@absolutejs/mcp 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -6,6 +6,18 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.26.0 — 2026-09-13
+
+### Added
+
+- **Resolve shared commerce policy from authenticated registered callback channels without per-account canary bindings.** (`registeredMcpProfiles`, `registeredMcpCommerce`)
+
+## 0.25.0 — 2026-09-13
+
+### Added
+
+- **Add estimate-based background work admission while preserving exact-ID recovery and hard charge caps.** (`McpBackgroundWorkEstimate`, `createBackgroundWorkTools`)
+
 ## 0.24.0 — 2026-09-13
 
 ### Added

package/changelog.json

@@ -2,6 +2,34 @@
 	"contract": 1,
 	"name": "@absolutejs/mcp",
 	"releases": [
+		{
+			"changes": [
+				{
+					"kind": "added",
+					"summary": "Resolve shared commerce policy from authenticated registered callback channels without per-account canary bindings.",
+					"symbols": [
+						"registeredMcpProfiles",
+						"registeredMcpCommerce"
+					]
+				}
+			],
+			"date": "2026-09-13",
+			"version": "0.26.0"
+		},
+		{
+			"changes": [
+				{
+					"kind": "added",
+					"summary": "Add estimate-based background work admission while preserving exact-ID recovery and hard charge caps.",
+					"symbols": [
+						"McpBackgroundWorkEstimate",
+						"createBackgroundWorkTools"
+					]
+				}
+			],
+			"date": "2026-09-13",
+			"version": "0.25.0"
+		},
 		{
 			"changes": [
 				{

package/dist/index.js

@@ -2917,11 +2917,32 @@ var createBackgroundWorkTools = (options) => {
       }
     }
   };
+  const estimate = options.estimate;
+  if (estimate)
+    tools.estimate_background_work = {
+      description: "Estimate service credits for a background plan without reserving credits or starting work. The minimum admits one step; the total estimates the whole plan. Actual usage varies. Get the user's approval for the maximum before starting; never silently increase it.",
+      annotations: { readOnlyHint: true },
+      commerce: { action: "paid_access", categories: ["usage_credits"] },
+      inputSchema: options.inputSchema,
+      handler: async (input) => {
+        const value = await estimate(input);
+        if (![value.minimumCredits, value.estimatedCredits, value.totalSteps].every(Number.isSafeInteger) || value.minimumCredits < 1 || value.estimatedCredits < value.minimumCredits || value.totalSteps < 1 || typeof value.assumptions !== "string" || !value.assumptions)
+          throw new Error("Invalid background work estimate");
+        const summary = {
+          minimumCredits: value.minimumCredits,
+          estimatedCredits: value.estimatedCredits,
+          totalSteps: value.totalSteps,
+          assumptions: value.assumptions,
+          message: "Estimate only, not a quote or guarantee. No credits reserved and no work started. Admission is checked again at start and before each step; work can stop with partial results. The approved maximum charge is never increased."
+        };
+        return { content: [{ type: "text", text: JSON.stringify(summary) }], structuredContent: summary };
+      }
+    };
   const start = options.start;
   if (start)
     tools.start_background_work = budgetedMcpTool({
       tool: {
-        description: `${options.description} Launch bounded background work only after the user agrees to the plan and maximum credits. Return the requestId promptly; poll get_background_work for progress.`,
+        description: `${options.description} Use estimate_background_work when available before asking for a budget. Launch bounded background work only after the user agrees to the plan and maximum credits. Return the requestId promptly; poll get_background_work for progress.`,
         inputSchema: options.inputSchema,
         handler: async () => {
           throw new Error("Background work must use durable dispatch");
@@ -2931,6 +2952,37 @@ var createBackgroundWorkTools = (options) => {
     });
   return tools;
 };
+// src/registeredCommerce.ts
+var registeredMcpProfiles = (redirectUris) => {
+  if (!redirectUris.length)
+    return ["unknown"];
+  const classify = (value) => {
+    try {
+      const url = new URL(value);
+      if (url.username || url.password)
+        return "unknown";
+      if (url.protocol === "https:" && ["claude.ai", "claude.com"].includes(url.hostname))
+        return "claude-interactive";
+      if (url.protocol === "https:" && ["chatgpt.com", "chat.openai.com"].includes(url.hostname))
+        return "chatgpt-plugin";
+      if (["http:", "https:"].includes(url.protocol) && ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname))
+        return "direct-mcp";
+      if (["vscode:", "vscode-insiders:", "cursor:", "windsurf:"].includes(url.protocol))
+        return "direct-mcp";
+      if (url.origin === "https://vscode.dev" && url.pathname === "/redirect")
+        return "direct-mcp";
+      return "unknown";
+    } catch {
+      return "unknown";
+    }
+  };
+  return [...new Set(redirectUris.map(classify))];
+};
+var registeredMcpCommerce = (options) => ({
+  profiles: registeredMcpProfiles(options.redirectUris),
+  reviews: options.reviews,
+  capabilities: options.capabilities
+});
 export {
   COMMERCE_POLICY_SOURCES,
   COMMERCE_POLICY_VERSION,
@@ -2978,6 +3030,8 @@ export {
   projectWorkPreview,
   protectedResourceMetadata,
   publicMcpTask,
+  registeredMcpCommerce,
+  registeredMcpProfiles,
   verifyBearer,
   withMcpApp
 };

package/dist/src/backgroundWork.d.ts

@@ -1,5 +1,11 @@
 import { type McpCreditWorkRequest } from "./budgetedTool";
 import type { McpTool, McpToolRegistry, McpToolResult } from "./types";
+export type McpBackgroundWorkEstimate = {
+    minimumCredits: number;
+    estimatedCredits: number;
+    totalSteps: number;
+    assumptions: string;
+};
 /** Public output only. Adapters must scope reads to the authenticated account. */
 export type McpBackgroundWorkSnapshot = {
     status: "queued" | "running" | "completed" | "stopped" | "failed" | "unknown";
@@ -16,6 +22,7 @@ export declare const createBackgroundWorkResult: (requestId: string, work: McpBa
 export declare const createBackgroundWorkTools: (options: {
     description: string;
     inputSchema: McpTool["inputSchema"];
+    estimate?: (input: unknown) => Promise<McpBackgroundWorkEstimate>;
     start?: (request: McpCreditWorkRequest) => Promise<McpBackgroundWorkSnapshot>;
     read: (requestId: string) => Promise<McpBackgroundWorkSnapshot | null>;
 }) => McpToolRegistry;

package/dist/src/index.d.ts

@@ -55,3 +55,5 @@ export { createSetupSelectionTools, projectSetupSelection, type SetupSelection,
 export { createActionWorkflowTools, projectActionReview, projectActionJob, type ActionReview, type ActionConfirmation, type ActionJob, } from "./actionWorkflow";
 export { createCreditWorkResult, type McpCreditWorkSnapshot, } from "./creditWorkResult";
 export { createBackgroundWorkTools, createBackgroundWorkResult, type McpBackgroundWorkSnapshot } from "./backgroundWork";
+export type { McpBackgroundWorkEstimate } from "./backgroundWork";
+export { registeredMcpProfiles, registeredMcpCommerce } from "./registeredCommerce";

package/dist/src/registeredCommerce.d.ts

@@ -0,0 +1,12 @@
+import type { CommerceContext, CommerceProfile, CommerceReview } from "./commerce";
+/** Classify the callback channel from the authenticated OAuth registration.
+ * This identifies a transport/distribution shape, not a verified vendor or plan.
+ * Never pass tool arguments, clientInfo names, or unbound request metadata. */
+export declare const registeredMcpProfiles: (redirectUris: readonly string[]) => CommerceProfile[];
+/** Every authenticated account shares deployment policy; account ownership and
+ * available credit checks remain separate. Mixed callback profiles intersect. */
+export declare const registeredMcpCommerce: (options: {
+    redirectUris: readonly string[];
+    reviews: readonly CommerceReview[];
+    capabilities?: CommerceContext["capabilities"];
+}) => CommerceContext;

package/docs/commerce-host-rules.md

@@ -368,3 +368,18 @@ bounded work until their reservation and recovery lifecycle is implemented.
 This documentation update changes no runtime API, profile, feature flag or
 published package version. It is available in the shared repository and will
 ship with the next package release through the existing documentation allowlist.
+
+### Background research estimates
+
+`createBackgroundWorkTools({ estimate, start, read, ... })` optionally exposes
+`estimate_background_work`. Its adapter returns minimum credits for one step,
+estimated total credits, total steps and explicit assumptions. Public output is
+identical in text and structured hosts, and omits adapter-private fields. No
+provider work or reservation belongs in the estimate adapter.
+
+Estimates use `paid_access` commerce policy, so a restricted host cannot use this
+as a pricing/purchase workaround. Obtain user agreement to the exact plan and
+maximum before start. Server-side start must reevaluate admission atomically;
+never silently raise a maximum. Saved-work reads remain separate and credit-free.
+An estimate is advisory, not an expiring quote or guaranteed cost. Bind input,
+account and maximum durably; exact-ID recovery must not depend on current pricing.

package/docs/reviews/general-service-access.md

@@ -0,0 +1,61 @@
+# Account-independent service access
+
+Reviewed September 13, 2026; re-review by October 13, 2026.
+This supersedes the per-account canary condition for the general-access deployment,
+not the published host restrictions or the requirement for explicit payment approval.
+
+## Scope and decision
+
+A customer account is not a distribution channel. Authenticated customers may use
+an independently operated service against their existing service-credit entitlement,
+without buying its portal subscription or being individually allowlisted. Each
+operation still needs account authorization, an explicit maximum, durable metering
+and recovery. Customer charges must never exceed the approved maximum.
+
+Native, directly configured MCP connections may return a user-requested link to
+the service's own HTTPS checkout. Card entry and confirmation happen on that page;
+the MCP tool neither collects card data nor charges. Organizational policies may
+block a user's connector; this service does not bypass those controls or certify
+compliance with a customer's private contract. This is a scoped operator
+interpretation, not vendor certification or a statement that every marketplace
+allows commerce.
+
+## Evidence and limits
+
+- [MCP authorization](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization)
+  binds access to OAuth scopes and resource owners. The authenticated registration's
+  redirect destinations classify a native callback or hosted channel. They do not
+  attest a vendor identity, host account plan or marketplace listing.
+- [VS Code MCP documentation](https://code.visualstudio.com/docs/agent-customization/mcp-servers)
+  documents direct connections and user/server trust. [GitHub additional terms](https://docs.github.com/en/site-policy/github-terms/github-terms-for-additional-products-and-features)
+  distinguish individual and organizational agreements. [Individual terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service)
+  and [Copilot product terms](https://github.com/customer-terms/github-copilot-product-specific-terms)
+  leave users responsible for their use. Our inference is that separately requested
+  merchant service work is not resale of the host's own service. Keep independent
+  service billing separate and obey the host's access/data controls.
+- [Claude interactive connectors](https://support.claude.com/en/articles/13454812-use-interactive-connectors-in-claude)
+  support third-party service accounts. Existing-credit access is separate from
+  purchases. In-connector payment operations remain blocked; this release does not
+  grant Claude credit-checkout links while that path remains unqualified.
+- [OpenAI plugin guidelines](https://developers.openai.com/plugins/app-guidelines#commerce-and-monetization)
+  allow existing paid entitlements while prohibiting digital-credit sales and
+  transactional links. Existing work is not a new credit purchase. Keep pricing
+  promotions, top-up links, saved-card charges, subscriptions and auto-refill hidden
+  from that hosted profile; explain unavailable entitlements without an upsell.
+
+## Shared implementation
+
+`registeredMcpProfiles` and `registeredMcpCommerce` classify only callback URIs
+loaded by the server for the authenticated OAuth client. Loopback/native callbacks
+select the direct channel, recognized hosted origins select their restricted
+profile, and unknown or mixed channels fail closed/intersect. Never classify from
+`clientInfo`, a model name, a tool argument, or an unverified query parameter.
+A native callback is not proof of Microsoft, Anthropic or OpenAI affiliation.
+Marketplace deployments must select their marketplace profile explicitly rather
+than reusing a native/direct review. Do not advertise an untested host as tested.
+
+The package does not grant access by itself: the deployment supplies dated reviews,
+capabilities, authentication, entitlement checks, rate limits and billing. Restrictive
+published rules override these reviews. Account IDs are used to scope data and
+charges, not to select an eligible customer cohort. Expired review evidence closes
+paid tools while status/recovery remains available.

package/package.json

@@ -90,5 +90,5 @@
     "canary:checkout": "bun canary/checkout.ts"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.24.0"
+  "version": "0.26.0"
 }