@aventara/mcp 0.0.0-stage → 1.0.0-rc.10

package/CHANGELOG.md

@@ -0,0 +1,184 @@
+# @aventara/mcp
+
+## 1.0.0-rc.10
+
+### Patch Changes
+
+- 04bb39a: `engines.node` is now `^22.23.4 || >=24.22.1`, the Node security releases of 2026-10-20 (CVE-2026-105481,
+  CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074,
+  CVE-2026-111497). The bins refuse an older Node in one sentence naming that range.
+- d7e7369: - The tool `me`, offered when the framework's `access` provider states its `client`: it takes `{}` and answers the
+  identity Aventara Access resolves from the request's credentials (`{ sub, claims }`, or `null`) as the protocol
+  envelope's data, projected onto the `access` section's `me` schema (an identity it does not describe answers
+  `A3000`).
+  - An endpoint without `authorization` now also requires a loopback `Host` header (`localhost`, `127.x.x.x` or
+    `[::1]`, any port); any other `Host`, or none, is `403`. This closes DNS rebinding (the class of CVE-2025-66414): a
+    page whose domain is rebound to `127.0.0.1` still names its own domain as `Host`.
+    An HTTP/2 caller (`:authority`, no `Host`) is refused by the open endpoint.
+- 3fb3333: `@aventara/mcp` pins `@modelcontextprotocol/sdk` 1.32.2 (was 1.30.1) and `zod` `^4.6.7` (was `^4.6.5`); `@aventara/core`
+  also takes `zod` `^4.6.7`. This clears the advisories against those versions:
+
+  | Advisory                              | Severity | Package             | What it was                                                                                              |
+  | ------------------------------------- | -------- | ------------------- | -------------------------------------------------------------------------------------------------------- |
+  | GHSA-46jr-4wx8-v453 (CVE-2026-111768) | high     | sdk < 1.32.0        | One HTTP request within the default size limit could exhaust server memory during validation             |
+  | GHSA-22jm-h49p-29qw (CVE-2026-111767) | high     | sdk 1.24.0 – 1.31.x | Experimental tasks were not tied to the session that created them                                        |
+  | GHSA-6qxp-vccf-f47h (CVE-2026-104850) | high     | sdk 1.12.0 – 1.30.x | The OAuth client could send credentials to an authorization server chosen by the MCP server              |
+  | GHSA-mrhx-c7xc-m3w5                   | high     | zod ≤ 4.6.5         | Validating an oversized unconstrained array could exhaust memory                                         |
+  | GHSA-rvq5-wwqv-78pq (CVE-2026-111771) | moderate | sdk 1.6.0 – 1.31.x  | Server bearer authentication accepted tokens issued for another service                                  |
+  | GHSA-6prh-2h8m-c8cw (CVE-2026-111769) | moderate | sdk < 1.32.0        | HTTP client transports and OAuth requests followed cross-origin redirects with custom headers and bodies |
+
+  Aventara's MCP server was already outside most of these: it uses the low-level `Server` (no `taskStore`, no
+  `requireBearerAuth`, no SDK OAuth client), and its transport's `maxRequestBodySize` is the agent layer's
+  `limits.maxRequestBytes`. No API of `@aventara/mcp` changes.
+
+- 88263a1: Documentation: `$access.can([])` answers `[]`, not a refusal; the MCP README states the query and fragment rule for
+  every authorization server.
+- Updated dependencies [587dd01]
+- Updated dependencies [d7e7369]
+- Updated dependencies [7ee547b]
+- Updated dependencies [f52c499]
+- Updated dependencies [2907484]
+- Updated dependencies [a6bbdf0]
+- Updated dependencies [3e26549]
+- Updated dependencies [a6bbdf0]
+- Updated dependencies [6f3f6f6]
+- Updated dependencies [04bb39a]
+- Updated dependencies [3fb3333]
+- Updated dependencies [827ccb6]
+- Updated dependencies [7f5abc3]
+- Updated dependencies [88263a1]
+- Updated dependencies [10341d5]
+- Updated dependencies [8129844]
+- Updated dependencies [88263a1]
+- Updated dependencies [3020b5c]
+- Updated dependencies [88263a1]
+- Updated dependencies [88263a1]
+  - @aventara/core@1.0.0-rc.10
+
+## 1.0.0-rc.9
+
+### Patch Changes
+
+- Updated dependencies [205a379]
+- Updated dependencies [a0bb05e]
+- Updated dependencies [86ab319]
+- Updated dependencies [fdf52e6]
+  - @aventara/core@1.0.0-rc.9
+
+## 1.0.0-rc.8
+
+1.0.0-rc.5, rc.6 and rc.7 were tagged but never published; 1.0.0-rc.8 contains everything listed under them and the changes below.
+
+### Patch Changes
+
+- Updated dependencies [1c8e4ee]
+  - @aventara/core@1.0.0-rc.8
+
+## 1.0.0-rc.7
+
+1.0.0-rc.5 and 1.0.0-rc.6 were tagged but never published; 1.0.0-rc.7 contains everything listed under them and the changes below.
+
+### Patch Changes
+
+- Updated dependencies [f917c1c]
+  - @aventara/core@1.0.0-rc.7
+
+## 1.0.0-rc.6
+
+1.0.0-rc.5 was tagged but never published. 1.0.0-rc.6 contains everything listed under 1.0.0-rc.5 and the fix below.
+
+### Patch Changes
+
+- Updated dependencies [1cf72e0]
+  - @aventara/core@1.0.0-rc.6
+
+## 1.0.0-rc.5
+
+### Patch Changes
+
+- Updated dependencies [4795ff1]
+- Updated dependencies [9e178ca]
+  - @aventara/core@1.0.0-rc.5
+
+## 1.0.0-rc.4
+
+### Patch Changes
+
+- d10639a: Faster reads. The read-only copies stages are told cost about half what they did: a read with a computed field
+  copies each row in one pass, a row with several computed fields shares its nested objects between the stages'
+  copies, and after hooks share one frozen copy of the result. A row whose computed field returns a value at once no
+  longer waits a turn per row. The MCP endpoint builds its JSON Schema validator once instead of on every request.
+  What stages are told, the order they run in and what a request answers are unchanged.
+- Updated dependencies [e3d03a7]
+- Updated dependencies [d10639a]
+- Updated dependencies [f67e68c]
+- Updated dependencies [708556c]
+- Updated dependencies [3a0dfca]
+- Updated dependencies [99169d2]
+- Updated dependencies [0fd2608]
+- Updated dependencies [154e440]
+- Updated dependencies [2fcffdb]
+  - @aventara/core@1.0.0-rc.4
+
+## 1.0.0-rc.3
+
+### Patch Changes
+
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+  - @aventara/core@1.0.0-rc.3
+
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- 9366e16: MCP endpoint polish:
+
+  - A request with no bearer credentials (no `Authorization` header, or another scheme such as `Basic`) is answered
+    `401` with `WWW-Authenticate: Bearer resource_metadata="…"` and no error code, as RFC 6750 §3.1 asks; its body no
+    longer says "Missing Authorization header". A bad bearer token keeps `error="invalid_token"`.
+  - A `mcp.authorization.verify` that throws is still answered `401`, and is now reported to the `diagnostics` sink as
+    an `AvMcpDiagnostic` holding the error.
+  - With `mcp` configured and `@aventara/mcp` missing, the startup error names the command that installs it at the
+    installed `@aventara/core`'s exact version: `npm install --save-exact @aventara/mcp@<version>`.
+
+- A tool call whose `resource` or `variant` holds a lone surrogate (JSON can carry one, a URL cannot) is answered as
+  the unknown name it is, as an HTTP call answers it: `fetch` spells a lone surrogate in a URL as U+FFFD, and so does
+  the tool call, so the agent gets `A2001` (`A2002` for the variant). In rc.1 the name could not be encoded, and the
+  call answered the generic `A3000` and reported a diagnostic of kind `mcp`. A `transaction` step that has no canonical
+  form (a lone surrogate in a name or a value) is sent with a `null` fingerprint, as core's plan builders and the
+  generated client send it, so it is judged as over HTTP: an unknown name is `A2001`/`A2002`, a value `A2004` `V1001`
+  at the step's `args`. It answered `V1000` for a missing `fingerprint`, a member the tool does not take.
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+  - @aventara/core@1.0.0-rc.2
+
+## 1.0.0-rc.1
+
+### Minor Changes
+
+- New package: the MCP server of an Aventara application. With `mcp` in the configuration, `@aventara/nest` mounts it
+  at that path over the Streamable HTTP transport, stateless. Its tools are the operation families the `agent` layer
+  exposes (`find`, `create`, `update`, `delete`, `upsert`) and `transaction`, each taking `{ resource, variant, args }`
+  (`transaction`: `{ steps }`, with `$ref` between steps). Every call runs as the `agent` origin through the protocol's
+  own decoding and validation; a success answers the envelope as structured content, a failure an MCP tool error
+  carrying the envelope and its issues. The Agent Contract is the resource `aventara://contract`.
+- With `mcp.authorization`, the endpoint is an OAuth 2.1 protected resource: it publishes its metadata at
+  `/.well-known/oauth-protected-resource` plus the endpoint's path, answers a request without a good bearer token `401`
+  with a `WWW-Authenticate` challenge, and puts what `verify` returned into `ctx.$state.mcp.claims`. Without it, the
+  endpoint answers callers on the same machine only.
+- A failure of the endpoint itself (the MCP SDK's server or transport) is answered `500` with no detail and reported to
+  the Framework's diagnostics sink as an `AvMcpDiagnostic`, so the raw error is not lost.
+- A throw inside a tool or resource handler no longer reaches the agent with its raw message. A tool call answers the
+  generic `A3000` envelope as a tool error (`isError: true`), the form the protocol's own `A3000` takes; a resource or
+  list request answers a JSON-RPC internal error with the same generic message. The raw error goes to the diagnostics
+  sink as an `AvMcpDiagnostic`.
+- A tool call's arguments nested deeper than the protocol allows are refused as the protocol refuses them from a
+  client (`A2009` with `V1013`, or `V1021` for a `json` value, at the arguments' path), as a tool error. The server
+  writes the arguments on without recursing on their depth, so a deep value no longer overflows the stack.

package/LICENSE

@@ -0,0 +1,91 @@
+Required Notice: Copyright 2026 Mohamed Ragheb
+
+# PolyForm Shield License 1.0.0
+
+<https://polyformproject.org/licenses/shield/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose.  However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software.  Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncompete
+
+Any purpose is a permitted purpose, except for providing any product that competes with the software or any product the licensor or any of its affiliates provides using the software.
+
+## Competition
+
+Goods and services compete even when they provide functionality through different kinds of interfaces or for different technical platforms.  Applications can compete with services, libraries with plugins, frameworks with development tools, and so on, even if they're written in different programming languages or for different computer architectures.  Goods and services compete even when provided free of charge.  If you market a product as a practical substitute for the software or another product, it definitely competes.
+
+## New Products
+
+If you are using the software to provide a product that does not compete, but the licensor or any of its affiliates brings your product into competition by providing a new version of the software or another product using the software, you may continue using versions of the software available under these terms beforehand to provide your competing product, but not any later versions.
+
+## Discontinued Products
+
+You may begin using the software to compete with a product or service that the licensor or any of its affiliates has stopped providing, unless the licensor includes a plain-text line beginning with `Licensor Line of Business:` with the software that mentions that line of business.  For example:
+
+> Licensor Line of Business: YoyodyneCMS Content Management System (http://example.com/cms)
+
+## Sales of Business
+
+If the licensor or any of its affiliates sells a line of business developing the software or using the software to provide a product, the buyer can also enforce [Noncompete](#noncompete) for that product.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+A **product** can be a good or service, or a combination of them.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all its affiliates.
+
+**Affiliates** means the other organizations than an organization has control over, is under the control of, or is under common control with.
+
+**Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

package/LICENSE-ADDITIONAL-PERMISSION.md

@@ -0,0 +1,9 @@
+# Additional Permission — Aventara
+
+Copyright 2026 Mohamed Ragheb
+
+In addition to the permissions of the PolyForm Shield License 1.0.0 in `LICENSE`, the licensor grants the following additional permission:
+
+The Noncompete section applies only to providing a product that competes with the software itself — the Aventara framework, its packages and its tooling. Providing a product that competes with any other product the licensor or its affiliates provide using the software is a permitted purpose.
+
+This additional permission only adds to your permissions; it does not restrict or replace any term of `LICENSE`.

package/README.md

@@ -1,3 +1,167 @@
-# Temporary Holding Version
+# `@aventara/mcp`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The MCP server of an Aventara application. It turns the configuration's `agent` layer into
+[Model Context Protocol](https://modelcontextprotocol.io) tools, so an AI agent (Claude Desktop, Claude Code, any MCP
+client) can read and write the application's data under the same validation, exposure and pipelines as every other
+caller.
+
+The server lives inside your application. `@aventara/nest` mounts it at the path the configuration's `mcp` key names,
+over the Streamable HTTP transport, stateless. You install this package beside `@aventara/nest`; you do not call it
+yourself.
+
+```bash
+npm install --save-exact @aventara/mcp@<your @aventara/core version>
+```
+
+It depends on `@aventara/core` and the official MCP TypeScript SDK (`@modelcontextprotocol/sdk`).
+
+## Turning it on
+
+```ts
+// src/aventara.config.ts
+export async function aventaraConfig(prisma: PrismaService) {
+	return {
+		api: "/api",
+		mcp: "/mcp",
+		adapter: await createPrismaAdapter({ client: prisma, discovery, provider: "postgresql", driver: "@prisma/adapter-pg" }),
+		// What the agent may reach: by default exactly what the client may.
+		agent: {
+			exposed: true,
+			exemptions: { resources: { AuditLog: true } },
+		},
+	};
+}
+```
+
+When the configuration has `mcp`, `AventaraModule` mounts the endpoint and logs it:
+`Aventara mounted the MCP endpoint at /mcp (…)`. With `mcp` set and this package missing, the application refuses to
+start and names the package.
+
+## The tools
+
+One tool per operation family the agent layer exposes, and none for a family nothing exposes:
+
+| Tool | Input | Hints |
+|---|---|---|
+| `find` | `{ resource, variant, args? }` | read-only |
+| `create` | `{ resource, variant, args }` | not destructive |
+| `update` | `{ resource, variant, args }` | destructive |
+| `delete` | `{ resource, variant, args }` | destructive |
+| `upsert` | `{ resource, variant, args }` | destructive |
+| `transaction` | `{ steps: [{ resource, family, variant, args? }] }` | destructive |
+| `me` | `{}` | read-only |
+
+`resource` and `variant` are enums read from the agent layer, so a resource the agent layer hides is not offered (and is
+refused with `A2001` if an agent names it anyway). `args` is the operation's arguments as the protocol defines them
+(`where`, `select`, `data`, …). `transaction` is offered when the agent layer's transactions are interactive. A step can
+use a value an earlier step returned with `{ "$ref": { "operation": 0, "path": ["id"] } }`; the server adds the
+fingerprints the protocol requires. `me` is offered when the framework's `access` provider states its `client`: it
+answers the identity Aventara Access resolves from the request's credentials (`{ sub, claims }`, or `null`) as the
+envelope's data, holding only what the `access` section's `me` schema declares (an identity the schema does not
+describe is the server's own failure, `A3000`). There is no sign-in tool.
+
+Every call runs as the `agent` origin, through the same decoding and validation as an HTTP call, with the agent
+layer's pipelines. A success answers the protocol's envelope (`{ data, code, cause }`) as structured content and as
+text. A failure answers an MCP tool error (`isError: true`) carrying the envelope, its cause and its issues (`path`,
+`code`, `check`, `params`, `message`), so the agent can fix its arguments and call again.
+
+## The contract resource
+
+The server exposes the Agent Contract as the MCP resource `aventara://contract`: every resource, its fields and their
+types, what can be filtered, selected, created and updated, and the request limits. The tool descriptions and the
+server's instructions tell the agent to read it first.
+
+## Write safety
+
+What an agent can do is decided where everything else is: exposure (the `agent` layer, which can only narrow the layer
+it extends) and guards. A guard can tell an agent's call by its origin:
+
+```ts
+const humansOnly: AvGuard = (ctx) => ctx.$origin !== "agent";
+```
+
+The tool hints (`readOnlyHint`, `destructiveHint`) are hints for the client; they enforce nothing.
+
+## Authorization
+
+With `mcp.authorization`, the endpoint is an OAuth 2.1 protected resource. It never issues tokens: your authorization
+server does.
+
+```ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+const jwks = createRemoteJWKSet(new URL("https://auth.example.com/.well-known/jwks.json"));
+
+mcp: {
+	path: "/mcp",
+	authorization: {
+		servers: ["https://auth.example.com"],
+		verify: async (token) => {
+			try {
+				const { payload } = await jwtVerify(token, jwks, {
+					issuer: "https://auth.example.com",
+					audience: "https://api.example.com/mcp",
+				});
+				return payload;
+			} catch {
+				return null;
+			}
+		},
+	},
+},
+```
+
+Each server is an https URL. One on your own machine may be http instead, so a local setup needs no TLS:
+`http://127.0.0.1:4000` or `http://[::1]:4000`, with any port and path. That is the whole list. Use the address, not
+`localhost`: a name is looked up, and `localhost` can resolve somewhere else (RFC 8252, section 8.3), so
+`http://localhost:4000` is refused with the spelling to use, `http://127.0.0.1:4000`. `0.0.0.0`, `[::]`, other
+`127.x` addresses, IPv4-mapped addresses, names such as `auth.localhost` and URLs with credentials are refused like
+any other http URL. Write the URL the way a browser would show it: `http://127.1:4000` is refused, and the error gives
+the spelling to use. No server URL, https included, may have a query or fragment (an issuer has neither), an empty
+path segment (`//`) or port 0.
+
+An http authorization server is for local development only. Tokens and authorization codes cross it unencrypted, and
+only clients on the same machine can reach it. Deploy with an https server.
+
+- `GET /.well-known/oauth-protected-resource/mcp` answers the protected-resource metadata (RFC 9728): the endpoint's
+  URL as `resource`, your `servers` as `authorization_servers`, and `bearer_methods_supported: ["header"]`.
+- A request without `Authorization: Bearer <token>` is `401` with `WWW-Authenticate: Bearer resource_metadata="…"`
+  naming that metadata, which is how an MCP client discovers where to sign in. As RFC 6750 asks, it carries no error
+  code: the request had no token to be wrong.
+- Each token goes to `verify`. `null` (or `undefined`, or a throw) is `401` with `error="invalid_token"`. A `verify`
+  that throws is also reported to your `diagnostics` sink (an `AvMcpDiagnostic` holding the error), so an outage of
+  your token check shows in your logs rather than as a run of rejected agents. Anything else lets the request in, and
+  what `verify` returned is the request's `ctx.$state.mcp.claims`, beside what the host's `state` option seeds. Declare
+  its type with the rest of your state:
+
+```ts
+declare module "@aventara/core" {
+	interface AvState {
+		mcp?: { claims: JWTPayload };
+	}
+}
+```
+
+The endpoint's URL comes from the request as your platform reports it, so behind a proxy set Express's `trust proxy`
+or Fastify's `trustProxy` for `https` and the public host to appear in the metadata.
+
+## Without authorization
+
+An endpoint without `authorization` takes no token, so it answers callers on the same machine only: a loopback peer
+address, no proxy forwarding header (`Forwarded`, `X-Forwarded-For`, `X-Real-IP`), a loopback `Host` (`localhost`,
+`127.x.x.x` or `[::1]`, any port), and no `Origin` header but a loopback one. Every other caller gets `403`. The `Host`
+rule closes DNS rebinding: a page whose domain is rebound to `127.0.0.1` still sends its own domain as `Host`. An HTTP/2
+caller sends `:authority` instead of `Host`, so the open endpoint refuses it too; serve it over HTTP/1.1, or configure
+`authorization`. This is for local development and for an agent running beside the
+application. To serve remote agents, configure `authorization`.
+
+## The transport
+
+Streamable HTTP, stateless: every `POST` is answered on its own with a JSON response, and no session is kept. `GET` and
+`DELETE` answer `405`. A request body is limited to the agent layer's `maxRequestBytes`.
+
+## License
+
+PolyForm Shield 1.0.0 with an additional permission. It is free to use, including in commercial applications, but you
+may not use it to build a product that competes with Aventara itself. See `LICENSE` and
+`LICENSE-ADDITIONAL-PERMISSION.md`.

package/dist/av-mcp.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The MCP server of an Aventara application: its agent layer as Model Context
+ * Protocol tools. Start with `AvMcp.bind(framework)`.
+ */
+export { bind } from "./mcp.binder.js";

package/dist/av-mcp.js

@@ -0,0 +1 @@
+export { bind } from "./mcp.binder.js";

package/dist/endpoint-access.policy.d.ts

@@ -0,0 +1,35 @@
+import type { AvMcpEndpoint } from "@aventara/core";
+import type { AvProtocolResponse } from "@aventara/core/protocol";
+/** The authorization `mcp.authorization` configures. */
+type EndpointAuthorization = NonNullable<AvMcpEndpoint["authorization"]>;
+/** What a request to the endpoint is let through with, or the answer that refuses it. */
+export type EndpointAccess = {
+    readonly ok: true;
+    /** What `verify` resolved the token to; absent on an open endpoint. */
+    readonly caller?: {
+        readonly claims: unknown;
+    };
+} | {
+    readonly ok: false;
+    readonly response: AvProtocolResponse;
+};
+/** The protected-resource metadata path for an endpoint at `endpointPath` (canonical, `""` at the root). */
+export declare function metadataPathOf(endpointPath: string): string;
+/** One JSON answer. */
+export declare function jsonAnswer(status: number, body: unknown, headers?: Readonly<Record<string, string>>): AvProtocolResponse;
+/**
+ * The protected-resource metadata document (RFC 9728 §2): the endpoint's URL as
+ * `resource`, the configured servers, and the one bearer method the endpoint
+ * reads, the `Authorization` header. Public, and readable from any origin.
+ */
+export declare function metadataAnswer(method: string, origin: string, endpointPath: string, authorization: EndpointAuthorization): AvProtocolResponse;
+/**
+ * A protected endpoint's check: the request's bearer token, verified. No bearer
+ * token, one `verify` rejects (`null`, `undefined`) and a `verify` that throws
+ * are each `401`; a good one passes with what `verify` resolved it to. A throw
+ * is handed to `reportFailure` (the diagnostics sink) as well.
+ */
+export declare function authorizedAccess(authorizationHeader: string | undefined, origin: string, endpointPath: string, authorization: EndpointAuthorization, reportFailure: (error: unknown) => void): Promise<EndpointAccess>;
+/** An open endpoint's check: the caller is on this machine. */
+export declare function loopbackAccess(remoteAddress: string | undefined, header: (name: string) => string | undefined): EndpointAccess;
+export {};

package/dist/endpoint-access.policy.js

@@ -0,0 +1,110 @@
+const METADATA_PREFIX = "/.well-known/oauth-protected-resource";
+export function metadataPathOf(endpointPath) {
+    return `${METADATA_PREFIX}${endpointPath}`;
+}
+export function jsonAnswer(status, body, headers = {}) {
+    return {
+        status,
+        headers: { "Content-Type": "application/json", ...headers },
+        body: JSON.stringify(body),
+    };
+}
+export function metadataAnswer(method, origin, endpointPath, authorization) {
+    if (method !== "GET") {
+        return jsonAnswer(405, { error: "method_not_allowed", error_description: "Use GET." }, { Allow: "GET" });
+    }
+    return jsonAnswer(200, {
+        resource: `${origin}${endpointPath}`,
+        authorization_servers: [...authorization.servers],
+        bearer_methods_supported: ["header"],
+    }, { "Access-Control-Allow-Origin": "*", "Cache-Control": "no-cache" });
+}
+function bearerTokenOf(header) {
+    const match = /^Bearer[ \t]+([^ \t].*?)[ \t]*$/i.exec(header ?? "");
+    return match?.[1];
+}
+function challenge(origin, endpointPath, invalid) {
+    const metadata = `resource_metadata="${origin}${metadataPathOf(endpointPath)}"`;
+    if (invalid === undefined) {
+        return jsonAnswer(401, {
+            error: "unauthorized",
+            error_description: "This MCP endpoint requires a bearer token in the Authorization header.",
+        }, { "WWW-Authenticate": `Bearer ${metadata}` });
+    }
+    return jsonAnswer(401, { error: "invalid_token", error_description: invalid.description }, {
+        "WWW-Authenticate": `Bearer error="invalid_token", error_description="${invalid.description}", ${metadata}`,
+    });
+}
+export async function authorizedAccess(authorizationHeader, origin, endpointPath, authorization, reportFailure) {
+    const token = bearerTokenOf(authorizationHeader);
+    if (token === undefined) {
+        return { ok: false, response: challenge(origin, endpointPath) };
+    }
+    let claims;
+    try {
+        claims = await authorization.verify(token);
+    }
+    catch (error) {
+        reportFailure(error);
+        claims = null;
+    }
+    if (claims === null || claims === undefined) {
+        return {
+            ok: false,
+            response: challenge(origin, endpointPath, {
+                description: "The access token is invalid",
+            }),
+        };
+    }
+    return { ok: true, caller: { claims } };
+}
+const FORWARDING_HEADERS = ["forwarded", "x-forwarded-for", "x-real-ip"];
+function isLoopbackAddress(address) {
+    if (address === undefined) {
+        return false;
+    }
+    const v4 = address.startsWith("::ffff:") ? address.slice(7) : address;
+    return address === "::1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(v4);
+}
+function isLoopbackOrigin(origin) {
+    try {
+        const { hostname } = new URL(origin);
+        return (hostname === "localhost" ||
+            hostname === "[::1]" ||
+            isLoopbackAddress(hostname));
+    }
+    catch {
+        return false;
+    }
+}
+const LOOPBACK_ONLY = "This MCP endpoint has no authorization, so it answers callers on this machine only. Configure mcp.authorization to serve remote agents.";
+function isLoopbackHost(host) {
+    if (host === undefined || host === "" || /[\s/?#@\\,]/.test(host)) {
+        return false;
+    }
+    try {
+        const { hostname } = new URL(`http://${host}`);
+        return (hostname === "localhost" ||
+            hostname === "[::1]" ||
+            isLoopbackAddress(hostname));
+    }
+    catch {
+        return false;
+    }
+}
+export function loopbackAccess(remoteAddress, header) {
+    const origin = header("origin");
+    const local = isLoopbackAddress(remoteAddress) &&
+        FORWARDING_HEADERS.every((name) => header(name) === undefined) &&
+        isLoopbackHost(header("host")) &&
+        (origin === undefined || isLoopbackOrigin(origin));
+    return local
+        ? { ok: true }
+        : {
+            ok: false,
+            response: jsonAnswer(403, {
+                error: "forbidden",
+                error_description: LOOPBACK_ONLY,
+            }),
+        };
+}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `@aventara/mcp`: the MCP server for an Aventara application. A host (the
+ * Nest module) mounts it at `framework.mcp.path`; it mounts nothing itself.
+ */
+export * as AvMcp from "./av-mcp.js";
+export type { AvMcpBinding, AvMcpRequest } from "./mcp.binder.js";

package/dist/index.js

@@ -0,0 +1 @@
+export * as AvMcp from "./av-mcp.js";

package/dist/json-text.writer.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `JSON.stringify(value)`'s text for JSON data (what an MCP message parses to),
+ * written without recursing on its depth: object members in their own order,
+ * a member whose value has no JSON form left out, and such a value in a list
+ * written `null`, as `JSON.stringify` does.
+ */
+export declare function jsonTextOf(value: unknown): string;