(),
@@ -72,7 +82,9 @@ export async function refreshTokens(config, refreshToken, now = Date.now()) {
     return tokenSetFrom(body, now);
 }
 export async function revokeRefreshToken(config, refreshToken) {
-    const res = await fetch(`${config.authDomain}/oauth2/revoke`, {
+    if (!config.revocationEndpoint)
+        return false;
+    const res = await fetch(config.revocationEndpoint, {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({ client_id: config.clientId, token: refreshToken }).toString(),
@@ -86,79 +98,75 @@ function reply(res, status, body, headers = {}) {
 }
 async function listen(handler) {
     for (const port of CALLBACK_PORTS) {
-        const v4 = createServer(handler);
+        const server = createServer(handler);
         const bound = await new Promise((resolve) => {
-            v4.once("error", () => resolve(false));
-            v4.listen(port, "127.0.0.1", () => resolve(true));
+            server.once("error", () => resolve(false));
+            server.listen(port, "127.0.0.1", () => resolve(true));
         });
         if (!bound)
             continue;
-        const v6 = createServer(handler);
-        await new Promise((resolve) => {
-            v6.once("error", () => resolve());
-            v6.listen(port, "::1", () => resolve());
-        });
         return {
             port,
             close: () => {
-                v4.close();
-                v6.close();
-                v4.closeAllConnections?.();
-                v6.closeAllConnections?.();
+                server.close();
+                server.closeAllConnections?.();
             },
         };
     }
     throw new Error(`Ports ${CALLBACK_PORTS.join(", ")} are all in use; close whatever holds them and try again.`);
 }
-export async function signInWithBrowser(config, open, now = Date.now) {
+export async function signInWithPleaxy(server, open, now = Date.now, device = deviceName()) {
     const { verifier, challenge } = pkcePair();
     const state = base64url(randomBytes(16));
     let redirectUri = "";
-    let authorizeUrl = "";
     let settle;
     const codePromise = new Promise((resolve, reject) => (settle = { resolve, reject }));
-    const server = await listen((req, res) => {
-        const url = new URL(req.url ?? "/", "http://localhost");
-        if (url.pathname === "/signed-out")
-            return reply(res, 302, "", { location: authorizeUrl });
+    const listener = await listen((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
         if (url.pathname !== "/callback")
             return reply(res, 404, PAGE("Not found."));
         if (url.searchParams.get("state") !== state)
             return reply(res, 400, PAGE("This sign-in link is out of date. Run the sign-in again."));
+        if (url.searchParams.get("iss") !== server.issuer) {
+            reply(res, 400, PAGE("The sign-in answered from an unexpected server. Run the sign-in again."));
+            return settle.reject(new Error("The sign-in answered from an unexpected server."));
+        }
         const error = url.searchParams.get("error");
         const code = url.searchParams.get("code");
         if (error || !code) {
-            reply(res, 400, PAGE("The sign-in didn't finish. You can close this window and try again."));
-            return settle.reject(new Error(`The sign-in didn't finish${error ? ` (${error})` : ""}.`));
+            reply(res, 400, PAGE(error === "access_denied" ? "You didn't allow the agent. You can close this window." : "The sign-in didn't finish. You can close this window and try again."));
+            return settle.reject(new Error(error === "access_denied" ? "You didn't allow the agent in Pleaxy." : `The sign-in didn't finish${error ? ` (${error})` : ""}.`));
         }
-        reply(res, 200, PAGE("Your agent is signed in to Pleaxy. You can close this window."));
+        reply(res, 200, PAGE("Your agent is connected to Pleaxy. You can close this window."));
         settle.resolve(code);
     });
-    redirectUri = `http://localhost:${server.port}/callback`;
-    authorizeUrl = `${config.authDomain}/oauth2/authorize?${new URLSearchParams({
+    redirectUri = `http://127.0.0.1:${listener.port}/callback`;
+    const config = { clientId: PLEAXY_CLIENT_ID, issuer: server.issuer, tokenEndpoint: server.tokenEndpoint, ...(server.revocationEndpoint ? { revocationEndpoint: server.revocationEndpoint } : {}) };
+    const authorizeUrl = `${server.authorizationEndpoint}?${new URLSearchParams({
         response_type: "code",
-        client_id: config.clientId,
+        client_id: PLEAXY_CLIENT_ID,
         redirect_uri: redirectUri,
-        scope: SCOPES,
+        scope: PLEAXY_SCOPE,
         state,
         code_challenge: challenge,
         code_challenge_method: "S256",
+        resource: server.issuer,
+        device_name: device,
     }).toString()}`;
-    const startUrl = `${config.authDomain}/logout?${new URLSearchParams({ client_id: config.clientId, logout_uri: `http://localhost:${server.port}/signed-out` }).toString()}`;
     const timer = setTimeout(() => settle.reject(new Error("The sign-in took longer than 5 minutes. Run it again.")), LOGIN_TIMEOUT_MS);
     try {
-        open(startUrl);
+        open(authorizeUrl);
         const code = await codePromise;
-        const { status, body } = await tokenRequest(config, { grant_type: "authorization_code", code, redirect_uri: redirectUri, code_verifier: verifier });
+        const { status, body } = await tokenRequest(config, { grant_type: "authorization_code", code, redirect_uri: redirectUri, code_verifier: verifier, resource: server.issuer });
         if (status !== 200)
             throw new Error(`The sign-in couldn't be completed (${status}${typeof body.error === "string" ? `: ${body.error}` : ""}).`);
         const tokens = tokenSetFrom(body, now());
         if (!tokens.refreshToken)
             throw new Error("The sign-in answered without a refresh token.");
-        return tokens;
+        return { ...tokens, config };
     }
     finally {
         clearTimeout(timer);
-        server.close();
+        listener.close();
     }
 }

package/dist/auth/session.js

@@ -1,5 +1,13 @@
 import { CredentialStore } from "./credentials.js";
 import { refreshTokens, SignInExpiredError } from "./oauth.js";
+export function configOf(signIn) {
+    return {
+        clientId: signIn.clientId,
+        issuer: signIn.issuer,
+        tokenEndpoint: signIn.tokenEndpoint,
+        ...(signIn.revocationEndpoint ? { revocationEndpoint: signIn.revocationEndpoint } : {}),
+    };
+}
 const EARLY_REFRESH_SECONDS = 60;
 export const LOGIN_HINT = "Run `npx pleaxy-mcp login` to sign the agent in again.";
 export class SignedInSession {
@@ -14,9 +22,11 @@ export class SignedInSession {
     }
     signIn() {
         const signIn = this.store.get(this.apiOrigin);
-        if (!signIn)
-            throw new SignInExpiredError(`This agent isn't signed in to Pleaxy at ${this.apiOrigin}. ${LOGIN_HINT}`);
-        return signIn;
+        if (signIn)
+            return signIn;
+        if (this.store.entry(this.apiOrigin))
+            throw new SignInExpiredError(`This agent's sign-in to Pleaxy at ${this.apiOrigin} is from an older version of pleaxy-mcp and no longer works. ${LOGIN_HINT}`);
+        throw new SignInExpiredError(`This agent isn't signed in to Pleaxy at ${this.apiOrigin}. ${LOGIN_HINT}`);
     }
     async accessToken(force = false) {
         const signIn = this.signIn();
@@ -26,15 +36,19 @@ export class SignedInSession {
         this.refreshing ??= this.refresh(signIn).finally(() => (this.refreshing = undefined));
         return this.refreshing;
     }
-    async refresh(signIn) {
+    async refresh(signIn, retried = false) {
         try {
-            const tokens = await refreshTokens({ clientId: signIn.clientId, authDomain: signIn.authDomain }, signIn.refreshToken, this.now());
+            const tokens = await refreshTokens(configOf(signIn), signIn.refreshToken, this.now());
             this.store.put({ ...signIn, refreshToken: tokens.refreshToken ?? signIn.refreshToken, accessToken: tokens.accessToken, accessExpiresAt: tokens.accessExpiresAt });
             return tokens.accessToken;
         }
         catch (err) {
-            if (err instanceof SignInExpiredError)
+            if (err instanceof SignInExpiredError) {
+                const latest = this.store.get(this.apiOrigin);
+                if (!retried && latest && latest.refreshToken !== signIn.refreshToken)
+                    return this.refresh(latest, true);
                 throw new SignInExpiredError(`The agent's sign-in to Pleaxy has ended. ${LOGIN_HINT}`);
+            }
             throw err;
         }
     }

package/dist/cli.js

@@ -1,7 +1,8 @@
 import { execFile } from "node:child_process";
 import { apiOrigin, isSignedIn, pleaxyAccountRequest } from "./api.js";
 import { CredentialStore } from "./auth/credentials.js";
-import { claimsOf, fetchAgentConfig, revokeRefreshToken, signInWithBrowser } from "./auth/oauth.js";
+import { discoverPleaxyAuthServer, revokeRefreshToken, signInWithPleaxy } from "./auth/oauth.js";
+import { configOf } from "./auth/session.js";
 export const CLI_COMMANDS = new Set(["login", "logout", "whoami"]);
 const say = (line) => process.stderr.write(`${line}\n`);
 function openBrowser(url) {
@@ -11,19 +12,20 @@ function openBrowser(url) {
 }
 async function login(store) {
     const origin = apiOrigin();
-    const config = await fetchAgentConfig(origin);
-    const tokens = await signInWithBrowser(config, openBrowser);
-    const email = tokens.idToken ? claimsOf(tokens.idToken).email : undefined;
+    const pleaxy = await discoverPleaxyAuthServer(origin);
+    const tokens = await signInWithPleaxy(pleaxy, openBrowser);
     store.put({
         apiOrigin: origin,
-        clientId: config.clientId,
-        authDomain: config.authDomain,
+        kind: "pleaxy",
+        clientId: tokens.config.clientId,
+        issuer: pleaxy.issuer,
+        tokenEndpoint: pleaxy.tokenEndpoint,
+        ...(pleaxy.revocationEndpoint ? { revocationEndpoint: pleaxy.revocationEndpoint } : {}),
         refreshToken: tokens.refreshToken,
         accessToken: tokens.accessToken,
         accessExpiresAt: tokens.accessExpiresAt,
-        ...(typeof email === "string" ? { email } : {}),
     });
-    say(`Signed in to Pleaxy at ${origin}${typeof email === "string" ? ` as ${email}` : ""}.`);
+    say(`Connected to Pleaxy at ${origin}.`);
     await whoami();
     return 0;
 }
@@ -31,10 +33,15 @@ async function logout(store) {
     const origin = apiOrigin();
     const signIn = store.get(origin);
     if (!signIn) {
-        say(`This agent isn't signed in to Pleaxy at ${origin}.`);
+        if (store.entry(origin)) {
+            store.delete(origin);
+            say(`Removed an old sign-in to Pleaxy at ${origin} from this machine.`);
+        }
+        else
+            say(`This agent isn't signed in to Pleaxy at ${origin}.`);
         return 0;
     }
-    const revoked = await revokeRefreshToken({ clientId: signIn.clientId, authDomain: signIn.authDomain }, signIn.refreshToken);
+    const revoked = await revokeRefreshToken(configOf(signIn), signIn.refreshToken);
     store.delete(origin);
     say(revoked ? `Signed out of Pleaxy at ${origin}.` : `Signed out on this machine. Pleaxy couldn't be reached to end the sign-in there too: sign the agent out in Pleaxy, under Security & Sign-in → Agents.`);
     return 0;
@@ -46,10 +53,11 @@ async function whoami() {
     }
     const me = await pleaxyAccountRequest("/auth/me");
     const who = me.employee?.name ?? me.employee?.email ?? "you";
-    say(`Acting as ${who}${me.agentSession ? `, signed in ${me.agentSession.signedInAt}` : ""}.`);
+    const until = me.agentSession?.expiresAt ? `, connected until ${me.agentSession.expiresAt}` : "";
+    say(`Acting as ${who}${me.agentSession ? `, signed in ${me.agentSession.signedInAt}${until}` : ""}.`);
     const workspaces = me.workspaces ?? [];
     if (workspaces.length) {
-        say("Workspaces it can reach (set one as PLEAXY_WORKSPACE_ID):");
+        say("Workspaces it can use (tools take one per call; PLEAXY_WORKSPACE_ID sets a default):");
         for (const w of workspaces) {
             const name = w.companyName ?? w.regionName;
             const locked = w.locked ? `  - not reachable by an agent (${w.locked.reason ?? "locked"})` : "";

package/dist/purchase-order-shape.js

@@ -22,10 +22,16 @@ export const lineItemShape = {
         .describe('e.g. "Net 30". Omit it unless the user gave terms: the line then takes the default payment terms of the contract it falls under (contractId, or the contract its catalog price came from), else the catalog item\'s, else "Net 30".'),
     validFrom: z.string(),
     validUntil: z.string(),
-    customerLineNo: z.string().max(40).optional().describe("Optional: the buyer's own number for this line (e.g. from their ERP), up to 40 letters, numbers, spaces, or . _ - /."),
+    customerLineNo: z
+        .string()
+        .max(40)
+        .optional()
+        .describe("Optional: the buyer's own number for this line (e.g. from their ERP), up to 40 letters, numbers, spaces, or . _ - /."),
 };
 export const createPurchaseOrderShape = {
-    supplier: z.string().describe("The supplier/counterparty you're purchasing from, e.g. \"aws\""),
+    supplier: z
+        .string()
+        .describe('The supplier/counterparty you\'re purchasing from, e.g. "aws"'),
     supplierRegionId: z
         .string()
         .optional()
@@ -34,6 +40,15 @@ export const createPurchaseOrderShape = {
     billTo: z.string().optional(),
     costCenter: z.string().optional(),
     budgetOwner: z.string().optional(),
+    blanket: z
+        .boolean()
+        .optional()
+        .describe("A blanket order: billed as used, up to its total (a subscription, support hours, a reseller's monthly licences). Its total never uses the cost center's budget at once; expectedMonthly does, month by month, and its invoices as they are approved. Cloud orders (provider) are blanket orders either way. Only when the user says so."),
+    expectedMonthly: z
+        .number()
+        .min(0)
+        .optional()
+        .describe("Only on a blanket or cloud order, when the user gives it: what it is expected to bill each month, in the order's currency. The cost center's budget reserves it each month until invoiced."),
     notes: z.string().optional(),
     contractId: z
         .string()