platformmcp

package
v0.0.0-...-e9baacc Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 12, 2026 License: AGPL-3.0 Imports: 117 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	AccessReadsConnectionLimitName   = "platform-mcp-access-reads-connection"
	AccessReadsOrganizationLimitName = "platform-mcp-access-reads-organization"

	AccessReadQueriesPerConnectionPerMinute   = 30
	AccessReadQueriesPerOrganizationPerMinute = 300
)
View Source 
const (
	DiagnosticsConnectionLimitName   = "platform-mcp-diagnostics-connection"
	DiagnosticsOrganizationLimitName = "platform-mcp-diagnostics-organization"
)
View Source 
const (
	SensitiveDiagnosticsConnectionLimitName   = "platform-mcp-sensitive-diagnostics-connection"
	SensitiveDiagnosticsOrganizationLimitName = "platform-mcp-sensitive-diagnostics-organization"
	DrilldownRowsLimitName                    = "platform-mcp-drilldown-rows"
	DrilldownMetricQueriesLimitName           = "platform-mcp-drilldown-metric-queries"
)
View Source 
const (
	SubjectStateActive         = "active"
	SubjectStateInactive       = "inactive"
	SubjectStateNoObservations = "no_observations"
)

Subject state categories. Closed vocabulary, assigned server-side: a category is the whole answer, so there is no count to reconstruct an individual's activity pattern from.

View Source 
const (
	ConnectionAuthStateNotConnected            = "not_connected"
	ConnectionAuthStateActive                  = "active"
	ConnectionAuthStateReauthorizationRequired = "reauthorization_required"
)
View Source 
const (
	CatalogConnectionLimitName         = "platform-mcp-catalog-connection"
	CatalogOrganizationLimitName       = "platform-mcp-catalog-organization"
	RegistrationConnectionLimitName    = "platform-mcp-registration-connection"
	RegistrationOrganizationLimitName  = "platform-mcp-registration-organization"
	HandoffConnectionLimitName         = "platform-mcp-handoff-connection"
	HandoffOrganizationLimitName       = "platform-mcp-handoff-organization"
	SetupConnectionLimitName           = "platform-mcp-setup-connection"
	SetupOrganizationLimitName         = "platform-mcp-setup-organization"
	RepairConnectionLimitName          = "platform-mcp-repair-connection"
	RepairOrganizationLimitName        = "platform-mcp-repair-organization"
	DocsConnectionLimitName            = "platform-mcp-docs-connection"
	DocsOrganizationLimitName          = "platform-mcp-docs-organization"
	SkillsConnectionLimitName          = "platform-mcp-skills-connection"
	SkillsOrganizationLimitName        = "platform-mcp-skills-organization"
	LifecycleConnectionLimitName       = "platform-mcp-lifecycle-connection"
	LifecycleOrganizationLimitName     = "platform-mcp-lifecycle-organization"
	SessionRecallConnectionLimitName   = "platform-mcp-session-recall-connection"
	SessionRecallOrganizationLimitName = "platform-mcp-session-recall-organization"
	RiskMutationConnectionLimitName    = "platform-mcp-risk-mutation-connection"
	RiskMutationOrganizationLimitName  = "platform-mcp-risk-mutation-organization"
)
View Source 
const (
	PluginAssignmentMutationConnectionLimitName   = "platform-mcp-plugin-assignment-mutation-connection"
	PluginAssignmentMutationOrganizationLimitName = "platform-mcp-plugin-assignment-mutation-organization"
	AccessRoleMutationConnectionLimitName         = "platform-mcp-access-role-mutation-connection"
	AccessRoleMutationOrganizationLimitName       = "platform-mcp-access-role-mutation-organization"
	ShadowAccessDecisionConnectionLimitName       = "platform-mcp-shadow-access-decision-connection"
	ShadowAccessDecisionOrganizationLimitName     = "platform-mcp-shadow-access-decision-organization"
)
View Source 
const (
	// DocsQueriesPerConnectionPerMinute and DocsQueriesPerOrganizationPerMinute
	// bound documentation search. Retrieval is in-process and cheap, so these
	// exist to stop a loop from spending the caller's context on repeated
	// queries rather than to protect a backend.
	DocsQueriesPerConnectionPerMinute   = 10
	DocsQueriesPerOrganizationPerMinute = 100

	// DiagnosticQueriesPer* bound the summary reads: the project overview and
	// the per-MCP diagnosis. They are generous because an administrator
	// investigating an incident legitimately makes many of them in a short
	// burst, and each one is a bounded aggregate that names no subject.
	DiagnosticQueriesPerConnectionPerMinute   = 60
	DiagnosticQueriesPerOrganizationPerMinute = 600

	// SensitiveDiagnosticQueriesPer* bound the drill-downs. They are metered
	// separately and lower than the summaries because they reach row-level
	// occurrences and, in one case, an individual: a caller must not be able to
	// fund them by spending the summary allowance.
	SensitiveDiagnosticQueriesPerConnectionPerMinute   = 30
	SensitiveDiagnosticQueriesPerOrganizationPerMinute = 300

	// RiskMutationsPer* bound all risk policy and exclusion writes together.
	// Keeping one shared budget prevents a caller from multiplying the permitted
	// write rate by alternating between mutation tools.
	RiskMutationsPerConnectionPerMinute   = 5
	RiskMutationsPerOrganizationPerMinute = 50

	// PluginAssignmentMutationsPer* bound the access-affecting replacement of one
	// plugin's complete assignment set on an independent allowance.
	PluginAssignmentMutationsPerConnectionPerMinute   = 5
	PluginAssignmentMutationsPerOrganizationPerMinute = 50
	AccessRoleMutationsPerConnectionPerMinute         = 5
	AccessRoleMutationsPerOrganizationPerMinute       = 50
	ShadowAccessDecisionsPerConnectionPerMinute       = 5
	ShadowAccessDecisionsPerOrganizationPerMinute     = 50

	// DrilldownRowsPerConnectionPerWindow and
	// DrilldownMetricQueriesPerConnectionPerWindow are the second cap the
	// drill-downs carry, over DrilldownVolumeWindow. A per-minute call budget
	// alone does not bound how much a caller can accumulate: paging steadily
	// under the call rate still walks an entire window's occurrences. These
	// meter the volume rather than the calls.
	DrilldownRowsPerConnectionPerWindow          = 1000
	DrilldownMetricQueriesPerConnectionPerWindow = 20

	// SessionRecallsPer* bound continue_session. Metered separately and lower
	// than every other read: each allowed call serves an entire session
	// transcript as a digest, so this allowance must not be fundable by
	// spending any other budget.
	SessionRecallsPerConnectionPerMinute   = 10
	SessionRecallsPerOrganizationPerMinute = 100
)
View Source 
const (
	PluginsConnectionLimitName   = "platform-mcp-plugins-connection"
	PluginsOrganizationLimitName = "platform-mcp-plugins-organization"
)
View Source 
const (
	// PluginQueriesPerConnectionPerMinute and
	// PluginQueriesPerOrganizationPerMinute bound plugin inventory reads. An
	// administrator answering "which plugins exist and what is in them" walks a
	// page and then opens the plugins that looked interesting, so the allowance
	// matches the diagnostics reads rather than a mutation's.
	PluginQueriesPerConnectionPerMinute   = 30
	PluginQueriesPerOrganizationPerMinute = 300
)
View Source 
const (
	// PluginPublicationPublished means the project's package repository holds a
	// published package for this plugin.
	PluginPublicationPublished = "published"
	// PluginPublicationUnpublished means the project has a package repository
	// but nothing published for this plugin yet.
	PluginPublicationUnpublished = "unpublished"
	// PluginPublicationNoRepository means the project has no package repository
	// connected, so no plugin in it can be published at all.
	PluginPublicationNoRepository = "no_repository"
)

Plugin publication states.

View Source 
const (
	ForcedReadinessProbeLimit      = "platform-mcp-forced-readiness-probe"
	ForcedReadinessProbesPerMinute = 3
)
View Source 
const (
	Path         = "/platform-mcp"
	TokenType    = "Bearer"
	MaxBodyBytes = 64 << 10
)
View Source 
const (
	SubjectIdentityEmail    = "email"
	SubjectIdentityExternal = "external"
	SubjectIdentityUser     = "user"
)

Identity kinds carried inside a user reference. Telemetry records a person under one of three different columns, and the value alone does not say which: filtering an external user id as though it were an email matches nothing and reports an active person as inactive. The minting side states the column, so the reading side can filter the right one.

View Source 
const AssistantClientID = "gram-project-assistant"

AssistantClientID names the acting client on assistant-originated calls, so telemetry and audit can tell an assistant-driven change from an external client's.

View Source 
const DefaultDiagnosticWindow = DiagnosticWindowLastDay

DefaultDiagnosticWindow is what an unspecified window resolves to when a tool states no narrower default.

View Source 
const DrilldownVolumeWindow = 10 * time.Minute

DrilldownVolumeWindow is the interval the drill-down volume caps refill over.

View Source 
const StaleWatermarkThreshold = 5 * time.Minute

StaleWatermarkThreshold is how far behind the observation watermark may fall before a diagnostic reports itself stale. Telemetry reaches the read model through batched ingestion, so a small lag is normal; beyond this the answer is old enough that a caller acting on it could be reasoning about a system state that has already changed.

View Source 
const SubjectReferenceTTL = 10 * time.Minute

SubjectReferenceTTL bounds how long an opaque reference stays usable. A reference is a handle for one investigation, not a durable identifier: a short life keeps it from accumulating in a caller's notes or being replayed against a later session.

View Source 
const SubjectSuppressionThreshold = 5

SubjectSuppressionThreshold is the smallest subject count a diagnostic will state exactly. Below it the count itself identifies: "one active user in this project last hour" names a person to anyone who knows the team.

Variables

View Source 
var (
	ErrAccessReferenceNotFound = errors.New("platform mcp access reference not found")
	ErrAccessMCPNotFound       = errors.New("platform mcp access target not found")
	ErrAccessQueryRequired     = errors.New("platform mcp access member filter required")
)
View Source 
var (
	ErrAccessRoleMutationUnavailable = errors.New("platform mcp access role mutations unavailable")
	ErrAccessRoleMutationInvalid     = errors.New("invalid platform mcp access role mutation")
	ErrAccessRoleMutationNotFound    = errors.New("platform mcp access role mutation target not found")
	ErrAccessRoleMutationConflict    = errors.New("platform mcp access role mutation conflict")
)
View Source 
var (
	ErrCatalogUnavailable = errors.New("platform mcp catalog unavailable")
	ErrCatalogRejected    = errors.New("platform mcp catalog candidate rejected")
)
View Source 
var (
	ErrIdentityProviderAttachmentUnavailable = errors.New("platform mcp identity provider attachment unavailable")
	ErrIdentityProviderAttachmentUnsupported = errors.New("platform mcp identity provider attachment unsupported")
	ErrIdentityProviderAttachmentConflict    = errors.New("platform mcp identity provider attachment conflict")
)
View Source 
var (
	ErrClientAdmissionInvalid     = errors.New("invalid platform mcp client admission request")
	ErrClientAdmissionUnavailable = errors.New("platform mcp client admission unavailable")
)
View Source 
var (
	ErrDirectRemoteRejected    = errors.New("direct remote MCP URL rejected")
	ErrDirectRemoteUnavailable = errors.New("direct remote MCP inspection unavailable")
)
View Source 
var (
	ErrDistributionInvalid                = errors.New("invalid platform mcp distribution input")
	ErrDistributionConflict               = errors.New("platform mcp distribution version conflict")
	ErrDistributionNotReady               = errors.New("platform mcp distribution requires fresh readiness")
	ErrDistributionDefaultAbsent          = errors.New("platform mcp distribution requires an existing default plugin")
	ErrDistributionTargetUnavailable      = errors.New("platform mcp distribution target is unavailable")
	ErrDistributionBlockedPendingApproval = errors.New("platform mcp distribution blocked by Shadow MCP approval enforcement")
)
View Source 
var (
	ErrFeedbackInvalid     = errors.New("invalid platform mcp feedback")
	ErrFeedbackConflict    = errors.New("platform mcp feedback idempotency conflict")
	ErrFeedbackRateLimited = errors.New("platform mcp feedback rate limited")
	ErrFeedbackUnavailable = errors.New("platform mcp feedback unavailable")
	ErrFeedbackForbidden   = errors.New("platform mcp feedback connection is no longer active")
)
View Source 
var (
	ErrSetupHandoffInvalid = errors.New("invalid platform mcp setup handoff")
	ErrReadinessInvalid    = errors.New("invalid platform mcp readiness")
)
View Source 
var (
	ErrLifecycleVisibilityInvalid     = errors.New("invalid platform mcp visibility update")
	ErrLifecycleVisibilityUnavailable = errors.New("platform mcp visibility is unavailable for this target")
)
View Source 
var (
	ErrOperationRateLimited       = errors.New("platform mcp operation rate limited")
	ErrOperationBudgetUnavailable = errors.New("platform mcp operation budget unavailable")
)
View Source 
var (
	ErrPluginAssignmentMutationUnavailable = errors.New("platform mcp plugin assignment mutations unavailable")
	ErrPluginAssignmentMutationInvalid     = errors.New("invalid platform mcp plugin assignment mutation")
	ErrPluginAssignmentMutationNotFound    = errors.New("platform mcp plugin assignment not found")
	ErrPluginAssignmentMutationConflict    = errors.New("platform mcp plugin assignment mutation conflict")
)
View Source 
var (
	// ErrPluginProjectNotFound is a project this principal may not read, or one
	// that does not exist. The two are deliberately one answer: distinguishing
	// them tells a caller which project ids exist in other organizations.
	ErrPluginProjectNotFound = errors.New("platform mcp plugin project not found")
	// ErrPluginNotFound is a named plugin that matches nothing in the project.
	ErrPluginNotFound = errors.New("platform mcp plugin not found")
	// ErrPluginAmbiguous is a name matching more than one plugin. It is never
	// resolved by picking one, and never by falling back to the default plugin.
	ErrPluginAmbiguous = errors.New("platform mcp plugin target ambiguous")
	// ErrPluginCursorInvalid is a page cursor that was not issued for this
	// principal, project, and listing.
	ErrPluginCursorInvalid = errors.New("invalid platform MCP plugin cursor")
)
View Source 
var (
	ErrProviderAdapterUnavailable  = errors.New("platform mcp provider adapter unavailable")
	ErrSetupHandoffReissueRequired = errors.New("platform mcp setup handoff reissue required")
)
View Source 
var (
	ErrReadinessRateLimited          = errors.New("platform mcp readiness probe rate limited")
	ErrReadinessRegistrationNotFound = errors.New("platform mcp readiness registration not found")
)
View Source 
var (
	ErrRegistrationConflict = errors.New("platform mcp registration idempotency conflict")
	ErrRegistrationCap      = errors.New("platform mcp active registration cap reached")
	ErrRegistrationInvalid  = errors.New("invalid platform mcp registration input")
	ErrTargetIneligible     = errors.New("platform mcp registration target is ineligible")
)
View Source 
var (
	ErrRiskMutationUnavailable = errors.New("platform mcp risk mutations unavailable")
	ErrRiskMutationInvalid     = errors.New("invalid platform mcp risk mutation")
	ErrRiskMutationNotFound    = errors.New("platform mcp risk mutation target not found")
	ErrRiskMutationConflict    = errors.New("platform mcp risk mutation conflict")
)
View Source 
var (
	ErrRiskReadInvalid  = errors.New("invalid platform mcp risk read")
	ErrRiskReadNotFound = errors.New("platform mcp risk resource not found")
)
View Source 
var (
	ErrUnauthorized = errors.New("platform mcp unauthorized")
	ErrForbidden    = errors.New("platform mcp forbidden")
	ErrUnavailable  = errors.New("platform mcp unavailable")
)
View Source 
var (
	ErrShadowDecisionInvalid     = errors.New("invalid platform mcp shadow access decision")
	ErrShadowDecisionNotFound    = errors.New("platform mcp shadow access decision target not found")
	ErrShadowDecisionUnavailable = errors.New("platform mcp shadow access decisions unavailable")
)
View Source 
var (
	ErrShadowInventoryInvalid     = errors.New("invalid platform mcp shadow inventory request")
	ErrShadowInventoryNotFound    = errors.New("platform mcp shadow inventory target not found")
	ErrShadowInventoryUnavailable = errors.New("platform mcp shadow inventory unavailable")
)
View Source 
var (
	// ErrSkillsUnavailable is the kill switch and the missing-dependency path:
	// the capability is off for this organization, or this deployment composed
	// no skills service.
	ErrSkillsUnavailable = errors.New("platform mcp skills unavailable")
	// ErrSkillTargetNotFound is an exact target that does not exist in the
	// named project. It is never softened into the default plugin: distributing
	// a skill somewhere the caller did not name is the one outcome authoring
	// safety depends on not happening.
	ErrSkillTargetNotFound = errors.New("platform mcp skill distribution target not found")
	// ErrSkillTargetAmbiguous is a target name matching more than one plugin or
	// assistant. Picking one would be a coin flip the caller cannot see.
	ErrSkillTargetAmbiguous = errors.New("platform mcp skill distribution target ambiguous")
	// ErrSkillContentTooLarge is a manifest over the reviewed ceiling.
	ErrSkillContentTooLarge = errors.New("platform mcp skill content too large")
)
View Source 
var (
	ErrDataExportConfirmationRequired = errors.New("data export creation requires confirmation")
	ErrDataExportInvalidInput         = errors.New("invalid data export input")
	ErrDataExportRouteConflict        = errors.New("a data export route already exists for this source")
)
View Source 
var ErrCatalogConfigurationRejected = fmt.Errorf("platform mcp catalog configuration rejected")
View Source 
var ErrCatalogCursorInvalid = errors.New("invalid platform mcp catalog cursor")
View Source 
var ErrDiagnosticWindowInvalid = fmt.Errorf("window must be one of %s, %s, %s, %s",
	DiagnosticWindowLastHour, DiagnosticWindowLastDay, DiagnosticWindowLastWeek, DiagnosticWindowLastMonth)

ErrDiagnosticWindowInvalid is returned for a window outside the closed set.

View Source 
var ErrDiagnosticWindowTooLong = errors.New("window is longer than this tool allows")

ErrDiagnosticWindowTooLong is returned for a window this tool will not look back over. It is refused rather than clamped for the same reason an unknown window is: a caller must never be told about a different interval than the one it asked for.

View Source 
var ErrDiagnosticsTargetNotFound = errors.New("platform mcp diagnostics target not found")
View Source 
var ErrDistributionVersionTokenInvalid = errors.New("invalid platform mcp distribution version token")
View Source 
var ErrInventoryCursorInvalid = errors.New("invalid platform MCP inventory cursor")
View Source 
var ErrLifecycleMetadataInvalid = errors.New("invalid platform mcp metadata update")
View Source 
var ErrOnboardingInvalid = errors.New("invalid platform mcp onboarding input")
View Source 
var ErrRegistrationUnavailable = errors.New("platform mcp catalog registration unavailable")
View Source 
var ErrRiskCursorInvalid = errors.New("invalid platform mcp risk cursor")
View Source 
var ErrSetupGuideUnavailable = errors.New("platform mcp setup guide unavailable")

ErrSetupGuideUnavailable is returned instead of setup content that is too far past its revalidation date to stand behind. Callers surface it as the guide_unavailable code with the guide's canonical links, so the model hands the reader a trusted source rather than inventing steps.

View Source 
var ErrShadowDecisionConflict = errors.New("platform mcp shadow decision conflict")
View Source 
var ErrSubjectReferenceNotFound = errors.New("platform mcp subject reference not found")

ErrSubjectReferenceNotFound is what an unknown, expired, cross-generation, or cross-organization reference resolves to. It is deliberately a single not-found rather than a set of distinguishable failures: telling a caller that a reference is "expired" rather than "unknown" confirms the reference once existed, which is itself information about another organization.

View Source 
var ErrToolNotFound = errors.New("platform mcp tool not found for this audience")

ErrToolNotFound reports a tool that is not admitted to the requested audience.

Functions

func AttachManagement 

func AttachManagement(mux goahttp.Muxer, service *ManagementService)

func ContextWithPrincipal 

func ContextWithPrincipal(ctx context.Context, principal Principal) context.Context

ContextWithPrincipal binds an acting identity to a context so tool handlers read it with PrincipalFromContext. Exported for the assistant adapter, which calls handlers directly rather than through the MCP transport.

func FormatSubjectIdentity 

func FormatSubjectIdentity(identityKind, identifier string) string

FormatSubjectIdentity builds the value a user reference carries. Summary tools mint references through this so the kind travels with the identifier.

func IsReadinessMCPErrorResponse 

func IsReadinessMCPErrorResponse(err error) bool

IsReadinessMCPErrorResponse reports whether an SDK error preserves a well-formed server-authored JSON-RPC error. Provider adapters use it to avoid treating a valid error response as malformed protocol data.

func ProviderAuthorizationFingerprint 

func ProviderAuthorizationFingerprint(identity ProviderAuthorizationIdentity) (string, error)

ProviderAuthorizationFingerprint returns an opaque value suitable for readiness persistence. It intentionally excludes access and refresh tokens.

func SetupResourceURI 

func SetupResourceURI(provider, intent string) string

SetupResourceURI is the stable address of one reviewed guide. It is exported because a corpus builder must produce exactly these URIs — they are a public contract with every MCP client that has one bookmarked.

func ValidateSetupResource 

func ValidateSetupResource(resource SetupResource) error

ValidateSetupResource reports why a resource is not servable. A corpus builder gets the reason so a malformed guide fails the build it came from, rather than disappearing from the corpus at registration time.

Types

type AccessMember 

type AccessMember struct {
	MaskedIdentity string   `json:"masked_identity"`
	Roles          []string `json:"roles"`
	Reference      string   `json:"reference"`
	Version        string   `json:"version"`
}

type AccessReadService 

type AccessReadService struct {
	// contains filtered or unexported fields
}

AccessReadService projects the access service's local role/member authority into privacy-safe Platform MCP reads. It never contacts WorkOS or a configured MCP and never accepts raw role, member, principal, or grant identifiers.

func NewAccessReadService 

func NewAccessReadService(logger *slog.Logger, db *pgxpool.Pool, budget OperationBudget, keyMaterial string) *AccessReadService

func (*AccessReadService) GetMCPAccess 

func (s *AccessReadService) GetMCPAccess(ctx context.Context, principal Principal, input GetMCPAccessInput) (GetMCPAccessOutput, error)

func (*AccessReadService) ListMembers 

func (s *AccessReadService) ListMembers(ctx context.Context, principal Principal, input ListAccessMembersInput) (ListAccessMembersOutput, error)

func (*AccessReadService) ListRoles 

func (s *AccessReadService) ListRoles(ctx context.Context, principal Principal) (ListAccessRolesOutput, error)

type AccessRole 

type AccessRole struct {
	Name        string            `json:"name"`
	Type        string            `json:"type"`
	MemberCount SubjectCount      `json:"member_count"`
	MCPAccess   MCPConnectSummary `json:"mcp_access"`
	Reference   string            `json:"reference"`
	Version     string            `json:"version"`
}

type AccessRoleAssignmentMember 

type AccessRoleAssignmentMember struct {
	MaskedIdentity string   `json:"masked_identity"`
	Roles          []string `json:"roles"`
	Version        string   `json:"version"`
}

type AccessRoleAssignmentReceiptResult 

type AccessRoleAssignmentReceiptResult struct {
	MaskedIdentity string   `json:"masked_identity"`
	Roles          []string `json:"roles"`
	Version        string   `json:"version"`
	AssignedRole   string   `json:"assigned_role"`
	ResultCategory string   `json:"result_category"`
	Reconciliation string   `json:"reconciliation"`
}

type AccessRoleAssignmentReceiptStore 

type AccessRoleAssignmentReceiptStore struct {
	// contains filtered or unexported fields
}

func NewAccessRoleAssignmentReceiptStore 

func NewAccessRoleAssignmentReceiptStore(db *pgxpool.Pool) *AccessRoleAssignmentReceiptStore

func (*AccessRoleAssignmentReceiptStore) Execute 

func (s *AccessRoleAssignmentReceiptStore) Execute(ctx context.Context, principal Principal, project ResolvedProject, idempotencyKey string, normalized normalizedAccessRoleAssignment, mutate AccessRoleAssignmentTransaction) (OperationReceipt, error)

type AccessRoleAssignmentRule 

type AccessRoleAssignmentRule struct {
	AllTools    bool   `` /* 143-byte string literal not displayed */
	Tool        string `json:"tool,omitempty" jsonschema:"exact named tool restriction; when disposition is also present both restrictions apply"`
	Disposition string `` /* 158-byte string literal not displayed */
}

type AccessRoleAssignmentService 

type AccessRoleAssignmentService struct {
	// contains filtered or unexported fields
}

func NewAccessRoleAssignmentService 

func NewAccessRoleAssignmentService(roles *AccessRoleMutationService) (*AccessRoleAssignmentService, error)

func (*AccessRoleAssignmentService) Assign 

func (s *AccessRoleAssignmentService) Assign(ctx context.Context, principal Principal, input AssignMCPAccessRoleInput) (AssignMCPAccessRoleOutput, error)

type AccessRoleAssignmentTransaction 

type AccessRoleAssignmentTransaction func(context.Context, pgx.Tx) (AccessRoleAssignmentReceiptResult, error)

type AccessRoleMutationBackend 

type AccessRoleMutationBackend interface {
	MutationReady() bool
	GetRoleByIDTx(context.Context, pgx.Tx, string, string) (*accessgen.Role, error)
	CreateRoleTx(context.Context, pgx.Tx, string, string, access.RoleAuditActor, *accessgen.CreateRolePayload) (access.RoleCreateResult, access.RoleReconciliation, error)
	UpdateRoleTx(context.Context, pgx.Tx, string, string, access.RoleAuditActor, *accessgen.UpdateRolePayload) (access.RoleUpdateResult, access.RoleReconciliation, error)
	AddMemberRoleTx(context.Context, pgx.Tx, string, string, string, access.RoleAuditActor, access.MemberRoleValidation) (access.MemberRoleAddResult, access.MemberRoleReconciliation, error)
	CurrentMemberRoleReconciliationTx(context.Context, pgx.Tx, string, string) (access.MemberRoleReconciliation, error)
	ReconcileRoleIdentity(context.Context, string, string, string, string, bool)
	ReconcileMemberRoles(context.Context, access.MemberRoleReconciliation)
}

AccessRoleMutationBackend matches the transaction-scoped access manager API.

type AccessRoleMutationError 

type AccessRoleMutationError struct {
	Code    string
	Message string
	Cause   error
}

AccessRoleMutationError is safe to return through Platform MCP. It never includes a role ID, principal, grant selector, or configured MCP ID.

func (*AccessRoleMutationError) Error 

func (e *AccessRoleMutationError) Error() string

func (*AccessRoleMutationError) Unwrap 

func (e *AccessRoleMutationError) Unwrap() error

type AccessRoleMutationReceiptResult 

type AccessRoleMutationReceiptResult struct {
	RoleID         string            `json:"role_id"`
	RoleSlug       string            `json:"role_slug"`
	Name           string            `json:"name"`
	Description    string            `json:"description,omitempty"`
	Version        string            `json:"version"`
	MCPAccess      MCPConnectSummary `json:"mcp_access"`
	ResultCategory string            `json:"result_category"`
	Reconciliation string            `json:"reconciliation"`
}

type AccessRoleMutationReceiptStore 

type AccessRoleMutationReceiptStore struct {
	// contains filtered or unexported fields
}

func NewAccessRoleMutationReceiptStore 

func NewAccessRoleMutationReceiptStore(db *pgxpool.Pool) *AccessRoleMutationReceiptStore

func (*AccessRoleMutationReceiptStore) ExecuteCreate 

func (s *AccessRoleMutationReceiptStore) ExecuteCreate(ctx context.Context, principal Principal, project ResolvedProject, idempotencyKey string, normalized normalizedCreateMCPAccessRole, mutate AccessRoleMutationTransaction) (OperationReceipt, error)

func (*AccessRoleMutationReceiptStore) ExecuteUpdate 

func (s *AccessRoleMutationReceiptStore) ExecuteUpdate(ctx context.Context, principal Principal, project ResolvedProject, idempotencyKey string, normalized normalizedUpdateMCPAccessRole, mutate AccessRoleMutationTransaction) (OperationReceipt, error)

type AccessRoleMutationService 

type AccessRoleMutationService struct {
	// contains filtered or unexported fields
}

func NewAccessRoleMutationService 

func NewAccessRoleMutationService(reads *AccessReadService, flags feature.Provider, budget OperationBudget, keyMaterial string, backend AccessRoleMutationBackend) (*AccessRoleMutationService, error)

func (*AccessRoleMutationService) Create 

func (s *AccessRoleMutationService) Create(ctx context.Context, principal Principal, input CreateMCPAccessRoleInput) (CreateMCPAccessRoleOutput, error)

func (*AccessRoleMutationService) Update 

func (s *AccessRoleMutationService) Update(ctx context.Context, principal Principal, input UpdateMCPAccessRoleInput) (UpdateMCPAccessRoleOutput, error)

type AccessRoleMutationSummary 

type AccessRoleMutationSummary struct {
	Name        string            `json:"name"`
	Description string            `json:"description,omitempty"`
	Reference   string            `json:"reference"`
	Version     string            `json:"version"`
	MCPAccess   MCPConnectSummary `json:"mcp_access"`
}

type AccessRoleMutationTransaction 

type AccessRoleMutationTransaction func(context.Context, pgx.Tx) (AccessRoleMutationReceiptResult, error)

type ActingSurface 

type ActingSurface string

ActingSurface names the surface a call arrives through. Audit has to be able to tell an agent-driven change from a dashboard change made by the same user, and reviewing a runaway agent's burst of activity depends on it. 

const (
	// SurfacePlatformMCP is the OAuth-authenticated Platform MCP endpoint.
	SurfacePlatformMCP ActingSurface = contextvalues.ActingSurfacePlatformMCP
	// SurfaceProjectAssistant is the project assistant runtime, which acts
	// under assistant identity and holds no OAuth connection.
	SurfaceProjectAssistant ActingSurface = "project_assistant"
	// SurfaceDashboard is an authenticated dashboard session completing work a
	// Platform MCP flow started, such as a provider setup handoff.
	SurfaceDashboard ActingSurface = "dashboard"
)

type AddSkillVersionInput 

type AddSkillVersionInput struct {
	ProjectSlug             string
	SkillID                 string
	Content                 string
	ExpectedLatestVersionID string
}

AddSkillVersionInput carries the full replacement manifest plus the version the caller believes is current. Versions are immutable, so a correction is another version rather than an edit of one.

type AddSkillVersionToolInput 

type AddSkillVersionToolInput struct {
	ProjectSlug             string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID                 string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	Content                 string `` /* 139-byte string literal not displayed */
	ExpectedLatestVersionID string `` /* 167-byte string literal not displayed */
}

type AssignMCPAccessRoleInput 

type AssignMCPAccessRoleInput struct {
	ProjectID           string `json:"project_id" jsonschema:"explicit project ID for the access workflow"`
	MemberReference     string `json:"member_reference" jsonschema:"opaque member reference returned by list_access_members"`
	RoleReference       string `json:"role_reference" jsonschema:"opaque custom role reference returned by list_access_roles or get_mcp_access"`
	ExpectedVersion     string `json:"expected_version" jsonschema:"opaque member role version returned by list_access_members immediately before this write"`
	MCPID               string `json:"mcp_id,omitempty" jsonschema:"required for new assignments: exact configured MCP selected from get_mcp_access"`
	ExpectedRoleVersion string `` /* 149-byte string literal not displayed */
	IdempotencyKey      string `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact assignment"`
	Confirmed           bool   `` /* 139-byte string literal not displayed */
}

type AssignMCPAccessRoleOutput 

type AssignMCPAccessRoleOutput struct {
	Member         AccessRoleAssignmentMember `` /* 143-byte string literal not displayed */
	SnapshotScope  string                     `json:"snapshot_scope" jsonschema:"assignment_commit: this response describes the committed operation, not current access"`
	AssignedRole   string                     `json:"assigned_role"`
	ResultCategory string                     `json:"result_category"`
	Reconciliation string                     `json:"reconciliation"`
	Receipt        RiskMutationToolReceipt    `json:"receipt"`
}

type AttachPlatformMCPIdentityProviderToolInput 

type AttachPlatformMCPIdentityProviderToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
	Confirmed      bool   `` /* 221-byte string literal not displayed */
}

type AttachPlatformMCPIdentityProviderToolOutput 

type AttachPlatformMCPIdentityProviderToolOutput struct {
	ProjectSlug      string `json:"project_slug"`
	RegistrationID   string `json:"registration_id"`
	Attached         bool   `json:"attached"`
	ProviderURL      string `json:"provider_url,omitempty"`
	NextAction       string `json:"next_action"`
	Message          string `json:"message"`
	AuthorizationURL string `json:"authorization_url,omitempty"`
}

type Audience 

type Audience string

Audience names a surface a tool may be served to.

Membership is declared per tool rather than per catalogue. The two surfaces differ in identity, targeting, and safety, so a tool built for one is not automatically fit for the other: admitting a capability to the assistant is a deliberate act a reviewer can see in the diff, not a consequence of adding it to Platform MCP. 

const (
	// AudienceExternal is the OAuth-authenticated /platform-mcp endpoint.
	AudienceExternal Audience = "external"
	// AudienceAssistant is a project's managed assistant, which acts under
	// assistant identity rather than an external user's OAuth connection.
	AudienceAssistant Audience = "assistant"
)

type Authenticator 

type Authenticator interface {
	Authenticate(ctx context.Context, token string) (Principal, error)
}

type Authorizer 

type Authorizer interface {
	RequireLiveOrgAdmin(ctx context.Context, principal Principal) error
}

type BrowserIdentity 

type BrowserIdentity interface {
	BuildAuthorizationURL(ctx context.Context, params identity.AuthorizationURLParams) (*url.URL, error)
	ExchangeCodeForTokens(ctx context.Context, code string) (*identity.IDPUserInfo, error)
	UpsertUserFromIDP(ctx context.Context, idpUser *identity.IDPUserInfo) (string, error)
}

BrowserIdentity resolves a real Gram user from the product identity provider.

type CandidateInspection 

type CandidateInspection struct {
	ProviderKey            string                      `json:"provider_key,omitempty"`
	CatalogRef             string                      `json:"catalog_ref,omitempty"`
	CanonicalURL           string                      `json:"canonical_url,omitempty"`
	Name                   string                      `json:"name,omitempty"`
	Description            string                      `json:"description,omitempty"`
	Version                string                      `json:"version,omitempty"`
	Transport              string                      `json:"transport"`
	ToolNames              []string                    `json:"tool_names"`
	ToolCount              int                         `json:"tool_count"`
	Configuration          []CatalogConfigurationField `json:"configuration,omitempty"`
	RequiresDashboardSetup bool                        `json:"requires_dashboard_setup"`
	Trust                  string                      `json:"trust"`
	Authentication         string                      `json:"authentication,omitempty"`
	OAuthDiscovery         string                      `json:"oauth_discovery,omitempty"`
	SetupIntent            string                      `json:"setup_intent,omitempty"`
	SetupCategory          SetupCategory               `json:"setup_category,omitempty"`
	Actions                []RepairAction              `json:"actions,omitempty"`
}

CandidateInspection is the safe common projection for reviewed and direct candidate paths. Direct remote URLs are always marked unreviewed and never enter the reviewed catalogue.

type CanonicalIdentityGate 

type CanonicalIdentityGate interface {
	CanonicalOrgFor(ctx context.Context, orgID string) string
}

CanonicalIdentityGate keeps Platform MCP user grouping under the same rollout switch as the dashboard telemetry APIs.

type CapabilityChecker 

type CapabilityChecker interface {
	IsFeatureEnabled(ctx context.Context, organizationID string, feature productfeatures.Feature) (bool, error)
	IsFeatureEnabledUncached(ctx context.Context, organizationID string, feature productfeatures.Feature) (bool, error)
}

CapabilityChecker is the durable organization capability boundary. Platform MCP checks bypass the shared 15-minute product-feature cache so revocation is visible on the next request, comfortably within the 60-second requirement.

type Catalog 

type Catalog interface {
	Search(ctx context.Context, query string) ([]CatalogCandidate, error)
	Inspect(ctx context.Context, providerKey, catalogRef string) (CatalogDetails, error)
}

type CatalogCandidate 

type CatalogCandidate struct {
	// ProviderKey is a server-issued opaque registry-source identity. It is not a
	// provider credential, remote URL, or client-supplied provider configuration.
	ProviderKey string `json:"provider_key"`
	CatalogRef  string `json:"catalog_ref"`
	Name        string `json:"name"`
	Description string `json:"description"`
	Version     string `json:"version"`
	ToolCount   int    `json:"tool_count"`
	SetupIntent string `json:"setup_intent"`
}

type CatalogConfigurationField 

type CatalogConfigurationField struct {
	Key         string   `json:"key"`
	Kind        string   `json:"kind"`
	Name        string   `json:"name"`
	Description string   `json:"description"`
	Required    bool     `json:"required"`
	Secret      bool     `json:"secret"`
	Default     string   `json:"default,omitempty"`
	Choices     []string `json:"choices,omitempty"`
}

type CatalogConfigurationValues 

type CatalogConfigurationValues map[string]string

CatalogConfigurationValues contains values supplied by an agent for one inspected catalogue entry. Its keys must be the server-issued field keys from CatalogDetails.Configuration. Secret values are rejected before they can be persisted, hashed, logged, or returned from a Platform MCP tool.

type CatalogDescriptor 

type CatalogDescriptor struct {
	ProviderKey      string
	Registry         externalmcp.Registry
	CanonicalRef     string
	AllowedRemoteURL string
	SetupIntent      string
}

CatalogDescriptor binds a Platform catalogue source to a server-owned registry. CanonicalRef and AllowedRemoteURL are optional only for a registry-wide source: the exact entry and remote are then revalidated on every inspection. Existing reviewed descriptors keep pinning both values for a narrower provider contract.

func BrowserCatalogDescriptor 

func BrowserCatalogDescriptor(registry externalmcp.Registry) CatalogDescriptor

BrowserCatalogDescriptor maps one configured browser-catalogue registry to a stable opaque Platform MCP source identity. The registry row and its endpoint remain server-owned; callers only receive this identity after a search result.

type CatalogDescriptorLoader 

type CatalogDescriptorLoader func(ctx context.Context) ([]CatalogDescriptor, error)

type CatalogDetails 

type CatalogDetails struct {
	CatalogCandidate
	Transport              string                      `json:"transport"`
	ToolNames              []string                    `json:"tool_names"`
	Configuration          []CatalogConfigurationField `json:"configuration"`
	RequiresDashboardSetup bool                        `json:"requires_dashboard_setup"`
	// contains filtered or unexported fields
}

type CatalogIdentityProviderAttachment 

type CatalogIdentityProviderAttachment interface {
	Attach(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogIdentityProviderAttachmentResult, error)
}

CatalogIdentityProviderAttachment attaches the one OAuth provider advertised by a persisted reviewed Remote MCP source. It is a server-owned boundary: neither the tool caller nor the browser supplies a client id, client secret, OAuth code, token, or other credential.

type CatalogIdentityProviderAttachmentResult 

type CatalogIdentityProviderAttachmentResult struct {
	Attached    bool
	ProviderURL string
}

CatalogIdentityProviderAttachmentResult contains only non-secret provider context for the agent. Provider URLs are safe to return; client secrets, tokens, passwords, and OAuth codes are never represented here.

type CatalogIdentityProviderAttachmentService 

type CatalogIdentityProviderAttachmentService struct {
	// contains filtered or unexported fields
}

func NewCatalogIdentityProviderAttachmentService 

func NewCatalogIdentityProviderAttachmentService(db *pgxpool.Pool, enc *encryption.Client, policy *guardian.Policy, auditLogger *audit.Logger, serverURL *url.URL) *CatalogIdentityProviderAttachmentService

func (*CatalogIdentityProviderAttachmentService) Attach 

func (s *CatalogIdentityProviderAttachmentService) Attach(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogIdentityProviderAttachmentResult, error)

Attach discovers the exact provider advertised by the lifecycle-owned Remote MCP source, creates a project-owned remote-session issuer/client when needed, and binds it to the registration's existing user-session issuer. It is safe to retry after a successful call: the existing matching binding is reused.

type CatalogReadinessProber 

type CatalogReadinessProber interface {
	ProbeCatalogReadiness(ctx context.Context, principal Principal, projectID, registrationID, remoteMCPServerID, userSessionIssuerID, connectionID, generation uuid.UUID) (ProviderReadinessProbeResult, error)
}

CatalogReadinessProber verifies a browser-catalogue registration through the same persisted Remote MCP source and remote-session authorization used at normal runtime. Its inputs come exclusively from a lifecycle-owned registration, never from an MCP caller.

type CatalogRegistrationGate 

type CatalogRegistrationGate struct {
	// contains filtered or unexported fields
}

CatalogRegistrationGate ensures mutations require the main Platform MCP capability and an explicit project slug. Dashboard visibility is not checked: an enabled organization may use the MCP through manual setup alone.

func NewCatalogRegistrationGate 

func NewCatalogRegistrationGate(platform Gate) *CatalogRegistrationGate

func (*CatalogRegistrationGate) Enabled 

func (g *CatalogRegistrationGate) Enabled(ctx context.Context, organizationID, projectSlug string) (bool, error)

func (*CatalogRegistrationGate) EnabledOrganization 

func (g *CatalogRegistrationGate) EnabledOrganization(ctx context.Context, organizationID string) (bool, error)

EnabledOrganization checks the same durable entitlement as a mutation without accepting a project selector. Read-only direct inspection needs this gate before it can perform user-directed egress.

type CatalogRegistrationGateChecker 

type CatalogRegistrationGateChecker interface {
	Enabled(ctx context.Context, organizationID, projectSlug string) (bool, error)
	EnabledOrganization(ctx context.Context, organizationID string) (bool, error)
}

type CatalogRegistrationRequest 

type CatalogRegistrationRequest struct {
	ProjectSlug       string
	SourceKind        string
	CatalogProvider   string
	CatalogReference  string
	ConfigurationHash string
	IdempotencyKey    string
	InputHash         string
}

CatalogRegistrationRequest is the normalized desired state behind one register_catalog_mcp call. The caller resolves catalog details before passing this value to persistence; display metadata is deliberately not identity.

type ClientAdmission 

type ClientAdmission struct {
	Mode             string
	AllowedModes     []string
	CustomClientURLs []string
}

ClientAdmission is the CIMD admission state of one registered MCP's session issuer. Mode is always the EFFECTIVE mode: an issuer that never had one set reports the resolved default, matching what the dashboard shows.

type ClientAdmissionService 

type ClientAdmissionService struct {
	// contains filtered or unexported fields
}

ClientAdmissionService reads and writes the CIMD admission policy of the session issuer a Platform MCP registration owns. It is the tool-surface equivalent of MCP Server -> Settings -> Authentication, and writes the same audit event the management API writes for the same change.

Nothing here is connection-scoped: a registration is resolved through the connection-tolerant lifecycle lookup, and the write is attributed to the caller's real user.

func NewClientAdmissionService 

func NewClientAdmissionService(db *pgxpool.Pool, auditLogger *audit.Logger) *ClientAdmissionService

func (*ClientAdmissionService) Get 

func (s *ClientAdmissionService) Get(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (ClientAdmission, error)

func (*ClientAdmissionService) Set 

func (s *ClientAdmissionService) Set(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID, mode string) (ClientAdmission, error)

Set writes one admission mode. The caller is responsible for having obtained explicit user confirmation: this changes which MCP clients may authorize against the registered server, and ModeDisabled additionally withdraws the advertised CIMD support from the issuer's RFC 8414 metadata.

type ContinueSessionInput 

type ContinueSessionInput struct {
	SessionID string `json:"session_id" jsonschema:"the session to recall — a session id from list_my_sessions"`
}

type ContinueSessionOutput 

type ContinueSessionOutput struct {
	Digest          string   `json:"digest"`
	SourceSessionID string   `json:"source_session_id"`
	ChatID          string   `json:"chat_id"`
	NotCarriedOver  []string `json:"not_carried_over"`
	Notes           []string `json:"notes"`
}

ContinueSessionOutput carries the digest plus its fidelity as structured fields; fidelity is never folded into the markdown prose.

type CreateDataExportInput 

type CreateDataExportInput struct {
	ProjectID     string `json:"project_id,omitempty" jsonschema:"project ID that will export telemetry; supply exactly one project selector"`
	ProjectSlug   string `json:"project_slug,omitempty" jsonschema:"project slug that will export telemetry; supply exactly one project selector"`
	Name          string `json:"name" jsonschema:"display name for the OTEL destination"`
	EndpointURL   string `json:"endpoint_url" jsonschema:"HTTP or HTTPS OTEL collector endpoint without credentials, query parameters, or fragments"`
	DataSource    string `json:"data_source" jsonschema:"data to export: product_telemetry or risk_findings"`
	SensitiveData string `json:"sensitive_data,omitempty" jsonschema:"whether sensitive fields are included: exclude (default) or include"`
	Enabled       *bool  `json:"enabled,omitempty" jsonschema:"whether delivery starts immediately; defaults to true"`
	Confirmed     bool   `` /* 151-byte string literal not displayed */
}

type CreateDataExportOutput 

type CreateDataExportOutput struct {
	Destination   DataExportDestination `json:"destination"`
	Route         DataExportRoute       `json:"route"`
	ManagementURL string                `json:"management_url"`
}

type CreateMCPAccessRoleInput 

type CreateMCPAccessRoleInput struct {
	ProjectID      string              `json:"project_id" jsonschema:"explicit project ID that owns every configured MCP in rules"`
	Name           string              `json:"name" jsonschema:"display name for the new custom role"`
	Description    string              `json:"description,omitempty" jsonschema:"optional description for the new custom role"`
	Rules          []MCPAccessRoleRule `json:"rules" jsonschema:"MCP access rules generated only for configured MCP IDs in this project"`
	IdempotencyKey string              `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact write"`
	Confirmed      bool                `json:"confirmed" jsonschema:"set true only after the user confirms this exact project, role, and MCP access delta"`
}

type CreateMCPAccessRoleOutput 

type CreateMCPAccessRoleOutput struct {
	Role           AccessRoleMutationSummary `json:"role"`
	Reconciliation string                    `json:"reconciliation"`
	Receipt        RiskMutationToolReceipt   `json:"receipt"`
}

type CreateRiskExclusionReceiptResult 

type CreateRiskExclusionReceiptResult struct {
	Project         RiskMutationReceiptProject  `json:"project"`
	Exclusion       RiskExclusionReceiptSummary `json:"exclusion"`
	Version         string                      `json:"version"`
	MatchedExisting bool                        `json:"matched_existing"`
	ResultCategory  string                      `json:"result_category"`
	Reconciliation  string                      `json:"reconciliation"`
}

type CreateRiskExclusionToolOutput 

type CreateRiskExclusionToolOutput struct {
	CreateRiskExclusionReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type CreateRiskPolicyReceiptResult 

type CreateRiskPolicyReceiptResult struct {
	Project         RiskMutationReceiptProject `json:"project"`
	Policy          RiskPolicyReceiptSummary   `json:"policy"`
	Version         string                     `json:"version"`
	MatchedExisting bool                       `json:"matched_existing"`
	ResultCategory  string                     `json:"result_category"`
}

type CreateRiskPolicyToolOutput 

type CreateRiskPolicyToolOutput struct {
	CreateRiskPolicyReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type CreateSkillInput 

type CreateSkillInput struct {
	ProjectSlug string
	Content     string
}

type CreateSkillToolInput 

type CreateSkillToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug that will own the skill"`
	Content     string `json:"content" jsonschema:"the complete SKILL.md, including YAML frontmatter and instructions; at most 65536 UTF-8 bytes"`
}

type CredentialCodec 

type CredentialCodec struct {
	// contains filtered or unexported fields
}

CredentialCodec makes Platform MCP credentials opaque while preserving a verified organization routing hint for organization-scoped persistence queries.

func NewCredentialCodec 

func NewCredentialCodec(encryptionClient *encryption.Client) (*CredentialCodec, error)

func (*CredentialCodec) Issue 

func (c *CredentialCodec) Issue(kind credentialKind, organizationID string) (string, error)

func (*CredentialCodec) OrganizationID 

func (c *CredentialCodec) OrganizationID(kind credentialKind, credential string) (string, error)

type DashboardSessionAuthenticator 

type DashboardSessionAuthenticator interface {
	AuthenticateWithCookie(ctx context.Context) (context.Context, error)
}

type DashboardSetupHTTP 

type DashboardSetupHTTP struct {
	// contains filtered or unexported fields
}

func NewDashboardSetupHTTP 

func NewDashboardSetupHTTP(starter DashboardSetupStarter, sessionManager DashboardSessionAuthenticator) *DashboardSetupHTTP

func (*DashboardSetupHTTP) Attach 

func (s *DashboardSetupHTTP) Attach(mux interface {
	Handle(string, string, http.HandlerFunc)
})

func (*DashboardSetupHTTP) Handler 

func (s *DashboardSetupHTTP) Handler() http.Handler

type DashboardSetupService 

type DashboardSetupService struct {
	// contains filtered or unexported fields
}

func NewDashboardSetupService 

func NewDashboardSetupService(store *RegistrationStore, gate CatalogRegistrationGateChecker, authorizer Authorizer, adapters *ProviderAdapters, setupBudget OperationBudget) *DashboardSetupService

func (*DashboardSetupService) StartDashboardSetup 

func (s *DashboardSetupService) StartDashboardSetup(ctx context.Context, userID, organizationID, handoff string) (ProviderSetupResult, error)

type DashboardSetupStarter 

type DashboardSetupStarter interface {
	StartDashboardSetup(ctx context.Context, userID, organizationID, handoff string) (ProviderSetupResult, error)
}

type DataEnvelope 

type DataEnvelope struct {
	QueriedAt   string    `json:"queried_at"`
	DataThrough string    `json:"data_through,omitempty"`
	Freshness   Freshness `json:"freshness"`
	// NoObservations states positively that the scope produced nothing in the
	// window. Freshness alone cannot carry this: "unavailable" describes the
	// pipeline, and a caller must not read either as evidence of health.
	NoObservations bool           `json:"no_observations"`
	ResolvedWindow ResolvedWindow `json:"resolved_window"`
}

DataEnvelope accompanies every diagnostic result. It says when the answer was computed, how far the underlying observations reach, and whether that is current enough to act on.

type DataExportDestination 

type DataExportDestination struct {
	ID            string             `json:"id"`
	ProjectID     string             `json:"project_id"`
	ProjectName   string             `json:"project_name"`
	ProjectSlug   string             `json:"project_slug"`
	Name          string             `json:"name"`
	Type          string             `json:"type"`
	EndpointURL   string             `json:"endpoint_url"`
	SensitiveData string             `json:"sensitive_data"`
	Headers       []DataExportHeader `json:"headers"`
}

type DataExportHeader 

type DataExportHeader struct {
	Name     string `json:"name"`
	HasValue bool   `json:"has_value"`
}

type DataExportReadService 

type DataExportReadService struct {
	// contains filtered or unexported fields
}

DataExportReadService owns the dependencies needed to project data export configuration without exposing stored header values.

type DataExportRoute 

type DataExportRoute struct {
	ID            string `json:"id"`
	ProjectID     string `json:"project_id"`
	ProjectName   string `json:"project_name"`
	ProjectSlug   string `json:"project_slug"`
	DataSource    string `json:"data_source"`
	Enabled       bool   `json:"enabled"`
	DestinationID string `json:"destination_id,omitempty"`
}

type DecideShadowMCPAccessInput 

type DecideShadowMCPAccessInput struct {
	ProjectID          string   `json:"project_id" jsonschema:"explicit project ID used to inspect the Shadow MCP target"`
	TargetReference    string   `` /* 135-byte string literal not displayed */
	Decision           string   `json:"decision" jsonschema:"decision to enforce: allow or deny"`
	Rationale          string   `json:"rationale" jsonschema:"bounded reason for the decision; required and stored in the audit trail"`
	AudienceReferences []string `` /* 227-byte string literal not displayed */
	ExpectedVersion    string   `json:"expected_version" jsonschema:"opaque decision version returned by get_shadow_mcp_review immediately before this write"`
	IdempotencyKey     string   `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact decision"`
	Confirmed          bool     `` /* 129-byte string literal not displayed */
}

type DecideShadowMCPAccessOutput 

type DecideShadowMCPAccessOutput struct {
	Decision    string                    `json:"decision"`
	Audiences   []ShadowDecisionAudience  `json:"audiences"`
	State       *GetShadowMCPReviewOutput `json:"state,omitempty"`
	StateStatus string                    `json:"state_status"`
	Receipt     RiskMutationToolReceipt   `json:"receipt"`
}

type Descriptor 

type Descriptor struct {
	Name        string
	Title       string
	Description string
	Annotations *mcp.ToolAnnotations
	Meta        ToolMeta
	InputSchema []byte
	// contains filtered or unexported fields
}

Descriptor is one registered tool, reachable either through the MCP server or by direct call.

The direct path exists for surfaces that speak Go rather than MCP. Going through a second in-process MCP server instead would re-encode every call, and would flatten a refusal into an ordinary result on the way back.

func (Descriptor) Invoke 

func (d Descriptor) Invoke(ctx context.Context, arguments json.RawMessage) (any, error)

Invoke calls the tool directly. The caller must have bound an authorized principal to the context with ContextWithPrincipal.

type DiagnosticWindow 

type DiagnosticWindow string

DiagnosticWindow is the closed set of windows a diagnostic may be asked for. Callers name a window rather than supplying timestamps: an open time grammar is a query language, and this surface deliberately has none.

Each tool additionally caps how far back it will look, because the cost of a read is not the same for a summary and for a row-level drill-down. 

const (
	DiagnosticWindowLastHour  DiagnosticWindow = "1h"
	DiagnosticWindowLastDay   DiagnosticWindow = "24h"
	DiagnosticWindowLastWeek  DiagnosticWindow = "7d"
	DiagnosticWindowLastMonth DiagnosticWindow = "30d"
)

type DiagnosticsService 

type DiagnosticsService struct {
	// contains filtered or unexported fields
}

DiagnosticsService answers the two overview-first questions: what is this project doing, and why is this one MCP not working.

func NewDiagnosticsService 

func NewDiagnosticsService(db *pgxpool.Pool, telemetry DiagnosticsTelemetryReader, sessionCapture FeatureChecker, reader Reader, readiness *ReadinessService, budget OperationBudget) *DiagnosticsService

NewDiagnosticsService composes the overview-first entry points. The bounded drill-down tools are attached separately by WithDrilldown, so a deployment that cannot mint subject references serves the overview and withholds the row-level reads rather than serving them unbound.

func (*DiagnosticsService) GetMCPDiagnostics 

func (s *DiagnosticsService) GetMCPDiagnostics(ctx context.Context, principal Principal, input GetMCPDiagnosticsInput) (GetMCPDiagnosticsOutput, error)

func (*DiagnosticsService) GetProjectOverview 

func (s *DiagnosticsService) GetProjectOverview(ctx context.Context, principal Principal, input GetProjectOverviewInput) (GetProjectOverviewOutput, error)

func (*DiagnosticsService) GetUserMCPStatus 

func (s *DiagnosticsService) GetUserMCPStatus(ctx context.Context, principal Principal, input GetUserMCPStatusInput) (GetUserMCPStatusOutput, error)

func (*DiagnosticsService) GetUserSkillStatus 

func (s *DiagnosticsService) GetUserSkillStatus(ctx context.Context, principal Principal, input GetUserSkillStatusInput) (GetUserSkillStatusOutput, error)

func (*DiagnosticsService) ListMCPUsageUsers 

func (s *DiagnosticsService) ListMCPUsageUsers(ctx context.Context, principal Principal, input ListMCPUsageUsersInput) (ListMCPUsageUsersOutput, error)

func (*DiagnosticsService) ListSkillUsageUsers 

func (s *DiagnosticsService) ListSkillUsageUsers(ctx context.Context, principal Principal, input ListSkillUsageUsersInput) (ListSkillUsageUsersOutput, error)

func (*DiagnosticsService) QueryMCPEvents 

func (s *DiagnosticsService) QueryMCPEvents(ctx context.Context, principal Principal, input QueryMCPEventsInput) (QueryMCPEventsOutput, error)

func (*DiagnosticsService) QueryMCPMetrics 

func (s *DiagnosticsService) QueryMCPMetrics(ctx context.Context, principal Principal, input QueryMCPMetricsInput) (QueryMCPMetricsOutput, error)

func (*DiagnosticsService) QueryMCPTraces 

func (s *DiagnosticsService) QueryMCPTraces(ctx context.Context, principal Principal, input QueryMCPTracesInput) (QueryMCPTracesOutput, error)

func (*DiagnosticsService) QuerySkillUsage 

func (s *DiagnosticsService) QuerySkillUsage(ctx context.Context, principal Principal, input QuerySkillUsageInput) (QuerySkillUsageOutput, error)

func (*DiagnosticsService) WithCanonicalIdentityGate 

func (s *DiagnosticsService) WithCanonicalIdentityGate(gate CanonicalIdentityGate) *DiagnosticsService

WithCanonicalIdentityGate applies the telemetry service's rollout-aware identity folding to user attribution without making the ClickHouse repository responsible for feature flags.

func (*DiagnosticsService) WithDrilldown 

func (s *DiagnosticsService) WithDrilldown(drilldown DrilldownTelemetryReader, referenceKeyMaterial string, sensitiveBudget OperationBudget, volume DrilldownVolumeBudget, auditor DrilldownAuditor) *DiagnosticsService

WithDrilldown attaches the bounded drill-down reads. Reference key material is required: without it a trace or subject handle could not be bound to the caller's organization and session, and the tools stay unavailable rather than returning unbound identifiers.

type DiagnosticsTelemetryReader 

type DiagnosticsTelemetryReader interface {
	GetMCPOutcomeBreakdown(ctx context.Context, arg telemetryrepo.GetMCPOutcomeBreakdownParams) ([]telemetryrepo.MCPOutcomeBreakdownRow, error)
	GetTelemetryWatermark(ctx context.Context, arg telemetryrepo.GetTelemetryWatermarkParams) (int64, error)
	GetOverviewSummary(ctx context.Context, arg telemetryrepo.GetOverviewSummaryParams) (*telemetryrepo.OverviewSummary, error)
	GetActiveCounts(ctx context.Context, arg telemetryrepo.GetActiveCountsParams) (*telemetryrepo.ActiveCounts, error)
	GetTopServers(ctx context.Context, arg telemetryrepo.GetTopServersParams) ([]telemetryrepo.TopServer, error)
	GetSkillsSummary(ctx context.Context, arg telemetryrepo.GetSkillsSummaryParams) ([]telemetryrepo.SkillSummaryRow, error)
	GetSkillBreakdown(ctx context.Context, arg telemetryrepo.GetSkillBreakdownParams) ([]telemetryrepo.SkillBreakdownRow, error)
}

DiagnosticsTelemetryReader is the Gram-owned telemetry this surface reads. It is deliberately two bounded aggregate queries: there is no query grammar here and no way to reach a raw row.

type DirectRemoteApprovalState 

type DirectRemoteApprovalState struct {
	EnforcementActive bool
	Approved          bool
}

DirectRemoteApprovalState reports whether existing Shadow MCP enforcement permits a registered user-supplied URL. It deliberately reflects the same policy and grant state used at runtime; a Platform MCP registration never creates an approval bypass.

type DirectRemoteApprovalTxChecker 

type DirectRemoteApprovalTxChecker interface {
	CheckDirectRemoteApprovalTx(context.Context, riskrepo.DBTX, string, string, uuid.UUID, string) (DirectRemoteApprovalState, error)
}

DirectRemoteApprovalTxChecker evaluates enforcement after attachment planning from the same distribution transaction snapshot as persistence. Policy reads are not locked, so a concurrent revoke remains race-narrowed rather than race-free.

type DirectRemoteInspection 

type DirectRemoteInspection struct {
	CanonicalURL           string   `json:"canonical_url"`
	Transport              string   `json:"transport"`
	ToolNames              []string `json:"tool_names"`
	ToolCount              int      `json:"tool_count"`
	Authentication         string   `json:"authentication"`
	OAuthDiscovery         string   `json:"oauth_discovery"`
	Trust                  string   `json:"trust"`
	RequiresDashboardSetup bool     `json:"requires_dashboard_setup"`
}

DirectRemoteInspection is the bounded, non-secret projection of a direct user-supplied remote MCP. It deliberately contains no response headers, response body, OAuth metadata, credentials, or schemas.

type DirectRemoteInspector 

type DirectRemoteInspector interface {
	Inspect(ctx context.Context, rawURL string) (DirectRemoteInspection, error)
}

DirectRemoteInspector is the boundary shared by candidate inspection and registration. Registration must call it again; an earlier tool result is never admission evidence.

type DistributeMCPToolInput 

type DistributeMCPToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug selected by the user"`
	Plugin      string `` /* 144-byte string literal not displayed */
}

type DistributeMCPToolOutput 

type DistributeMCPToolOutput struct {
	ProjectSlug      string `json:"project_slug"`
	Plugin           string `json:"plugin"`
	Attached         bool   `json:"attached"`
	PublicationState string `json:"publication_state"`
	Message          string `json:"message"`
}

type DistributeSkillInput 

type DistributeSkillInput struct {
	ProjectSlug string
	SkillID     string
	Plugin      string
	Assistant   string
}

DistributeSkillInput names exactly one target. Plugin and assistant names are resolved to exactly one existing target in the named project or refused.

type DistributeSkillOutput 

type DistributeSkillOutput struct {
	ProjectSlug       string      `json:"project_slug"`
	SkillID           string      `json:"skill_id"`
	SkillName         string      `json:"skill_name"`
	Target            SkillTarget `json:"target"`
	DistributionID    string      `json:"distribution_id"`
	ResolvedVersionID string      `json:"resolved_version_id"`
	Message           string      `json:"message"`
}

type DistributeSkillToolInput 

type DistributeSkillToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug that owns both the skill and the target"`
	SkillID     string `json:"skill_id" jsonschema:"skill ID returned by list_skills or create_skill"`
	Plugin      string `` /* 176-byte string literal not displayed */
	Assistant   string `` /* 142-byte string literal not displayed */
}

type Distribution 

type Distribution struct {
	// State is the recorded lifecycle state: attached or removed.
	State string

	// Version is the distribution version this result reflects.
	Version int64

	// AttachmentLive is whether the plugin currently carries the MCP.
	AttachmentLive bool

	// PublicationState is how far the package publication got.
	PublicationState string

	// Plugin is the name of the plugin the caller's target resolved to, echoed
	// so a caller sees where its distribution landed rather than inferring it.
	Plugin string
}

Distribution is the bounded state used by management and MCP tool adapters. Version is internal to the application service; external adapters must turn it into a server-issued opaque token before returning it to callers.

type DistributionInput 

type DistributionInput struct {
	// ProjectSlug is the explicit project the distribution acts in.
	ProjectSlug string

	// Plugin names an exact existing plugin by id, slug, or name. Empty selects
	// the project's default plugin, which is what the dashboard's own
	// "add to Default plugin" action asks for; the agent-facing tools require a
	// named target so a mistyped plugin is refused rather than silently
	// redirected.
	Plugin string

	// ExpectedVersion is the distribution version the caller read before
	// writing.
	ExpectedVersion int64
}

DistributionInput identifies the project selected by its slug and the plugin inside it that receives the distribution. The active onboarding workflow still supplies the registration and MCP server, so a caller can choose which existing plugin receives an MCP but never which server is distributed.

type DistributionService 

type DistributionService struct {
	// contains filtered or unexported fields
}

DistributionService changes only the selected workflow's attachment to the existing Default plugin. plugin_servers remains the attachment authority; platform_mcp_distributions records the caller-bound lifecycle projection.

func NewDistributionService 

func NewDistributionService(db *pgxpool.Pool, auditLogger *audit.Logger, attach ExistingPluginAttacher, publish ProjectPublisher, plugins PluginTargetResolver) *DistributionService

func (*DistributionService) Current 

func (s *DistributionService) Current(ctx context.Context, principal Principal, projectSlug, targetPlugin string) (Distribution, error)

Current returns the selected workflow target's live attachment state and its last persisted version. It does not require readiness, so dashboard resume can safely project the state before offering a mutation.

func (*DistributionService) Distribute 

func (s *DistributionService) Distribute(ctx context.Context, principal Principal, input DistributionInput) (Distribution, error)

func (*DistributionService) DistributeForOnboarding 

func (s *DistributionService) DistributeForOnboarding(ctx context.Context, principal Principal, projectSlug, targetPlugin string) (Distribution, error)

DistributeForOnboarding delegates to the same explicit-project distribution path used by the dashboard. The active workflow supplies the registered MCP; callers cannot target an arbitrary server or create a Default plugin.

func (*DistributionService) Remove 

func (s *DistributionService) Remove(ctx context.Context, principal Principal, input DistributionInput) (Distribution, error)

func (*DistributionService) RepairPublication 

func (s *DistributionService) RepairPublication(ctx context.Context, principal Principal, input DistributionInput) (Distribution, error)

RepairPublication replays the same post-commit desired-state publication without changing the attachment or distribution version.

type DocsExcerpt 

type DocsExcerpt struct {
	URI          string   `json:"uri"`
	Title        string   `json:"title"`
	Heading      string   `json:"heading,omitempty"`
	Excerpt      string   `json:"excerpt"`
	Source       string   `json:"source"`
	Owner        string   `json:"owner,omitempty"`
	ObservedAt   string   `json:"observed_at,omitempty"`
	RevalidateBy string   `json:"revalidate_by,omitempty"`
	Stale        bool     `json:"stale,omitempty"`
	Links        []string `json:"links,omitempty"`
	// DocsURL is the guide's published page, for a reader who wants to open it
	// rather than have it quoted.
	DocsURL string `json:"docs_url,omitempty"`
}

DocsExcerpt is one cited passage. Every field except Excerpt is the citation: a reader must be able to see what the passage is, where it came from, how old it is, and where to verify it — without a second call.

type DocsIndex 

type DocsIndex interface {
	Search(ctx context.Context, query string, limit int) ([]DocsExcerpt, error)
}

DocsIndex is the provider-neutral retrieval boundary. The public tool is defined by this interface, not by whatever indexes behind it: a vendor search backend is one possible implementation and never a runtime dependency or a public surface.

Implementations retrieve only from reviewed, allowlisted, pinned content. Live web or provider retrieval is not a permitted implementation.

type DrilldownAuditor 

type DrilldownAuditor interface {
	RecordUserMCPStatusRead(ctx context.Context, principal Principal, projectID, mcpID, maskedIdentity, window string) error
	RecordUsageAttributionRead(ctx context.Context, principal Principal, projectID, targetKind, target, maskedIdentity, window string) error
}

DrilldownAuditor records the one drill-down that answers about a person. It is an interface so the diagnostics service depends on the recording, not on the audit logger's transaction handling.

func NewPostgresDrilldownAuditor 

func NewPostgresDrilldownAuditor(db *pgxpool.Pool) DrilldownAuditor

NewPostgresDrilldownAuditor records the sensitive drill-down against the shared audit log.

type DrilldownTelemetryReader 

type DrilldownTelemetryReader interface {
	GetMCPToolOutcomeBreakdown(ctx context.Context, arg telemetryrepo.GetMCPToolOutcomeBreakdownParams) ([]telemetryrepo.MCPToolOutcomeBreakdownRow, error)
	ListMCPTraceReferences(ctx context.Context, arg telemetryrepo.ListMCPTraceReferencesParams) ([]telemetryrepo.MCPTraceReferenceRow, error)
	ListMCPUsageUsers(ctx context.Context, arg telemetryrepo.GetMCPOutcomeBreakdownParams) ([]telemetryrepo.MCPUsageUserRow, error)
	ListMCPUsageUserTools(ctx context.Context, arg telemetryrepo.GetMCPOutcomeBreakdownParams, identityKind, identifier string) ([]telemetryrepo.MCPUsageUserToolRow, error)
}

DrilldownTelemetryReader is the additional telemetry the bounded drill-down tools read. It stays separate from DiagnosticsTelemetryReader so the overview-first entry points cannot accidentally acquire row-level reads.

type DrilldownVolumeBudget 

type DrilldownVolumeBudget struct {
	Rows          Limiter
	MetricQueries Limiter
}

DrilldownVolumeBudget is the second cap on the drill-down tools. It is keyed on the connection alone: it exists to stop one caller from walking a window row by row, which an organization-wide bucket would not catch until every other connection had already been starved.

func (DrilldownVolumeBudget) AllowMetricQuery 

func (b DrilldownVolumeBudget) AllowMetricQuery(ctx context.Context, principal Principal) error

AllowMetricQuery charges one metric query.

func (DrilldownVolumeBudget) AllowRows 

func (b DrilldownVolumeBudget) AllowRows(ctx context.Context, principal Principal, n int) error

AllowRows charges n rows or spans. A connection-less principal is not metered here: it holds no connection key to charge, and the per-call organization budget already bounds it.

type DynamicRegistryCatalog 

type DynamicRegistryCatalog struct {
	// contains filtered or unexported fields
}

func NewDynamicRegistryCatalog 

func NewDynamicRegistryCatalog(client *externalmcp.RegistryClient, load CatalogDescriptorLoader) *DynamicRegistryCatalog

func NewDynamicRegistryCatalogSources 

func NewDynamicRegistryCatalogSources(load RegistryCatalogSourceLoader) *DynamicRegistryCatalog

func (*DynamicRegistryCatalog) Inspect 

func (c *DynamicRegistryCatalog) Inspect(ctx context.Context, providerKey, catalogRef string) (CatalogDetails, error)

func (*DynamicRegistryCatalog) Search 

func (c *DynamicRegistryCatalog) Search(ctx context.Context, query string) ([]CatalogCandidate, error)

type EventFeedReadService 

type EventFeedReadService struct {
	// contains filtered or unexported fields
}

EventFeedReadService owns the Event Feed reader, the org Logs gate, and the trusted dashboard URL.

type EventFeedReader 

type EventFeedReader interface {
	ListEventLog(ctx context.Context, arg chrepo.ListEventLogParams) ([]chrepo.EventLogRow, error)
}

EventFeedReader is the org-scoped Event Feed page read used by Platform MCP. It returns the merged log/span list; this tool never surfaces attributes.

type ExistingPluginAttacher 

type ExistingPluginAttacher func(ctx context.Context, tx pgx.Tx, authCtx *contextvalues.AuthContext, organizationID string, projectID, pluginID, mcpServerID uuid.UUID, displayName string) (uuid.UUID, bool, error)

ExistingPluginAttacher delegates attachment to the Plugins package. Keeping this narrow adapter outside platformmcp avoids an import cycle: the plugin publisher already consumes Platform MCP package-admission policy.

type Fault 

type Fault string

Fault is where a diagnosed problem lives. The set is closed and the values are the only vocabulary a caller receives. 

const (
	// FaultNone is a server with no evidence of a problem in the window.
	FaultNone Fault = "none"
	// FaultGramConfiguration is a problem in how the MCP is configured in Gram:
	// missing or expired authorization, incomplete required configuration.
	FaultGramConfiguration Fault = "gram_configuration"
	// FaultProvider is a problem upstream of Gram — the provider the MCP
	// fronts is failing or unreachable.
	FaultProvider Fault = "provider"
	// FaultClient is a problem in the calling MCP client: malformed or rejected
	// requests that never became a provider call. The wire value says
	// "mcp_client" rather than "client" so a reader cannot mistake it for the
	// OAuth client, which is a different thing this same package registers.
	FaultClient Fault = "mcp_client"
	// FaultIndeterminate is the honest answer when the evidence does not
	// separate the candidates. It is always preferred over a guess.
	FaultIndeterminate Fault = "indeterminate"
)

type FaultAttribution 

type FaultAttribution struct {
	Fault Fault `json:"fault"`
	// Reason names the single rule that decided this attribution.
	Reason string `json:"reason"`
	// ReadinessExonerates records whether a fresh, ready server-side readiness
	// result was available. When true, Gram-side configuration and the provider
	// are both known good as of that check.
	ReadinessExonerates bool `json:"readiness_exonerates"`
	// Scope says whether the failure pattern is confined to this server or
	// present across the organization; an organization-wide pattern points away
	// from this server's own configuration.
	Scope FaultScope `json:"scope"`
}

FaultAttribution is a diagnosis and the evidence it rests on. Reasons are server-authored codes from a closed set, never provider or client text.

type FaultScope 

type FaultScope string

FaultScope is the server-computed answer to "is this only happening here?". 

const (
	FaultScopeServerSpecific   FaultScope = "server_specific"
	FaultScopeOrganizationWide FaultScope = "organization_wide"
	// FaultScopeUnknown is returned when the organization-wide comparison had
	// too little traffic to say either way.
	FaultScopeUnknown FaultScope = "unknown"
)

type FeatureChecker 

type FeatureChecker func(ctx context.Context, organizationID string) (bool, error)

FeatureChecker answers whether an organization has a product feature enabled. It mirrors the telemetry service's checker so both surfaces resolve the organization's metrics mode from the same source.

type FeedbackInput 

type FeedbackInput struct {
	Category        string
	Rating          *int
	Success         *bool
	ToolName        string
	FailureCategory string
	Note            string
	IdempotencyKey  string
}

type FeedbackResult 

type FeedbackResult struct {
	TrackingID    string
	DeliveryState string
	ExpiresAt     time.Time
	Replayed      bool
}

type FeedbackService 

type FeedbackService struct {
	// contains filtered or unexported fields
}

FeedbackService stores a local, bounded feedback record. Delivery stays queued: this slice deliberately does not compose an external feedback destination.

func NewFeedbackService 

func NewFeedbackService(db *pgxpool.Pool) *FeedbackService

func (*FeedbackService) Submit 

func (s *FeedbackService) Submit(ctx context.Context, principal Principal, input FeedbackInput) (FeedbackResult, error)

type FindMCPInput 

type FindMCPInput struct {
	// At most one project selector may be supplied. Without a selector, an
	// unfiltered list uses the organization's Default project; a query searches
	// the organization. The assistant policy injects project_id and removes both
	// selectors from its model-visible schema.
	ProjectID   string `` /* 130-byte string literal not displayed */
	ProjectSlug string `` /* 134-byte string literal not displayed */
	Query       string `` /* 128-byte string literal not displayed */
	Cursor      string `json:"cursor,omitempty" jsonschema:"opaque cursor returned by a previous unfiltered find_mcp result"`
	Limit       int    `json:"limit,omitempty" jsonschema:"maximum number of MCPs to return; server clamps this to 100"`
	Readiness   string `json:"readiness,omitempty" jsonschema:"optional persisted readiness state filter"`
}

type FindMCPOutput 

type FindMCPOutput struct {
	MCPs       []MCP  `json:"mcps"`
	NextCursor string `json:"next_cursor,omitempty"`
}

type Freshness 

type Freshness string

Freshness qualifies every diagnostic result. It is deliberately reported beside the data rather than folded into it: an empty result is FreshnessNoObservations, which is the absence of evidence and never evidence of health. 

const (
	// FreshnessCurrent means the watermark is within StaleWatermarkThreshold of
	// the read, or already past the end of the window.
	FreshnessCurrent Freshness = "current"
	FreshnessStale   Freshness = "stale"
	// FreshnessUnavailable means the scope holds no observations at all. It is
	// paired with DataEnvelope.NoObservations, which says the same thing
	// positively: a caller must not read either as "nothing went wrong".
	FreshnessUnavailable Freshness = "unavailable"
)

type Gate 

type Gate interface {
	Enabled(ctx context.Context, organizationID string) (bool, error)
}

type GetMCPAccessInput 

type GetMCPAccessInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the configured MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp"`
}

type GetMCPAccessOutput 

type GetMCPAccessOutput struct {
	ProjectID string            `json:"project_id"`
	MCP       MCPAccessTarget   `json:"mcp"`
	Roles     []MCPRoleCoverage `json:"roles"`
	ExpiresAt string            `json:"expires_at"`
}

type GetMCPClientAdmissionToolInput 

type GetMCPClientAdmissionToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
}

type GetMCPDiagnosticsInput 

type GetMCPDiagnosticsInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h (default) or 24h"`
}

GetMCPDiagnosticsInput names one configured MCP, using the same identity find_mcp and get_mcp return.

type GetMCPDiagnosticsOutput 

type GetMCPDiagnosticsOutput struct {
	ProjectID string       `json:"project_id"`
	MCPID     string       `json:"mcp_id"`
	Envelope  DataEnvelope `json:"data"`

	Readiness MCPDiagnosticsReadiness `json:"readiness"`
	Outcomes  MCPOutcomeSummary       `json:"outcomes"`
	// OrganizationOutcomes is the same summary across the organization's
	// projects. It is what makes the scope check answerable server-side.
	OrganizationOutcomes MCPOutcomeSummary `json:"organization_outcomes"`
	// OrganizationOutcomesPartial reports that the comparison covered only the
	// first maxOverviewProjects projects. When it is true the attribution's
	// scope is forced to unknown rather than asserted from partial coverage.
	OrganizationOutcomesPartial bool                `json:"organization_outcomes_partial"`
	Clients                     []MCPClientEvidence `json:"clients"`
	ClientsTruncated            bool                `json:"clients_truncated"`
	Attribution                 FaultAttribution    `json:"attribution"`
}

type GetMCPInput 

type GetMCPInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID"`
}

type GetMCPReadinessToolInput 

type GetMCPReadinessToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
	Force          bool   `` /* 185-byte string literal not displayed */
}

type GetMCPReadinessToolOutput 

type GetMCPReadinessToolOutput struct {
	ProjectSlug    string         `json:"project_slug"`
	RegistrationID string         `json:"registration_id"`
	State          ReadinessState `json:"state"`
	EvidenceCode   string         `json:"evidence_code,omitempty"`
	SetupCategory  SetupCategory  `json:"setup_category,omitempty"`
	Freshness      string         `json:"freshness"`
	CheckedAt      string         `json:"checked_at,omitempty"`
	ExpiresAt      string         `json:"expires_at,omitempty"`
	Actions        []RepairAction `json:"actions"`
}

type GetMCPRepairPlanToolInput 

type GetMCPRepairPlanToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
}

type GetMCPRepairPlanToolOutput 

type GetMCPRepairPlanToolOutput struct {
	ProjectSlug    string         `json:"project_slug"`
	RegistrationID string         `json:"registration_id"`
	State          ReadinessState `json:"state"`
	SetupCategory  SetupCategory  `json:"setup_category,omitempty"`
	Freshness      string         `json:"freshness"`
	Actions        []RepairAction `json:"actions"`
}

type GetPluginInput 

type GetPluginInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the plugin"`
	Plugin    string `json:"plugin" jsonschema:"exact plugin ID, slug, or name as returned by list_plugins"`
}

type GetPluginOutput 

type GetPluginOutput struct {
	// ProjectID echoes the project the plugin belongs to.
	ProjectID string `json:"project_id"`

	// Plugin is the resolved plugin's inventory projection.
	Plugin Plugin `json:"plugin"`

	// Servers is the MCP servers the plugin carries.
	Servers []PluginServer `json:"servers"`

	// Skills is the skills the plugin carries.
	Skills []PluginSkill `json:"skills"`

	// AssignmentVersion is an opaque optimistic-concurrency token over the
	// plugin identity and its complete canonical assignment set. It remains
	// valid until that state changes; a future write must also use unexpired
	// assignment references from the same or a fresher read.
	AssignmentVersion string `json:"assignment_version"`

	// Assignments are the current assignment targets that can be named without
	// exposing an individual identity or stale internal principal.
	Assignments []PluginAssignmentOption `json:"assignments"`

	// AssignmentDetailsComplete is false when at least one current assignment
	// cannot be safely represented as a reviewed role or directory target.
	AssignmentDetailsComplete bool `json:"assignment_details_complete"`

	// AssignmentsTruncated is true when more than 100 current assignments can be
	// represented and the returned list is only a prefix.
	AssignmentsTruncated bool `json:"assignments_truncated"`

	// ReferencesExpireAt applies to every assignment reference in this result.
	ReferencesExpireAt string `json:"references_expire_at,omitempty"`

	// Truncated is true when the plugin carries more members than one result
	// projects, so the lists above are a prefix rather than the whole bundle.
	Truncated bool `json:"truncated"`
}

type GetProjectOverviewInput 

type GetProjectOverviewInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID to summarize"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h (default), 7d, or 30d"`
}

GetProjectOverviewInput asks for one project's activity. It carries no filters: the overview is the entry point, and narrowing happens through the drill-down tools once it has identified something to look at.

type GetProjectOverviewOutput 

type GetProjectOverviewOutput struct {
	ProjectID string       `json:"project_id"`
	Envelope  DataEnvelope `json:"data"`
	// MetricsMode is the organization's metrics mode, resolved server-side. It
	// is reported because it changes what ActiveUsers counts: chat participants
	// under "session", tool-call actors under "tool_call".
	MetricsMode     string                  `json:"metrics_mode"`
	ToolCalls       int64                   `json:"tool_calls"`
	FailedToolCalls int64                   `json:"failed_tool_calls"`
	ActiveServers   int64                   `json:"active_servers"`
	ActiveUsers     SubjectCount            `json:"active_users"`
	TopServers      []ProjectOverviewServer `json:"top_servers"`
}

GetProjectOverviewOutput is the Platform subset of the project overview: the activity and failure shape of a project, aggregated server-side.

It carries no users, no clients, no tokens, and no cost. Those are either personal data this surface does not project or a billing concern that does not belong in a diagnostic.

type GetRiskPolicyInput 

type GetRiskPolicyInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	PolicyID    string `json:"policy_id"`
}

type GetRiskPolicyOutput 

type GetRiskPolicyOutput struct {
	Project            RiskProject      `json:"project"`
	CatalogVersion     string           `json:"catalog_version"`
	CatalogFingerprint string           `json:"catalog_fingerprint"`
	Policy             RiskPolicyDetail `json:"policy"`
}

type GetSetupHandoffToolInput 

type GetSetupHandoffToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp"`
	ProviderKey    string `json:"provider_key" jsonschema:"reviewed provider key returned by register_catalog_mcp"`
	CatalogRef     string `json:"catalog_ref" jsonschema:"reviewed catalog reference returned by register_catalog_mcp"`
}

type GetSetupHandoffToolOutput 

type GetSetupHandoffToolOutput struct {
	ProjectID      string `json:"project_id"`
	RegistrationID string `json:"registration_id"`
	ProviderKey    string `json:"provider_key"`
	CatalogRef     string `json:"catalog_ref"`
	SetupURL       string `json:"setup_url"`
	Intent         string `json:"intent"`
	Handoff        string `json:"handoff,omitempty"`
	ExpiresAt      string `json:"expires_at,omitempty"`
}

type GetShadowMCPReviewInput 

type GetShadowMCPReviewInput struct {
	ProjectID       string `json:"project_id" jsonschema:"explicit project ID used to list this target"`
	TargetReference string `json:"target_reference" jsonschema:"short-lived opaque target reference returned by list_shadow_mcp_inventory"`
}

type GetShadowMCPReviewOutput 

type GetShadowMCPReviewOutput struct {
	Project  RiskProject              `json:"project"`
	Target   ShadowMCPTargetSummary   `json:"target"`
	Evidence ShadowMCPEvidenceSummary `json:"evidence"`
}

type GetSkillInput 

type GetSkillInput struct {
	ProjectSlug    string
	SkillID        string
	IncludeContent bool
}

GetSkillInput reads one skill. Manifest content is opt-in rather than default so a caller that wanted a name and a version id does not pay 64 KiB for it.

type GetSkillOutput 

type GetSkillOutput struct {
	ProjectSlug   string               `json:"project_slug"`
	Skill         SkillSummary         `json:"skill"`
	LatestVersion *SkillVersionSummary `json:"latest_version,omitempty"`
	Distributed   bool                 `json:"distributed"`
}

type GetSkillToolInput 

type GetSkillToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID        string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	IncludeContent bool   `` /* 142-byte string literal not displayed */
}

type GetUserMCPStatusInput 

type GetUserMCPStatusInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	// SubjectReference is an expiring, session-bound handle returned in the
	// optional rows of a summary tool. It cannot be searched, joined,
	// refreshed, or constructed.
	SubjectReference string `` /* 127-byte string literal not displayed */
	Window           string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

GetUserMCPStatusInput names one subject and one MCP. The subject is given as an opaque reference minted by a summary tool, never as an email, account id, or name: the caller asks about someone it was shown, not about someone it can describe.

type GetUserMCPStatusOutput 

type GetUserMCPStatusOutput struct {
	ProjectID string       `json:"project_id"`
	MCPID     string       `json:"mcp_id"`
	Envelope  DataEnvelope `json:"data"`

	// MaskedIdentity is enough to recognize a subject already known to the
	// administrator and not enough to learn one. It is never a raw identifier.
	MaskedIdentity string `json:"masked_identity"`
	// Activity is a state category rather than a count, so a caller cannot
	// assemble an activity profile from repeated calls.
	Activity       string              `json:"activity"`
	Tools          []SubjectToolStatus `json:"tools"`
	ToolsTruncated bool                `json:"tools_truncated"`
	// Unavailable is retained for compatibility. The call-level reader can scope
	// every MCP model that carries a trustworthy server identity.
	Unavailable bool `json:"unavailable"`
}

type GetUserSkillStatusInput 

type GetUserSkillStatusInput struct {
	ProjectID        string `json:"project_id" jsonschema:"project ID that owns the skill"`
	SkillName        string `json:"skill_name" jsonschema:"exact canonical skill name returned by query_skill_usage"`
	SubjectReference string `json:"subject_reference" jsonschema:"opaque subject reference returned by list_skill_usage_users"`
	Window           string `` /* 126-byte string literal not displayed */
}

type GetUserSkillStatusOutput 

type GetUserSkillStatusOutput struct {
	ProjectID      string       `json:"project_id"`
	SkillName      string       `json:"skill_name"`
	Envelope       DataEnvelope `json:"data"`
	MaskedIdentity string       `json:"masked_identity"`
	Activity       string       `json:"activity"`
	Errors         string       `json:"errors"`
}

type GrantPreparer 

type GrantPreparer interface {
	PrepareContext(ctx context.Context) (context.Context, error)
}

GrantPreparer loads the acting user's RBAC grants onto the context.

Platform MCP does not travel the session middleware that prepares grants for dashboard requests, so it prepares them itself. Without this the skills service's scope checks would find no grants and refuse every call.

type GuardianDirectRemoteInspector 

type GuardianDirectRemoteInspector struct {
	// contains filtered or unexported fields
}

GuardianDirectRemoteInspector canonicalizes, validates, and probes one direct remote MCP using Guardian before every network hop. It supports only Streamable HTTP's JSON response form; standalone SSE is intentionally not a D1 admission path.

func NewGuardianDirectRemoteInspector 

func NewGuardianDirectRemoteInspector(policy *guardian.Policy) *GuardianDirectRemoteInspector

func (*GuardianDirectRemoteInspector) Inspect 

func (s *GuardianDirectRemoteInspector) Inspect(ctx context.Context, rawURL string) (DirectRemoteInspection, error)

type InspectCatalogCandidateInput 

type InspectCatalogCandidateInput struct {
	ProviderKey string `` /* 152-byte string literal not displayed */
	CatalogRef  string `` /* 158-byte string literal not displayed */
	RemoteURL   string `` /* 258-byte string literal not displayed */
}

type IssueSetupHandoffInput 

type IssueSetupHandoffInput struct {
	ProjectSlug    string
	RegistrationID string
	ProviderKey    string
	CatalogRef     string
}

type IssuedSetupHandoff 

type IssuedSetupHandoff struct {
	SetupHandoff
	Value string
}

type JWTAuthenticator 

type JWTAuthenticator struct {
	// contains filtered or unexported fields
}

func NewJWTAuthenticator 

func NewJWTAuthenticator(signer *sessiontokens.Signer, db *pgxpool.Pool, encryptionClient *encryption.Client, issuer, audience string) (*JWTAuthenticator, error)

func (*JWTAuthenticator) Authenticate 

func (a *JWTAuthenticator) Authenticate(ctx context.Context, token string) (Principal, error)

type Lifecycle 

type Lifecycle struct {
	DefaultProjectID     string
	MarketplacePublished bool
	Connections          []LifecycleConnection
}

Lifecycle is the safe management projection for the active organization. It deliberately excludes OAuth client, subject, token, JTI, and session values.

type LifecycleConnection 

type LifecycleConnection struct {
	ID             string
	AuthorizedAt   *time.Time
	ReauthorizedAt *time.Time
	Ready          bool
}

type LifecycleEvent 

type LifecycleEvent struct {
	Operation string
	Phase     string
	Outcome   string
	State     ReadinessState
}

type LifecycleMetadataService 

type LifecycleMetadataService struct {
	// contains filtered or unexported fields
}

LifecycleMetadataService updates the display metadata of a complete Platform-owned MCP registration. It shares the narrow mcpservers transaction command used by dashboard updates, but never selects or changes plugin attachments.

func NewLifecycleMetadataService 

func NewLifecycleMetadataService(db *pgxpool.Pool, updater LifecycleMetadataUpdater, keyMaterial string) (*LifecycleMetadataService, error)

func (*LifecycleMetadataService) Update 

func (s *LifecycleMetadataService) Update(ctx context.Context, principal Principal, input UpdateMCPMetadataInput) (UpdateMCPMetadataResult, error)

type LifecycleMetadataUpdate 

type LifecycleMetadataUpdate struct {
	OrganizationID string
	ProjectID      uuid.UUID
	ActorUserID    string
	ServerID       uuid.UUID
	Name           string
}

type LifecycleMetadataUpdater 

type LifecycleMetadataUpdater func(ctx context.Context, tx pgx.Tx, existing mcpserversrepo.McpServer, input LifecycleMetadataUpdate) (mcpserversrepo.McpServer, error)

LifecycleMetadataUpdater is supplied by server composition so Platform MCP invokes the same narrow mcpservers command as the dashboard without importing the dashboard package back into this boundary.

type LifecycleTelemetry 

type LifecycleTelemetry interface {
	Record(ctx context.Context, event LifecycleEvent)
}

func NewLifecycleTelemetry 

func NewLifecycleTelemetry(logger *slog.Logger, meterProvider metric.MeterProvider) LifecycleTelemetry

type LifecycleVisibilityLocker 

type LifecycleVisibilityLocker func(context.Context, pgx.Tx, string, uuid.UUID, uuid.UUID) error

LifecycleVisibilityLocker is composed from mcpservers to preserve its domain -> root endpoint -> MCP server lock order before the Platform service locks the target server.

type LifecycleVisibilityService 

type LifecycleVisibilityService struct {
	// contains filtered or unexported fields
}

func NewLifecycleVisibilityService 

func NewLifecycleVisibilityService(db *pgxpool.Pool, auditLogger *audit.Logger, locker LifecycleVisibilityLocker, updater LifecycleVisibilityUpdater, publisher ProjectPublisher, reconcile func(context.Context, []uuid.UUID) error, readiness *ReadinessService, keyMaterial string) (*LifecycleVisibilityService, error)

func (*LifecycleVisibilityService) Disable 

func (s *LifecycleVisibilityService) Disable(ctx context.Context, principal Principal, input UpdateMCPVisibilityInput) (UpdateMCPVisibilityResult, error)

func (*LifecycleVisibilityService) Enable 

func (s *LifecycleVisibilityService) Enable(ctx context.Context, principal Principal, input UpdateMCPVisibilityInput) (UpdateMCPVisibilityResult, error)

type LifecycleVisibilityUpdate 

type LifecycleVisibilityUpdate struct {
	OrganizationID string
	ProjectID      uuid.UUID
	ActorUserID    string
	ServerID       uuid.UUID
	Visibility     string
}

type LifecycleVisibilityUpdateResult 

type LifecycleVisibilityUpdateResult struct {
	Server               mcpserversrepo.McpServer
	ClearedRootDomainIDs []uuid.UUID
}

type LifecycleVisibilityUpdater 

type LifecycleVisibilityUpdater func(context.Context, pgx.Tx, mcpserversrepo.McpServer, LifecycleVisibilityUpdate) (LifecycleVisibilityUpdateResult, error)

LifecycleVisibilityUpdater is composed from mcpservers so Platform MCP uses the same transactional visibility/audit primitive as the dashboard while intentionally bypassing dashboard-only attach-to-Default behavior.

type Limiter 

type Limiter interface {
	Allow(ctx context.Context, key string) (ratelimit.Result, error)
	// AllowN charges n units at once. A volume cap meters rows or spans rather
	// than calls, and charging them one at a time would let a page that cannot
	// be afforded in full be paid for halfway.
	AllowN(ctx context.Context, key string, n int) (ratelimit.Result, error)
}

Limiter is the narrow Platform MCP boundary around Gram's shared rate limiter. It lets unit tests deterministically model an allowance, a throttle, or a backing-store failure without depending on Redis.

type ListAccessMembersInput 

type ListAccessMembersInput struct {
	Query         string `json:"query,omitempty" jsonschema:"identity text to search for; required unless role_reference is supplied"`
	RoleReference string `json:"role_reference,omitempty" jsonschema:"opaque role reference returned by list_access_roles"`
	Limit         int    `json:"limit,omitempty" jsonschema:"maximum number of matching members to return; server clamps this to 50"`
}

type ListAccessMembersOutput 

type ListAccessMembersOutput struct {
	Members      []AccessMember `json:"members"`
	TotalMatches SubjectCount   `json:"total_matches"`
	Suppressed   bool           `json:"suppressed"`
	Truncated    bool           `json:"truncated"`
	ExpiresAt    string         `json:"expires_at,omitempty"`
}

type ListAccessRolesOutput 

type ListAccessRolesOutput struct {
	Roles     []AccessRole `json:"roles"`
	ExpiresAt string       `json:"expires_at"`
}

type ListDataExportsInput 

type ListDataExportsInput struct {
	ProjectID   string `json:"project_id,omitempty" jsonschema:"optional project ID; omit both project selectors to list the organization's exports"`
	ProjectSlug string `` /* 128-byte string literal not displayed */
	Limit       int    `` /* 133-byte string literal not displayed */
}

type ListDataExportsOutput 

type ListDataExportsOutput struct {
	Destinations  []DataExportDestination `json:"destinations"`
	Routes        []DataExportRoute       `json:"routes"`
	ManagementURL string                  `json:"management_url"`
	Truncated     bool                    `json:"truncated"`
}

type ListMCPUsageUsersInput 

type ListMCPUsageUsersInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

type ListMCPUsageUsersOutput 

type ListMCPUsageUsersOutput struct {
	ProjectID string         `json:"project_id"`
	MCPID     string         `json:"mcp_id"`
	Envelope  DataEnvelope   `json:"data"`
	Users     []MCPUsageUser `json:"users"`
	Truncated bool           `json:"truncated"`
}

type ListMySessionsInput 

type ListMySessionsInput struct {
	Limit int `json:"limit,omitempty" jsonschema:"maximum number of sessions to return; server clamps this to 100"`
}

type ListMySessionsOutput 

type ListMySessionsOutput struct {
	Sessions []RecallableSession `json:"sessions"`
}

type ListOrganizationEventsInput 

type ListOrganizationEventsInput struct {
	Limit  int    `json:"limit,omitempty" jsonschema:"maximum events to return; defaults to 20 and is capped at 50"`
	Window string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h (default), or 7d"`
	Kind   string `json:"kind,omitempty" jsonschema:"optional signal kind filter: log or span"`
}

type ListOrganizationEventsOutput 

type ListOrganizationEventsOutput struct {
	Window       ResolvedWindow      `json:"window"`
	Events       []OrganizationEvent `json:"events"`
	More         bool                `json:"more"`
	EventFeedURL string              `json:"event_feed_url"`
}

type ListPluginAssignmentsInput 

type ListPluginAssignmentsInput struct {
	ProjectID string `json:"project_id" jsonschema:"explicit project ID whose plugin assignment targets to list"`
}

type ListPluginAssignmentsOutput 

type ListPluginAssignmentsOutput struct {
	ProjectID          string                   `json:"project_id"`
	Assignments        []PluginAssignmentOption `json:"assignments"`
	ReferencesExpireAt string                   `json:"references_expire_at,omitempty"`
	Truncated          bool                     `json:"truncated"`
}

type ListPluginsInput 

type ListPluginsInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID whose plugins to list"`
	Limit     int    `json:"limit,omitempty" jsonschema:"maximum number of plugins to return; server clamps this to 50"`
	Cursor    string `json:"cursor,omitempty" jsonschema:"opaque cursor from a previous list_plugins result"`
}

type ListPluginsOutput 

type ListPluginsOutput struct {
	// ProjectID echoes the project the plugins belong to.
	ProjectID string `json:"project_id"`

	// Plugins is one page of the project's plugins.
	Plugins []Plugin `json:"plugins"`

	// NextCursor is the cursor for the next page, empty when this page is the
	// last one.
	NextCursor string `json:"next_cursor,omitempty"`
}

type ListProjectsInput 

type ListProjectsInput struct {
	Limit int `json:"limit,omitempty" jsonschema:"maximum number of projects to return; server clamps this to 100"`
}

type ListProjectsOutput 

type ListProjectsOutput struct {
	Projects  []Project `json:"projects"`
	Truncated bool      `json:"truncated"`
}

type ListRecentToolCallsInput 

type ListRecentToolCallsInput struct {
	ProjectID   string `json:"project_id,omitempty" jsonschema:"project ID to inspect; supply exactly one project selector"`
	ProjectSlug string `json:"project_slug,omitempty" jsonschema:"project slug to inspect; supply exactly one project selector"`
	Window      string `json:"window,omitempty" jsonschema:"observation window: 1h (default) or 24h"`
	Outcome     string `json:"outcome,omitempty" jsonschema:"optional outcome filter: success, error, blocked, or pending"`
	Limit       int    `json:"limit,omitempty" jsonschema:"maximum calls to return; defaults to 10 and is capped at 50"`
}

type ListRecentToolCallsOutput 

type ListRecentToolCallsOutput struct {
	ProjectID   string           `json:"project_id"`
	ProjectName string           `json:"project_name"`
	ProjectSlug string           `json:"project_slug"`
	Window      ResolvedWindow   `json:"window"`
	Calls       []RecentToolCall `json:"calls"`
	More        bool             `json:"more"`
	ToolLogsURL string           `json:"tool_logs_url"`
}

type ListRiskExclusionsInput 

type ListRiskExclusionsInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	PolicyID    string `json:"policy_id,omitempty"`
	Cursor      string `json:"cursor,omitempty"`
	Limit       int    `json:"limit,omitempty"`
}

type ListRiskExclusionsOutput 

type ListRiskExclusionsOutput struct {
	Project            RiskProject            `json:"project"`
	CatalogVersion     string                 `json:"catalog_version"`
	CatalogFingerprint string                 `json:"catalog_fingerprint"`
	Exclusions         []RiskExclusionSummary `json:"exclusions"`
	NextCursor         string                 `json:"next_cursor,omitempty"`
}

type ListRiskPoliciesInput 

type ListRiskPoliciesInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	Cursor      string `json:"cursor,omitempty"`
	Limit       int    `json:"limit,omitempty"`
}

type ListRiskPoliciesOutput 

type ListRiskPoliciesOutput struct {
	Project            RiskProject         `json:"project"`
	CatalogVersion     string              `json:"catalog_version"`
	CatalogFingerprint string              `json:"catalog_fingerprint"`
	Policies           []RiskPolicySummary `json:"policies"`
	NextCursor         string              `json:"next_cursor,omitempty"`
}

type ListShadowMCPInventoryInput 

type ListShadowMCPInventoryInput struct {
	ProjectID string `json:"project_id" jsonschema:"explicit project ID returned by list_projects"`
	Cursor    string `json:"cursor,omitempty" jsonschema:"opaque cursor returned by the preceding list_shadow_mcp_inventory page"`
	Limit     int    `json:"limit,omitempty" jsonschema:"maximum targets to return; server clamps this to 50"`
}

type ListShadowMCPInventoryOutput 

type ListShadowMCPInventoryOutput struct {
	Project    RiskProject              `json:"project"`
	Targets    []ShadowMCPTargetSummary `json:"targets"`
	NextCursor string                   `json:"next_cursor,omitempty"`
}

type ListSkillUsageUsersInput 

type ListSkillUsageUsersInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the skill"`
	SkillName string `json:"skill_name" jsonschema:"exact canonical skill name returned by query_skill_usage"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

type ListSkillUsageUsersOutput 

type ListSkillUsageUsersOutput struct {
	ProjectID string           `json:"project_id"`
	SkillName string           `json:"skill_name"`
	Envelope  DataEnvelope     `json:"data"`
	Users     []SkillUsageUser `json:"users"`
	Truncated bool             `json:"truncated"`
}

type ListSkillVersionsInput 

type ListSkillVersionsInput struct {
	ProjectSlug    string
	SkillID        string
	IncludeContent bool
	Cursor         string
	Limit          int
}

type ListSkillVersionsOutput 

type ListSkillVersionsOutput struct {
	ProjectSlug string                `json:"project_slug"`
	SkillID     string                `json:"skill_id"`
	Versions    []SkillVersionSummary `json:"versions"`
	NextCursor  string                `json:"next_cursor,omitempty"`
}

type ListSkillVersionsToolInput 

type ListSkillVersionsToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID        string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	IncludeContent bool   `` /* 136-byte string literal not displayed */
	Cursor         string `json:"cursor,omitempty" jsonschema:"pagination cursor returned by a previous list_skill_versions call"`
	Limit          int    `json:"limit,omitempty" jsonschema:"maximum versions to return; defaults to 50 and is capped at 100"`
}

type ListSkillsInput 

type ListSkillsInput struct {
	ProjectSlug string
	Search      string
	Cursor      string
	Limit       int
}

ListSkillsInput names the project whose registry to read.

type ListSkillsOutput 

type ListSkillsOutput struct {
	ProjectSlug string         `json:"project_slug"`
	Skills      []SkillSummary `json:"skills"`
	TotalCount  int64          `json:"total_count"`
	NextCursor  string         `json:"next_cursor,omitempty"`
}

type ListSkillsToolInput 

type ListSkillsToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug whose skill registry to list"`
	Search      string `json:"search,omitempty" jsonschema:"optional case-insensitive search over skill names and summaries"`
	Cursor      string `json:"cursor,omitempty" jsonschema:"pagination cursor returned by a previous list_skills call"`
	Limit       int    `json:"limit,omitempty" jsonschema:"maximum skills to return; defaults to 50 and is capped at 100"`
}

type LiveOrgAdminAuthorizer 

type LiveOrgAdminAuthorizer struct {
	// contains filtered or unexported fields
}

func NewLiveOrgAdminAuthorizer 

func NewLiveOrgAdminAuthorizer(db *pgxpool.Pool, engine *authz.Engine) *LiveOrgAdminAuthorizer

func (*LiveOrgAdminAuthorizer) RequireLiveOrgAdmin 

func (a *LiveOrgAdminAuthorizer) RequireLiveOrgAdmin(ctx context.Context, principal Principal) error

type LiveOrganizationSelector 

type LiveOrganizationSelector struct {
	// contains filtered or unexported fields
}

LiveOrganizationSelector returns only organizations where the current user holds the same live org:admin grant required to authorize Platform MCP.

func NewLiveOrganizationSelector 

func NewLiveOrganizationSelector(db *pgxpool.Pool, authorizer Authorizer) *LiveOrganizationSelector

func (*LiveOrganizationSelector) EligibleOrganizations 

func (s *LiveOrganizationSelector) EligibleOrganizations(ctx context.Context, userID string) ([]OrganizationOption, error)

type MCP 

type MCP struct {
	ID               string            `json:"id"`
	ProjectID        string            `json:"project_id"`
	ProjectName      string            `json:"project_name,omitempty"`
	ProjectSlug      string            `json:"project_slug,omitempty"`
	Name             string            `json:"name,omitempty"`
	Slug             string            `json:"slug,omitempty"`
	Version          string            `json:"version,omitempty"`
	Visibility       string            `json:"visibility"`
	EffectiveEnabled bool              `json:"effective_enabled"`
	Model            string            `json:"model"`
	BackendKind      MCPBackendKind    `json:"backend_kind"`
	Source           MCPSource         `json:"source"`
	Registration     *MCPRegistration  `json:"registration,omitempty"`
	Readiness        MCPReadiness      `json:"readiness"`
	Distributions    []MCPDistribution `json:"distributions"`
	Operations       []string          `json:"operations"`
	DashboardPath    string            `json:"dashboard_path,omitempty"`
}

type MCPAccessRoleRule 

type MCPAccessRoleRule struct {
	MCPID       string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp for the explicit project"`
	Tool        string `json:"tool,omitempty" jsonschema:"optional exact tool name currently returned by get_mcp_access"`
	Disposition string `json:"disposition,omitempty" jsonschema:"optional closed tool disposition: read_only, destructive, idempotent, or open_world"`
}

MCPAccessRoleRule is a caller-facing request for one server-generated mcp:connect selector. MCPID must be a configured MCP returned for the explicit project. Tool, when present, is accepted only from an enumerable current catalog. Disposition is a closed annotation class, never an open selector.

type MCPAccessTarget 

type MCPAccessTarget struct {
	ID                   string          `json:"id"`
	Name                 string          `json:"name"`
	Backend              string          `json:"backend"`
	Visibility           string          `json:"visibility"`
	AuthorizationMode    string          `json:"authorization_mode"`
	AuthorizationSurface string          `json:"authorization_surface"`
	AccessSummary        string          `json:"access_summary"`
	ToolCatalog          string          `json:"tool_catalog"`
	Tools                []MCPAccessTool `json:"tools"`
	ToolsTruncated       bool            `json:"tools_truncated"`
}

type MCPAccessTool 

type MCPAccessTool struct {
	Name        string `json:"name"`
	Disposition string `json:"disposition,omitempty"`
}

type MCPBackendKind 

type MCPBackendKind string
const (
	MCPBackendHosted    MCPBackendKind = "hosted"
	MCPBackendRemote    MCPBackendKind = "remote"
	MCPBackendTunneled  MCPBackendKind = "tunneled"
	MCPBackendUnproxied MCPBackendKind = "unproxied"
	MCPBackendLegacy    MCPBackendKind = "legacy"
)

type MCPClientAdmissionToolOutput 

type MCPClientAdmissionToolOutput struct {
	ProjectSlug      string   `json:"project_slug"`
	RegistrationID   string   `json:"registration_id"`
	Mode             string   `json:"mode"`
	AllowedModes     []string `json:"allowed_modes"`
	CustomClientURLs []string `json:"custom_client_urls"`
	Message          string   `json:"message"`
}

type MCPClientEvidence 

type MCPClientEvidence struct {
	Client   string `json:"client"`
	Calls    int64  `json:"calls"`
	Failures int64  `json:"failures"`
}

MCPClientEvidence is what one client reported about its own calls. The name is self-reported by that client and is evidence, not a dimension: nothing in this surface lets a caller filter or group by it.

type MCPConnectSummary 

type MCPConnectSummary struct {
	AllServers              bool     `json:"all_servers"`
	ProjectRules            int      `json:"project_rules"`
	ServerRules             int      `json:"server_rules"`
	ToolRules               int      `json:"tool_rules"`
	DispositionRules        []string `json:"disposition_rules"`
	BlockedServers          bool     `json:"blocked_servers"`
	BlockedProjectRules     int      `json:"blocked_project_rules"`
	BlockedServerRules      int      `json:"blocked_server_rules"`
	BlockedToolRules        int      `json:"blocked_tool_rules"`
	BlockedDispositionRules []string `json:"blocked_disposition_rules"`
}

type MCPDiagnosticsReadiness 

type MCPDiagnosticsReadiness struct {
	State         string         `json:"state"`
	EvidenceCode  string         `json:"evidence_code,omitempty"`
	SetupCategory SetupCategory  `json:"setup_category,omitempty"`
	Freshness     string         `json:"freshness"`
	CheckedAt     string         `json:"checked_at,omitempty"`
	Actions       []RepairAction `json:"actions"`
}

MCPDiagnosticsReadiness is the latest server-side readiness result, with the freshness that decides whether it can exonerate anything.

type MCPDistribution 

type MCPDistribution struct {
	PluginID         string `json:"plugin_id"`
	State            string `json:"state"`
	PublicationState string `json:"publication_state"`
}

type MCPOutcomeSummary 

type MCPOutcomeSummary struct {
	Total        int64 `json:"total"`
	Success      int64 `json:"success"`
	Unauthorized int64 `json:"unauthorized"`
	ClientError  int64 `json:"client_error"`
	ServerError  int64 `json:"server_error"`
	Failed       int64 `json:"failed"`
	Blocked      int64 `json:"blocked"`
	Unknown      int64 `json:"unknown"`
}

MCPOutcomeSummary is a server's calls in the window, already summed per outcome class. There is no per-bucket series: an external MCP client has no scratch compute to add one up with.

type MCPReadiness 

type MCPReadiness struct {
	State     string `json:"state"`
	CheckedAt string `json:"checked_at,omitempty"`
	ExpiresAt string `json:"expires_at,omitempty"`
}

type MCPRegistration 

type MCPRegistration struct {
	ID                 string `json:"id"`
	Status             string `json:"status"`
	ComponentsComplete bool   `json:"components_complete"`
}

type MCPRoleCoverage 

type MCPRoleCoverage struct {
	Name                string                     `json:"name"`
	Type                string                     `json:"type"`
	MemberCount         SubjectCount               `json:"member_count"`
	Reference           string                     `json:"reference"`
	Version             string                     `json:"version"`
	CanEnterServer      bool                       `json:"can_enter_server"`
	KnownToolAccess     string                     `json:"known_tool_access"`
	AllowedKnownTools   []string                   `json:"allowed_known_tools"`
	DispositionRules    []string                   `json:"disposition_rules"`
	BlockedDispositions []string                   `json:"blocked_dispositions"`
	UnevaluatedGrants   bool                       `json:"unevaluated_grants"`
	AssignmentRules     []AccessRoleAssignmentRule `` /* 171-byte string literal not displayed */
	AssignmentEligible  bool                       `` /* 180-byte string literal not displayed */
}

type MCPSource 

type MCPSource struct {
	Kind      string `json:"kind"`
	Provider  string `json:"provider,omitempty"`
	Reference string `json:"reference,omitempty"`
}

type MCPToolEvents 

type MCPToolEvents struct {
	ToolName string            `json:"tool_name"`
	Outcomes MCPOutcomeSummary `json:"outcomes"`
}

MCPToolEvents is one tool's calls in the window, already summed per outcome.

type MCPTraceReference 

type MCPTraceReference struct {
	Reference  string `json:"reference"`
	OccurredAt string `json:"occurred_at"`
	ToolName   string `json:"tool_name,omitempty"`
	Outcome    string `json:"outcome"`
	Client     string `json:"client"`
}

MCPTraceReference is one occurrence, reduced to what an investigation needs: when it happened, which tool, how it ended, and an opaque handle to quote. It carries no arguments, results, bodies, headers, URLs, or identities.

type MCPUsageUser 

type MCPUsageUser struct {
	SubjectReference string `json:"subject_reference"`
	MaskedIdentity   string `json:"masked_identity"`
	Activity         string `json:"activity"`
	Errors           string `json:"errors"`
	Blocked          string `json:"blocked"`
	LastUsedAt       string `json:"last_used_at"`
}

MCPUsageUser is one masked caller with categorical evidence. Exact individual call counts are deliberately absent; aggregate event counts live on the tool breakdown instead.

type ManagementService 

type ManagementService struct {
	// contains filtered or unexported fields
}

ManagementService exposes the session-authenticated dashboard projection. It deliberately returns only bounded lifecycle state; setup handoffs, OAuth values, provider material, and internal resource identifiers stay private.

func NewManagementService 

func NewManagementService(logger *slog.Logger, tracerProvider trace.TracerProvider, db *pgxpool.Pool, sessionManager *sessions.Manager, authzEngine *authz.Engine, gate Gate, authorizer Authorizer, mcpURL string, registrations *RegistrationService, readiness *ReadinessService, distributions *DistributionService, versionTokenKey string, catalog Catalog) *ManagementService

func (*ManagementService) APIKeyAuth 

func (s *ManagementService) APIKeyAuth(ctx context.Context, key string, schema *security.APIKeyScheme) (context.Context, error)

func (*ManagementService) DismissOnboarding 

func (s *ManagementService) DismissOnboarding(ctx context.Context, _ *platformmcpgen.DismissOnboardingPayload) error

func (*ManagementService) DistributeOnboardingCandidate 

func (s *ManagementService) DistributeOnboardingCandidate(ctx context.Context, payload *platformmcpgen.DistributeOnboardingCandidatePayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) GetOnboarding 

func (s *ManagementService) GetOnboarding(ctx context.Context, _ *platformmcpgen.GetOnboardingPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RecheckOnboardingReadiness 

func (s *ManagementService) RecheckOnboardingReadiness(ctx context.Context, _ *platformmcpgen.RecheckOnboardingReadinessPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RecordAgentConfigurationCopied 

func (s *ManagementService) RecordAgentConfigurationCopied(ctx context.Context, _ *platformmcpgen.RecordAgentConfigurationCopiedPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RecordDashboardCtaEvent 

func (s *ManagementService) RecordDashboardCtaEvent(ctx context.Context, payload *platformmcpgen.RecordDashboardCtaEventPayload) error

func (*ManagementService) RecordInstallIntent 

func (s *ManagementService) RecordInstallIntent(ctx context.Context, payload *platformmcpgen.RecordInstallIntentPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RemoveOnboardingDistribution 

func (s *ManagementService) RemoveOnboardingDistribution(ctx context.Context, payload *platformmcpgen.RemoveOnboardingDistributionPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RepairOnboardingPublication 

func (s *ManagementService) RepairOnboardingPublication(ctx context.Context, payload *platformmcpgen.RepairOnboardingPublicationPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) StartOnboarding 

func (s *ManagementService) StartOnboarding(ctx context.Context, payload *platformmcpgen.StartOnboardingPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) StartOnboardingSetup 

func (s *ManagementService) StartOnboardingSetup(ctx context.Context, _ *platformmcpgen.StartOnboardingSetupPayload) (*platformmcpgen.PlatformMCPOnboardingSetupHandoff, error)

type MemoryDocsIndex 

type MemoryDocsIndex struct {
	// contains filtered or unexported fields
}

MemoryDocsIndex searches the pinned corpus in process. It holds no network client and no vendor dependency, which is what lets the public tool stay provider-neutral while the corpus is small enough that nothing more is warranted.

func NewMemoryDocsIndex 

func NewMemoryDocsIndex(resources []SetupResource, now func() time.Time) *MemoryDocsIndex

NewMemoryDocsIndex indexes the reviewed corpus by markdown heading. now is injected so freshness is evaluated against a test's clock rather than the wall clock at process start.

func (*MemoryDocsIndex) Search 

func (i *MemoryDocsIndex) Search(_ context.Context, query string, limit int) ([]DocsExcerpt, error)

Search returns the best-scoring excerpts. Content past its grace window is omitted entirely rather than ranked low: an unreviewed step that loses on score today wins on score tomorrow.

type OAuthEvent 

type OAuthEvent struct {
	Operation string
	Outcome   string
	Reason    string
}

type OAuthHTTP 

type OAuthHTTP struct {
	// contains filtered or unexported fields
}

OAuthHTTP serves the Platform MCP-owned authorization server. It deliberately does not import hosted MCP runtime or persistence packages.

func NewOAuthHTTP 

func NewOAuthHTTP(config OAuthHTTPConfig) (*OAuthHTTP, error)

func (*OAuthHTTP) Attach 

func (s *OAuthHTTP) Attach(mux interface {
	Handle(string, string, http.HandlerFunc)
})

func (*OAuthHTTP) Audience 

func (s *OAuthHTTP) Audience() string

func (*OAuthHTTP) AuthorizationServerHandler 

func (s *OAuthHTTP) AuthorizationServerHandler() http.Handler

func (*OAuthHTTP) AuthorizeHandler 

func (s *OAuthHTTP) AuthorizeHandler() http.Handler

func (*OAuthHTTP) ConnectHandler 

func (s *OAuthHTTP) ConnectHandler() http.Handler

func (*OAuthHTTP) IDPCallbackHandler 

func (s *OAuthHTTP) IDPCallbackHandler() http.Handler

func (*OAuthHTTP) Issuer 

func (s *OAuthHTTP) Issuer() string

func (*OAuthHTTP) OrganizationSelectionHandler 

func (s *OAuthHTTP) OrganizationSelectionHandler() http.Handler

func (*OAuthHTTP) ProtectedResourceHandler 

func (s *OAuthHTTP) ProtectedResourceHandler() http.Handler

func (*OAuthHTTP) ProtectedResourceURL 

func (s *OAuthHTTP) ProtectedResourceURL() string

func (*OAuthHTTP) ProviderSetupCompleteHandler 

func (s *OAuthHTTP) ProviderSetupCompleteHandler() http.Handler

ProviderSetupCompleteHandler is the fixed server-owned landing page after a reviewed remote-session provider callback persists its tokens. It carries no provider identity, tokens, state, or handoff values.

func (*OAuthHTTP) ProviderSetupCompletionURL 

func (s *OAuthHTTP) ProviderSetupCompletionURL() string

ProviderSetupCompletionURL is the only callback landing page accepted for Platform MCP provider authorization. It is server-owned and carries no state.

func (*OAuthHTTP) RegisterHandler 

func (s *OAuthHTTP) RegisterHandler() http.Handler

func (*OAuthHTTP) RevokeHandler 

func (s *OAuthHTTP) RevokeHandler() http.Handler

func (*OAuthHTTP) TokenHandler 

func (s *OAuthHTTP) TokenHandler() http.Handler

type OAuthHTTPConfig 

type OAuthHTTPConfig struct {
	BaseURL       *url.URL
	Environment   string
	Cache         cache.Cache
	Store         platformoauth.Store
	Identity      BrowserIdentity
	Gate          Gate
	Authorizer    Authorizer
	Organizations OrganizationSelector
	Signer        *sessiontokens.Signer
	Encryption    *encryption.Client
	Telemetry     OAuthTelemetry
	Logger        *slog.Logger
	// GuardianPolicy backs the CIMD document fetcher's SSRF protection.
	// Nil leaves inbound CIMD disabled.
	GuardianPolicy *guardian.Policy
	MeterProvider  metric.MeterProvider
}

type OAuthTelemetry 

type OAuthTelemetry interface {
	Record(context.Context, OAuthEvent)
	RecordRefreshSuccess(context.Context, time.Duration, time.Duration)
	RecordTerminalTransition(context.Context, platformoauth.ReauthorizationReason)
}

func NewOAuthTelemetry 

func NewOAuthTelemetry(logger *slog.Logger, meterProvider metric.MeterProvider) OAuthTelemetry

type OnboardingClientFamily 

type OnboardingClientFamily string
const (
	OnboardingClientClaudeCode   OnboardingClientFamily = "claude_code"
	OnboardingClientClaudeCowork OnboardingClientFamily = "claude_cowork"
	OnboardingClientCodex        OnboardingClientFamily = "codex"
	OnboardingClientCursor       OnboardingClientFamily = "cursor"
	OnboardingClientOpencode     OnboardingClientFamily = "opencode"
	// Any agent outside the certified set. It has no plugin package, so its
	// walkthrough offers the remote MCP configuration only.
	OnboardingClientOther OnboardingClientFamily = "other"
)

type OnboardingConnection 

type OnboardingConnection struct {
	ID             uuid.UUID
	Generation     uuid.UUID
	AuthorizedAt   *time.Time
	ReauthorizedAt *time.Time
	Ready          bool
}

type OnboardingProjection 

type OnboardingProjection struct {
	Workflow                  *OnboardingWorkflow
	Connections               []OnboardingConnection
	EvidenceConnection        *OnboardingConnection
	ConnectionAuthState       string
	ReauthorizationReason     string
	SelectedProject           *ResolvedProject
	CatalogExplored           bool
	RegistrationSucceeded     bool
	DistributionToolSucceeded bool
	ReadinessVerified         bool
	OrganizationSetupComplete bool
	Stage                     OnboardingStage
}

type OnboardingService 

type OnboardingService struct {
	// contains filtered or unexported fields
}

OnboardingService owns the user- and organization-bound workflow projection consumed by the session-authenticated dashboard. It never stores prompts, provider material, OAuth values, or setup handoffs.

func NewOnboardingService 

func NewOnboardingService(db *pgxpool.Pool) *OnboardingService

func (*OnboardingService) BindRegistration 

func (s *OnboardingService) BindRegistration(ctx context.Context, organizationID, userID string, projectID, registrationID uuid.UUID) (OnboardingProjection, error)

func (*OnboardingService) BindRegistrationForPrincipal 

func (s *OnboardingService) BindRegistrationForPrincipal(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) (OnboardingProjection, error)

BindRegistrationForPrincipal associates an MCP-created registration with the caller's active workflow only when the project and registration were resolved by the same organization-bound principal.

func (*OnboardingService) Dismiss 

func (s *OnboardingService) Dismiss(ctx context.Context, organizationID, userID string) error

func (*OnboardingService) Get 

func (s *OnboardingService) Get(ctx context.Context, organizationID, userID string) (OnboardingProjection, error)

func (*OnboardingService) RecordAgentConfigurationCopied 

func (s *OnboardingService) RecordAgentConfigurationCopied(ctx context.Context, organizationID, userID string) (OnboardingProjection, error)

func (*OnboardingService) RecordCatalogExplored 

func (s *OnboardingService) RecordCatalogExplored(ctx context.Context, principal Principal) error

BindRegistration stores the server-owned selected target on the caller's active workflow. The registration ID remains internal and is never projected to dashboard callers.

func (*OnboardingService) RecordDistributionSucceeded 

func (s *OnboardingService) RecordDistributionSucceeded(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) error

func (*OnboardingService) RecordInstallIntent 

func (s *OnboardingService) RecordInstallIntent(ctx context.Context, organizationID, userID string, client OnboardingClientFamily) (OnboardingProjection, error)

func (*OnboardingService) RecordReadinessVerified 

func (s *OnboardingService) RecordReadinessVerified(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) error

func (*OnboardingService) RecordRegistrationSucceeded 

func (s *OnboardingService) RecordRegistrationSucceeded(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) error

func (*OnboardingService) Start 

func (s *OnboardingService) Start(ctx context.Context, organizationID, userID string, source ...OnboardingSourceSurface) (OnboardingProjection, error)

type OnboardingSourceSurface 

type OnboardingSourceSurface string
const (
	OnboardingSourcePlatformMCPSettings OnboardingSourceSurface = "platform_mcp_settings"
	OnboardingSourceOrganizationSetup   OnboardingSourceSurface = "organization_setup"
	OnboardingSourcePlatformPlugins     OnboardingSourceSurface = "platform_plugins"
	OnboardingSourceSidebarFooter       OnboardingSourceSurface = "sidebar_footer"
	OnboardingSourceSourcesEmpty        OnboardingSourceSurface = "sources_empty"
	OnboardingSourceProjectOverview     OnboardingSourceSurface = "project_overview_zero_data"
	OnboardingSourceOrganizationHome    OnboardingSourceSurface = "organization_home"
)

type OnboardingStage 

type OnboardingStage string
const (
	OnboardingStageNotStarted          OnboardingStage = "not_started"
	OnboardingStageInstallInstructions OnboardingStage = "install_instructions"
	OnboardingStageAuthorized          OnboardingStage = "authorized"
	OnboardingStageConnectionReady     OnboardingStage = "connection_ready"
)

type OnboardingWorkflow 

type OnboardingWorkflow struct {
	ID                         uuid.UUID
	SourceSurface              string
	ClientFamily               OnboardingClientFamily
	AgentConfigurationCopiedAt *time.Time
	Status                     string
	ExpiresAt                  time.Time
	SelectedProjectID          uuid.UUID
	SelectedRegistrationID     uuid.UUID
}

type OperationBudget 

type OperationBudget struct {
	Connection   Limiter
	Organization Limiter
}

OperationBudget applies independently configured connection and organization buckets. Connection is always charged first; a denial prevents the second bucket, mutations, and provider egress.

func (OperationBudget) Allow 

func (b OperationBudget) Allow(ctx context.Context, principal Principal) error

func (OperationBudget) AllowConnectionOrOrganization 

func (b OperationBudget) AllowConnectionOrOrganization(ctx context.Context, principal Principal) error

AllowConnectionOrOrganization charges OAuth calls to both their connection and organization buckets. A connection-less assistant has no connection to charge, so it consumes only the organization allowance.

type OperationBudgets 

type OperationBudgets struct {
	Catalog      OperationBudget
	Registration OperationBudget
	Handoff      OperationBudget
	SetupStart   OperationBudget
	Repair       OperationBudget
	Docs         OperationBudget
	// Skills meters authoring and distribution together. Reads and writes share
	// one allowance because they are one workflow: a caller reads a skill to
	// obtain the version token its next write needs, and metering the read
	// separately would only let a loop spend twice as much reaching the same
	// write.
	Skills            OperationBudget
	LifecycleMetadata OperationBudget
	// Plugins meters the plugin inventory reads. They are bounded PostgreSQL
	// reads of a project's own plugins, metered separately from diagnostics so
	// an administrator walking the inventory does not spend the allowance the
	// failure diagnosis it leads to will need.
	Plugins OperationBudget
	// AccessReads meters role/member access inspection separately. Member search
	// returns masked personal data and must not be fundable by another read lane.
	AccessReads OperationBudget
	// AccessRoleMutations independently meters custom MCP access-role writes.
	AccessRoleMutations OperationBudget
	// Diagnostics meters the observability reads. They are bounded aggregate
	// queries over Gram-owned telemetry, so the cost being metered is the
	// ClickHouse scan, not an external egress.
	Diagnostics OperationBudget
	// SensitiveDiagnostics meters the bounded drill-downs. It is separate from
	// Diagnostics so exhausting it is not possible by spending the summary
	// allowance, and so it can be tightened on its own.
	SensitiveDiagnostics OperationBudget
	// SensitiveSessionRecall meters continue_session — the only operation that
	// serves whole-transcript content — on its own low allowance.
	SensitiveSessionRecall OperationBudget
	// RiskMutations is shared by policy and exclusion writes. Connection-less
	// assistant calls consume only its organization bucket.
	RiskMutations OperationBudget

	// DrilldownVolume meters what the drill-downs return rather than how often
	// they are called: rows and spans against one bucket, metric queries
	// against another, both per connection over DrilldownVolumeWindow.
	DrilldownVolume DrilldownVolumeBudget
}

OperationBudgets groups the independently metered public Platform MCP operations. Every value is injected at composition; no production defaults are assigned here.

func (OperationBudgets) Valid 

func (b OperationBudgets) Valid() bool

type OperationReceipt 

type OperationReceipt struct {
	ID             uuid.UUID
	RegistrationID uuid.NullUUID
	Status         string
	ResultCode     string
	ResultPayload  []byte
	InputHash      string
	ExpiresAt      time.Time
	Replayed       bool
	// Invalid when the receipt was written by a surface with no OAuth
	// connection. Unwrapping these to a bare uuid.Nil would be read downstream
	// as "connection missing" rather than "no connection applies".
	ConnectionID         uuid.NullUUID
	ConnectionGeneration uuid.NullUUID
}

type OrganizationEvent 

type OrganizationEvent struct {
	OccurredAt  string `json:"occurred_at"`
	Kind        string `json:"kind"`
	Source      string `json:"source"`
	Name        string `json:"name"`
	BodyPreview string `json:"body_preview,omitempty"`
	ProjectID   string `json:"project_id,omitempty"`
}

type OrganizationGate 

type OrganizationGate struct {
	// contains filtered or unexported fields
}

OrganizationGate enforces the durable organization-admin entitlement. Any unavailable dependency fails closed.

func NewOrganizationGate 

func NewOrganizationGate(capabilities CapabilityChecker) *OrganizationGate

func (*OrganizationGate) Enabled 

func (g *OrganizationGate) Enabled(ctx context.Context, organizationID string) (bool, error)

type OrganizationOption 

type OrganizationOption struct {
	ID   string
	Name string
}

type OrganizationSelector 

type OrganizationSelector interface {
	EligibleOrganizations(ctx context.Context, userID string) ([]OrganizationOption, error)
}

type OrganizationSlugResolver 

type OrganizationSlugResolver interface {
	OrganizationSlug(ctx context.Context, organizationID string) (string, error)
}

OrganizationSlugResolver is the narrow organization lookup needed to target the exact-project risk mutation kill switch. It remains separate from the product-feature-only Platform MCP organization gate.

type PlatformContext 

type PlatformContext struct {
	OrganizationID string `json:"organization_id"`
	ConnectionID   string `json:"connection_id"`
	ReadOnly       bool   `json:"read_only"`
	// Overview orients a caller that has only ever seen this server's tool
	// names. The manifest can say what one tool does; only something read at
	// the start of a conversation can say how the pieces relate, which is what
	// keeps a reply from narrating the machinery instead of the outcome.
	Overview string `json:"overview"`
}

type Plugin 

type Plugin struct {
	// ID is the plugin id, and is what a distribution target should name to be
	// unambiguous.
	ID string `json:"id"`

	// Name is the administrator-facing plugin name.
	Name string `json:"name"`

	// Slug is the plugin's project-unique slug.
	Slug string `json:"slug"`

	// Description is the plugin's description, absent when it has none.
	Description string `json:"description,omitempty"`

	// IsDefault marks the project's fallback plugin.
	IsDefault bool `json:"is_default"`

	// ServerCount is how many MCP servers the plugin carries.
	ServerCount int64 `json:"server_count"`

	// SkillCount is how many skills the plugin carries.
	SkillCount int64 `json:"skill_count"`

	// Assignments summarizes who receives the plugin.
	Assignments PluginAssignmentSummary `json:"assignments"`

	// Publication is the plugin's package publication state.
	Publication string `json:"publication"`
}

Plugin is the inventory projection of one plugin: what it is, how much it carries, who receives it, and whether it has been published.

type PluginAssignmentMutationError 

type PluginAssignmentMutationError struct {
	Code    string
	Message string
	Cause   error
}

func (*PluginAssignmentMutationError) Error 

func (e *PluginAssignmentMutationError) Error() string

func (*PluginAssignmentMutationError) Unwrap 

func (e *PluginAssignmentMutationError) Unwrap() error

type PluginAssignmentMutationPlugin 

type PluginAssignmentMutationPlugin struct {
	ID          string                  `json:"id"`
	Name        string                  `json:"name"`
	Slug        string                  `json:"slug"`
	IsDefault   bool                    `json:"is_default"`
	Assignments PluginAssignmentSummary `json:"assignments"`
	Publication string                  `json:"publication"`
}

type PluginAssignmentMutationReceiptStore 

type PluginAssignmentMutationReceiptStore struct {
	// contains filtered or unexported fields
}

func NewPluginAssignmentMutationReceiptStore 

func NewPluginAssignmentMutationReceiptStore(db *pgxpool.Pool) *PluginAssignmentMutationReceiptStore

func (*PluginAssignmentMutationReceiptStore) Execute 

func (s *PluginAssignmentMutationReceiptStore) Execute(ctx context.Context, principal Principal, project ResolvedProject, idempotencyKey string, normalized normalizedSetPluginAssignments, mutate PluginAssignmentMutationTransaction) (OperationReceipt, error)

type PluginAssignmentMutationTransaction 

type PluginAssignmentMutationTransaction func(context.Context, pgx.Tx) (SetPluginAssignmentsReceiptResult, error)

type PluginAssignmentOption 

type PluginAssignmentOption struct {
	Kind        string        `json:"kind"`
	DisplayName string        `json:"display_name"`
	MemberCount *SubjectCount `json:"member_count,omitempty"`
	Reference   string        `json:"reference"`
}

PluginAssignmentOption is one current organization assignment target that can receive a plugin. Reference is encrypted and short-lived; the underlying principal URN never leaves the server. MemberCount is omitted for Everyone.

type PluginAssignmentSummary 

type PluginAssignmentSummary struct {
	// AllMembers is true when the plugin is assigned to every organization
	// member through the wildcard principal.
	AllMembers bool `json:"all_members"`

	// Roles is how many role principals the plugin is assigned to.
	Roles int64 `json:"roles"`

	// Users is how many individual principals the plugin is assigned to.
	Users int64 `json:"users"`
}

PluginAssignmentSummary is who receives a plugin, projected as counts rather than principals. A plugin assignment holds a principal URN that embeds a user id, which this surface must not carry.

type PluginAssignmentSummaryResult 

type PluginAssignmentSummaryResult struct {
	Kind        string        `json:"kind"`
	DisplayName string        `json:"display_name"`
	MemberCount *SubjectCount `json:"member_count,omitempty"`
}

type PluginRef 

type PluginRef struct {
	// ID is the resolved plugin id.
	ID uuid.UUID

	// Name is the resolved plugin name.
	Name string

	// Slug is the resolved plugin slug.
	Slug string

	// IsDefault marks the project's fallback plugin, so a caller can tell that
	// a name happened to resolve to it rather than being sent there implicitly.
	IsDefault bool
}

PluginRef is one resolved plugin. It is echoed back by every distribution so a caller sees which plugin its name resolved to rather than inferring it.

type PluginServer 

type PluginServer struct {
	// DisplayName is the name the generated package gives this server.
	DisplayName string `json:"display_name"`

	// Backend is what the entry is backed by: "toolset" or "mcp_server".
	Backend string `json:"backend"`

	// MCPSlug is the server's MCP slug, empty when the backing server has no
	// usable endpoint.
	MCPSlug string `json:"mcp_slug,omitempty"`

	// Policy is "required" or "optional" for the installing client.
	Policy string `json:"policy"`

	// Enabled is false when the backing server is disabled, in which case the
	// plugin carries an entry that currently serves nothing.
	Enabled bool `json:"enabled"`
}

PluginServer is one MCP server a plugin carries. It names the server; it does not hand out an endpoint URL.

type PluginSkill 

type PluginSkill struct {
	// Name is the skill name.
	Name string `json:"name"`

	// PinnedVersionID is the version the distribution is pinned to, empty when
	// it follows the skill's latest valid version.
	PinnedVersionID string `json:"pinned_version_id,omitempty"`

	// FollowsLatest is true when no version is pinned, so authoring a new
	// version changes what this plugin ships.
	FollowsLatest bool `json:"follows_latest"`
}

PluginSkill is one skill a plugin carries.

type PluginTargetResolver 

type PluginTargetResolver interface {
	ResolvePlugin(ctx context.Context, principal Principal, projectID uuid.UUID, wanted string) (PluginRef, error)
}

PluginTargetResolver resolves the exact plugin a distribution names. It is the same resolution the plugin inventory tools expose, so a target that list_plugins shows is a target a distribution can name.

type PluginsService 

type PluginsService struct {
	// contains filtered or unexported fields
}

PluginsService answers what plugins a project has and what is inside one, and resolves the exact plugin a distribution names.

func NewPluginsService 

func NewPluginsService(db *pgxpool.Pool, budget OperationBudget, cursorKeyMaterial string) *PluginsService

func (*PluginsService) GetPlugin 

func (s *PluginsService) GetPlugin(ctx context.Context, principal Principal, input GetPluginInput) (GetPluginOutput, error)

func (*PluginsService) ListPluginAssignments 

func (s *PluginsService) ListPluginAssignments(ctx context.Context, principal Principal, input ListPluginAssignmentsInput) (ListPluginAssignmentsOutput, error)

func (*PluginsService) ListPlugins 

func (s *PluginsService) ListPlugins(ctx context.Context, principal Principal, input ListPluginsInput) (ListPluginsOutput, error)

func (*PluginsService) ResolveAssignmentReferences 

func (s *PluginsService) ResolveAssignmentReferences(ctx context.Context, tx pgx.Tx, principal Principal, project ResolvedProject, references []string) ([]string, []PluginAssignmentSummaryResult, error)

ResolveAssignmentReferences decodes current role/directory audience handles for another Platform MCP access workflow without exposing principal URNs.

func (*PluginsService) ResolvePlugin 

func (s *PluginsService) ResolvePlugin(ctx context.Context, principal Principal, projectID uuid.UUID, wanted string) (PluginRef, error)

ResolvePlugin matches one plugin in the project exactly. A name that matches nothing is not_found and a name that matches more than one is ambiguous; neither falls back to the default plugin.

func (*PluginsService) SetPluginAssignments 

func (s *PluginsService) SetPluginAssignments(ctx context.Context, principal Principal, input SetPluginAssignmentsInput) (SetPluginAssignmentsOutput, error)

func (*PluginsService) WithAssignmentMutations 

func (s *PluginsService) WithAssignmentMutations(flags feature.Provider, organizations OrganizationSlugResolver, logger *audit.Logger, budget OperationBudget) *PluginsService

WithAssignmentMutations enables the separately gated write half of the plugin service. Inventory reads remain available when any write dependency is absent.

type PostgresDirectRemoteApprovals 

type PostgresDirectRemoteApprovals struct{}

PostgresDirectRemoteApprovals reads enabled Shadow MCP policies and their URL-scoped grants. It is a narrow adapter over the existing enforcement data, not a parallel approval system.

func NewPostgresDirectRemoteApprovals 

func NewPostgresDirectRemoteApprovals() *PostgresDirectRemoteApprovals

func (*PostgresDirectRemoteApprovals) CheckDirectRemoteApprovalTx 

func (c *PostgresDirectRemoteApprovals) CheckDirectRemoteApprovalTx(ctx context.Context, db riskrepo.DBTX, organizationID, userID string, projectID uuid.UUID, remoteURL string) (DirectRemoteApprovalState, error)

type PostgresLifecycleStore 

type PostgresLifecycleStore struct {
	// contains filtered or unexported fields
}

func NewPostgresLifecycleStore 

func NewPostgresLifecycleStore(db *pgxpool.Pool) *PostgresLifecycleStore

func (*PostgresLifecycleStore) GetLifecycle 

func (s *PostgresLifecycleStore) GetLifecycle(ctx context.Context, organizationID string) (Lifecycle, error)

func (*PostgresLifecycleStore) RevokeConnection 

func (s *PostgresLifecycleStore) RevokeConnection(ctx context.Context, organizationID, connectionID string, now time.Time) error

type PostgresNewModelEligibility 

type PostgresNewModelEligibility struct {
	// contains filtered or unexported fields
}

func NewPostgresNewModelEligibility 

func NewPostgresNewModelEligibility(db *pgxpool.Pool) *PostgresNewModelEligibility

func (*PostgresNewModelEligibility) EligibleForPlatformMCP 

func (e *PostgresNewModelEligibility) EligibleForPlatformMCP(ctx context.Context, organizationID string) (bool, error)

type PostgresOAuthStore 

type PostgresOAuthStore struct {
	// contains filtered or unexported fields
}

PostgresOAuthStore persists the Platform MCP-owned OAuth lifecycle. It keeps opaque codes and refresh tokens hashed, and uses transactions for every transition that locks or invalidates a grant/session family.

func NewPostgresOAuthStore 

func NewPostgresOAuthStore(db *pgxpool.Pool) *PostgresOAuthStore

func (*PostgresOAuthStore) AuthorizeConnection 

func (s *PostgresOAuthStore) AuthorizeConnection(ctx context.Context, input platformoauth.AuthorizeConnectionInput) (platformoauth.Connection, error)

func (*PostgresOAuthStore) ConsumeGrant 

func (s *PostgresOAuthStore) ConsumeGrant(ctx context.Context, input platformoauth.ConsumeGrantInput) (platformoauth.Grant, error)

func (*PostgresOAuthStore) CreateSession 

func (s *PostgresOAuthStore) CreateSession(ctx context.Context, session platformoauth.Session) error

func (*PostgresOAuthStore) DetectRefreshReuse 

func (s *PostgresOAuthStore) DetectRefreshReuse(ctx context.Context, organizationID, refreshHash string, now time.Time) (bool, error)

func (*PostgresOAuthStore) ExchangeGrant 

func (s *PostgresOAuthStore) ExchangeGrant(ctx context.Context, input platformoauth.ExchangeGrantInput) (platformoauth.Grant, error)

func (*PostgresOAuthStore) GetClient 

func (s *PostgresOAuthStore) GetClient(ctx context.Context, clientID string) (platformoauth.Client, error)

func (*PostgresOAuthStore) GetConnection 

func (s *PostgresOAuthStore) GetConnection(ctx context.Context, organizationID, subject, clientID string) (platformoauth.Connection, error)

func (*PostgresOAuthStore) GetSessionByRefreshHash 

func (s *PostgresOAuthStore) GetSessionByRefreshHash(ctx context.Context, organizationID, refreshHash string) (platformoauth.Session, error)

func (*PostgresOAuthStore) IssueGrant 

func (s *PostgresOAuthStore) IssueGrant(ctx context.Context, grant platformoauth.Grant) error

func (*PostgresOAuthStore) MarkAuthorizationLost 

func (s *PostgresOAuthStore) MarkAuthorizationLost(ctx context.Context, organizationID, connectionID, generation string, now time.Time) error

func (*PostgresOAuthStore) PrepareRefresh 

func (s *PostgresOAuthStore) PrepareRefresh(ctx context.Context, input platformoauth.PrepareRefreshInput) (platformoauth.Session, error)

func (*PostgresOAuthStore) RegisterClient 

func (s *PostgresOAuthStore) RegisterClient(ctx context.Context, client platformoauth.Client) error

func (*PostgresOAuthStore) RegisterConnection 

func (s *PostgresOAuthStore) RegisterConnection(ctx context.Context, connection platformoauth.Connection) error

func (*PostgresOAuthStore) RevokeAccessSession 

func (s *PostgresOAuthStore) RevokeAccessSession(ctx context.Context, organizationID, jti, clientID string, now time.Time) (platformoauth.Session, error)

func (*PostgresOAuthStore) RevokeClient 

func (s *PostgresOAuthStore) RevokeClient(ctx context.Context, clientID string, now time.Time) error

func (*PostgresOAuthStore) RevokeConnection 

func (s *PostgresOAuthStore) RevokeConnection(ctx context.Context, organizationID, connectionID string, now time.Time) error

func (*PostgresOAuthStore) RevokeSession 

func (s *PostgresOAuthStore) RevokeSession(ctx context.Context, organizationID, refreshHash, clientID string, now time.Time) (platformoauth.Session, error)

func (*PostgresOAuthStore) RotateConnectionGeneration 

func (s *PostgresOAuthStore) RotateConnectionGeneration(ctx context.Context, organizationID, connectionID, generation string, now time.Time) (platformoauth.Connection, error)

func (*PostgresOAuthStore) RotateSession 

func (s *PostgresOAuthStore) RotateSession(ctx context.Context, input platformoauth.RotateSessionInput) (platformoauth.Session, error)

func (*PostgresOAuthStore) TouchClientCIMDCache 

func (s *PostgresOAuthStore) TouchClientCIMDCache(ctx context.Context, input platformoauth.TouchCIMDCacheInput) (platformoauth.Client, error)

func (*PostgresOAuthStore) UpsertClientFromCIMD 

func (s *PostgresOAuthStore) UpsertClientFromCIMD(ctx context.Context, input platformoauth.UpsertCIMDClientInput) (platformoauth.Client, error)

func (*PostgresOAuthStore) ValidateGrant 

func (s *PostgresOAuthStore) ValidateGrant(ctx context.Context, input platformoauth.ValidateGrantInput) (platformoauth.Grant, error)

func (*PostgresOAuthStore) WithTelemetry 

func (s *PostgresOAuthStore) WithTelemetry(telemetry OAuthTelemetry) *PostgresOAuthStore

type PostgresOrganizationSlugResolver 

type PostgresOrganizationSlugResolver struct {
	// contains filtered or unexported fields
}

func NewPostgresOrganizationSlugResolver 

func NewPostgresOrganizationSlugResolver(db *pgxpool.Pool) *PostgresOrganizationSlugResolver

func (*PostgresOrganizationSlugResolver) OrganizationSlug 

func (r *PostgresOrganizationSlugResolver) OrganizationSlug(ctx context.Context, organizationID string) (string, error)

type PostgresReader 

type PostgresReader struct {
	// contains filtered or unexported fields
}

func NewPostgresReader 

func NewPostgresReader(logger *slog.Logger, db *pgxpool.Pool) *PostgresReader

func (*PostgresReader) CreateDataExport 

func (r *PostgresReader) CreateDataExport(ctx context.Context, principal Principal, input CreateDataExportInput) (CreateDataExportOutput, error)

func (*PostgresReader) FindMCP 

func (r *PostgresReader) FindMCP(ctx context.Context, principal Principal, input FindMCPInput) (FindMCPOutput, error)

func (*PostgresReader) GetMCP 

func (r *PostgresReader) GetMCP(ctx context.Context, principal Principal, input GetMCPInput) (MCP, error)

func (*PostgresReader) ListDataExports 

func (r *PostgresReader) ListDataExports(ctx context.Context, principal Principal, input ListDataExportsInput) (ListDataExportsOutput, error)

func (*PostgresReader) ListOrganizationEvents 

func (r *PostgresReader) ListOrganizationEvents(ctx context.Context, principal Principal, input ListOrganizationEventsInput) (ListOrganizationEventsOutput, error)

func (*PostgresReader) ListProjects 

func (r *PostgresReader) ListProjects(ctx context.Context, principal Principal, input ListProjectsInput) (ListProjectsOutput, error)

func (*PostgresReader) ListRecentToolCalls 

func (r *PostgresReader) ListRecentToolCalls(ctx context.Context, principal Principal, input ListRecentToolCallsInput) (ListRecentToolCallsOutput, error)

func (*PostgresReader) WithDataExportMutations 

func (r *PostgresReader) WithDataExportMutations(auditLogger *audit.Logger, dashboardURL *url.URL) *PostgresReader

WithDataExportMutations enables creation after the read dependencies have been configured. Secret headers remain dashboard-only.

func (*PostgresReader) WithDataExports 

func (r *PostgresReader) WithDataExports(encryptionClient *encryption.Client, dashboardURL *url.URL) *PostgresReader

WithDataExports enables the safe data export inventory on this reader.

func (*PostgresReader) WithOrganizationEvents 

func (r *PostgresReader) WithOrganizationEvents(events EventFeedReader, logs FeatureChecker, dashboardURL *url.URL) *PostgresReader

WithOrganizationEvents enables recent organization-scoped Event Feed summaries. A missing Logs checker leaves the live tool unregistered: the dashboard Event Feed is gated on that product feature, and a nil checker cannot enforce it.

func (*PostgresReader) WithRecentToolCalls 

func (r *PostgresReader) WithRecentToolCalls(telemetry RecentToolCallReader, dashboardURL *url.URL) *PostgresReader

WithRecentToolCalls enables recent project-scoped Tool Logs summaries.

func (*PostgresReader) WithShadowDecisions 

func (r *PostgresReader) WithShadowDecisions(service *ShadowDecisionService) *PostgresReader

func (*PostgresReader) WithShadowInventory 

func (r *PostgresReader) WithShadowInventory(service *ShadowInventoryService) *PostgresReader

type PostgresReadinessRecorder 

type PostgresReadinessRecorder struct {
	// contains filtered or unexported fields
}

func NewPostgresReadinessRecorder 

func NewPostgresReadinessRecorder(db *pgxpool.Pool) *PostgresReadinessRecorder

func (*PostgresReadinessRecorder) RecordReady 

func (r *PostgresReadinessRecorder) RecordReady(ctx context.Context, principal Principal, _ time.Time) error

type PostgresSkillTargets 

type PostgresSkillTargets struct {
	// contains filtered or unexported fields
}

PostgresSkillTargets reads the distribution targets a project actually has.

It reads the tables directly rather than calling the plugins and assistants management services: resolution needs two names and two ids, while those services return whole plugin and assistant records — and the plugins service provisions a missing default plugin as a side effect of listing, which is not something naming a target should do.

func NewPostgresSkillTargets 

func NewPostgresSkillTargets(db *pgxpool.Pool) *PostgresSkillTargets

func (*PostgresSkillTargets) SkillTargets 

func (s *PostgresSkillTargets) SkillTargets(ctx context.Context, organizationID string, projectID uuid.UUID, limitPerKind int) ([]SkillTarget, error)

type Principal 

type Principal struct {
	UserID         string
	OrganizationID string
	ConnectionID   string
	Generation     string
	ClientID       string
	Surface        ActingSurface
}

Principal is the identity a Platform MCP call acts under.

ConnectionID and Generation are empty together for a surface with no OAuth connection, and present together otherwise — the same invariant the connection columns carry in the database.

OrganizationID is always present. UserID is present for every surface that writes, because authorization, idempotency, and audit are keyed on the real user rather than on the connection; that is what makes a connection-less call attributable exactly as well as one with a connection.

func PrincipalFromContext 

func PrincipalFromContext(ctx context.Context) (Principal, bool)

func (Principal) HasConnection 

func (p Principal) HasConnection() bool

HasConnection reports whether this principal claims an OAuth connection.

Either half counts as a claim. A principal presenting one half has an incomplete identity rather than no connection, and must fail strict parsing instead of silently taking the connection-less path — which would record a user-attributed write for a connection the caller could not prove.

type Project 

type Project struct {
	ID   string `json:"id"`
	Name string `json:"name"`
	Slug string `json:"slug"`
}

type ProjectOverviewServer 

type ProjectOverviewServer struct {
	Name      string `json:"name"`
	ToolCalls int64  `json:"tool_calls"`
}

ProjectOverviewServer is one MCP server's share of the project's tool calls.

type ProjectOverviewSessionReader 

type ProjectOverviewSessionReader interface {
	GetActiveUserCountByMessages(ctx context.Context, arg chatrepo.GetActiveUserCountByMessagesParams) (int64, error)
}

ProjectOverviewSessionReader is the PostgreSQL side of a session-mode overview. In session mode the active-user count is a count of chat participants, which ClickHouse's tool-call lane cannot answer.

type ProjectPublisher 

type ProjectPublisher func(context.Context, uuid.UUID, string, string) error

ProjectPublisher is a post-commit adapter to the existing plugin publisher. The caller supplies only bounded identity and intent; no provider values or package details cross the Platform MCP boundary.

type ProjectScope 

type ProjectScope int

ProjectScope declares how a tool obtains the project it acts on. 

const (
	// ProjectScopeNone: the tool does not act on a single project.
	ProjectScopeNone ProjectScope = iota
	// ProjectScopeExplicit: the caller names the project. An external client
	// spans every project in its organization, so it has to say which.
	ProjectScopeExplicit
	// ProjectScopeDefaultable: an external caller may name an exact project or
	// omit both selectors to use the organization's literal default project. The
	// assistant still injects its own exact project and hides the selectors.
	ProjectScopeDefaultable
)

type ProviderAdapter 

type ProviderAdapter interface {
	ProviderKey() string
	PreflightSetup(ctx context.Context, request ProviderSetupRequest) error
	BeginSetup(ctx context.Context, request ProviderSetupRequest) (ProviderSetupResult, error)
	ProbeReadiness(ctx context.Context, request ProviderReadinessProbeRequest) (ProviderReadinessProbeResult, error)
}

ProviderAdapter is implemented only for a reviewed provider or the local deterministic fixture. The Platform MCP never accepts arbitrary adapters or provider endpoints from an MCP caller.

type ProviderAdapters 

type ProviderAdapters struct {
	// contains filtered or unexported fields
}

func NewProviderAdapters 

func NewProviderAdapters(adapters []ProviderAdapter) *ProviderAdapters

func (*ProviderAdapters) Get 

func (a *ProviderAdapters) Get(providerKey string) (ProviderAdapter, error)

type ProviderAuthorizationIdentity 

type ProviderAuthorizationIdentity struct {
	OrganizationID         string
	Subject                urn.SessionSubject
	RegistrationID         uuid.UUID
	RemoteSessionID        uuid.UUID
	RemoteSessionUpdatedAt time.Time
	RemoteSessionClientID  uuid.UUID
	RemoteSessionIssuerID  uuid.UUID
	Absence                string
}

ProviderAuthorizationIdentity contains the durable, non-secret identity of the shared provider authorization used for one Platform MCP registration.

type ProviderReadinessProbeRequest 

type ProviderReadinessProbeRequest struct {
	UserID              string
	OrganizationID      string
	ProjectID           uuid.UUID
	RegistrationID      uuid.UUID
	UserSessionIssuerID uuid.UUID
	ConnectionID        uuid.UUID
	Generation          uuid.UUID
}

type ProviderReadinessProbeResult 

type ProviderReadinessProbeResult struct {
	AuthorizationIdentity ProviderAuthorizationIdentity
	State                 ReadinessState
	EvidenceCode          string
	CheckedAt             time.Time
	ExpiresAt             time.Time
}

ProviderReadinessProbeResult normalizes the result of authenticated MCP initialize and tools/list negotiation. Adapters return durable authorization identity, never an opaque caller-defined fingerprint, raw protocol bodies, remote URLs, headers, credentials, or tokens.

type ProviderSetupRequest 

type ProviderSetupRequest struct {
	UserID              string
	OrganizationID      string
	ProjectID           uuid.UUID
	RegistrationID      uuid.UUID
	UserSessionIssuerID uuid.UUID
	MCPSlug             string
	ConnectionID        uuid.UUID
	Generation          uuid.UUID
	HandoffID           uuid.UUID
}

ProviderSetupRequest is created from a trusted, lifecycle-validated handoff. It contains identifiers, never a handoff value, OAuth value, provider secret, or remote URL. HandoffID is set only after the handoff is consumed.

type ProviderSetupResult 

type ProviderSetupResult struct {
	AuthorizationURL string
}

ProviderSetupResult carries only transient provider setup state. It must not include a bearer token, provider secret, or readiness fingerprint.

type QueryMCPEventsInput 

type QueryMCPEventsInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

QueryMCPEventsInput drills into one MCP's calls by tool. It has no free-text filter and no attribute selector: the only axis is the MCP the overview already named.

type QueryMCPEventsOutput 

type QueryMCPEventsOutput struct {
	ProjectID string          `json:"project_id"`
	MCPID     string          `json:"mcp_id"`
	Envelope  DataEnvelope    `json:"data"`
	Tools     []MCPToolEvents `json:"tools"`
	Truncated bool            `json:"truncated"`
}

type QueryMCPMetricsInput 

type QueryMCPMetricsInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h (default), or 7d"`
}

QueryMCPMetricsInput asks for one MCP's aggregate levels over a window.

type QueryMCPMetricsOutput 

type QueryMCPMetricsOutput struct {
	ProjectID string       `json:"project_id"`
	MCPID     string       `json:"mcp_id"`
	Envelope  DataEnvelope `json:"data"`

	ToolCalls       int64 `json:"tool_calls"`
	FailedToolCalls int64 `json:"failed_tool_calls"`
	// FailureRate is computed server-side and rounded to four decimal places.
	// Zero calls yields zero rather than an undefined ratio.
	FailureRate  float64      `json:"failure_rate"`
	AvgLatencyMs float64      `json:"avg_latency_ms"`
	ActiveUsers  SubjectCount `json:"active_users"`
	// ActiveUsersUnavailable reports that this MCP's model cannot be scoped by
	// the active-count read, so ActiveUsers is not an answer about this server.
	// Stated rather than left as a zero, which would read as "nobody".
	ActiveUsersUnavailable bool `json:"active_users_unavailable"`
}

QueryMCPMetricsOutput is aggregated to the window it names. There is deliberately no per-bucket series: an external MCP client has no scratch compute, and handing it buckets to sum would be a contract failure.

type QueryMCPTracesInput 

type QueryMCPTracesInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
	Outcome   string `` /* 153-byte string literal not displayed */
	Cursor    string `json:"cursor,omitempty" jsonschema:"opaque cursor returned by a previous query_mcp_traces result"`
}

QueryMCPTracesInput asks for individual occurrences of a failure class the overview or diagnostics already identified.

type QueryMCPTracesOutput 

type QueryMCPTracesOutput struct {
	ProjectID  string              `json:"project_id"`
	MCPID      string              `json:"mcp_id"`
	Envelope   DataEnvelope        `json:"data"`
	Traces     []MCPTraceReference `json:"traces"`
	NextCursor string              `json:"next_cursor,omitempty"`
}

type QuerySkillUsageInput 

type QuerySkillUsageInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID to summarize"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

type QuerySkillUsageOutput 

type QuerySkillUsageOutput struct {
	ProjectID string       `json:"project_id"`
	Envelope  DataEnvelope `json:"data"`
	Skills    []SkillUsage `json:"skills"`
	Truncated bool         `json:"truncated"`
}

type ReadGramDocToolInput 

type ReadGramDocToolInput struct {
	URI string `` /* 166-byte string literal not displayed */
}

type ReadGramDocToolOutput 

type ReadGramDocToolOutput struct {
	URI   string `json:"uri"`
	Title string `json:"title,omitempty"`
	// Text is the full reviewed guide, including its own citation header.
	Text    string `json:"text,omitempty"`
	Code    string `json:"code,omitempty"`
	Message string `json:"message,omitempty"`
	// TrustedLinks are where to send the reader when no guide can be served.
	// Withholding content must not withhold the trail to a reviewed source.
	TrustedLinks []string `json:"trusted_links,omitempty"`
}

type Reader 

type Reader interface {
	ListProjects(ctx context.Context, principal Principal, input ListProjectsInput) (ListProjectsOutput, error)
	FindMCP(ctx context.Context, principal Principal, input FindMCPInput) (FindMCPOutput, error)
	GetMCP(ctx context.Context, principal Principal, input GetMCPInput) (MCP, error)
}

type Readiness 

type Readiness struct {
	ID                   uuid.UUID
	ProjectID            uuid.UUID
	RegistrationID       uuid.UUID
	State                ReadinessState
	EvidenceCode         string
	CheckedAt            time.Time
	ExpiresAt            time.Time
	ConnectionID         uuid.UUID
	ConnectionGeneration uuid.UUID
	Fresh                bool
}

type ReadinessBinding 

type ReadinessBinding struct {
	ProjectID                        uuid.UUID
	RegistrationID                   uuid.UUID
	ProviderAuthorizationFingerprint string
}

type ReadinessRecorder 

type ReadinessRecorder interface {
	RecordReady(ctx context.Context, principal Principal, at time.Time) error
}

ReadinessRecorder persists authenticated discovery completion for a single connection generation. Its input is intentionally the authenticated principal, never an OAuth token or raw MCP message.

type ReadinessService 

type ReadinessService struct {
	// contains filtered or unexported fields
}

func NewReadinessService 

func NewReadinessService(store *RegistrationStore, gate CatalogRegistrationGateChecker, adapters *ProviderAdapters, forceLimiter Limiter, repairBudget OperationBudget, generic ...CatalogReadinessProber) *ReadinessService

func (*ReadinessService) CurrentReadiness 

func (s *ReadinessService) CurrentReadiness(ctx context.Context, principal Principal, projectSlug, registrationID string) (ResolvedProject, Readiness, bool, error)

CurrentReadiness loads existing, generation-bound readiness without probing a provider or consuming a repair budget. It is safe for the dashboard's authoritative projection to call while resuming after a reload.

func (*ReadinessService) GetReadiness 

func (s *ReadinessService) GetReadiness(ctx context.Context, principal Principal, projectSlug, registrationID string, force bool) (ResolvedProject, Readiness, bool, error)

func (*ReadinessService) GetRepairPlan 

func (s *ReadinessService) GetRepairPlan(ctx context.Context, principal Principal, projectSlug, registrationID string) (ResolvedProject, Readiness, bool, error)

func (*ReadinessService) WithTelemetry 

func (s *ReadinessService) WithTelemetry(telemetry LifecycleTelemetry) *ReadinessService

type ReadinessState 

type ReadinessState string
const (
	ReadinessReady                  ReadinessState = "ready"
	ReadinessNeedsProviderSetup     ReadinessState = "needs_provider_setup"
	ReadinessNeedsGramAuthorization ReadinessState = "needs_gram_authorization"
	ReadinessNeedsConfiguration     ReadinessState = "needs_configuration"
	ReadinessAuthFailed             ReadinessState = "auth_failed"
	ReadinessUnreachable            ReadinessState = "unreachable"
	ReadinessUnsupported            ReadinessState = "unsupported"
	ReadinessUnauthorized           ReadinessState = "unauthorized"
	ReadinessGuideUnavailable       ReadinessState = "guide_unavailable"
	ReadinessDegraded               ReadinessState = "degraded"
)

func ClassifyReadinessProbeFailure 

func ClassifyReadinessProbeFailure(err error) (ReadinessState, string)

ClassifyReadinessProbeFailure separates transport failures from invalid MCP responses without exposing the underlying network or protocol error. It is exported for provider adapters in child packages; callers receive only the closed state and evidence code, never the original error.

type RecallableSession 

type RecallableSession struct {
	SessionID   string `json:"session_id"`
	ChatID      string `json:"chat_id"`
	Title       string `json:"title,omitempty"`
	Summary     string `json:"summary,omitempty"`
	ProjectName string `json:"project_name"`
	ProjectSlug string `json:"project_slug"`
	Cwd         string `json:"cwd,omitempty"`
	LastActive  string `json:"last_active"`
}

RecallableSession is one captured session the caller owns — metadata only, never transcript content.

type RecentToolCall 

type RecentToolCall struct {
	OccurredAt string `json:"occurred_at"`
	ToolName   string `json:"tool_name,omitempty"`
	TargetType string `json:"target_type"`
	TargetKind string `json:"target_kind"`
	Target     string `json:"target,omitempty"`
	Outcome    string `json:"outcome"`
	Client     string `json:"client,omitempty"`
}

type RecentToolCallReadService 

type RecentToolCallReadService struct {
	// contains filtered or unexported fields
}

RecentToolCallReadService owns the summary reader and trusted dashboard URL.

type RecentToolCallReader 

type RecentToolCallReader interface {
	ListToolUsageTraces(ctx context.Context, arg telemetryrepo.ListToolUsageTracesParams) ([]telemetryrepo.ToolUsageTraceSummary, error)
}

RecentToolCallReader is the bounded Tool Logs summary read used by Platform MCP. It intentionally cannot read raw log bodies or attributes.

type RegisterCatalogMCPInput 

type RegisterCatalogMCPInput struct {
	ProjectSlug     string
	ProviderKey     string
	CatalogRef      string
	NonSecretConfig CatalogConfigurationValues
	IdempotencyKey  string
}

type RegisterCatalogMCPResult 

type RegisterCatalogMCPResult struct {
	Project             ResolvedProject
	ProviderKey         string
	CatalogRef          string
	SetupIntent         string
	Receipt             OperationReceipt
	Registration        string
	SecretFieldsPending []CatalogConfigurationField
}

type RegisterCatalogMCPToolInput 

type RegisterCatalogMCPToolInput struct {
	ProjectSlug     string                     `json:"project_slug" jsonschema:"explicit project slug that will own the reviewed MCP"`
	ProviderKey     string                     `json:"provider_key" jsonschema:"server-issued catalogue source identity returned by search_mcp_catalog"`
	CatalogRef      string                     `json:"catalog_ref" jsonschema:"exact catalogue reference returned by search_mcp_catalog"`
	NonSecretConfig CatalogConfigurationValues `` /* 248-byte string literal not displayed */
	IdempotencyKey  string                     `` /* 157-byte string literal not displayed */
}

type RegisterCatalogMCPToolOutput 

type RegisterCatalogMCPToolOutput struct {
	ProjectSlug         string                      `json:"project_slug"`
	ProviderKey         string                      `json:"provider_key"`
	CatalogRef          string                      `json:"catalog_ref"`
	SetupIntent         string                      `json:"setup_intent"`
	ReceiptID           string                      `json:"receipt_id"`
	RegistrationID      string                      `json:"registration_id"`
	Replayed            bool                        `json:"replayed"`
	NextAction          string                      `json:"next_action"`
	DashboardSetupURL   string                      `json:"dashboard_setup_url,omitempty"`
	SecretFieldsPending []CatalogConfigurationField `json:"secret_fields_pending,omitempty"`
}

type RegisterRemoteMCPInput 

type RegisterRemoteMCPInput struct {
	ProjectSlug    string
	RemoteURL      string
	DisplayName    string
	IdempotencyKey string
}

type RegisterRemoteMCPResult 

type RegisterRemoteMCPResult struct {
	Project           ResolvedProject
	RemoteURL         string
	Receipt           OperationReceipt
	Registration      string
	NextAction        string
	DashboardSetupURL string
}

type RegisterRemoteMCPToolInput 

type RegisterRemoteMCPToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that will own the user-supplied MCP"`
	RemoteURL      string `` /* 208-byte string literal not displayed */
	DisplayName    string `json:"display_name,omitempty" jsonschema:"optional project-local display name for the MCP; maximum 256 bytes"`
	IdempotencyKey string `` /* 131-byte string literal not displayed */
}

type RegisterRemoteMCPToolOutput 

type RegisterRemoteMCPToolOutput struct {
	ProjectSlug       string `json:"project_slug"`
	CanonicalURL      string `json:"canonical_url"`
	ReceiptID         string `json:"receipt_id"`
	RegistrationID    string `json:"registration_id"`
	Replayed          bool   `json:"replayed"`
	NextAction        string `json:"next_action"`
	DashboardSetupURL string `json:"dashboard_setup_url,omitempty"`
}

type Registrar 

type Registrar struct {
	// contains filtered or unexported fields
}

Registrar collects the tools and resources composed for one deployment while registering them with the MCP server, so the external endpoint and any other admitted audience are built from a single pass rather than two lists that can drift.

func (*Registrar) Descriptors 

func (r *Registrar) Descriptors() []Descriptor

Descriptors returns everything registered, before any audience filter.

func (*Registrar) For 

func (r *Registrar) For(audience Audience) []Descriptor

For returns the descriptors admitted to one audience.

func (*Registrar) ResourceFor 

func (r *Registrar) ResourceFor(audience Audience, uri string) (ResourceDescriptor, bool)

ResourceFor returns one admitted resource by URI. An audience that is not admitted to a resource cannot tell it apart from one that does not exist.

type RegistrationDashboardSetup 

type RegistrationDashboardSetup struct {
	OrganizationSlug string
	MCPServerRoute   string
}

RegistrationDashboardSetup is the persisted, server-owned dashboard target for a registered Remote MCP source. It deliberately contains no upstream URL, OAuth metadata, header value, or other provider material.

type RegistrationPersistence 

type RegistrationPersistence interface {
	ResolveProject(ctx context.Context, organizationID, projectSlug string) (ResolvedProject, error)
	EligibleCatalogRegistrationTarget(ctx context.Context, organizationID string, project ResolvedProject) (bool, error)
	BeginReceipt(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, now time.Time) (OperationReceipt, error)
	ConvergeRegistration(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt) (OperationReceipt, error)
	CompleteRegistration(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt, configuration resolvedCatalogConfiguration) (OperationReceipt, error)
	ResolveRegistrationPendingSecretFields(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID, declared []CatalogConfigurationField) ([]CatalogConfigurationField, error)
	ResolveRegistrationCatalogIdentity(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogCandidate, error)
	ResolveRegistrationDashboardSetup(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (RegistrationDashboardSetup, error)
	IssueSetupHandoff(ctx context.Context, principal Principal, binding SetupHandoffBinding, now time.Time) (IssuedSetupHandoff, error)
}

type RegistrationService 

type RegistrationService struct {
	// contains filtered or unexported fields
}

RegistrationService is the handler-facing boundary for one reviewed catalog registration. Catalog identity is validated before persistence, and the normalized input hash is computed here rather than trusted from an MCP caller.

func NewRegistrationService 

func NewRegistrationService(catalog Catalog, gate CatalogRegistrationGateChecker, store RegistrationPersistence) *RegistrationService

func (*RegistrationService) AttachDefaultIdentityProvider 

func (s *RegistrationService) AttachDefaultIdentityProvider(ctx context.Context, principal Principal, projectSlug, registrationID string) (CatalogIdentityProviderAttachmentResult, error)

AttachDefaultIdentityProvider attaches the one OAuth provider advertised by the lifecycle-bound Remote MCP. The caller supplies no provider identity, OAuth configuration, client ID, secret, code, or token.

func (*RegistrationService) DashboardAuthorizationURL 

func (s *RegistrationService) DashboardAuthorizationURL(ctx context.Context, principal Principal, projectSlug, registrationID string) (string, error)

DashboardAuthorizationURL returns the Inspect page only after the upstream provider is attached. Inspect owns the visible Connect/Authorize action.

func (*RegistrationService) DashboardSetupURL 

func (s *RegistrationService) DashboardSetupURL(ctx context.Context, principal Principal, input IssueSetupHandoffInput) (string, error)

DashboardSetupURL returns the existing Remote MCP server Authentication settings page for a browser-catalogue registration. This is the browser-only fallback for provider attachment; callers cannot provide an endpoint, source, or credential.

func (*RegistrationService) DisableMCP 

func (s *RegistrationService) DisableMCP(ctx context.Context, principal Principal, input UpdateMCPVisibilityInput) (UpdateMCPVisibilityResult, error)

func (*RegistrationService) EnableMCP 

func (s *RegistrationService) EnableMCP(ctx context.Context, principal Principal, input UpdateMCPVisibilityInput) (UpdateMCPVisibilityResult, error)

func (*RegistrationService) GetClientAdmission 

func (s *RegistrationService) GetClientAdmission(ctx context.Context, principal Principal, projectSlug, registrationID string) (ClientAdmission, error)

func (*RegistrationService) IssueSetupHandoff 

func (s *RegistrationService) IssueSetupHandoff(ctx context.Context, principal Principal, input IssueSetupHandoffInput) (IssuedSetupHandoff, error)

func (*RegistrationService) IssueSetupHandoffForRegistration 

func (s *RegistrationService) IssueSetupHandoffForRegistration(ctx context.Context, principal Principal, projectSlug, registrationID string) (IssuedSetupHandoff, error)

IssueSetupHandoffForRegistration derives the persisted catalogue identity from the exact workflow-bound registration. Dashboard callers never supply a provider key, catalogue reference, endpoint, or credential.

func (*RegistrationService) RegisterCatalogMCP 

func (s *RegistrationService) RegisterCatalogMCP(ctx context.Context, principal Principal, input RegisterCatalogMCPInput) (RegisterCatalogMCPResult, error)

func (*RegistrationService) RegisterRemoteMCP 

func (s *RegistrationService) RegisterRemoteMCP(ctx context.Context, principal Principal, input RegisterRemoteMCPInput) (RegisterRemoteMCPResult, error)

RegisterRemoteMCP re-inspects the exact URL before persistence. An inspection result from an earlier MCP call is deliberately not trusted as admission evidence, and no caller can supply credentials or headers.

func (*RegistrationService) RegistrationCatalogIdentity 

func (s *RegistrationService) RegistrationCatalogIdentity(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogCandidate, error)

RegistrationCatalogIdentity resolves the server-owned catalog identity for a lifecycle-bound registration. It keeps management adapters from depending on RegistrationService persistence internals.

func (*RegistrationService) SetClientAdmission 

func (s *RegistrationService) SetClientAdmission(ctx context.Context, principal Principal, projectSlug, registrationID, mode string) (ClientAdmission, error)

SetClientAdmission applies a confirmed admission-mode change. Confirmation is enforced at the tool boundary; this path assumes it and only verifies that the caller may act on the registration.

func (*RegistrationService) UpdateMCPMetadata 

func (s *RegistrationService) UpdateMCPMetadata(ctx context.Context, principal Principal, input UpdateMCPMetadataInput) (UpdateMCPMetadataResult, error)

func (*RegistrationService) WithClientAdmission 

func (s *RegistrationService) WithClientAdmission(clientAdmission *ClientAdmissionService) *RegistrationService

WithClientAdmission enables reading and setting the CIMD client admission policy of a registered MCP's session issuer over MCP, which is otherwise reachable only from the dashboard's Authentication settings.

func (*RegistrationService) WithDashboardURL 

func (s *RegistrationService) WithDashboardURL(dashboardURL *url.URL) *RegistrationService

WithDashboardURL supplies the configured dashboard origin used only to build trusted same-origin setup links for persisted registrations.

func (*RegistrationService) WithDirectRemoteInspector 

func (s *RegistrationService) WithDirectRemoteInspector(inspector DirectRemoteInspector) *RegistrationService

WithDirectRemoteInspector enables direct user-supplied remote MCP admission. The inspector is server-composed because it owns Guardian-backed egress.

func (*RegistrationService) WithIdentityProviderAttachment 

func (s *RegistrationService) WithIdentityProviderAttachment(attachment CatalogIdentityProviderAttachment) *RegistrationService

WithIdentityProviderAttachment enables confirmed agent-side provider attachment using trusted lifecycle persistence and server-owned OAuth calls.

func (*RegistrationService) WithLifecycleMetadata 

func (s *RegistrationService) WithLifecycleMetadata(metadata *LifecycleMetadataService) *RegistrationService

WithLifecycleMetadata enables narrow, Platform-owned MCP display-name updates. The command is injected from server composition to share the dashboard domain implementation without importing mcpservers into Platform MCP.

func (*RegistrationService) WithLifecycleVisibility 

func (s *RegistrationService) WithLifecycleVisibility(visibility *LifecycleVisibilityService) *RegistrationService

func (*RegistrationService) WithOperationBudgets 

func (s *RegistrationService) WithOperationBudgets(budgets OperationBudgets) *RegistrationService

func (*RegistrationService) WithReadiness 

func (s *RegistrationService) WithReadiness(readiness *ReadinessService) *RegistrationService

func (*RegistrationService) WithTelemetry 

func (s *RegistrationService) WithTelemetry(telemetry LifecycleTelemetry) *RegistrationService

type RegistrationStore 

type RegistrationStore struct {
	// contains filtered or unexported fields
}

RegistrationStore owns the tenant-qualified receipt and desired-state persistence boundary. It does not fetch catalog data, call providers, or create project components.

func NewRegistrationStore 

func NewRegistrationStore(db *pgxpool.Pool, config RegistrationStoreConfig) (*RegistrationStore, error)

func (*RegistrationStore) BeginProviderSetup 

func (s *RegistrationStore) BeginProviderSetup(ctx context.Context, principal Principal, binding SetupHandoffBinding, value string, adapters *ProviderAdapters) (ProviderSetupResult, error)

BeginProviderSetup redeems a single-use handoff on a trusted surface and dispatches only to the adapter bound to the registration's persisted provider.

func (*RegistrationStore) BeginReceipt 

func (s *RegistrationStore) BeginReceipt(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, now time.Time) (OperationReceipt, error)

BeginReceipt atomically establishes the 24-hour idempotency boundary. It never creates a registration: callers first resolve catalog data outside a transaction, then use ConvergeRegistration to create or reuse the desired registration state.

func (*RegistrationStore) CompleteRegistration 

func (s *RegistrationStore) CompleteRegistration(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt, configuration resolvedCatalogConfiguration) (OperationReceipt, error)

CompleteRegistration creates the local, private component stack only after a reviewed catalog adapter has validated the remote endpoint. It does not call management handlers, create plugin rows, or publish packages. CompleteRegistration resolves private resources from one server-validated catalogue configuration. Tests and older internal callers use CompleteRegistrationWithRemoteURL to build the equivalent empty configuration.

func (*RegistrationStore) CompleteRegistrationWithRemoteURL 

func (s *RegistrationStore) CompleteRegistrationWithRemoteURL(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt, remoteURL string) (OperationReceipt, error)

func (*RegistrationStore) ConsumeSetupHandoff 

func (s *RegistrationStore) ConsumeSetupHandoff(ctx context.Context, principal Principal, binding SetupHandoffBinding, value string) (SetupHandoff, error)

func (*RegistrationStore) ConvergeRegistration 

func (s *RegistrationStore) ConvergeRegistration(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt) (OperationReceipt, error)

ConvergeRegistration creates or reuses the active desired-state registration in one transaction. It intentionally leaves the receipt pending: only the later private-component convergence can complete the receipt and record the registration_succeeded milestone.

func (*RegistrationStore) EligibleCatalogRegistrationTarget 

func (s *RegistrationStore) EligibleCatalogRegistrationTarget(ctx context.Context, organizationID string, project ResolvedProject) (bool, error)

func (*RegistrationStore) GetProviderReadiness 

func (s *RegistrationStore) GetProviderReadiness(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) (Readiness, bool, error)

GetProviderReadiness returns the most recent normalized evidence for the principal's active connection generation. It never returns the stored authorization fingerprint or attempts provider egress.

func (*RegistrationStore) IssueSetupHandoff 

func (s *RegistrationStore) IssueSetupHandoff(ctx context.Context, principal Principal, binding SetupHandoffBinding, now time.Time) (IssuedSetupHandoff, error)

func (*RegistrationStore) ProbeProviderReadiness 

func (s *RegistrationStore) ProbeProviderReadiness(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID, adapters *ProviderAdapters, generic ...CatalogReadinessProber) (Readiness, error)

ProbeProviderReadiness delegates fixture registrations to their reviewed adapter and browser-catalogue registrations to the persisted Remote MCP source path. Both paths persist only normalized, generation-bound evidence.

func (*RegistrationStore) RecordReadiness 

func (s *RegistrationStore) RecordReadiness(ctx context.Context, principal Principal, binding ReadinessBinding, state ReadinessState, evidenceCode string, checkedAt, expiresAt time.Time) (Readiness, error)

func (*RegistrationStore) ResolveProject 

func (s *RegistrationStore) ResolveProject(ctx context.Context, organizationID, projectSlug string) (ResolvedProject, error)

func (*RegistrationStore) ResolveRegistrationCatalogIdentity 

func (s *RegistrationStore) ResolveRegistrationCatalogIdentity(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogCandidate, error)

func (*RegistrationStore) ResolveRegistrationDashboardSetup 

func (s *RegistrationStore) ResolveRegistrationDashboardSetup(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (RegistrationDashboardSetup, error)

ResolveRegistrationDashboardSetup derives the only dashboard continuation target from the lifecycle-bound private resources. The agent never receives the Remote MCP source URL or configuration values.

func (*RegistrationStore) ResolveRegistrationPendingSecretFields 

func (s *RegistrationStore) ResolveRegistrationPendingSecretFields(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID, declared []CatalogConfigurationField) ([]CatalogConfigurationField, error)

ResolveRegistrationPendingSecretFields projects the persisted secret-header state without reading or decrypting secret values. It is used for idempotent registration replays so the agent is not sent back to dashboard setup after the user has already completed it there.

type RegistrationStoreConfig 

type RegistrationStoreConfig struct {
	ActiveRegistrationCap int64
}

RegistrationStoreConfig carries values whose production defaults require explicit review before Platform catalog registration can be composed.

type RegistryCatalog 

type RegistryCatalog struct {
	// contains filtered or unexported fields
}

func NewRegistryCatalog 

func NewRegistryCatalog(client *externalmcp.RegistryClient, descriptors []CatalogDescriptor) *RegistryCatalog

func NewRegistryCatalogSources 

func NewRegistryCatalogSources(sources []RegistryCatalogSource) *RegistryCatalog

NewRegistryCatalogSources composes only server-owned registry sources. The opaque ProviderKey remains unique across every source, preventing a selected entry from being reinterpreted against a different registry.

func (*RegistryCatalog) Inspect 

func (c *RegistryCatalog) Inspect(ctx context.Context, providerKey, catalogRef string) (CatalogDetails, error)

func (*RegistryCatalog) Search 

func (c *RegistryCatalog) Search(ctx context.Context, query string) ([]CatalogCandidate, error)

type RegistryCatalogSource 

type RegistryCatalogSource struct {
	// Client is constructed by server composition. The local fixture uses a
	// development-CA-aware client; normal browser-catalogue registries share the
	// standard client. It is never chosen from Platform MCP input. Every source is
	// strict: search fails closed rather than presenting a partial reviewed catalog.
	Client      externalmcp.RegistryReader
	Descriptors []CatalogDescriptor
}

type RegistryCatalogSourceLoader 

type RegistryCatalogSourceLoader func(ctx context.Context) ([]RegistryCatalogSource, error)

type RemoteMCPReadinessProber 

type RemoteMCPReadinessProber struct {
	// contains filtered or unexported fields
}

RemoteMCPReadinessProber is the generic browser-catalogue readiness path. It intentionally has no provider descriptor: source URL, configured headers and attached remote identity provider are all read from the persisted Remote MCP resources created during registration.

func NewRemoteMCPReadinessProber 

func NewRemoteMCPReadinessProber(logger *slog.Logger, db *pgxpool.Pool, enc *encryption.Client, policy *guardian.Policy, sessions *remotesessions.ChallengeManager) *RemoteMCPReadinessProber

func (*RemoteMCPReadinessProber) ProbeCatalogReadiness 

func (p *RemoteMCPReadinessProber) ProbeCatalogReadiness(ctx context.Context, principal Principal, projectID, registrationID, remoteMCPServerID, userSessionIssuerID, connectionID, generation uuid.UUID) (ProviderReadinessProbeResult, error)

type RepairAction 

type RepairAction struct {
	Kind  string `json:"kind"`
	Label string `json:"label"`
}

type ResolvedProject 

type ResolvedProject struct {
	ID   uuid.UUID
	Name string
	Slug string
}

type ResolvedWindow 

type ResolvedWindow struct {
	Window DiagnosticWindow `json:"window"`
	From   string           `json:"from"`
	To     string           `json:"to"`
	// contains filtered or unexported fields
}

ResolvedWindow is the window a diagnostic actually read, echoed on every result. A caller never has to infer it from what it asked for.

type ResourceDescriptor 

type ResourceDescriptor struct {
	URI         string
	Name        string
	Title       string
	Description string
	MIMEType    string
	Meta        ResourceMeta
	// contains filtered or unexported fields
}

ResourceDescriptor is one registered resource, reachable either through the MCP server's resources/* methods or by direct read.

The direct path exists for the same reason Descriptor's does: a surface that speaks Go rather than MCP — the project assistant — must serve the same corpus, gated the same way, or a citation link returned by search would resolve on one surface and dangle on the other.

func (ResourceDescriptor) Read 

func (d ResourceDescriptor) Read(ctx context.Context) (string, error)

Read returns the resource's current text. It is a function rather than a field because freshness is evaluated per read: a guide that passes its revalidation date while the process is running must not keep being served as though it were reviewed today.

type ResourceMeta 

type ResourceMeta struct {
	Audiences []Audience
}

ResourceMeta is what a resource declares beyond its content: who may read it. Resources carry no project scope — a reviewed guide is the same document for every project in the organization.

type RiskCompatibility 

type RiskCompatibility struct {
	State             string   `json:"state"`
	UnsupportedFields []string `json:"unsupported_fields"`
}

type RiskDetectionScope 

type RiskDetectionScope struct {
	Category     string   `json:"category"`
	MessageTypes []string `json:"message_types"`
}

type RiskExclusionReceiptSummary 

type RiskExclusionReceiptSummary struct {
	ID        string  `json:"id"`
	PolicyID  *string `json:"policy_id,omitempty"`
	MatchType string  `json:"match_type"`
	Enabled   bool    `json:"enabled"`
}

RiskExclusionReceiptSummary omits match values and filters even for allowlisted match types so exact and legacy-regex content can never leak.

type RiskExclusionSummary 

type RiskExclusionSummary struct {
	ID               string            `json:"id"`
	PolicyID         *string           `json:"policy_id,omitempty"`
	MatchType        string            `json:"match_type"`
	MatchValue       string            `json:"match_value,omitempty"`
	MatchFingerprint string            `json:"match_fingerprint,omitempty"`
	MatchLength      int               `json:"match_length,omitempty"`
	RuleIDFilter     string            `json:"rule_id_filter,omitempty"`
	SourceFilter     string            `json:"source_filter,omitempty"`
	Enabled          bool              `json:"enabled"`
	Version          string            `json:"version"`
	CreatedAt        string            `json:"created_at"`
	UpdatedAt        string            `json:"updated_at"`
	Compatibility    RiskCompatibility `json:"compatibility"`
}

type RiskMutationControls 

type RiskMutationControls struct {
	// contains filtered or unexported fields
}

RiskMutationControls owns the checks shared by every risk write. Admission is intentionally separate from receipt execution so callers can prove the flag and budget fail before opening a write transaction.

func NewRiskMutationControls 

func NewRiskMutationControls(db *pgxpool.Pool, flags feature.Provider, organizations OrganizationSlugResolver, budget OperationBudget, keyMaterial string) (*RiskMutationControls, error)

func (*RiskMutationControls) Admit 

func (c *RiskMutationControls) Admit(ctx context.Context, principal Principal, projectSlug string) (ResolvedProject, error)

Admit resolves an explicit project and checks its exact rollout cohort at invocation time. Missing providers, errors, and indeterminate evaluations all fail closed. The mutation budget is consumed only after the kill switch is on.

func (*RiskMutationControls) Receipts 

func (c *RiskMutationControls) Receipts() *RiskMutationReceiptStore

func (*RiskMutationControls) Versions 

func (c *RiskMutationControls) Versions() *riskVersionCodec

type RiskMutationError 

type RiskMutationError struct {
	Code    string
	Message string
	Cause   error
}

RiskMutationError is safe to map into a tool refusal. Message deliberately contains no policy, prompt, URL, principal, CEL, or exclusion material.

func (*RiskMutationError) Error 

func (e *RiskMutationError) Error() string

func (*RiskMutationError) Unwrap 

func (e *RiskMutationError) Unwrap() error

type RiskMutationHandlers 

type RiskMutationHandlers struct {
	Controls        *RiskMutationControls
	CreatePolicy    mcp.ToolHandlerFor[map[string]any, CreateRiskPolicyToolOutput]
	UpdatePolicy    mcp.ToolHandlerFor[map[string]any, UpdateRiskPolicyToolOutput]
	CreateExclusion mcp.ToolHandlerFor[map[string]any, CreateRiskExclusionToolOutput]
	UpdateExclusion mcp.ToolHandlerFor[map[string]any, UpdateRiskExclusionToolOutput]
}

RiskMutationHandlers names the four independently selectable callbacks. Every callback has an exported success type that composition code can construct, while the schemas remain owned by this package.

func NewRiskMutationHandlers 

func NewRiskMutationHandlers(db *pgxpool.Pool, controls *RiskMutationControls, policies *policycore.Core, exclusions *exclusioncore.Core) (*RiskMutationHandlers, error)

NewRiskMutationHandlers activates policy and exclusion mutation callbacks.

func NewRiskPolicyMutationHandlers 

func NewRiskPolicyMutationHandlers(db *pgxpool.Pool, controls *RiskMutationControls, policies *policycore.Core) (*RiskMutationHandlers, error)

NewRiskPolicyMutationHandlers retains the policy-only composition used by the preceding rollout slice.

type RiskMutationReceiptProject 

type RiskMutationReceiptProject struct {
	ID   string `json:"id"`
	Slug string `json:"slug"`
}

type RiskMutationReceiptRequest 

type RiskMutationReceiptRequest struct {
	Operation      string
	IdempotencyKey string
	Input          any
}

RiskMutationReceiptRequest is the safe identity of one normalized write. Input must already have schema defaults, canonical ordering, and transport aliases resolved. It is hashed and is never persisted or logged directly.

type RiskMutationReceiptResult 

type RiskMutationReceiptResult interface {
	// contains filtered or unexported methods
}

RiskMutationReceiptResult is implemented only by the four closed, redacted result projections below. Callbacks cannot supply an open JSON object, so a new user-authored field cannot silently enter operation receipts.

type RiskMutationReceiptStore 

type RiskMutationReceiptStore struct {
	// contains filtered or unexported fields
}

func NewRiskMutationReceiptStore 

func NewRiskMutationReceiptStore(db *pgxpool.Pool) *RiskMutationReceiptStore

func (*RiskMutationReceiptStore) Execute 

func (s *RiskMutationReceiptStore) Execute(ctx context.Context, principal Principal, project ResolvedProject, request RiskMutationReceiptRequest, mutate RiskMutationTransaction) (OperationReceipt, error)

Execute serializes one user's exact operation/project/key, replays an exact completed input from its stored result, and commits receipt + domain + audit atomically. Any callback, completion, or commit failure rolls all three back.

type RiskMutationToolReceipt 

type RiskMutationToolReceipt struct {
	ID       string `json:"id"`
	Replayed bool   `json:"replayed"`
}

type RiskMutationTransaction 

type RiskMutationTransaction func(ctx context.Context, tx pgx.Tx) (RiskMutationReceiptResult, error)

RiskMutationTransaction performs the domain write and audit write using the same transaction that owns the receipt. Its result must be one of the closed operation-specific projections above.

type RiskPolicyDetail 

type RiskPolicyDetail struct {
	RiskPolicySummary
	Version                string               `json:"version"`
	PresidioEntities       []string             `json:"presidio_entities"`
	PresidioScoreThreshold *float64             `json:"presidio_score_threshold,omitempty"`
	ApprovedEmailDomains   []string             `json:"approved_email_domains"`
	DisabledRules          []string             `json:"disabled_rules"`
	DetectionScopes        []RiskDetectionScope `json:"detection_scopes"`
	UserMessage            *string              `json:"user_message,omitempty"`
	Prompt                 *string              `json:"prompt,omitempty"`
	PendingMessages        *int64               `json:"pending_messages,omitempty"`
	TotalMessages          *int64               `json:"total_messages,omitempty"`
}

type RiskPolicyReceiptSummary 

type RiskPolicyReceiptSummary struct {
	ID         string `json:"id"`
	PolicyType string `json:"policy_type"`
	Enabled    bool   `json:"enabled"`
	Action     string `json:"action,omitempty"`
}

RiskPolicyReceiptSummary contains only fixed-vocabulary administrative state. Policy names, prompts, CEL, model configuration, principals, and URLs are deliberately absent.

type RiskPolicySummary 

type RiskPolicySummary struct {
	ID              string                 `json:"id"`
	Name            string                 `json:"name"`
	PolicyType      string                 `json:"policy_type"`
	Enabled         bool                   `json:"enabled"`
	Action          string                 `json:"action,omitempty"`
	Sources         []string               `json:"sources"`
	Score           float64                `json:"score"`
	CreatedAt       string                 `json:"created_at"`
	UpdatedAt       string                 `json:"updated_at"`
	Compatibility   RiskCompatibility      `json:"compatibility"`
	ShadowDecisions *ShadowPolicyDecisions `json:"shadow_decisions,omitempty"`
}

type RiskPolicyVersionGrant 

type RiskPolicyVersionGrant struct {
	PrincipalURN string          `json:"principal_urn"`
	Selector     json.RawMessage `json:"selector"`
}

RiskPolicyVersionGrant captures the complete enforcement identity of one URL grant. The principal and canonical selector remain inside the opaque HMAC.

type RiskPolicyVersionState 

type RiskPolicyVersionState struct {
	Policy                policycore.Policy
	AnalyzerConfig        json.RawMessage
	AllowedURLGrants      []RiskPolicyVersionGrant
	BlockedURLGrants      []RiskPolicyVersionGrant
	StandingDecisionState []string
}

RiskPolicyVersionState is the complete locked policy state needed for an optimistic-concurrency token. Grant-backed URL selectors and audiences, standing-decision state, and canonical analyzer JSON are included because they can change enforcement without changing the policy's public summary. They remain inside the HMAC.

type RiskProject 

type RiskProject struct {
	ID   string `json:"id"`
	Name string `json:"name"`
	Slug string `json:"slug"`
}

type RiskReadService 

type RiskReadService struct {
	// contains filtered or unexported fields
}

func (*RiskReadService) GetPolicy 

func (s *RiskReadService) GetPolicy(ctx context.Context, principal Principal, input GetRiskPolicyInput) (GetRiskPolicyOutput, error)

func (*RiskReadService) ListExclusions 

func (s *RiskReadService) ListExclusions(ctx context.Context, principal Principal, input ListRiskExclusionsInput) (ListRiskExclusionsOutput, error)

func (*RiskReadService) ListPolicies 

func (s *RiskReadService) ListPolicies(ctx context.Context, principal Principal, input ListRiskPoliciesInput) (ListRiskPoliciesOutput, error)

type RiskTelemetry 

type RiskTelemetry interface {
	Record(context.Context, RiskToolEvent, time.Duration)
}

func NewRiskTelemetry 

func NewRiskTelemetry(logger *slog.Logger, meterProvider metric.MeterProvider) RiskTelemetry

type RiskToolEvent 

type RiskToolEvent struct {
	Tool           string
	Outcome        string
	Replay         string
	CatalogVersion string
	Reconciliation string
}

type Runtime 

type Runtime struct {
	// contains filtered or unexported fields
}

func NewRuntime 

func NewRuntime(logger *slog.Logger, authenticator Authenticator, gate Gate, authorizer Authorizer, protectedResourceURL, cursorKeyMaterial string, reader Reader, catalog Catalog, registrations *RegistrationService, readiness ReadinessRecorder, setupResources []SetupResource) *Runtime

func NewRuntimeWithFeedback 

func NewRuntimeWithFeedback(logger *slog.Logger, authenticator Authenticator, gate Gate, authorizer Authorizer, protectedResourceURL, cursorKeyMaterial string, reader Reader, catalog Catalog, registrations *RegistrationService, readiness ReadinessRecorder, setupResources []SetupResource, feedback *FeedbackService) *Runtime

func NewRuntimeWithLifecycle 

func NewRuntimeWithLifecycle(logger *slog.Logger, authenticator Authenticator, gate Gate, authorizer Authorizer, protectedResourceURL, cursorKeyMaterial string, reader Reader, catalog Catalog, registrations *RegistrationService, readiness ReadinessRecorder, setupResources []SetupResource, feedback *FeedbackService, onboarding *OnboardingService, distributions *DistributionService, skills *SkillsService, diagnostics *DiagnosticsService, plugins *PluginsService, sessionRecall *SessionRecallService, candidate CatalogDescriptor) *Runtime

NewRuntimeWithLifecycle wires the Platform MCP onboarding lifecycle. Catalogue selection remains server-validated: callers receive only search/inspect identities and declared configuration fields, never an arbitrary endpoint or provider credential.

func NewRuntimeWithRiskMutations 

func NewRuntimeWithRiskMutations(logger *slog.Logger, authenticator Authenticator, gate Gate, authorizer Authorizer, protectedResourceURL, cursorKeyMaterial string, reader Reader, catalog Catalog, registrations *RegistrationService, readiness ReadinessRecorder, setupResources []SetupResource, feedback *FeedbackService, onboarding *OnboardingService, distributions *DistributionService, skills *SkillsService, diagnostics *DiagnosticsService, plugins *PluginsService, sessionRecall *SessionRecallService, riskMutations *RiskMutationHandlers, candidate CatalogDescriptor, accessReads *AccessReadService, accessRoleMutations *AccessRoleMutationService) *Runtime

func (*Runtime) AssistantTools 

func (r *Runtime) AssistantTools() []Descriptor

AssistantTools returns the descriptors admitted to a project's managed assistant. The assistant adapter composes these directly; nothing else in the catalogue reaches it.

func (*Runtime) Handler 

func (r *Runtime) Handler() http.Handler

func (*Runtime) WithOAuthTelemetry 

func (r *Runtime) WithOAuthTelemetry(telemetry OAuthTelemetry) *Runtime

func (*Runtime) WithRiskTelemetry 

func (r *Runtime) WithRiskTelemetry(telemetry RiskTelemetry) *Runtime

type SearchCatalogInput 

type SearchCatalogInput struct {
	Query       string `json:"query,omitempty" jsonschema:"optional search text; only reviewed catalog candidates are returned"`
	ProviderKey string `json:"provider_key,omitempty" jsonschema:"optional reviewed provider key to filter"`
	Cursor      string `json:"cursor,omitempty" jsonschema:"opaque continuation cursor returned by search_mcp_catalog"`
}

type SearchCatalogOutput 

type SearchCatalogOutput struct {
	Candidates []CatalogCandidate `json:"candidates"`
	NextCursor string             `json:"next_cursor,omitempty"`
}

type SearchGramDocsToolInput 

type SearchGramDocsToolInput struct {
	Query string `` /* 165-byte string literal not displayed */
}

type SearchGramDocsToolOutput 

type SearchGramDocsToolOutput struct {
	Query string `json:"query"`
	// Excerpts is empty when nothing reviewed answers the query. It is never
	// filled with a paraphrase or a guess.
	Excerpts []DocsExcerpt `json:"excerpts"`
	// Code is set only when no excerpt could be returned, so a caller can tell
	// "the corpus has no answer" from "the corpus answered".
	Code    string `json:"code,omitempty"`
	Message string `json:"message,omitempty"`
	// TrustedLinks are where to send the reader when nothing reviewed answers.
	TrustedLinks []string `json:"trusted_links,omitempty"`
}

type SelectedUseRecorder 

type SelectedUseRecorder struct {
	// contains filtered or unexported fields
}

SelectedUseRecorder persists only the first successful normal Remote MCP tool use for an active Platform distribution version. It deliberately accepts no request or response content.

func NewSelectedUseRecorder 

func NewSelectedUseRecorder(db *pgxpool.Pool) *SelectedUseRecorder

func (*SelectedUseRecorder) RecordSuccessfulToolCall 

func (r *SelectedUseRecorder) RecordSuccessfulToolCall(ctx context.Context, observation toolcallobserver.SuccessObservation)

type SendPlatformMCPFeedbackToolInput 

type SendPlatformMCPFeedbackToolInput struct {
	Category        string `` /* 183-byte string literal not displayed */
	Rating          *int   `json:"rating,omitempty" jsonschema:"optional rating from 1 through 5"`
	Success         *bool  `json:"success,omitempty" jsonschema:"optional success outcome"`
	ToolName        string `json:"tool_name,omitempty" jsonschema:"optional known Platform MCP tool name; do not include remote tool names"`
	FailureCategory string `json:"failure_category,omitempty" jsonschema:"optional allowlisted failure or readiness category"`
	Note            string `` /* 166-byte string literal not displayed */
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"caller-generated retry key, at most 128 characters; reuse only for the same feedback"`
}

type SendPlatformMCPFeedbackToolOutput 

type SendPlatformMCPFeedbackToolOutput struct {
	TrackingID    string `json:"tracking_id"`
	DeliveryState string `json:"delivery_state"`
	ExpiresAt     string `json:"expires_at"`
	Replayed      bool   `json:"replayed"`
}

type SessionRecallService 

type SessionRecallService struct {
	// contains filtered or unexported fields
}

SessionRecallService serves the session-portability recall tools: listing the caller's own captured coding-agent sessions and rendering one as a redacted handoff digest so its work can continue in the current harness.

Every read fuses tenancy and ownership into the SQL row filter (the queries carry organization + owner user_id + not-deleted + the personal-account exclusion), so there is no fetch-then-authorize step anywhere in this file.

func NewSessionRecallService 

func NewSessionRecallService(logger *slog.Logger, db *pgxpool.Pool, repo *platformrepo.Queries, auditor *audit.Logger, portability FeatureChecker, budget OperationBudget) *SessionRecallService

NewSessionRecallService composes the recall entry points. A nil dependency leaves the service invalid, which registers the unavailable stubs rather than tools that always fail.

func (*SessionRecallService) ContinueSession 

func (s *SessionRecallService) ContinueSession(ctx context.Context, principal Principal, input ContinueSessionInput) (ContinueSessionOutput, error)

func (*SessionRecallService) ListMySessions 

func (s *SessionRecallService) ListMySessions(ctx context.Context, principal Principal, input ListMySessionsInput) (ListMySessionsOutput, error)

type SessionRecaller 

type SessionRecaller interface {
	ListMySessions(ctx context.Context, principal Principal, input ListMySessionsInput) (ListMySessionsOutput, error)
	ContinueSession(ctx context.Context, principal Principal, input ContinueSessionInput) (ContinueSessionOutput, error)
}

SessionRecaller is the narrow boundary the session-recall tools call through, so unit tests can model the service without a database.

type SetMCPClientAdmissionToolInput 

type SetMCPClientAdmissionToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
	Mode           string `` /* 149-byte string literal not displayed */
	Confirmed      bool   `` /* 174-byte string literal not displayed */
}

type SetPluginAssignmentsInput 

type SetPluginAssignmentsInput struct {
	ProjectID                 string   `json:"project_id" jsonschema:"explicit project ID that owns the plugin"`
	Plugin                    string   `json:"plugin" jsonschema:"exact plugin ID, slug, or name returned by list_plugins"`
	AssignmentReferences      []string `` /* 172-byte string literal not displayed */
	ExpectedAssignmentVersion string   `json:"expected_assignment_version" jsonschema:"assignment version returned by get_plugin immediately before this write"`
	IdempotencyKey            string   `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact write"`
	Confirmed                 bool     `` /* 136-byte string literal not displayed */
}

type SetPluginAssignmentsOutput 

type SetPluginAssignmentsOutput struct {
	SetPluginAssignmentsReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type SetPluginAssignmentsReceiptResult 

type SetPluginAssignmentsReceiptResult struct {
	ProjectID         string                          `json:"project_id"`
	Plugin            PluginAssignmentMutationPlugin  `json:"plugin"`
	AssignmentVersion string                          `json:"assignment_version"`
	Assignments       []PluginAssignmentSummaryResult `json:"assignments"`
	ResultCategory    string                          `json:"result_category"`
}

type SetupCategory 

type SetupCategory string

SetupCategory is the privacy-safe reason an MCP setup needs attention. Values are server-authored from typed errors or closed evidence codes; raw provider, network, or protocol text must never be used as a category. 

const (
	SetupCategoryInvalidURL                     SetupCategory = "invalid_url"
	SetupCategoryUnsafeTargetOrRedirect         SetupCategory = "unsafe_target_or_redirect"
	SetupCategoryUnreachable                    SetupCategory = "unreachable"
	SetupCategoryTimeout                        SetupCategory = "timeout"
	SetupCategoryInvalidMCPResponse             SetupCategory = "invalid_mcp_response"
	SetupCategoryAuthenticationRequired         SetupCategory = "authentication_required"
	SetupCategoryConfigurationRequired          SetupCategory = "configuration_required"
	SetupCategoryOAuthMetadataIncomplete        SetupCategory = "oauth_metadata_incomplete"
	SetupCategoryDynamicRegistrationUnsupported SetupCategory = "dynamic_registration_unsupported"
	SetupCategoryProviderAuthorizationRejected  SetupCategory = "provider_authorization_rejected"
	SetupCategoryTemporarilyUnavailable         SetupCategory = "temporarily_unavailable"
)

type SetupGuideUnavailableError 

type SetupGuideUnavailableError struct {
	URI     string
	DocsURL string
	Links   []string
}

SetupGuideUnavailableError is a withheld guide together with the sources a reader should be sent to instead. The links are the whole point of the refusal: a caller told to hand over trusted documentation needs something to hand over.

func (*SetupGuideUnavailableError) Error 

func (e *SetupGuideUnavailableError) Error() string
func (e *SetupGuideUnavailableError) TrustedLinks() []string

TrustedLinks returns the guide's published page followed by its canonical upstream sources, deduplicated, for a caller assembling a fallback answer.

Never empty: a guide with no page and no canonical sources still has the documentation index, and the whole point of the refusal is to hand the caller somewhere trustworthy to send the reader rather than leave it inventing one.

func (*SetupGuideUnavailableError) Unwrap 

func (e *SetupGuideUnavailableError) Unwrap() error

type SetupHandoff 

type SetupHandoff struct {
	ID                   uuid.UUID
	ProjectID            uuid.UUID
	RegistrationID       uuid.UUID
	ProviderKey          string
	CatalogReference     string
	Intent               string
	ExpiresAt            time.Time
	ConnectionID         uuid.UUID
	ConnectionGeneration uuid.UUID
}

type SetupHandoffBinding 

type SetupHandoffBinding struct {
	ProjectID        uuid.UUID
	RegistrationID   uuid.UUID
	ProviderKey      string
	CatalogReference string
	Intent           string
}

type SetupResource 

type SetupResource struct {
	URI         string
	Name        string
	Title       string
	Description string
	// Text is what a reader receives: the citation header followed by the
	// guide. Body is the guide alone.
	Text string
	// Body is what search indexes. The citation header is prose about the
	// guide rather than guide content, so indexing Text would let every guide
	// match on "owner" or "source" and would return the header block as the
	// answer to a setup question.
	Body string

	// Provider and Intent are the two URI segments, kept as fields so search
	// results can cite them without re-parsing the URI.
	Provider string
	Intent   string
	// Owner is who is accountable for reviewing this content.
	Owner string
	// Source identifies the pinned export the content came from, including its
	// version — "mcp-setup-docs/go@v0.3.0", not "mcp-setup-docs".
	Source string
	// ObservedAt is when the upstream provider documentation behind this guide
	// was last observed. RevalidateBy is when that observation expires.
	ObservedAt   time.Time
	RevalidateBy time.Time
	// Aliases are other names the provider is known by — registry identifiers,
	// vendor spellings — so search can match what a caller actually typed.
	Aliases []string
	// Links are the canonical upstream sources. They are the fallback a reader
	// is handed when content is missing or withheld.
	Links []string
	// DocsURL is this guide's published page on the Speakeasy documentation
	// site — the same content, somewhere a person can open, link, and share.
	// The gram:// URI addresses the resource; this addresses the page.
	DocsURL string
}

SetupResource is a reviewed, static setup guide. It is intentionally supplied only by explicit composition, never fetched from a provider or documentation service at request time.

The metadata fields are not decoration: they are the citation a reader needs to judge the content, and the freshness signal that decides whether it is served at all.

type ShadowDecisionAudience 

type ShadowDecisionAudience struct {
	Kind        string        `json:"kind"`
	DisplayName string        `json:"display_name"`
	MemberCount *SubjectCount `json:"member_count,omitempty"`
}

type ShadowDecisionError 

type ShadowDecisionError struct {
	Code    string
	Message string
	Cause   error
}

func (*ShadowDecisionError) Error 

func (e *ShadowDecisionError) Error() string

func (*ShadowDecisionError) Unwrap 

func (e *ShadowDecisionError) Unwrap() error

type ShadowDecisionReceiptResult 

type ShadowDecisionReceiptResult struct {
	Decision       string                   `json:"decision"`
	Audiences      []ShadowDecisionAudience `json:"audiences"`
	ResultCategory string                   `json:"result_category"`
}

type ShadowDecisionReceiptStore 

type ShadowDecisionReceiptStore struct {
	// contains filtered or unexported fields
}

ShadowDecisionReceiptStore writes the operation receipt in the same transaction as the decision core.

func NewShadowDecisionReceiptStore 

func NewShadowDecisionReceiptStore(db *pgxpool.Pool) *ShadowDecisionReceiptStore

func (*ShadowDecisionReceiptStore) Execute 

func (s *ShadowDecisionReceiptStore) Execute(ctx context.Context, principal Principal, project ResolvedProject, key string, normalized normalizedShadowDecision, mutate func(context.Context, pgx.Tx) (ShadowDecisionReceiptResult, error)) (OperationReceipt, error)

type ShadowDecisionService 

type ShadowDecisionService struct {
	// contains filtered or unexported fields
}

func NewShadowDecisionService 

func NewShadowDecisionService(db *pgxpool.Pool, shadow *ShadowInventoryService, core *mcpapproval.Service, audiences shadowDecisionAudienceResolver, flags feature.Provider, organizations OrganizationSlugResolver, budget OperationBudget) *ShadowDecisionService

func (*ShadowDecisionService) Decide 

func (s *ShadowDecisionService) Decide(ctx context.Context, principal Principal, input DecideShadowMCPAccessInput) (DecideShadowMCPAccessOutput, error)

type ShadowInventoryService 

type ShadowInventoryService struct {
	// contains filtered or unexported fields
}

func NewShadowInventoryService 

func NewShadowInventoryService(dbReader shadowInventoryReader, reviews shadowReviewReader, flags feature.Provider, organizations OrganizationSlugResolver, dbQueries *platformrepo.Queries, budget OperationBudget, keyMaterial string) (*ShadowInventoryService, error)

func (*ShadowInventoryService) GetReview 

func (s *ShadowInventoryService) GetReview(ctx context.Context, principal Principal, input GetShadowMCPReviewInput) (GetShadowMCPReviewOutput, error)

func (*ShadowInventoryService) List 

func (s *ShadowInventoryService) List(ctx context.Context, principal Principal, input ListShadowMCPInventoryInput) (ListShadowMCPInventoryOutput, error)

func (*ShadowInventoryService) ResolveTargetReference 

func (s *ShadowInventoryService) ResolveTargetReference(principal Principal, projectID, targetReference string) (string, string, error)

ResolveTargetReference resolves a D1 handle for the D2 mutation path. The underlying URL or command remains inside the server process.

type ShadowMCPAccessSummary 

type ShadowMCPAccessSummary struct {
	State            string `json:"state"`
	AllowedFor       string `json:"allowed_for"`
	BlockedFor       string `json:"blocked_for"`
	BlockingDefault  string `json:"blocking_default"`
	Decision         string `json:"decision,omitempty"`
	DecisionCoverage string `json:"decision_coverage"`
}

type ShadowMCPEvidenceSummary 

type ShadowMCPEvidenceSummary struct {
	Collected             bool     `json:"collected"`
	Gaps                  []string `json:"gaps"`
	IdentityKind          string   `json:"identity_kind"`
	VersionPinned         bool     `json:"version_pinned"`
	PackagePublication    string   `json:"package_publication"`
	RepositoryState       string   `json:"repository_state"`
	AdvisoryLookup        string   `json:"advisory_lookup"`
	KnownAdvisories       int      `json:"known_advisories"`
	AuthorityState        string   `json:"authority_state"`
	CapabilitySource      string   `json:"capability_source"`
	DeclaredToolCount     int      `json:"declared_tool_count"`
	RiskyDeclarationCount int      `json:"risky_declaration_count"`
	ResearchStatus        string   `json:"research_status"`
	ResearchCoverage      string   `json:"research_coverage"`
	CitationCount         int      `json:"citation_count"`
	TrustedCitationCount  int      `json:"trusted_citation_count"`
}

type ShadowMCPReviewSummary 

type ShadowMCPReviewSummary struct {
	Status           string       `json:"status"`
	StandingDecision string       `json:"standing_decision,omitempty"`
	RequesterCount   SubjectCount `json:"requester_count"`
	EvidenceChanged  bool         `json:"evidence_changed"`
}

type ShadowMCPTargetSummary 

type ShadowMCPTargetSummary struct {
	Display            string                  `json:"display"`
	TargetKind         string                  `json:"target_kind"`
	ObservationState   string                  `json:"observation_state"`
	FirstSeen          string                  `json:"first_seen,omitempty"`
	LastSeen           string                  `json:"last_seen,omitempty"`
	LastCalled         string                  `json:"last_called,omitempty"`
	ObservedUseCount   int                     `json:"observed_use_count"`
	UserCount          SubjectCount            `json:"user_count"`
	Access             ShadowMCPAccessSummary  `json:"access"`
	Review             *ShadowMCPReviewSummary `json:"review,omitempty"`
	DecisionVersion    string                  `json:"decision_version,omitempty"`
	TargetReference    string                  `json:"target_reference"`
	ReferenceExpiresAt string                  `json:"reference_expires_at"`
}

type ShadowPolicyDecisions 

type ShadowPolicyDecisions struct {
	Disposition        string `json:"effective_disposition"`
	AllowedTargetCount int    `json:"allowed_target_count"`
	BlockedTargetCount int    `json:"blocked_target_count"`
	ManagedVia         string `json:"managed_via"`
}

ShadowPolicyDecisions describes the configured URL-target posture of a blocking Shadow MCP policy. It never contains URLs, principals, or selectors.

type SkillAuthoringResult 

type SkillAuthoringResult struct {
	ProjectSlug         string              `json:"project_slug"`
	Skill               SkillSummary        `json:"skill"`
	Version             SkillVersionSummary `json:"version"`
	CreatedSkill        bool                `json:"created_skill"`
	CreatedVersion      bool                `json:"created_version"`
	Distributed         bool                `json:"distributed"`
	InertMessage        string              `json:"inert_message"`
	NextAction          string              `json:"next_action"`
	DistributionTargets []SkillTarget       `json:"distribution_targets,omitempty"`
}

SkillAuthoringResult is what create and version writes return.

Distributed and DistributionTargets are on it for one reason: authoring a skill changes no runtime behavior at all, and a result that only said "created" would read as activation to the exact caller most likely to stop there. The result states the skill is inert and names where it can be sent.

type SkillProjectResolver 

type SkillProjectResolver interface {
	ResolveProject(ctx context.Context, organizationID, projectSlug string) (ResolvedProject, error)
}

SkillProjectResolver turns the project slug a caller names into the project every downstream call is scoped by.

type SkillSummary 

type SkillSummary struct {
	ID              string   `json:"id"`
	Name            string   `json:"name"`
	DisplayName     string   `json:"display_name"`
	Summary         string   `json:"summary,omitempty"`
	Tags            []string `json:"tags,omitempty"`
	LatestVersionID string   `json:"latest_version_id,omitempty"`
	VersionCount    int64    `json:"version_count"`
	HasValidVersion bool     `json:"has_valid_version"`
	UpdatedAt       string   `json:"updated_at"`
}

SkillSummary is the registry projection of one skill. Content is deliberately absent: listing a project's skills should not spend the caller's context on manifests it has not asked to read.

type SkillTarget 

type SkillTarget struct {
	Kind      SkillTargetKind `json:"kind"`
	ID        string          `json:"id"`
	Name      string          `json:"name"`
	Slug      string          `json:"slug,omitempty"`
	IsDefault bool            `json:"is_default,omitempty"`
}

SkillTarget is one resolved or offered distribution target. It is echoed back on every distribution so the caller can see which plugin or assistant its name resolved to rather than inferring it.

type SkillTargetInventory 

type SkillTargetInventory interface {
	SkillTargets(ctx context.Context, organizationID string, projectID uuid.UUID, limitPerKind int) ([]SkillTarget, error)
}

SkillTargetInventory names the plugins and assistants a skill may be distributed to in one project. Lane D6 owns the full plugin catalogue surface; this is the resolution half it promises to supply to distribution, expressed as the narrow read it actually needs.

The limit is per kind, not per result. A combined cap would let a project with many plugins push every assistant out of the answer, and a target that is missing from the answer is a target distribution refuses as not_found.

type SkillTargetKind 

type SkillTargetKind string

SkillTargetKind names what a distribution attaches to. 

const (
	SkillTargetPlugin    SkillTargetKind = "plugin"
	SkillTargetAssistant SkillTargetKind = "assistant"
)

type SkillUsage 

type SkillUsage struct {
	SkillName   string       `json:"skill_name"`
	Activations int64        `json:"activations"`
	ActiveUsers SubjectCount `json:"active_users"`
	Errors      string       `json:"errors"`
}

type SkillUsageUser 

type SkillUsageUser struct {
	SubjectReference string `json:"subject_reference"`
	MaskedIdentity   string `json:"masked_identity"`
	Activity         string `json:"activity"`
	Errors           string `json:"errors"`
}

type SkillVersionSummary 

type SkillVersionSummary struct {
	ID               string   `json:"id"`
	CanonicalSHA256  string   `json:"canonical_sha256"`
	SpecValid        bool     `json:"spec_valid"`
	ValidationErrors []string `json:"validation_errors,omitempty"`
	CreatedAt        string   `json:"created_at"`
	Content          string   `json:"content,omitempty"`
	ContentTruncated bool     `json:"content_truncated,omitempty"`
}

SkillVersionSummary is one immutable version. Content appears only when the caller opted in.

type SkillsManagement 

type SkillsManagement interface {
	Create(context.Context, *genskills.CreatePayload) (*genskills.RecordSkillResult, error)
	AddVersion(context.Context, *genskills.AddVersionPayload) (*genskills.RecordSkillResult, error)
	Update(context.Context, *genskills.UpdatePayload) (*types.Skill, error)
	List(context.Context, *genskills.ListPayload) (*genskills.ListSkillsResult, error)
	Get(context.Context, *genskills.GetPayload) (*genskills.GetSkillResult, error)
	ListDistributions(context.Context, *genskills.ListDistributionsPayload) (*genskills.ListSkillDistributionsResult, error)
	ListVersions(context.Context, *genskills.ListVersionsPayload) (*genskills.ListSkillVersionsResult, error)
	Distribute(context.Context, *genskills.DistributePayload) (*types.SkillDistribution, error)
}

SkillsManagement is the subset of the skills management service this surface calls. Going through the service rather than the repository is what keeps one definition of manifest validation, version immutability, canonical-content idempotency, and typed audit for every surface that authors a skill.

type SkillsService 

type SkillsService struct {
	// contains filtered or unexported fields
}

SkillsService is the handler-facing boundary for skill authoring and distribution over Platform MCP.

func NewSkillsService 

func NewSkillsService(skills SkillsManagement, targets SkillTargetInventory, projects SkillProjectResolver, grants GrantPreparer, gate CatalogRegistrationGateChecker, budget OperationBudget) *SkillsService

func (*SkillsService) AddSkillVersion 

func (s *SkillsService) AddSkillVersion(ctx context.Context, principal Principal, input AddSkillVersionInput) (SkillAuthoringResult, error)

func (*SkillsService) CreateSkill 

func (s *SkillsService) CreateSkill(ctx context.Context, principal Principal, input CreateSkillInput) (SkillAuthoringResult, error)

func (*SkillsService) DistributeSkill 

func (s *SkillsService) DistributeSkill(ctx context.Context, principal Principal, input DistributeSkillInput) (DistributeSkillOutput, error)

func (*SkillsService) GetSkill 

func (s *SkillsService) GetSkill(ctx context.Context, principal Principal, input GetSkillInput) (GetSkillOutput, error)

func (*SkillsService) ListSkillVersions 

func (s *SkillsService) ListSkillVersions(ctx context.Context, principal Principal, input ListSkillVersionsInput) (ListSkillVersionsOutput, error)

func (*SkillsService) ListSkills 

func (s *SkillsService) ListSkills(ctx context.Context, principal Principal, input ListSkillsInput) (ListSkillsOutput, error)

func (*SkillsService) UpdateSkillMetadata 

func (s *SkillsService) UpdateSkillMetadata(ctx context.Context, principal Principal, input UpdateSkillMetadataInput) (UpdateSkillMetadataOutput, error)

type SubjectCount 

type SubjectCount struct {
	// contains filtered or unexported fields
}

SubjectCount is a count of people — users, members, operators. It serializes as a number when it is zero or at least SubjectSuppressionThreshold, and as "less_than_5" in between.

Zero is reported exactly because it identifies nobody: it is the difference between "no one used this" and "someone did", which a diagnostic caller needs and which reveals no subject. Counts of events — calls, failures — are not subject counts and are reported exactly; they are plain integers, not this type.

func NewSubjectCount 

func NewSubjectCount(value int64) SubjectCount

NewSubjectCount wraps a raw subject count for suppression at the boundary.

func (SubjectCount) MarshalJSON 

func (c SubjectCount) MarshalJSON() ([]byte, error)

func (SubjectCount) Suppressed 

func (c SubjectCount) Suppressed() bool

Suppressed reports whether this count will be withheld.

func (*SubjectCount) UnmarshalJSON 

func (c *SubjectCount) UnmarshalJSON(data []byte) error

UnmarshalJSON exists so a result round-trips through JSON in tests and in any caller that decodes its own output. A suppressed value decodes back to the suppression floor rather than to a real count, because the real count was never transmitted.

type SubjectToolStatus 

type SubjectToolStatus struct {
	ToolName string `json:"tool_name"`
	Outcome  string `json:"outcome"`
	Errors   string `json:"errors"`
	Blocked  string `json:"blocked"`
}

type ToolMeta 

type ToolMeta struct {
	Audiences    []Audience
	ProjectScope ProjectScope
}

ToolMeta is what a tool declares beyond its schemas: who may call it, and how it obtains its target.

type ToolRefusalError 

type ToolRefusalError struct {
	Code    string
	Payload string
}

ToolRefusalError is a tool's own refusal — a rate limit, a disabled feature, an ineligible target — rather than a failure of the call. The MCP surface returns these as an error result; a direct caller receives this error, so the reason survives instead of being replaced by an empty payload.

func (*ToolRefusalError) Error 

func (e *ToolRefusalError) Error() string

type UpdateMCPAccessRoleInput 

type UpdateMCPAccessRoleInput struct {
	ProjectID       string              `json:"project_id" jsonschema:"explicit project ID that owns every configured MCP in the delta"`
	RoleReference   string              `json:"role_reference" jsonschema:"opaque role reference returned by list_access_roles, get_mcp_access, or a role mutation"`
	ExpectedVersion string              `json:"expected_version" jsonschema:"opaque role version returned by the preceding role mutation"`
	AddRules        []MCPAccessRoleRule `json:"add_rules,omitempty" jsonschema:"MCP access rules to add without replacing other grants"`
	RemoveRules     []MCPAccessRoleRule `json:"remove_rules,omitempty" jsonschema:"MCP access rules to remove without replacing other grants"`
	IdempotencyKey  string              `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact write"`
	Confirmed       bool                `json:"confirmed" jsonschema:"set true only after the user confirms this exact project, role, and MCP access delta"`
}

type UpdateMCPAccessRoleOutput 

type UpdateMCPAccessRoleOutput struct {
	Role           AccessRoleMutationSummary `json:"role"`
	Reconciliation string                    `json:"reconciliation"`
	Receipt        RiskMutationToolReceipt   `json:"receipt"`
}

type UpdateMCPMetadataInput 

type UpdateMCPMetadataInput struct {
	ProjectSlug     string
	RegistrationID  string
	MCPID           string
	Name            string
	ExpectedVersion string
	IdempotencyKey  string
}

type UpdateMCPMetadataResult 

type UpdateMCPMetadataResult struct {
	Project        ResolvedProject
	RegistrationID string
	MCPID          string
	Name           string
	Slug           string
	Visibility     string
	Version        string
	Receipt        OperationReceipt
}

type UpdateMCPMetadataToolInput 

type UpdateMCPMetadataToolInput struct {
	ProjectSlug     string `json:"project_slug" jsonschema:"explicit project slug that owns the Platform-managed MCP"`
	RegistrationID  string `json:"registration_id" jsonschema:"Platform registration ID returned by find_mcp or get_mcp"`
	MCPID           string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp or get_mcp"`
	Name            string `json:"name" jsonschema:"new project-local MCP display name; 1-256 bytes after trimming and no line breaks"`
	ExpectedVersion string `json:"expected_version" jsonschema:"opaque version returned by find_mcp, get_mcp, or a previous update_mcp_metadata result"`
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"caller-generated idempotency key; reuse only to retry this exact metadata update"`
}

type UpdateMCPMetadataToolOutput 

type UpdateMCPMetadataToolOutput struct {
	ProjectSlug    string `json:"project_slug"`
	RegistrationID string `json:"registration_id"`
	MCPID          string `json:"mcp_id"`
	Name           string `json:"name"`
	Slug           string `json:"slug"`
	Visibility     string `json:"visibility"`
	Version        string `json:"version"`
	ReceiptID      string `json:"receipt_id"`
	Replayed       bool   `json:"replayed"`
}

type UpdateMCPVisibilityInput 

type UpdateMCPVisibilityInput struct {
	ProjectSlug     string
	RegistrationID  string
	MCPID           string
	ExpectedVersion string
	IdempotencyKey  string
}

type UpdateMCPVisibilityResult 

type UpdateMCPVisibilityResult struct {
	Project        ResolvedProject
	RegistrationID string
	MCPID          string
	Visibility     string
	Version        string
	Receipt        OperationReceipt
	Readiness      MCPReadiness
	Published      bool
}

type UpdateMCPVisibilityToolInput 

type UpdateMCPVisibilityToolInput struct {
	ProjectSlug     string `json:"project_slug" jsonschema:"explicit project slug that owns the Platform-managed MCP"`
	RegistrationID  string `json:"registration_id" jsonschema:"Platform registration ID returned by find_mcp or get_mcp"`
	MCPID           string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp or get_mcp"`
	ExpectedVersion string `json:"expected_version" jsonschema:"opaque version returned by find_mcp, get_mcp, or a previous lifecycle update"`
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"caller-generated idempotency key; reuse only to retry this exact visibility update"`
}

type UpdateMCPVisibilityToolOutput 

type UpdateMCPVisibilityToolOutput struct {
	ProjectSlug    string       `json:"project_slug"`
	RegistrationID string       `json:"registration_id"`
	MCPID          string       `json:"mcp_id"`
	Visibility     string       `json:"visibility"`
	Version        string       `json:"version"`
	ReceiptID      string       `json:"receipt_id"`
	Replayed       bool         `json:"replayed"`
	Readiness      MCPReadiness `json:"readiness"`
	Published      bool         `json:"published"`
}

type UpdateRiskExclusionReceiptResult 

type UpdateRiskExclusionReceiptResult struct {
	Project        RiskMutationReceiptProject  `json:"project"`
	Exclusion      RiskExclusionReceiptSummary `json:"exclusion"`
	Version        string                      `json:"version"`
	ResultCategory string                      `json:"result_category"`
	Reconciliation string                      `json:"reconciliation"`
}

type UpdateRiskExclusionToolOutput 

type UpdateRiskExclusionToolOutput struct {
	UpdateRiskExclusionReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type UpdateRiskPolicyReceiptResult 

type UpdateRiskPolicyReceiptResult struct {
	Project        RiskMutationReceiptProject `json:"project"`
	Policy         RiskPolicyReceiptSummary   `json:"policy"`
	Version        string                     `json:"version"`
	ResultCategory string                     `json:"result_category"`
}

type UpdateRiskPolicyToolOutput 

type UpdateRiskPolicyToolOutput struct {
	UpdateRiskPolicyReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type UpdateSkillMetadataInput 

type UpdateSkillMetadataInput struct {
	ProjectSlug             string
	SkillID                 string
	Name                    string
	DisplayName             string
	Summary                 string
	ClearSummary            bool
	ExpectedLatestVersionID string
}

UpdateSkillMetadataInput changes registry naming only. Instructions live in versions, so nothing here can alter what a skill tells an agent to do.

type UpdateSkillMetadataOutput 

type UpdateSkillMetadataOutput struct {
	ProjectSlug string       `json:"project_slug"`
	Skill       SkillSummary `json:"skill"`
}

type UpdateSkillMetadataToolInput 

type UpdateSkillMetadataToolInput struct {
	ProjectSlug             string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID                 string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	Name                    string `json:"name,omitempty" jsonschema:"new canonical skill name; omitted leaves it unchanged"`
	DisplayName             string `json:"display_name,omitempty" jsonschema:"new user-facing skill name; omitted leaves it unchanged"`
	Summary                 string `json:"summary,omitempty" jsonschema:"new registry summary; omitted leaves it unchanged"`
	ClearSummary            bool   `json:"clear_summary,omitempty" jsonschema:"remove the registry summary instead of replacing it"`
	ExpectedLatestVersionID string `` /* 167-byte string literal not displayed */
}

Source Files

View all Source files

Directories

Path Synopsis
Package localfixture owns the code-defined reviewed provider used only by the explicit local Platform MCP fixture composition.
 Package localfixture owns the code-defined reviewed provider used only by the explicit local Platform MCP fixture composition.
Package oauth defines Platform MCP's organization-bound OAuth state contracts.
 Package oauth defines Platform MCP's organization-bound OAuth state contracts.
Package remotesessionprovider implements reviewed Platform MCP provider readiness over shared remote-session authorization.
 Package remotesessionprovider implements reviewed Platform MCP provider readiness over shared remote-session authorization.
Package setupcorpus builds the reviewed Platform MCP setup resource corpus from the pinned mcp-setup-docs export.
 Package setupcorpus builds the reviewed Platform MCP setup resource corpus from the pinned mcp-setup-docs export.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.