@aventara/nest 1.0.0-rc.1 → 1.0.0-rc.11

package/CHANGELOG.md

@@ -1,5 +1,178 @@
 # @aventara/nest
 
+## 1.0.0-rc.11
+
+### Patch Changes
+
+- e0e89c1: `POST {api}/_all` now streams when the client asks for it: the hosts forward `Accept`, so with
+  `application/x-ndjson` each entry's line is written as it settles (Nest on Express and Fastify writes it to the response,
+  flushed through `compression` when present; Next returns a `ReadableStream`), and plain JSON stays the answer otherwise.
+  When the client disconnects, the set stops: entries not yet started never start.
+- 186bc29: `POST {api}/_all` is mounted with the other protocol routes and answered by the binding's `handleAll`.
+- 33b5f83: The hosts hand the request URL's query to the protocol, so a cached read's `GET` (a read with a `cache({ for, maxAge })` stage)
+  is mounted and answered like every other route in `protocol.surface()`, on Express, Fastify and Next.js.
+- bedab57: A cached read's `Vary` joins the `Vary` the platform already set instead of replacing it. With `enableCors()` on, a
+  `for: "anonymous"` or `"user"` answer carries `Vary: Origin, Authorization, Cookie` on Express and Fastify, where it
+  carried only `Vary: Authorization, Cookie` and dropped CORS's `Vary: Origin`, so a CDN could serve one origin's
+  `Access-Control-Allow-Origin` to another. Each name appears once, compared without case, the platform's first.
+- Updated dependencies [6197c08]
+- Updated dependencies [e0e89c1]
+- Updated dependencies [186bc29]
+- Updated dependencies [33b5f83]
+- Updated dependencies [6d8b589]
+- Updated dependencies [11ece49]
+- Updated dependencies [92fd093]
+- Updated dependencies [e5e98e6]
+- Updated dependencies [a05d970]
+  - @aventara/core@1.0.0-rc.11
+  - @aventara/mcp@1.0.0-rc.11
+
+## 1.0.0-rc.10
+
+### Patch Changes
+
+- 04bb39a: `engines.node` is now `^22.23.4 || >=24.22.1`, the Node security releases of 2026-10-20 (CVE-2026-105481,
+  CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074,
+  CVE-2026-111497). The bins refuse an older Node in one sentence naming that range.
+- 587dd01: `AventaraModule` mounts `POST {api}/_access/can` on Express and Fastify when the Framework is built with `access`,
+  answered by `AvProtocol.bind(framework).handleCan` with the request's state seeded as on every other protocol route. The internal-failure log line names a `can`
+  request's failure by its question (`A3000 on access question 2 (orders update) …`) or as `the access questions`.
+- Updated dependencies [587dd01]
+- Updated dependencies [d7e7369]
+- Updated dependencies [7ee547b]
+- Updated dependencies [f52c499]
+- Updated dependencies [2907484]
+- Updated dependencies [a6bbdf0]
+- Updated dependencies [3e26549]
+- Updated dependencies [a6bbdf0]
+- Updated dependencies [6f3f6f6]
+- Updated dependencies [04bb39a]
+- Updated dependencies [d7e7369]
+- Updated dependencies [3fb3333]
+- Updated dependencies [827ccb6]
+- Updated dependencies [7f5abc3]
+- Updated dependencies [88263a1]
+- Updated dependencies [10341d5]
+- Updated dependencies [8129844]
+- Updated dependencies [88263a1]
+- Updated dependencies [3020b5c]
+- Updated dependencies [88263a1]
+- Updated dependencies [88263a1]
+  - @aventara/core@1.0.0-rc.10
+  - @aventara/mcp@1.0.0-rc.10
+
+## 1.0.0-rc.9
+
+### Patch Changes
+
+- 8c40b81: `@aventara/nest` declares a NestJS project's layout in its manifest (`"aventara": { "host": … }`).
+  `aventara new` and `aventara init`, which now also scaffold Next.js apps, and `aventara-build` read a NestJS project's
+  paths from it, so the three always agree. A NestJS project is scaffolded exactly as before.
+- 205a379: `AventaraModule` hosts a Framework built with `access` (an access provider, from `@aventara/core`): each protocol
+  request's `ctx.$state` is seeded by the provider's `state`, called with `{ headers, request }`, the platform
+  request's headers as `Headers` and Express's `req` or Fastify's `request`. It works the same through `config`
+  (`forRoot({ config: { ...config, access } })`) and `framework`. The module's own `state` option beside `access` is
+  refused while Nest builds the application, and is a type error on a `config` that states `access`.
+- Updated dependencies [205a379]
+- Updated dependencies [a0bb05e]
+- Updated dependencies [86ab319]
+- Updated dependencies [fdf52e6]
+  - @aventara/core@1.0.0-rc.9
+  - @aventara/mcp@1.0.0-rc.9
+
+## 1.0.0-rc.8
+
+1.0.0-rc.5, rc.6 and rc.7 were tagged but never published; 1.0.0-rc.8 contains everything listed under them and the changes below.
+
+### Patch Changes
+
+- Updated dependencies [1c8e4ee]
+  - @aventara/core@1.0.0-rc.8
+  - @aventara/mcp@1.0.0-rc.8
+
+## 1.0.0-rc.7
+
+1.0.0-rc.5 and 1.0.0-rc.6 were tagged but never published; 1.0.0-rc.7 contains everything listed under them and the changes below.
+
+### Patch Changes
+
+- Updated dependencies [f917c1c]
+  - @aventara/core@1.0.0-rc.7
+  - @aventara/mcp@1.0.0-rc.7
+
+## 1.0.0-rc.6
+
+1.0.0-rc.5 was tagged but never published. 1.0.0-rc.6 contains everything listed under 1.0.0-rc.5 and the fix below.
+
+### Patch Changes
+
+- Updated dependencies [1cf72e0]
+  - @aventara/core@1.0.0-rc.6
+  - @aventara/mcp@1.0.0-rc.6
+
+## 1.0.0-rc.5
+
+### Patch Changes
+
+- Updated dependencies [4795ff1]
+- Updated dependencies [9e178ca]
+  - @aventara/core@1.0.0-rc.5
+  - @aventara/mcp@1.0.0-rc.5
+
+## 1.0.0-rc.4
+
+### Patch Changes
+
+- Updated dependencies [e3d03a7]
+- Updated dependencies [d10639a]
+- Updated dependencies [f67e68c]
+- Updated dependencies [708556c]
+- Updated dependencies [3a0dfca]
+- Updated dependencies [99169d2]
+- Updated dependencies [0fd2608]
+- Updated dependencies [154e440]
+- Updated dependencies [2fcffdb]
+  - @aventara/core@1.0.0-rc.4
+  - @aventara/mcp@1.0.0-rc.4
+
+## 1.0.0-rc.3
+
+### Patch Changes
+
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+  - @aventara/core@1.0.0-rc.3
+  - @aventara/mcp@1.0.0-rc.3
+
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- `AventaraModule.forRoot({ config })` reports a Pick layer that names what its parent hid with the sentence first, as
+  `createFramework` does: an inline `client: { exposed: false, exemptions: { resources: { Comment: true } } }` whose
+  root hid `Comment` fails at the key with
+  `Type 'true' is not assignable to type 'true & (readonly ["Error: client cannot expose 'Comment': hidden by root"] & …)'`.
+- 9366e16: MCP endpoint polish:
+
+  - A request with no bearer credentials (no `Authorization` header, or another scheme such as `Basic`) is answered
+    `401` with `WWW-Authenticate: Bearer resource_metadata="…"` and no error code, as RFC 6750 §3.1 asks; its body no
+    longer says "Missing Authorization header". A bad bearer token keeps `error="invalid_token"`.
+  - A `mcp.authorization.verify` that throws is still answered `401`, and is now reported to the `diagnostics` sink as
+    an `AvMcpDiagnostic` holding the error.
+  - With `mcp` configured and `@aventara/mcp` missing, the startup error names the command that installs it at the
+    installed `@aventara/core`'s exact version: `npm install --save-exact @aventara/mcp@<version>`.
+
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+  - @aventara/core@1.0.0-rc.2
+  - @aventara/mcp@1.0.0-rc.2
+
 ## 1.0.0-rc.1
 
 ### Patch Changes
@@ -65,7 +238,6 @@
               nullable: false,
               list: false,
               lifecycle: ["VIRTUAL"],
-              format: "url",
             },
             pipelines: {
               compute: {

package/README.md

@@ -51,7 +51,7 @@ export async function aventaraConfig(prisma: PrismaService) {
 			const { error } = diagnostic;
 			logger.error(
 				`${diagnostic.code} (request ${diagnostic.requestId}): raw error`,
-				error instanceof Error ? error.stack : String(error),
+				(error instanceof Error && error.stack) || String(error),
 			);
 		},
 		adapter: await createPrismaAdapter({
@@ -140,7 +140,7 @@ rest of `<api>/_*`. Nest's `RouterExplorer` does not list platform routes, so th
 own when it mounts them, through Nest's `Logger` (context `AventaraModule`; `logger: false` silences it like any other):
 
 ```text
-[Nest] LOG [AventaraModule] Aventara mounted 10 operations at /api (+ GET /api/_contract, POST /api/_transactions)
+[Nest] LOG [AventaraModule] Aventara mounted 10 operations at /api (+ GET /api/_contract, POST /api/_transactions, POST /api/_all)
 ```
 
 An internal failure (`A3000`–`A3004`, answered as a 500) is logged as one error line through Nest's `Logger`
@@ -203,6 +203,11 @@ const signedIn: AvGuard = (ctx) => ctx.$state.user !== undefined;
   runs before it (`app.use` middleware, an earlier `onRequest` hook) has run.
 - Use `app.use(...)` for the middleware that finds the user (a Passport `authenticate` call, a session or JWT check).
   Nest guards never run on protocol routes, and `MiddlewareConsumer` middleware does not on Express (the table above).
+- A Framework built with `access` (an access provider, see `@aventara/core`) seeds the state itself: the module calls
+  the provider's `state` with `{ headers, request }`, the platform request's headers and the request. Pass no `state`
+  beside it; the module refuses the pair while Nest builds the application, and as a type error on a `config` that
+  states `access`. It works the same through `config` and `framework`:
+  `AventaraModule.forRoot({ config: { ...config, access } })`.
 - Throw `new AvError("A4001", "…")` from `state` to refuse the request (`403`); any other throw is `500 A3000`, with the
   error in your `diagnostics` sink.
 - A plan sent to `/_transactions` gets one state for all its steps and transaction stages. A ctx call a stage makes
@@ -229,15 +234,20 @@ const signedIn: AvGuard = (ctx) => ctx.$state.user !== undefined;
 ## The MCP endpoint
 
 With `mcp` in the configuration, the module also mounts the MCP server of `@aventara/mcp` at that path, on Express and
-Fastify alike, and logs `Aventara mounted the MCP endpoint at /mcp (…)`. Install it beside this package, at the same
-version:
+Fastify alike, and logs `Aventara mounted the MCP endpoint at /mcp (…)`. Install it beside this package, at
+`@aventara/core`'s exact version:
 
 ```bash
-npm install @aventara/mcp@rc
+npm install --save-exact @aventara/mcp@<your @aventara/core version>
 ```
 
 It is an optional peer dependency: an application without `mcp` does not need it, and one with `mcp` and without the
-package refuses to start, naming it. As for the protocol's routes, the module only mounts: the endpoint's body is read
+package refuses to start, naming it and the command, with the version filled in:
+
+```text
+AventaraModule: the configuration has `mcp`, and the package that serves it, @aventara/mcp, is not installed. Install it at @aventara/core's exact version (npm install --save-exact @aventara/mcp@1.0.0-rc.11), or remove `mcp` from the configuration.
+```
+ As for the protocol's routes, the module only mounts: the endpoint's body is read
 raw, the request's URL comes from the platform's `protocol` and `host` (set `trust proxy` on Express or `trustProxy` on
 Fastify behind a proxy), and every answer is `@aventara/mcp`'s. The `state` option seeds each tool call's `ctx.$state`.
 See `@aventara/mcp`'s README for the tools, the contract resource and authorization.

package/dist/access-state.translator.d.ts

@@ -0,0 +1,7 @@
+import type { AvFramework } from "@aventara/core";
+import type { HostState } from "./protocol-host.factory.js";
+/**
+ * The state seed of `framework`'s access provider, over a platform request;
+ * `undefined` for a Framework built without `access`.
+ */
+export declare function accessStateSeed(framework: AvFramework): HostState | undefined;

package/dist/access-state.translator.js

@@ -0,0 +1,20 @@
+import { accessProviderOf } from "@aventara/core/internal";
+function headersOf(request) {
+    const headers = new Headers();
+    const given = request?.headers;
+    for (const [name, value] of Object.entries(given ?? {})) {
+        if (value === undefined || name.startsWith(":")) {
+            continue;
+        }
+        for (const one of typeof value === "string" ? [value] : value) {
+            headers.append(name, one);
+        }
+    }
+    return headers;
+}
+export function accessStateSeed(framework) {
+    const state = accessProviderOf(framework)?.state;
+    return state === undefined
+        ? undefined
+        : (request) => state({ headers: headersOf(request), request });
+}

package/dist/aventara.module.d.ts

@@ -5,25 +5,35 @@ import { type PendingProtocolHost } from "./protocol-host.factory.js";
  * How the application's Framework enters Nest: your own instance
  * (`{ framework }`, from `createFramework`) or a configuration the module
  * passes to `createFramework` itself (`{ config }`). Pass exactly one. Either
- * arm may add `state`, which seeds each protocol request's `ctx.$state`.
+ * arm may add `state`, which seeds each protocol request's `ctx.$state`,
+ * unless the Framework is built with `access`, whose `state` seeds it.
  */
 export type AventaraModuleOptions<M extends AvAdapterModel = AvAdapterModel, Cfg = AvConfigAny> = ({
     readonly framework: AvFramework;
     readonly config?: never;
 } | {
-    readonly config: Cfg & AvConfig<M, Cfg> & AvConfigExact<M, Cfg>;
+    readonly config: Cfg & AvConfigExact<M, Cfg> & AvConfig<M, Cfg>;
     readonly framework?: never;
-}) & {
+}) & StateBesideAccess<Cfg> & {
     /**
      * Seeds a protocol request's `ctx.$state`, once per request, with the
      * platform's own request: Express's `req`, or Fastify's `request` (its Node
      * request is `request.raw`). What middleware already set there, such as
      * Passport's `req.user`, flows into every stage of the request. A throw is
      * answered like any developer failure: a thrown `AvError` as its own
-     * outcome, anything else `500 A3000`. Omitted, the state is `{}`.
+     * outcome, anything else `500 A3000`. Omitted, the state is `{}`, or what
+     * the Framework's `access` provider seeds; not together with `access`.
      */
     state?(request: unknown): AvState | Promise<AvState>;
 };
+/** `state` refused beside a configuration that states `access`, by the sentence that says why. */
+type StateBesideAccess<Cfg> = [Cfg] extends [never] ? unknown : Cfg extends {
+    readonly access: object;
+} ? {
+    readonly state?: readonly [
+        "Error: `access` seeds each request's state; remove `state`"
+    ];
+} : unknown;
 /**
  * `forRootAsync`'s options: the Nest idiom when what builds the Framework
  * (a Prisma client, a configuration service) is itself a provider. The
@@ -62,3 +72,4 @@ export declare class AventaraModule implements NestModule, OnModuleInit {
     static forRootAsync<M extends AvAdapterModel, const Cfg = AvConfigAny>(options: AventaraModuleAsyncOptions<M, Cfg>): DynamicModule;
     private static mount;
 }
+export {};

package/dist/aventara.module.js

@@ -1,6 +1,7 @@
 import { createFramework, } from "@aventara/core";
 import { Inject, Module, } from "@nestjs/common";
 import { HttpAdapterHost } from "@nestjs/core";
+import { accessStateSeed } from "./access-state.translator.js";
 import { AVENTARA_FRAMEWORK } from "./framework.token.js";
 import { checkedOptions, recordMount } from "./host-bootstrap.validator.js";
 import { withInternalFailureLog } from "./internal-failure.logger.js";
@@ -66,7 +67,7 @@ export class AventaraModule {
                 {
                     provide: PROTOCOL_HOST,
                     inject: [HttpAdapterHost, AVENTARA_FRAMEWORK, OPTIONS, MCP_BINDING],
-                    useFactory: (application, framework, options, mcp) => createPendingProtocolHost(application, framework, options.state?.bind(options), mcp ?? undefined),
+                    useFactory: (application, framework, options, mcp) => createPendingProtocolHost(application, framework, options.state?.bind(options) ?? accessStateSeed(framework), mcp ?? undefined),
                 },
             ],
             exports: [AVENTARA_FRAMEWORK],

package/dist/express-protocol.mounter.d.ts

@@ -25,7 +25,7 @@ type ExpressRequest = NodeIncoming & {
 type ExpressResponse = NodeOutgoing;
 /** Express passes `next`; Nest's handler type declares it as an optional `Function`. */
 type ExpressHandler = (request: ExpressRequest, response: ExpressResponse, next?: unknown) => unknown;
-export type ExpressPlatform = {
+type ExpressPlatform = {
     get(path: string, handler: ExpressHandler): unknown;
     post(path: string, handler: ExpressHandler): unknown;
     delete(path: string, handler: ExpressHandler): unknown;

package/dist/express-protocol.mounter.js

@@ -1,4 +1,4 @@
-import { mcpRequest, NO_BYTES, pathnameOf, protocolRequest, writeAnswer, } from "./node-exchange.translator.js";
+import { disconnectOf, mcpRequest, NO_BYTES, pathnameOf, protocolRequest, writeAnswer, } from "./node-exchange.translator.js";
 import { MCP_ROUTES, PROTOCOL_ROUTES, } from "./protocol-route.table.js";
 import { readRequestBody, unreadBodyAnswer, } from "./request-body.reader.js";
 const REGISTER = { GET: "get", POST: "post", DELETE: "delete" };
@@ -27,7 +27,7 @@ export function createExpressProtocolHost(platform, binding, entrypoint, maxRequ
                 for (const method of route.methods) {
                     platform[REGISTER[method]](literalPath(route.path), exactly(route.path, async (request, response) => {
                         const body = bodyOf(request);
-                        writeAnswer(response, await answer(mcpRequest(request.method, request, request.originalUrl, request, body.kind === "read" ? body.content : NO_BYTES, request.socket.remoteAddress), state === undefined ? undefined : () => state(request)));
+                        await writeAnswer(response, await answer(mcpRequest(request.method, request, request.originalUrl, request, body.kind === "read" ? body.content : NO_BYTES, request.socket.remoteAddress), state === undefined ? undefined : () => state(request)));
                     }));
                 }
             }
@@ -35,8 +35,9 @@ export function createExpressProtocolHost(platform, binding, entrypoint, maxRequ
                 const answer = PROTOCOL_ROUTES[route.kind](binding);
                 platform[REGISTER[route.method]](literalPath(`${entrypoint}${route.path}`), async (request, response) => {
                     const body = bodyOf(request);
-                    writeAnswer(response, body.kind === "read"
-                        ? await answer(translated(request, entrypoint, body.content), state === undefined ? undefined : () => state(request))
+                    const disconnect = disconnectOf(response);
+                    await writeAnswer(response, body.kind === "read"
+                        ? await answer(translated(request, entrypoint, body.content), state === undefined ? undefined : () => state(request), disconnect)
                         : unreadBodyAnswer(binding, body));
                 });
             }
@@ -51,7 +52,7 @@ export function createExpressProtocolHost(platform, binding, entrypoint, maxRequ
                     handOn(next);
                     return;
                 }
-                writeAnswer(response, absent);
+                void writeAnswer(response, absent);
             });
         },
     };

package/dist/fastify-protocol.mounter.js

@@ -1,4 +1,4 @@
-import { mcpRequest, NO_BYTES, pathnameOf, protocolRequest, writeAnswer, } from "./node-exchange.translator.js";
+import { disconnectOf, mcpRequest, NO_BYTES, pathnameOf, protocolRequest, writeAnswer, } from "./node-exchange.translator.js";
 import { MCP_ROUTES, PROTOCOL_ROUTES } from "./protocol-route.table.js";
 import { readRequestBody, unreadBodyAnswer } from "./request-body.reader.js";
 const UNMATCHABLE = /\*|%(?:3A|2B|23|24|26|2C|2F|3B|3D|3F|40)/i;
@@ -37,7 +37,7 @@ export function createFastifyProtocolHost(platform, binding, entrypoint, maxRequ
                     exposeHeadRoute: false,
                     onRequest: async (request, reply) => {
                         const body = await readRequestBody(request.raw, undefined, mcp.maxRequestBytes);
-                        write(reply, await answer(mcpRequest(request.raw.method, request, request.raw.url, request.raw, body.kind === "read" ? body.content : NO_BYTES, request.raw.socket.remoteAddress), state === undefined ? undefined : () => state(request)));
+                        await write(reply, await answer(mcpRequest(request.raw.method, request, request.raw.url, request.raw, body.kind === "read" ? body.content : NO_BYTES, request.raw.socket.remoteAddress), state === undefined ? undefined : () => state(request)));
                         return reply;
                     },
                     handler: () => {
@@ -53,8 +53,9 @@ export function createFastifyProtocolHost(platform, binding, entrypoint, maxRequ
                     exposeHeadRoute: false,
                     onRequest: async (request, reply) => {
                         const body = await readRequestBody(request.raw, request.raw.headersDistinct["content-encoding"], maxRequestBytes);
-                        write(reply, body.kind === "read"
-                            ? await answer(translated(request, body.content), state === undefined ? undefined : () => state(request))
+                        const disconnect = disconnectOf(reply.raw);
+                        await write(reply, body.kind === "read"
+                            ? await answer(translated(request, body.content), state === undefined ? undefined : () => state(request), disconnect)
                             : unreadBodyAnswer(binding, body));
                         return reply;
                     },
@@ -72,7 +73,7 @@ export function createFastifyProtocolHost(platform, binding, entrypoint, maxRequ
                 if (absent === undefined) {
                     return undefined;
                 }
-                write(reply, absent);
+                await write(reply, absent);
                 return reply;
             });
         },
@@ -83,5 +84,5 @@ function literalPath(path) {
 }
 function write(reply, answer) {
     reply.hijack();
-    writeAnswer(reply.raw, answer, reply.getHeaders());
+    return writeAnswer(reply.raw, answer, reply.getHeaders());
 }

package/dist/host-bootstrap.validator.js

@@ -1,7 +1,9 @@
+import { accessProviderOf } from "@aventara/core/internal";
 const NEITHER_ARM = "AventaraModule: the options carry neither `framework` nor `config`; pass exactly one.";
 const BOTH_ARMS = "AventaraModule: the options carry both `framework` and `config`; pass exactly one.";
 const NOT_A_FRAMEWORK = "AventaraModule: `framework` is not an Aventara Framework (it has no string `api` and no `contracts.client`); pass what `createFramework` resolved to.";
 const STATE_NOT_A_FUNCTION = "AventaraModule: `state` is not a function; pass `(request) => ({ … })`, called once per protocol request.";
+const STATE_BESIDE_ACCESS = "AventaraModule: the Framework is built with `access`, whose `state` seeds each request's state; remove the module's `state` option.";
 const MOUNTED_TWICE = "AventaraModule is mounted twice in one application; import AventaraModule.forRoot or forRootAsync once.";
 export function checkedOptions(options) {
     const record = typeof options === "object" && options !== null
@@ -22,6 +24,13 @@ export function checkedOptions(options) {
     if (state !== undefined && typeof state !== "function") {
         throw new Error(STATE_NOT_A_FUNCTION);
     }
+    if (state !== undefined &&
+        (hasFramework
+            ? accessProviderOf(record.framework) !== undefined
+            : record.config?.access !==
+                undefined)) {
+        throw new Error(STATE_BESIDE_ACCESS);
+    }
     return record;
 }
 function isFramework(value) {

package/dist/internal-failure.logger.js

@@ -17,7 +17,11 @@ export function internalFailureLine(diagnostic) {
         ? `${diagnostic.resource}.${diagnostic.family}.${diagnostic.variant}`
         : diagnostic.kind === "transaction"
             ? "a transaction"
-            : "the MCP endpoint";
+            : diagnostic.kind === "can"
+                ? diagnostic.question === undefined
+                    ? "the access questions"
+                    : `access question ${diagnostic.question} (${diagnostic.resource} ${diagnostic.action})`
+                : "the MCP endpoint";
     const step = diagnostic.operation === undefined
         ? ""
         : `, plan operation ${diagnostic.operation}`;

package/dist/mcp-binding.loader.js

@@ -1,5 +1,19 @@
 const MCP_PACKAGE = "@aventara/mcp";
-const missing = (specifier) => `AventaraModule: the configuration has \`mcp\`, and the package that serves it, ${specifier}, is not installed. Install it beside @aventara/nest, at the same version (npm install ${specifier}), or remove \`mcp\` from the configuration.`;
+const missing = (specifier, coreVersion) => `AventaraModule: the configuration has \`mcp\`, and the package that serves it, ${specifier}, is not installed. Install it at @aventara/core's exact version (npm install --save-exact ${specifier}@${coreVersion ?? "<your @aventara/core version>"}), or remove \`mcp\` from the configuration.`;
+async function installedCoreVersion() {
+    try {
+        const manifest = new URL("../package.json", import.meta.resolve("@aventara/core"));
+        const { default: read } = (await import(manifest.href, {
+            with: { type: "json" },
+        }));
+        return read.name === "@aventara/core" && typeof read.version === "string"
+            ? read.version
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function isMissing(error, specifier) {
     const { code, message } = (error ?? {});
     return ((code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") &&
@@ -16,7 +30,7 @@ export async function loadMcpBinding(framework, specifier = MCP_PACKAGE) {
     }
     catch (error) {
         if (isMissing(error, specifier)) {
-            throw new Error(missing(specifier));
+            throw new Error(missing(specifier, await installedCoreVersion()));
         }
         throw error;
     }

package/dist/node-exchange.translator.d.ts

@@ -1,11 +1,28 @@
-import type { AvProtocolRequest, AvProtocolResponse } from "@aventara/core/protocol";
+import type { AvProtocolRequest } from "@aventara/core/protocol";
 import type { McpRequest } from "./mcp-binding.loader.js";
+import type { RouteResponse } from "./protocol-route.table.js";
 export type NodeIncoming = AsyncIterable<Uint8Array> & {
     readonly headersDistinct: Readonly<Record<string, readonly string[]>>;
 };
 export type NodeOutgoing = {
     writeHead(status: number, headers: Readonly<Record<string, string | number | readonly string[]>>): unknown;
-    end(body: string): unknown;
+    end(body?: string): unknown;
+    /** A header already set on the response (Express's middleware sets its own here). */
+    getHeader(name: string): string | number | readonly string[] | undefined;
+    /** `false` when the socket's buffer is full: wait for `drain`. */
+    write(chunk: string): boolean;
+    once(event: "close" | "drain", listener: () => void): unknown;
+    removeListener(event: "close" | "drain", listener: () => void): unknown;
+    destroy(): unknown;
+    /** Sends the status line and headers now, before any body is written. */
+    flushHeaders(): void;
+    /** Whether the whole answer was handed to the socket. */
+    readonly writableFinished: boolean;
+    /** Whether the response was ended or the socket went away. */
+    readonly writableEnded: boolean;
+    readonly destroyed: boolean;
+    /** The `compression` middleware's: sends what it has compressed so far. */
+    flush?(): void;
 };
 /** Headers a platform's own hooks set on the reply before the protocol answered. */
 export type PlatformHeaders = Readonly<Record<string, string | number | readonly string[] | undefined>>;
@@ -13,16 +30,23 @@ export type PlatformHeaders = Readonly<Record<string, string | number | readonly
 export declare const NO_BYTES: Uint8Array<ArrayBuffer>;
 /** A request URL's raw pathname: the query is dropped and nothing is URL-decoded. */
 export declare function pathnameOf(url: string): string;
-/** The request as the protocol reads it: path relative to the entrypoint, distinct headers, raw body. */
+/** The request as the protocol reads it: path relative to the entrypoint, raw query, distinct headers, raw body. */
 export declare function protocolRequest(method: string, url: string, incoming: NodeIncoming, entrypoint: string, content: Uint8Array): AvProtocolRequest;
 /** The request as `@aventara/mcp` reads it: absolute URL, distinct headers, raw body, peer address. */
 export declare function mcpRequest(method: string, origin: {
     readonly protocol: string;
     readonly host: string;
 }, url: string, incoming: NodeIncoming, content: Uint8Array, remoteAddress: string | undefined): McpRequest;
+/** Aborted when the client goes away before the answer was written. */
+export declare function disconnectOf(response: NodeOutgoing): AbortSignal;
 /**
  * Writes the protocol's answer as it is. Headers the platform's hooks already
  * set (CORS, say) go beneath it; a protocol header of the same name, in any
- * case, wins.
+ * case, wins, except `Vary`: the protocol's names join the platform's
+ * (`mergedVary`), which Express holds on the response and Fastify hands in
+ * `beneath`. A streamed body (`/_all` under NDJSON) is piped: each line
+ * written as core yields it, and flushed through `compression` when that
+ * middleware wraps the response. Writing stops when the client goes away,
+ * and the lines are no longer pulled (`return()`).
  */
-export declare function writeAnswer(response: NodeOutgoing, answer: AvProtocolResponse, beneath?: PlatformHeaders): void;
+export declare function writeAnswer(response: NodeOutgoing, answer: RouteResponse, beneath?: PlatformHeaders): Promise<void>;

package/dist/node-exchange.translator.js

@@ -3,10 +3,15 @@ export function pathnameOf(url) {
     const query = url.indexOf("?");
     return query === -1 ? url : url.slice(0, query);
 }
+function queryOf(url) {
+    const query = url.indexOf("?");
+    return query === -1 ? "" : url.slice(query + 1);
+}
 export function protocolRequest(method, url, incoming, entrypoint, content) {
     return {
         method,
         path: pathnameOf(url).slice(entrypoint.length),
+        query: queryOf(url),
         headers: incoming.headersDistinct,
         body: { kind: "raw", content },
     };
@@ -20,7 +25,35 @@ export function mcpRequest(method, origin, url, incoming, content, remoteAddress
         remoteAddress,
     };
 }
-export function writeAnswer(response, answer, beneath = {}) {
+export function disconnectOf(response) {
+    const disconnect = new AbortController();
+    response.once("close", () => {
+        if (!response.writableFinished) {
+            disconnect.abort();
+        }
+    });
+    return disconnect.signal;
+}
+function textOf(value) {
+    return value === undefined
+        ? ""
+        : typeof value === "object"
+            ? value.join(", ")
+            : String(value);
+}
+function mergedVary(lists) {
+    const names = new Map();
+    for (const list of lists) {
+        for (const name of list.split(",")) {
+            const trimmed = name.trim();
+            if (trimmed !== "" && !names.has(trimmed.toLowerCase())) {
+                names.set(trimmed.toLowerCase(), trimmed);
+            }
+        }
+    }
+    return names.has("*") ? "*" : [...names.values()].join(", ");
+}
+export async function writeAnswer(response, answer, beneath = {}) {
     const own = new Set(Object.keys(answer.headers).map((name) => name.toLowerCase()));
     const headers = {};
     for (const [name, value] of Object.entries(beneath)) {
@@ -28,6 +61,52 @@ export function writeAnswer(response, answer, beneath = {}) {
             headers[name] = value;
         }
     }
-    response.writeHead(answer.status, { ...headers, ...answer.headers });
-    response.end(answer.body);
+    const written = {
+        ...headers,
+        ...answer.headers,
+    };
+    const vary = Object.keys(answer.headers).find((name) => name.toLowerCase() === "vary");
+    if (vary !== undefined) {
+        const platform = Object.entries(beneath).flatMap(([name, value]) => name.toLowerCase() === "vary" ? [textOf(value)] : []);
+        written[vary] = mergedVary([
+            textOf(response.getHeader("vary")),
+            ...platform,
+            textOf(answer.headers[vary]),
+        ]);
+    }
+    response.writeHead(answer.status, written);
+    if (typeof answer.body === "string") {
+        response.end(answer.body);
+        return;
+    }
+    response.flushHeaders();
+    try {
+        for await (const line of answer.body) {
+            if (response.destroyed || response.writableEnded) {
+                break;
+            }
+            if (!response.write(line)) {
+                await drained(response);
+            }
+            response.flush?.();
+        }
+    }
+    catch {
+        response.destroy();
+        return;
+    }
+    if (!response.destroyed) {
+        response.end();
+    }
+}
+function drained(response) {
+    return new Promise((resolve) => {
+        const done = () => {
+            response.removeListener("drain", done);
+            response.removeListener("close", done);
+            resolve();
+        };
+        response.once("drain", done);
+        response.once("close", done);
+    });
 }

package/dist/protocol-host.factory.d.ts

@@ -1,41 +1,19 @@
 import type { AvFramework, AvState } from "@aventara/core";
 import type { AbstractHttpAdapter } from "@nestjs/core";
-import type { McpBinding, McpRoute } from "./mcp-binding.loader.js";
-import type { SurfaceRoute } from "./protocol-route.table.js";
+import type { McpBinding } from "./mcp-binding.loader.js";
 /** The developer's `state` option: seeds a request's `ctx.$state` from its platform request. */
 export type HostState = (request: unknown) => AvState | Promise<AvState>;
 /** The protocol, bound once at startup, and the one call that mounts it. */
 export type ProtocolHost = {
     readonly mount: () => void;
 };
-/**
- * Binds `framework`'s protocol for the application's platform, refusing an
- * unsupported platform while providers are instantiated, so `NestFactory.create`
- * rejects before the application listens. The routes are mounted later, from
- * the module's `configure()`.
- */
-export declare function createProtocolHost(adapter: AbstractHttpAdapter | undefined, framework: AvFramework, state?: HostState, mcp?: McpBinding): ProtocolHost;
-/**
- * What the MCP mount registered: the endpoint, and its OAuth metadata route
- * or, without one, the rule an open endpoint answers by — e.g. `Aventara
- * mounted the MCP endpoint at /mcp (+ GET
- * /.well-known/oauth-protected-resource/mcp)`.
- */
-export declare function mcpMountedLine(routes: readonly McpRoute[]): string;
-/**
- * What one mount registered, read off `protocol.surface()`: the operation
- * count under the entrypoint, then each framework route by method and path —
- * e.g. `Aventara mounted 5 operations at /api (+ GET /api/_contract, POST
- * /api/_transactions)`.
- */
-export declare function mountedLine(routes: readonly SurfaceRoute[], entrypoint: string): string;
 /** What `AventaraModule` holds: a host, perhaps waiting for its platform, and the check that it has one. */
 export type PendingProtocolHost = ProtocolHost & {
     /** Throws when no platform arrived, or the one that did is refused. */
     readonly assertReady: () => void;
 };
 /** The parts of Nest's `HttpAdapterHost` the module reads. */
-export type AdapterHostView = {
+type AdapterHostView = {
     readonly httpAdapter: AbstractHttpAdapter | undefined;
     readonly init$: {
         subscribe(next: () => void): unknown;
@@ -46,3 +24,4 @@ export type AdapterHostView = {
  * are instantiated (Nest's testing module).
  */
 export declare function createPendingProtocolHost(application: AdapterHostView, framework: AvFramework, state?: HostState, mcp?: McpBinding): PendingProtocolHost;
+export {};

package/dist/protocol-host.factory.js

@@ -12,7 +12,7 @@ const PLATFORM_MOUNTERS = {
     }, binding, entrypoint, maxRequestBytes, state, mcp),
     fastify: (adapter, binding, entrypoint, maxRequestBytes, state, mcp) => createFastifyProtocolHost(adapter.getInstance(), binding, entrypoint, maxRequestBytes, state, mcp),
 };
-export function createProtocolHost(adapter, framework, state, mcp) {
+function createProtocolHost(adapter, framework, state, mcp) {
     const platform = checkedPlatform(adapter?.getType());
     const binding = AvProtocol.bind(framework);
     const host = PLATFORM_MOUNTERS[platform](adapter, binding, framework.api, framework.contracts.client.limits.maxRequestBytes, state, mcp);
@@ -26,7 +26,7 @@ export function createProtocolHost(adapter, framework, state, mcp) {
         },
     };
 }
-export function mcpMountedLine(routes) {
+function mcpMountedLine(routes) {
     const endpoint = routes.find((route) => route.kind === "endpoint");
     const metadata = routes.find((route) => route.kind === "metadata");
     return `Aventara mounted the MCP endpoint at ${endpoint?.path ?? "/"} (${metadata === undefined
@@ -34,7 +34,7 @@ export function mcpMountedLine(routes) {
         : `+ GET ${metadata.path}`})`;
 }
 const MOUNT_LOGGER = new Logger("AventaraModule");
-export function mountedLine(routes, entrypoint) {
+function mountedLine(routes, entrypoint) {
     const operations = routes.filter((route) => route.kind === "operation");
     const framework = routes
         .filter((route) => route.kind !== "operation")

package/dist/protocol-route.table.d.ts

@@ -4,17 +4,22 @@ import type { McpBinding, McpRequest, McpRoute } from "./mcp-binding.loader.js";
 /** One route `protocol.surface()` lists. */
 export type SurfaceRoute = ReturnType<AvProtocolBinding["surface"]>[number];
 /** The developer's `state` option over one platform request: seeds its `ctx.$state`. */
-export type StateSeed = () => AvState | Promise<AvState>;
+type StateSeed = () => AvState | Promise<AvState>;
+/** An answer a route writes: the protocol's, its body text or, for a streamed `/_all`, lines as they settle. */
+export type RouteResponse = Awaited<ReturnType<AvProtocolBinding["handleAll"]>>;
 /** What a mounted route answers its request with: a bound protocol member. */
-export type RouteAnswer = (request: AvProtocolRequest, state: StateSeed | undefined) => AvProtocolResponse | Promise<AvProtocolResponse>;
+export type RouteAnswer = (request: AvProtocolRequest, state: StateSeed | undefined, 
+/** Aborted when the client goes away; only `/_all` reads it. */
+disconnect: AbortSignal) => RouteResponse | Promise<RouteResponse>;
 /** The bound member each kind of surface route is answered by. */
 export type ProtocolRouteTable = {
     readonly [K in SurfaceRoute["kind"]]: (binding: AvProtocolBinding) => RouteAnswer;
 };
 export declare const PROTOCOL_ROUTES: ProtocolRouteTable;
 /** What a mounted MCP route answers its request with: a bound `@aventara/mcp` member. */
-export type McpRouteAnswer = (request: McpRequest, state: StateSeed | undefined) => AvProtocolResponse | Promise<AvProtocolResponse>;
+type McpRouteAnswer = (request: McpRequest, state: StateSeed | undefined) => AvProtocolResponse | Promise<AvProtocolResponse>;
 /** The bound `@aventara/mcp` member each kind of MCP route is answered by. */
 export declare const MCP_ROUTES: {
     readonly [K in McpRoute["kind"]]: (binding: McpBinding) => McpRouteAnswer;
 };
+export {};

package/dist/protocol-route.table.js

@@ -2,6 +2,10 @@ export const PROTOCOL_ROUTES = {
     operation: (binding) => (request, state) => binding.handleOperation(request, state === undefined ? {} : { state }),
     contract: (binding) => (request) => binding.encodeContract(request),
     transactions: (binding) => (request, state) => binding.handleTransaction(request, state === undefined ? {} : { state }),
+    can: (binding) => (request, state) => binding.handleCan(request, state === undefined ? {} : { state }),
+    all: (binding) => (request, state, disconnect) => binding.handleAll(request, state === undefined
+        ? { signal: disconnect }
+        : { state, signal: disconnect }),
 };
 export const MCP_ROUTES = {
     endpoint: (binding) => (request, state) => binding.handleEndpoint(request, state === undefined ? {} : { state }),

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@aventara/nest",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0-rc.11",
   "license": "SEE LICENSE IN LICENSE",
   "description": "NestJS host integration for Aventara.",
   "type": "module",
   "engines": {
-    "node": "^22.18.0 || >=24.2.0"
+    "node": "^22.23.4 || >=24.22.1"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -22,10 +22,10 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@aventara/core": "1.0.0-rc.1"
+    "@aventara/core": "1.0.0-rc.11"
   },
   "peerDependencies": {
-    "@aventara/mcp": "1.0.0-rc.1",
+    "@aventara/mcp": "1.0.0-rc.11",
     "@nestjs/common": "^12.0.0",
     "@nestjs/core": "^12.0.0"
   },
@@ -34,21 +34,33 @@
       "optional": true
     }
   },
+  "aventara": {
+    "host": {
+      "alias": "nest",
+      "label": "NestJS",
+      "framework": "@nestjs/core",
+      "layout": {
+        "config": "src/aventara.config",
+        "adapter": "src/aventara.adapter",
+        "generated": "src/generated/aventara"
+      }
+    }
+  },
   "publishConfig": {
     "access": "public"
   },
   "devDependencies": {
-    "@aventara/mcp": "1.0.0-rc.1",
-    "@aventara/prisma7-adapter": "1.0.0-rc.1",
-    "@aventara/testing": "1.0.0-rc.1",
-    "@modelcontextprotocol/sdk": "1.30.1",
-    "@nestjs/common": "^12.1.2",
-    "@nestjs/core": "^12.1.2",
-    "@nestjs/platform-express": "^12.1.2",
-    "@nestjs/platform-fastify": "^12.1.2",
-    "@nestjs/testing": "^12.1.2",
-    "@prisma/adapter-better-sqlite3": "7.10.0",
-    "@prisma/adapter-pg": "7.10.0",
+    "@aventara/mcp": "1.0.0-rc.11",
+    "@aventara/prisma7-adapter": "1.0.0-rc.11",
+    "@aventara/testing": "1.0.0-rc.11",
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "@nestjs/common": "^12.2.0",
+    "@nestjs/core": "^12.2.0",
+    "@nestjs/platform-express": "^12.2.0",
+    "@nestjs/platform-fastify": "^12.2.0",
+    "@nestjs/testing": "^12.2.0",
+    "@prisma/adapter-better-sqlite3": "7.10.1",
+    "@prisma/adapter-pg": "7.10.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2"
   },