pulsemcp-cms-admin-mcp-server 0.10.3 → 0.10.6

package/shared/server.js

@@ -51,6 +51,9 @@ import { getRedirect } from './pulsemcp-admin-client/lib/get-redirect.js';
 import { createRedirect } from './pulsemcp-admin-client/lib/create-redirect.js';
 import { updateRedirect } from './pulsemcp-admin-client/lib/update-redirect.js';
 import { deleteRedirect } from './pulsemcp-admin-client/lib/delete-redirect.js';
+import { getSecret } from './pulsemcp-admin-client/lib/get-secret.js';
+import { createSecret } from './pulsemcp-admin-client/lib/create-secret.js';
+import { linkSecretToServer } from './pulsemcp-admin-client/lib/link-secret-to-server.js';
 import { getGoodJobs } from './pulsemcp-admin-client/lib/get-good-jobs.js';
 import { getGoodJob } from './pulsemcp-admin-client/lib/get-good-job.js';
 import { getGoodJobCronSchedules } from './pulsemcp-admin-client/lib/get-good-job-cron-schedules.js';
@@ -74,6 +77,7 @@ import { getMozBacklinks } from './pulsemcp-admin-client/lib/get-moz-backlinks.j
 import { getMozStoredMetrics } from './pulsemcp-admin-client/lib/get-moz-stored-metrics.js';
 import { recacheMCPServer } from './pulsemcp-admin-client/lib/recache-mcp-server.js';
 import { setKnownMissingInitToolsList } from './pulsemcp-admin-client/lib/set-known-missing-init-tools-list.js';
+import { setGithubRepositoryClassification } from './pulsemcp-admin-client/lib/set-github-repository-classification.js';
 import { createTenant } from './pulsemcp-admin-client/lib/create-tenant.js';
 import { createApiKey } from './pulsemcp-admin-client/lib/create-api-key.js';
 import { deleteTenant } from './pulsemcp-admin-client/lib/delete-tenant.js';
@@ -250,6 +254,9 @@ export class PulseMCPAdminClient {
     async setKnownMissingInitToolsList(id, knownMissingInitToolsList, knownMissingInitToolsListFilterTo) {
         return setKnownMissingInitToolsList(this.apiKey, this.baseUrl, id, knownMissingInitToolsList, knownMissingInitToolsListFilterTo);
     }
+    async setGithubRepositoryClassification(id, classification) {
+        return setGithubRepositoryClassification(this.apiKey, this.baseUrl, id, classification);
+    }
     // Redirect REST API methods
     async getRedirects(params) {
         return getRedirects(this.apiKey, this.baseUrl, params);
@@ -266,6 +273,16 @@ export class PulseMCPAdminClient {
     async deleteRedirect(id) {
         return deleteRedirect(this.apiKey, this.baseUrl, id);
     }
+    // Secret REST API methods
+    async getSecret(idOrSlug) {
+        return getSecret(this.apiKey, this.baseUrl, idOrSlug);
+    }
+    async createSecret(params) {
+        return createSecret(this.apiKey, this.baseUrl, params);
+    }
+    async linkSecretToServer(params) {
+        return linkSecretToServer(this.apiKey, this.baseUrl, params);
+    }
     // GoodJob REST API methods
     async getGoodJobs(params) {
         return getGoodJobs(this.apiKey, this.baseUrl, params);

package/shared/tools/link-secret-to-mcp-server.d.ts

@@ -0,0 +1,50 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { ClientFactory } from '../server.js';
+export declare function linkSecretToMcpServer(_server: Server, clientFactory: ClientFactory): {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            slug: {
+                type: string;
+                description: "Unique slug identifier for the secret (lowercase, hyphenated, e.g. \"linear-api-key\"). Used to look up an existing secret or to create a new one.";
+            };
+            onepassword_item_id: {
+                type: string;
+                description: "The 1Password item reference the secret value lives in (e.g. \"op://Vault/Item/credential\"). The raw secret value is NEVER passed through this tool — only this reference. If a secret with this slug already exists, this must match its stored reference.";
+            };
+            mcp_server_slug: {
+                type: string;
+                description: "Slug of the MCP server to grant the secret to (e.g. \"linear\"). The link is what Proctor reads to inject the secret value when running that server.";
+            };
+            title: {
+                type: string;
+                description: "Optional human-readable title for the secret (only used when creating a new secret).";
+            };
+            description: {
+                type: string;
+                description: "Optional description of what the secret is for (only used when creating a new secret).";
+            };
+            onepassword_tag: {
+                type: string;
+                description: "Optional tag scoping which field of the 1Password item to inject for this server (e.g. \"production\"). Stored on the server↔secret link, so the same secret can inject different fields per server.";
+            };
+        };
+        required: string[];
+    };
+    handler: (args: unknown) => Promise<{
+        content: {
+            type: string;
+            text: string;
+        }[];
+        isError: boolean;
+    } | {
+        content: {
+            type: string;
+            text: string;
+        }[];
+        isError?: undefined;
+    }>;
+};
+//# sourceMappingURL=link-secret-to-mcp-server.d.ts.map

package/shared/tools/link-secret-to-mcp-server.js

@@ -0,0 +1,140 @@
+import { z } from 'zod';
+const PARAM_DESCRIPTIONS = {
+    slug: 'Unique slug identifier for the secret (lowercase, hyphenated, e.g. "linear-api-key"). Used to look up an existing secret or to create a new one.',
+    onepassword_item_id: 'The 1Password item reference the secret value lives in (e.g. "op://Vault/Item/credential"). The raw secret value is NEVER passed through this tool — only this reference. If a secret with this slug already exists, this must match its stored reference.',
+    mcp_server_slug: 'Slug of the MCP server to grant the secret to (e.g. "linear"). The link is what Proctor reads to inject the secret value when running that server.',
+    title: 'Optional human-readable title for the secret (only used when creating a new secret).',
+    description: 'Optional description of what the secret is for (only used when creating a new secret).',
+    onepassword_tag: 'Optional tag scoping which field of the 1Password item to inject for this server (e.g. "production"). Stored on the server↔secret link, so the same secret can inject different fields per server.',
+};
+const LinkSecretToMcpServerSchema = z.object({
+    slug: z.string().describe(PARAM_DESCRIPTIONS.slug),
+    onepassword_item_id: z.string().describe(PARAM_DESCRIPTIONS.onepassword_item_id),
+    mcp_server_slug: z.string().describe(PARAM_DESCRIPTIONS.mcp_server_slug),
+    title: z.string().optional().describe(PARAM_DESCRIPTIONS.title),
+    description: z.string().optional().describe(PARAM_DESCRIPTIONS.description),
+    onepassword_tag: z.string().optional().describe(PARAM_DESCRIPTIONS.onepassword_tag),
+});
+export function linkSecretToMcpServer(_server, clientFactory) {
+    return {
+        name: 'link_secret_to_mcp_server',
+        description: `Make an auth secret available to an MCP server. This upserts a Secret (by slug) that references a 1Password item, then writes the server↔secret link that Proctor reads to inject the secret value at runtime.
+
+The raw secret value stays in 1Password — this tool only deals in the 1Password item reference ("onepassword_item_id") and slug, never a credential value.
+
+Behavior:
+- If no secret with "slug" exists, it is created from "onepassword_item_id" (plus optional title/description).
+- If a secret with "slug" already exists, it is reused. Its stored "onepassword_item_id" must match the one you pass, otherwise the tool errors instead of silently rebinding a shared secret.
+- The link is idempotent: re-running for an already-linked server updates the "onepassword_tag" (when provided) without creating a duplicate.
+
+Example request:
+{
+  "slug": "linear-api-key",
+  "onepassword_item_id": "op://Shared/Linear API Key/credential",
+  "mcp_server_slug": "linear",
+  "onepassword_tag": "production"
+}
+
+Use cases:
+- Onboarding an auth-gated MCP server: register its credential reference and scope it to the server so Proctor can run it.
+- Granting an already-registered secret to an additional server.`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                slug: { type: 'string', description: PARAM_DESCRIPTIONS.slug },
+                onepassword_item_id: {
+                    type: 'string',
+                    description: PARAM_DESCRIPTIONS.onepassword_item_id,
+                },
+                mcp_server_slug: { type: 'string', description: PARAM_DESCRIPTIONS.mcp_server_slug },
+                title: { type: 'string', description: PARAM_DESCRIPTIONS.title },
+                description: { type: 'string', description: PARAM_DESCRIPTIONS.description },
+                onepassword_tag: { type: 'string', description: PARAM_DESCRIPTIONS.onepassword_tag },
+            },
+            required: ['slug', 'onepassword_item_id', 'mcp_server_slug'],
+        },
+        handler: async (args) => {
+            const validatedArgs = LinkSecretToMcpServerSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const existing = await client.getSecret(validatedArgs.slug);
+                if (existing && existing.onepassword_item_id !== validatedArgs.onepassword_item_id) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `Error: a secret with slug "${validatedArgs.slug}" already exists but references a different 1Password item ` +
+                                    `("${existing.onepassword_item_id}", not "${validatedArgs.onepassword_item_id}"). ` +
+                                    `Refusing to rebind it, since other servers may depend on it. ` +
+                                    `Use a different slug, or update the existing secret explicitly if the reference really changed.`,
+                            },
+                        ],
+                        isError: true,
+                    };
+                }
+                let created = false;
+                if (!existing) {
+                    try {
+                        await client.createSecret({
+                            slug: validatedArgs.slug,
+                            onepassword_item_id: validatedArgs.onepassword_item_id,
+                            title: validatedArgs.title,
+                            description: validatedArgs.description,
+                        });
+                    }
+                    catch (createError) {
+                        // The backend also enforces uniqueness on onepassword_item_id, so the
+                        // item may already be registered under a *different* slug than the one
+                        // requested. getSecret(slug) can't surface that (it looks up by slug),
+                        // so translate the opaque uniqueness 422 into actionable guidance
+                        // instead of letting the raw validation message reach the agent.
+                        const message = createError instanceof Error ? createError.message : String(createError);
+                        if (/onepassword item/i.test(message) && /taken/i.test(message)) {
+                            return {
+                                content: [
+                                    {
+                                        type: 'text',
+                                        text: `Error: the 1Password item "${validatedArgs.onepassword_item_id}" is already registered under a different secret slug, ` +
+                                            `so it cannot be created again as "${validatedArgs.slug}". ` +
+                                            `To link it to "${validatedArgs.mcp_server_slug}", re-run this tool with the existing secret's slug ` +
+                                            `(find it via the secrets list), or register a different 1Password item under "${validatedArgs.slug}".`,
+                                    },
+                                ],
+                                isError: true,
+                            };
+                        }
+                        throw createError;
+                    }
+                    created = true;
+                }
+                const result = await client.linkSecretToServer({
+                    secret: validatedArgs.slug,
+                    mcp_server_slug: validatedArgs.mcp_server_slug,
+                    onepassword_tag: validatedArgs.onepassword_tag,
+                });
+                let content = `Successfully linked secret "${result.slug}" to MCP server "${result.link.mcp_server_slug}".\n\n`;
+                content += `**Secret:** ${result.slug} (id ${result.id}) — ${created ? 'created' : 'reused existing'}\n`;
+                content += `**1Password item:** ${result.onepassword_item_id}\n`;
+                content += `**Linked server:** ${result.link.mcp_server_slug} (id ${result.link.mcp_server_id})\n`;
+                if (result.link.onepassword_tag) {
+                    content += `**1Password tag:** ${result.link.onepassword_tag}\n`;
+                }
+                if (result.mcp_server_slugs && result.mcp_server_slugs.length > 0) {
+                    content += `**All servers using this secret:** ${result.mcp_server_slugs.join(', ')}\n`;
+                }
+                return { content: [{ type: 'text', text: content }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error linking secret to MCP server: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/shared/tools/set-github-repository-classification.d.ts

@@ -0,0 +1,41 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { ClientFactory } from '../server.js';
+export declare function setGithubRepositoryClassification(_server: Server, clientFactory: ClientFactory): {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            id: {
+                type: string;
+                description: "The integer id of the GitHub repository record (github_repositories.id).";
+            };
+            classification: {
+                type: string;
+                enum: ("other" | "single_mcp_server" | "single_mcp_client" | "multiple_mcp_servers" | "multiple_mcp_clients")[];
+                description: `The classification to set on the GitHub repository. One of: ${string}.
+
+- single_mcp_server: the repo is a single MCP server (counts toward the gh_stars popularity path).
+- single_mcp_client: the repo is a single MCP client.
+- multiple_mcp_servers: the repo hosts multiple MCP servers.
+- multiple_mcp_clients: the repo hosts multiple MCP clients.
+- other: NOT a single MCP server (e.g. a broader platform where MCP is one incidental feature). Setting "other" excludes the repo from the gh_stars popularity path \u2014 int_github_repositories.sql maps it to mcp_server_count = 0, dropping it from the normalized downloads estimate.`;
+            };
+        };
+        required: string[];
+    };
+    handler: (args: unknown) => Promise<{
+        content: {
+            type: string;
+            text: string;
+        }[];
+        isError?: undefined;
+    } | {
+        content: {
+            type: string;
+            text: string;
+        }[];
+        isError: boolean;
+    }>;
+};
+//# sourceMappingURL=set-github-repository-classification.d.ts.map

package/shared/tools/set-github-repository-classification.js

@@ -0,0 +1,73 @@
+import { z } from 'zod';
+const CLASSIFICATION_VALUES = [
+    'single_mcp_server',
+    'single_mcp_client',
+    'multiple_mcp_servers',
+    'multiple_mcp_clients',
+    'other',
+];
+const PARAM_DESCRIPTIONS = {
+    id: 'The integer id of the GitHub repository record (github_repositories.id).',
+    classification: `The classification to set on the GitHub repository. One of: ${CLASSIFICATION_VALUES.join(', ')}.
+
+- single_mcp_server: the repo is a single MCP server (counts toward the gh_stars popularity path).
+- single_mcp_client: the repo is a single MCP client.
+- multiple_mcp_servers: the repo hosts multiple MCP servers.
+- multiple_mcp_clients: the repo hosts multiple MCP clients.
+- other: NOT a single MCP server (e.g. a broader platform where MCP is one incidental feature). Setting "other" excludes the repo from the gh_stars popularity path — int_github_repositories.sql maps it to mcp_server_count = 0, dropping it from the normalized downloads estimate.`,
+};
+const SetGithubRepositoryClassificationSchema = z.object({
+    id: z.number().int().describe(PARAM_DESCRIPTIONS.id),
+    classification: z.enum(CLASSIFICATION_VALUES).describe(PARAM_DESCRIPTIONS.classification),
+});
+export function setGithubRepositoryClassification(_server, clientFactory) {
+    return {
+        name: 'set_github_repository_classification',
+        description: `Set the \`classification\` field on a GitHub repository record (github_repositories). Identifies the repository by its integer id.
+
+The primary use case is tagging a repository as \`other\` ("not a single MCP server") so it stops inflating PulseMCP popularity estimates. When a broad platform repo (e.g. heyputer/puter) carries a large GitHub-star count, the gh_stars path overstates MCP adoption; setting \`classification: "other"\` drops the repo out of that path (int_github_repositories.sql maps "other" to mcp_server_count = 0). The corrected estimate propagates on the next BigQuery warehouse rebuild and the subsequent UpdatePopularityEstimatesFromBigqueryJob run.
+
+Example request:
+{
+  "id": 12345,
+  "classification": "other"
+}
+
+Use cases:
+- Tag a non-MCP-driven platform repo as "other" to exclude it from gh_stars-based popularity
+- Correct a misclassified repository (e.g. a client repo tagged as a server)`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: { type: 'integer', description: PARAM_DESCRIPTIONS.id },
+                classification: {
+                    type: 'string',
+                    enum: [...CLASSIFICATION_VALUES],
+                    description: PARAM_DESCRIPTIONS.classification,
+                },
+            },
+            required: ['id', 'classification'],
+        },
+        handler: async (args) => {
+            const validatedArgs = SetGithubRepositoryClassificationSchema.parse(args);
+            const client = clientFactory();
+            try {
+                const result = await client.setGithubRepositoryClassification(validatedArgs.id, validatedArgs.classification);
+                const text = `Updated GitHub repository (id: ${result.id}):
+- classification: ${result.classification}`;
+                return { content: [{ type: 'text', text }] };
+            }
+            catch (error) {
+                return {
+                    content: [
+                        {
+                            type: 'text',
+                            text: `Error setting github_repository classification: ${error instanceof Error ? error.message : String(error)}`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        },
+    };
+}

package/shared/tools.d.ts

@@ -23,13 +23,14 @@ import { ClientFactory } from './server.js';
  * - mcp_jsons / mcp_jsons_readonly: MCP JSON configuration tools
  * - mcp_servers / mcp_servers_readonly: Unified MCP server tools (abstracted interface)
  * - redirects / redirects_readonly: URL redirect management tools
+ * - secrets: Auth-secret tools (link_secret_to_mcp_server). Upserts a Secret referencing a 1Password item and writes the mcp_servers_secrets join Proctor reads to inject the value. Write-only, so there is no _readonly variant.
  * - good_jobs / good_jobs_readonly: GoodJob background job management tools
  * - proctor / proctor_readonly: Proctor exam execution and result storage tools. The readonly variant includes get_exam_result, list_proctor_runs, and get_proctor_metadata for retrieving stored results and metadata without running exams or saving
  * - discovered_urls / discovered_urls_readonly: Discovered URL management tools for processing URLs into MCP implementations
  * - moz / moz_readonly: MOZ SEO metrics tools (live URL metrics, backlinks, stored historical data)
  * - notifications: Notification email tools (send_impl_posted_notif). Separated from server_directory so notification capability can be granted independently.
  */
-export type ToolGroup = 'newsletter' | 'newsletter_readonly' | 'server_directory' | 'server_directory_readonly' | 'official_queue' | 'official_queue_readonly' | 'unofficial_mirrors' | 'unofficial_mirrors_readonly' | 'official_mirrors' | 'official_mirrors_readonly' | 'tenants' | 'tenants_readonly' | 'tenants_destructive' | 'mcp_jsons' | 'mcp_jsons_readonly' | 'mcp_servers' | 'mcp_servers_readonly' | 'redirects' | 'redirects_readonly' | 'good_jobs' | 'good_jobs_readonly' | 'proctor' | 'proctor_readonly' | 'discovered_urls' | 'discovered_urls_readonly' | 'moz' | 'moz_readonly' | 'notifications';
+export type ToolGroup = 'newsletter' | 'newsletter_readonly' | 'server_directory' | 'server_directory_readonly' | 'official_queue' | 'official_queue_readonly' | 'unofficial_mirrors' | 'unofficial_mirrors_readonly' | 'official_mirrors' | 'official_mirrors_readonly' | 'tenants' | 'tenants_readonly' | 'tenants_destructive' | 'mcp_jsons' | 'mcp_jsons_readonly' | 'mcp_servers' | 'mcp_servers_readonly' | 'redirects' | 'redirects_readonly' | 'secrets' | 'good_jobs' | 'good_jobs_readonly' | 'proctor' | 'proctor_readonly' | 'discovered_urls' | 'discovered_urls_readonly' | 'moz' | 'moz_readonly' | 'notifications';
 /**
  * Parse enabled tool groups from environment variable or parameter
  * @param enabledGroupsParam - Comma-separated list of tool groups (e.g., "newsletter,server_directory_readonly")

package/shared/tools.js

@@ -48,12 +48,15 @@ import { listMCPServers } from './tools/list-mcp-servers.js';
 import { getMCPServer } from './tools/get-mcp-server.js';
 import { updateMCPServer } from './tools/update-mcp-server.js';
 import { recacheMCPServer } from './tools/recache-mcp-server.js';
+import { setGithubRepositoryClassification } from './tools/set-github-repository-classification.js';
 // Redirect tools
 import { getRedirects } from './tools/get-redirects.js';
 import { getRedirect } from './tools/get-redirect.js';
 import { createRedirect } from './tools/create-redirect.js';
 import { updateRedirect } from './tools/update-redirect.js';
 import { deleteRedirect } from './tools/delete-redirect.js';
+// Secret tools
+import { linkSecretToMcpServer } from './tools/link-secret-to-mcp-server.js';
 // GoodJob tools
 import { listGoodJobs } from './tools/list-good-jobs.js';
 import { getGoodJob } from './tools/get-good-job.js';
@@ -253,6 +256,8 @@ const ALL_TOOLS = [
     { factory: createRedirect, groups: ['redirects'], isWriteOperation: true },
     { factory: updateRedirect, groups: ['redirects'], isWriteOperation: true },
     { factory: deleteRedirect, groups: ['redirects'], isWriteOperation: true },
+    // Secret tools (write-only: upsert a secret + write the mcp_servers_secrets join Proctor reads)
+    { factory: linkSecretToMcpServer, groups: ['secrets'], isWriteOperation: true },
     // GoodJob tools
     { factory: listGoodJobs, groups: ['good_jobs'], isWriteOperation: false },
     { factory: getGoodJob, groups: ['good_jobs'], isWriteOperation: false },
@@ -281,6 +286,16 @@ const ALL_TOOLS = [
         groups: ['mcp_servers', 'server_directory'],
         isWriteOperation: true,
     },
+    // setGithubRepositoryClassification writes the `classification` field on a
+    // `github_repository` record (e.g. tagging a non-MCP-driven platform repo as
+    // `other` so it drops out of the gh_stars popularity path). It lives in the
+    // mcp_servers / server_directory groups alongside the other server-directory
+    // data-correction tools.
+    {
+        factory: setGithubRepositoryClassification,
+        groups: ['mcp_servers', 'server_directory'],
+        isWriteOperation: true,
+    },
     // Discovered URLs tools
     { factory: listDiscoveredUrls, groups: ['discovered_urls'], isWriteOperation: false },
     {
@@ -317,6 +332,7 @@ const VALID_TOOL_GROUPS = [
     'mcp_servers_readonly',
     'redirects',
     'redirects_readonly',
+    'secrets',
     'good_jobs',
     'good_jobs_readonly',
     'proctor',
@@ -340,6 +356,7 @@ const BASE_TOOL_GROUPS = [
     'mcp_jsons',
     'mcp_servers',
     'redirects',
+    'secrets',
     'good_jobs',
     'proctor',
     'discovered_urls',

package/shared/types.d.ts

@@ -676,6 +676,37 @@ export interface UpdateRedirectParams {
     to?: string;
     status?: RedirectStatus;
 }
+export interface Secret {
+    id: number;
+    slug: string;
+    onepassword_item_id: string;
+    title?: string | null;
+    description?: string | null;
+    mcp_servers_count?: number;
+    mcp_server_slugs?: string[];
+    created_at?: string;
+    updated_at?: string;
+}
+export interface CreateSecretParams {
+    slug: string;
+    onepassword_item_id: string;
+    title?: string;
+    description?: string;
+}
+export interface SecretServerLink {
+    mcp_server_id: number;
+    mcp_server_slug: string;
+    onepassword_tag?: string | null;
+}
+export interface LinkSecretToServerParams {
+    secret: string | number;
+    mcp_server_id?: number;
+    mcp_server_slug?: string;
+    onepassword_tag?: string;
+}
+export interface SecretWithLink extends Secret {
+    link: SecretServerLink;
+}
 export type GoodJobStatus = 'scheduled' | 'queued' | 'running' | 'succeeded' | 'failed' | 'discarded';
 export interface GoodJob {
     id: string;
@@ -897,6 +928,11 @@ export interface SetKnownMissingInitToolsListResponse {
     known_missing_init_tools_list: boolean;
     known_missing_init_tools_list_filter_to: string | null;
 }
+export type GithubRepositoryClassification = 'single_mcp_server' | 'single_mcp_client' | 'multiple_mcp_servers' | 'multiple_mcp_clients' | 'other';
+export interface SetGithubRepositoryClassificationResponse {
+    id: number;
+    classification: GithubRepositoryClassification;
+}
 export interface PopularityDropBypassStatus {
     enabled: boolean;
     enabled_at: string | null;