@carlonicora/nestjs-neo4jsonapi 1.110.3 → 1.112.0

package/dist/foundations/rbac/rbac-permission.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-permission.module.js","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac-permission.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,0FAAqF;AACrF,gFAA2E;AAE3E;;;;;;;;;;GAUG;AAKI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAAG,CAAA;AAAvB,oDAAoB;+BAApB,oBAAoB;IAJhC,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,qDAAwB,EAAE,+CAAqB,CAAC;QAC5D,OAAO,EAAE,CAAC,qDAAwB,EAAE,+CAAqB,CAAC;KAC3D,CAAC;GACW,oBAAoB,CAAG"}

package/dist/foundations/rbac/repositories/rbac-permission.repository.d.ts

@@ -0,0 +1,31 @@
+import { Neo4jService } from "../../../core/neo4j/services/neo4j.service";
+import type { RbacAction } from "../services/rbac-permission.service";
+/**
+ * Resolves the effective per-module permission flags for a user. Mirrors the
+ * permission model used by the rest of the app (see AuthRepository and
+ * UserModulesRepository): a module is visible to the user iff its parent
+ * Feature is subscribed by the user's Company (or is a core Feature), and the
+ * effective permissions result from merging the Module's default
+ * `permissions` JSON with any role-level `HAS_PERMISSIONS` overrides.
+ *
+ * Used by RbacPermissionService to answer `can(userId, moduleId, action)`
+ * for the MCP layer.
+ */
+export declare class RbacPermissionRepository {
+    private readonly neo4j;
+    private readonly logger;
+    constructor(neo4j: Neo4jService);
+    /**
+     * Effective per-module permission flags for a user.
+     *
+     * The query reuses `featureModuleQuery` — identical to the permission
+     * resolution run at login by AuthRepository and by the chatbot's
+     * UserModulesRepository — so MCP permission checks are always in
+     * lock-step with the rest of the app. The resolved effective permissions
+     * are returned on a virtual module node as a JSON string on
+     * `properties.permissions`; we parse it and keep all four permission
+     * types (`read`, `create`, `update`, `delete`).
+     */
+    findEffectivePermissionsForUser(userId: string): Promise<Map<string, Record<RbacAction, boolean>>>;
+}
+//# sourceMappingURL=rbac-permission.repository.d.ts.map

package/dist/foundations/rbac/repositories/rbac-permission.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-permission.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAOtE;;;;;;;;;;GAUG;AACH,qBACa,wBAAwB;IAGvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAEvC,KAAK,EAAE,YAAY;IAEhD;;;;;;;;;;OAUG;IACG,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;CA+BzG"}

package/dist/foundations/rbac/repositories/rbac-permission.repository.js

@@ -0,0 +1,80 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var RbacPermissionRepository_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RbacPermissionRepository = void 0;
+const common_1 = require("@nestjs/common");
+const neo4j_service_1 = require("../../../core/neo4j/services/neo4j.service");
+const feature_module_query_1 = require("../../module/queries/feature.module.query");
+/**
+ * Resolves the effective per-module permission flags for a user. Mirrors the
+ * permission model used by the rest of the app (see AuthRepository and
+ * UserModulesRepository): a module is visible to the user iff its parent
+ * Feature is subscribed by the user's Company (or is a core Feature), and the
+ * effective permissions result from merging the Module's default
+ * `permissions` JSON with any role-level `HAS_PERMISSIONS` overrides.
+ *
+ * Used by RbacPermissionService to answer `can(userId, moduleId, action)`
+ * for the MCP layer.
+ */
+let RbacPermissionRepository = RbacPermissionRepository_1 = class RbacPermissionRepository {
+    constructor(neo4j) {
+        this.neo4j = neo4j;
+        this.logger = new common_1.Logger(RbacPermissionRepository_1.name);
+    }
+    /**
+     * Effective per-module permission flags for a user.
+     *
+     * The query reuses `featureModuleQuery` — identical to the permission
+     * resolution run at login by AuthRepository and by the chatbot's
+     * UserModulesRepository — so MCP permission checks are always in
+     * lock-step with the rest of the app. The resolved effective permissions
+     * are returned on a virtual module node as a JSON string on
+     * `properties.permissions`; we parse it and keep all four permission
+     * types (`read`, `create`, `update`, `delete`).
+     */
+    async findEffectivePermissionsForUser(userId) {
+        const result = await this.neo4j.read(`
+      MATCH (user:User {id: $userId})-[:BELONGS_TO]->(company:Company)
+      ${feature_module_query_1.featureModuleQuery}
+      `, { userId });
+        const map = new Map();
+        for (const record of result.records) {
+            const moduleNode = record.get("module");
+            const props = moduleNode?.properties;
+            if (!props)
+                continue;
+            const id = props.id;
+            const permsJson = props.permissions;
+            if (typeof id !== "string" || !id.length || typeof permsJson !== "string")
+                continue;
+            try {
+                const perms = JSON.parse(permsJson);
+                map.set(id, {
+                    read: perms.find((p) => p.type === "read")?.value === true,
+                    create: perms.find((p) => p.type === "create")?.value === true,
+                    update: perms.find((p) => p.type === "update")?.value === true,
+                    delete: perms.find((p) => p.type === "delete")?.value === true,
+                });
+            }
+            catch {
+                this.logger.warn(`findEffectivePermissionsForUser: malformed permissions JSON on module ${id}`);
+            }
+        }
+        return map;
+    }
+};
+exports.RbacPermissionRepository = RbacPermissionRepository;
+exports.RbacPermissionRepository = RbacPermissionRepository = RbacPermissionRepository_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [neo4j_service_1.Neo4jService])
+], RbacPermissionRepository);
+//# sourceMappingURL=rbac-permission.repository.js.map

package/dist/foundations/rbac/repositories/rbac-permission.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-permission.repository.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,8EAA0E;AAC1E,oFAA+E;AAQ/E;;;;;;;;;;GAUG;AAEI,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;QAF/B,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEjB,CAAC;IAEpD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,+BAA+B,CAAC,MAAc;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC;;QAEE,yCAAkB;OACnB,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuC,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,UAAU,GAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,SAAS;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;gBACzD,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;oBACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC1D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;iBAC/D,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AA/CY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAIyB,4BAAY;GAHrC,wBAAwB,CA+CpC"}

package/dist/foundations/rbac/services/rbac-permission.service.d.ts

@@ -0,0 +1,31 @@
+import { RbacPermissionRepository } from "../repositories/rbac-permission.repository";
+/**
+ * The four permission flags resolved per module by the RBAC permission model.
+ *
+ * String-literal union (not the `Action` enum from `common/enums/action.ts`)
+ * so it can be re-exported from the library root without a name collision —
+ * same reasoning as the rbac DSL's non-exported `Action` type.
+ */
+export type RbacAction = "read" | "create" | "update" | "delete";
+/**
+ * Answers `can(userId, moduleId, action)` using the same `featureModuleQuery`
+ * permission resolution as the rest of the app (AuthRepository at login,
+ * UserModulesRepository for the chatbot catalog).
+ *
+ * Consumed by the MCP layer to gate reads and writes per tool call.
+ */
+export declare class RbacPermissionService {
+    private readonly repository;
+    constructor(repository: RbacPermissionRepository);
+    /**
+     * True iff the user's effective permission flag for `action` on the module
+     * resolves to `true`. Unknown modules (not in the user's effective set)
+     * always deny.
+     */
+    can(params: {
+        userId: string;
+        moduleId: string;
+        action: RbacAction;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=rbac-permission.service.d.ts.map

package/dist/foundations/rbac/services/rbac-permission.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-permission.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/rbac-permission.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjE;;;;;;GAMG;AACH,qBACa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAEjE;;;;OAIG;IACG,GAAG,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAI9F"}

package/dist/foundations/rbac/services/rbac-permission.service.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RbacPermissionService = void 0;
+const common_1 = require("@nestjs/common");
+const rbac_permission_repository_1 = require("../repositories/rbac-permission.repository");
+/**
+ * Answers `can(userId, moduleId, action)` using the same `featureModuleQuery`
+ * permission resolution as the rest of the app (AuthRepository at login,
+ * UserModulesRepository for the chatbot catalog).
+ *
+ * Consumed by the MCP layer to gate reads and writes per tool call.
+ */
+let RbacPermissionService = class RbacPermissionService {
+    constructor(repository) {
+        this.repository = repository;
+    }
+    /**
+     * True iff the user's effective permission flag for `action` on the module
+     * resolves to `true`. Unknown modules (not in the user's effective set)
+     * always deny.
+     */
+    async can(params) {
+        const perms = await this.repository.findEffectivePermissionsForUser(params.userId);
+        return perms.get(params.moduleId)?.[params.action] === true;
+    }
+};
+exports.RbacPermissionService = RbacPermissionService;
+exports.RbacPermissionService = RbacPermissionService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [rbac_permission_repository_1.RbacPermissionRepository])
+], RbacPermissionService);
+//# sourceMappingURL=rbac-permission.service.js.map

package/dist/foundations/rbac/services/rbac-permission.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-permission.service.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/rbac-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2FAAsF;AAWtF;;;;;;GAMG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YAA6B,UAAoC;QAApC,eAAU,GAAV,UAAU,CAA0B;IAAG,CAAC;IAErE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAgE;QACxE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAC9D,CAAC;CACF,CAAA;AAZY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAE8B,qDAAwB;GADtD,qBAAqB,CAYjC"}

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export * from "./core/pdf";
 export * from "./core/document";
 export * from "./foundations";
 export * from "./agents";
+export * from "./mcp";
 export * from "./bootstrap";
 export * from "./openapi";
 export { RedisLockService } from "./core/redis/services/redis.lock.service";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,UAAU,CAAC;AAGzB,cAAc,UAAU,CAAC;AAGzB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,eAAe,CAAC;AAG9B,cAAc,UAAU,CAAC;AAGzB,cAAc,aAAa,CAAC;AAG5B,cAAc,WAAW,CAAC;AAG1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,UAAU,CAAC;AAGzB,cAAc,UAAU,CAAC;AAGzB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,eAAe,CAAC;AAG9B,cAAc,UAAU,CAAC;AAGzB,cAAc,OAAO,CAAC;AAGtB,cAAc,aAAa,CAAC;AAG5B,cAAc,WAAW,CAAC;AAG1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/index.js

@@ -32,6 +32,8 @@ __exportStar(require("./core/document"), exports);
 __exportStar(require("./foundations"), exports);
 // Agent module exports
 __exportStar(require("./agents"), exports);
+// MCP (Model Context Protocol) module exports
+__exportStar(require("./mcp"), exports);
 // Bootstrap utilities
 __exportStar(require("./bootstrap"), exports);
 // OpenAPI module exports

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;AAEH,iBAAiB;AACjB,2CAAyB;AAEzB,iBAAiB;AACjB,2CAAyB;AAEzB,sBAAsB;AACtB,yCAAuB;AACvB,6CAA2B;AAC3B,kDAAgC;AAEhC,4BAA4B;AAC5B,gDAA8B;AAE9B,uBAAuB;AACvB,2CAAyB;AAEzB,sBAAsB;AACtB,8CAA4B;AAE5B,yBAAyB;AACzB,4CAA0B;AAE1B,yFAAyF;AACzF,+EAA4E;AAAnE,sHAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;AAEH,iBAAiB;AACjB,2CAAyB;AAEzB,iBAAiB;AACjB,2CAAyB;AAEzB,sBAAsB;AACtB,yCAAuB;AACvB,6CAA2B;AAC3B,kDAAgC;AAEhC,4BAA4B;AAC5B,gDAA8B;AAE9B,uBAAuB;AACvB,2CAAyB;AAEzB,8CAA8C;AAC9C,wCAAsB;AAEtB,sBAAsB;AACtB,8CAA4B;AAE5B,yBAAyB;AACzB,4CAA0B;AAE1B,yFAAyF;AACzF,+EAA4E;AAAnE,sHAAA,gBAAgB,OAAA"}

package/dist/mcp/controllers/mcp.controller.d.ts

@@ -0,0 +1,34 @@
+import { ConfigService } from "@nestjs/config";
+import { FastifyReply, FastifyRequest } from "fastify";
+import { ClsService } from "nestjs-cls";
+import { UserModulesRepository } from "../../agents/graph/repositories/user-modules.repository";
+import { McpServerFactory } from "../services/mcp.server.factory";
+/**
+ * MCP (Model Context Protocol) endpoint — stateless Streamable HTTP.
+ *
+ * Each `POST /mcp` request is authenticated by the existing OAuthTokenGuard
+ * (which populates CLS `userId`/`companyId`), then handed to a fresh per-request
+ * MCP Server + StreamableHTTPServerTransport pair (`sessionIdGenerator:
+ * undefined` — stateless mode, no session tracking). GET/DELETE are rejected
+ * with 405: stateless servers expose no SSE notification channel and no
+ * session to terminate.
+ *
+ * Uses `@Res()` with raw reply writing (the SDK transport writes directly to
+ * `res.raw`), which opts this handler out of Nest response serialization —
+ * the MCP wire format is JSON-RPC, not JSON:API, matching how the OAuth
+ * controllers speak their own RFC-mandated wire formats.
+ */
+export declare class McpController {
+    private readonly factory;
+    private readonly cls;
+    private readonly userModules;
+    private readonly configService;
+    constructor(factory: McpServerFactory, cls: ClsService, userModules: UserModulesRepository, configService: ConfigService);
+    /** Handles one stateless MCP Streamable-HTTP request (initialize, tools/list, tools/call, ...). */
+    handle(req: FastifyRequest, res: FastifyReply): Promise<void>;
+    /** Stateless server: no SSE notification stream is offered. */
+    rejectGet(): never;
+    /** Stateless server: there is no session to terminate. */
+    rejectDelete(): never;
+}
+//# sourceMappingURL=mcp.controller.d.ts.map

package/dist/mcp/controllers/mcp.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.controller.d.ts","sourceRoot":"","sources":["../../../src/mcp/controllers/mcp.controller.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAKhG,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,qBAGa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,UAAU,EACf,WAAW,EAAE,qBAAqB,EAClC,aAAa,EAAE,aAAa;IAG/C,mGAAmG;IAE7F,MAAM,CAAQ,GAAG,EAAE,cAAc,EAAS,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBjF,+DAA+D;IAE/D,SAAS,IAAI,KAAK;IAIlB,0DAA0D;IAE1D,YAAY,IAAI,KAAK;CAGtB"}

package/dist/mcp/controllers/mcp.controller.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpController = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+const nestjs_cls_1 = require("nestjs-cls");
+const user_modules_repository_1 = require("../../agents/graph/repositories/user-modules.repository");
+const oauth_token_guard_1 = require("../../foundations/oauth/guards/oauth.token.guard");
+const mcp_auth_filter_1 = require("../filters/mcp.auth.filter");
+const mcp_server_factory_1 = require("../services/mcp.server.factory");
+/**
+ * MCP (Model Context Protocol) endpoint — stateless Streamable HTTP.
+ *
+ * Each `POST /mcp` request is authenticated by the existing OAuthTokenGuard
+ * (which populates CLS `userId`/`companyId`), then handed to a fresh per-request
+ * MCP Server + StreamableHTTPServerTransport pair (`sessionIdGenerator:
+ * undefined` — stateless mode, no session tracking). GET/DELETE are rejected
+ * with 405: stateless servers expose no SSE notification channel and no
+ * session to terminate.
+ *
+ * Uses `@Res()` with raw reply writing (the SDK transport writes directly to
+ * `res.raw`), which opts this handler out of Nest response serialization —
+ * the MCP wire format is JSON-RPC, not JSON:API, matching how the OAuth
+ * controllers speak their own RFC-mandated wire formats.
+ */
+let McpController = class McpController {
+    constructor(factory, cls, userModules, configService) {
+        this.factory = factory;
+        this.cls = cls;
+        this.userModules = userModules;
+        this.configService = configService;
+    }
+    /** Handles one stateless MCP Streamable-HTTP request (initialize, tools/list, tools/call, ...). */
+    async handle(req, res) {
+        if (!this.configService.get("mcp")?.enabled) {
+            throw new common_1.NotFoundException();
+        }
+        const userId = this.cls.get("userId");
+        const companyId = this.cls.get("companyId");
+        const ctx = {
+            userId,
+            companyId,
+            userModuleIds: await this.userModules.findModuleIdsForUser(userId),
+        };
+        const server = this.factory.create(ctx);
+        const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({ sessionIdGenerator: undefined }); // stateless
+        res.raw.on("close", () => {
+            void transport.close();
+            void server.close();
+        });
+        await server.connect(transport);
+        // Fastify has already parsed the JSON body — pass it through so the SDK
+        // does not attempt to re-read the (already consumed) request stream.
+        await transport.handleRequest(req.raw, res.raw, req.body);
+    }
+    /** Stateless server: no SSE notification stream is offered. */
+    rejectGet() {
+        throw new common_1.HttpException("Method Not Allowed", 405);
+    }
+    /** Stateless server: there is no session to terminate. */
+    rejectDelete() {
+        throw new common_1.HttpException("Method Not Allowed", 405);
+    }
+};
+exports.McpController = McpController;
+__decorate([
+    (0, common_1.Post)(),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], McpController.prototype, "handle", null);
+__decorate([
+    (0, common_1.Get)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], McpController.prototype, "rejectGet", null);
+__decorate([
+    (0, common_1.Delete)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], McpController.prototype, "rejectDelete", null);
+exports.McpController = McpController = __decorate([
+    (0, common_1.Controller)("mcp"),
+    (0, common_1.UseFilters)(mcp_auth_filter_1.McpAuthFilter),
+    (0, common_1.UseGuards)(oauth_token_guard_1.OAuthTokenGuard),
+    __metadata("design:paramtypes", [mcp_server_factory_1.McpServerFactory,
+        nestjs_cls_1.ClsService,
+        user_modules_repository_1.UserModulesRepository,
+        config_1.ConfigService])
+], McpController);
+//# sourceMappingURL=mcp.controller.js.map

package/dist/mcp/controllers/mcp.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.controller.js","sourceRoot":"","sources":["../../../src/mcp/controllers/mcp.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,2CAA+C;AAC/C,0FAAmG;AAEnG,2CAAwC;AACxC,qGAAgG;AAEhG,wFAAmF;AACnF,gEAA2D;AAE3D,uEAAkE;AAElE;;;;;;;;;;;;;;GAcG;AAII,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YACmB,OAAyB,EACzB,GAAe,EACf,WAAkC,EAClC,aAA4B;QAH5B,YAAO,GAAP,OAAO,CAAkB;QACzB,QAAG,GAAH,GAAG,CAAY;QACf,gBAAW,GAAX,WAAW,CAAuB;QAClC,kBAAa,GAAb,aAAa,CAAe;IAC5C,CAAC;IAEJ,mGAAmG;IAE7F,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAmB,EAAS,GAAiB;QAC/D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAqB,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;YAChE,MAAM,IAAI,0BAAiB,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAmB;YAC1B,MAAM;YACN,SAAS;YACT,aAAa,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,MAAM,CAAC;SACnE,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,iDAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,YAAY;QACpG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,+DAA+D;IAE/D,SAAS;QACP,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,0DAA0D;IAE1D,YAAY;QACV,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AA9CY,sCAAa;AAUlB;IADL,IAAA,aAAI,GAAE;IACO,WAAA,IAAA,YAAG,GAAE,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAuB9C;AAID;IADC,IAAA,YAAG,GAAE;;;;8CAGL;AAID;IADC,IAAA,eAAM,GAAE;;;;iDAGR;wBA7CU,aAAa;IAHzB,IAAA,mBAAU,EAAC,KAAK,CAAC;IACjB,IAAA,mBAAU,EAAC,+BAAa,CAAC;IACzB,IAAA,kBAAS,EAAC,mCAAe,CAAC;qCAGG,qCAAgB;QACpB,uBAAU;QACF,+CAAqB;QACnB,sBAAa;GALpC,aAAa,CA8CzB"}

package/dist/mcp/filters/mcp.auth.filter.d.ts

@@ -0,0 +1,21 @@
+import { ArgumentsHost, HttpException } from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import { HttpExceptionFilter } from "../../common/filters/http-exception.filter";
+import { AppLoggingService } from "../../core/logging/services/logging.service";
+/**
+ * MCP-scoped exception filter.
+ *
+ * RFC 9728 requires 401 responses from a protected resource to carry a
+ * `WWW-Authenticate` header pointing at the protected-resource metadata so MCP
+ * clients can discover the authorization server. On 401 this filter sets that
+ * header, then delegates the JSON error body to the library's standard
+ * HttpExceptionFilter; every other HttpException is handled identically to the
+ * global filter (non-HttpException errors fall through to the global filter
+ * because of the `@Catch(HttpException)` scope).
+ */
+export declare class McpAuthFilter extends HttpExceptionFilter {
+    private readonly configService;
+    constructor(configService: ConfigService, logger?: AppLoggingService);
+    catch(exception: HttpException, host: ArgumentsHost): void;
+}
+//# sourceMappingURL=mcp.auth.filter.d.ts.map

package/dist/mcp/filters/mcp.auth.filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.filter.d.ts","sourceRoot":"","sources":["../../../src/mcp/filters/mcp.auth.filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAS,aAAa,EAAY,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,qBACa,aAAc,SAAQ,mBAAmB;IAElD,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa,EACjC,MAAM,CAAC,EAAE,iBAAiB;IAKxC,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI;CAQ3D"}

package/dist/mcp/filters/mcp.auth.filter.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpAuthFilter = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const http_exception_filter_1 = require("../../common/filters/http-exception.filter");
+const logging_service_1 = require("../../core/logging/services/logging.service");
+/**
+ * MCP-scoped exception filter.
+ *
+ * RFC 9728 requires 401 responses from a protected resource to carry a
+ * `WWW-Authenticate` header pointing at the protected-resource metadata so MCP
+ * clients can discover the authorization server. On 401 this filter sets that
+ * header, then delegates the JSON error body to the library's standard
+ * HttpExceptionFilter; every other HttpException is handled identically to the
+ * global filter (non-HttpException errors fall through to the global filter
+ * because of the `@Catch(HttpException)` scope).
+ */
+let McpAuthFilter = class McpAuthFilter extends http_exception_filter_1.HttpExceptionFilter {
+    constructor(configService, logger) {
+        super(logger);
+        this.configService = configService;
+    }
+    catch(exception, host) {
+        if (exception.getStatus() === 401) {
+            const reply = host.switchToHttp().getResponse();
+            const base = (this.configService.get("api")?.url ?? "").replace(/\/$/, "");
+            reply.header("WWW-Authenticate", `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`);
+        }
+        super.catch(exception, host);
+    }
+};
+exports.McpAuthFilter = McpAuthFilter;
+exports.McpAuthFilter = McpAuthFilter = __decorate([
+    (0, common_1.Catch)(common_1.HttpException),
+    __param(1, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [config_1.ConfigService,
+        logging_service_1.AppLoggingService])
+], McpAuthFilter);
+//# sourceMappingURL=mcp.auth.filter.js.map

package/dist/mcp/filters/mcp.auth.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.filter.js","sourceRoot":"","sources":["../../../src/mcp/filters/mcp.auth.filter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+E;AAC/E,2CAA+C;AAE/C,sFAAiF;AACjF,iFAAgF;AAEhF;;;;;;;;;;GAUG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,2CAAmB;IACpD,YACmB,aAA4B,EACjC,MAA0B;QAEtC,KAAK,CAAC,MAAM,CAAC,CAAC;QAHG,kBAAa,GAAb,aAAa,CAAe;IAI/C,CAAC;IAED,KAAK,CAAC,SAAwB,EAAE,IAAmB;QACjD,IAAI,SAAS,CAAC,SAAS,EAAE,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAgB,CAAC;YAC9D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAkB,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5F,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,IAAI,wCAAwC,CAAC,CAAC;QAC9G,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF,CAAA;AAhBY,sCAAa;wBAAb,aAAa;IADzB,IAAA,cAAK,EAAC,sBAAa,CAAC;IAIhB,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCADqB,sBAAa;QACxB,mCAAiB;GAH7B,aAAa,CAgBzB"}

package/dist/mcp/index.d.ts

@@ -0,0 +1,4 @@
+export { McpModule } from "./mcp.module";
+export { MCP_TOOLS } from "./interfaces/mcp.tool.interface";
+export type { McpToolContribution, McpToolDefinition, McpToolResult, McpUserContext, } from "./interfaces/mcp.tool.interface";
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,GACf,MAAM,iCAAiC,CAAC"}

package/dist/mcp/index.js

@@ -0,0 +1,11 @@
+"use strict";
+// MCP (Model Context Protocol) server — public entry point.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_TOOLS = exports.McpModule = void 0;
+// Module (mounted via BootstrapOptions.mcp === true)
+var mcp_module_1 = require("./mcp.module");
+Object.defineProperty(exports, "McpModule", { enumerable: true, get: function () { return mcp_module_1.McpModule; } });
+// App-contribution surface: register McpToolContribution factories under MCP_TOOLS.
+var mcp_tool_interface_1 = require("./interfaces/mcp.tool.interface");
+Object.defineProperty(exports, "MCP_TOOLS", { enumerable: true, get: function () { return mcp_tool_interface_1.MCP_TOOLS; } });
+//# sourceMappingURL=index.js.map

package/dist/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":";AAAA,4DAA4D;;;AAE5D,qDAAqD;AACrD,2CAAyC;AAAhC,uGAAA,SAAS,OAAA;AAElB,oFAAoF;AACpF,sEAA4D;AAAnD,+GAAA,SAAS,OAAA"}

package/dist/mcp/interfaces/mcp.tool.interface.d.ts

@@ -0,0 +1,37 @@
+/** Per-request user context every MCP tool executes with (company scoping + RBAC module visibility). */
+export interface McpUserContext {
+    userId: string;
+    companyId: string;
+    userModuleIds: string[];
+}
+/** MCP tool-call result: text content blocks, with `isError` set on failures. */
+export interface McpToolResult {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}
+/**
+ * A single MCP tool as exposed over tools/list + tools/call.
+ * `inputSchema` is JSON Schema (draft 2020-12); `readOnly` maps to `annotations.readOnlyHint`.
+ */
+export interface McpToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    readOnly: boolean;
+    execute(input: Record<string, unknown>, ctx: McpUserContext): Promise<McpToolResult>;
+}
+/**
+ * Factory contract for app-contributed MCP tools.
+ * Built once per request — like the built-ins — so contributed tools can
+ * apply company scoping and RBAC filtering from the request context.
+ */
+export interface McpToolContribution {
+    /** Called once per MCP request with the authenticated user context. */
+    build(ctx: McpUserContext): McpToolDefinition[];
+}
+/** Multi-provider DI token: consuming apps contribute McpToolContribution factories. */
+export declare const MCP_TOOLS: unique symbol;
+//# sourceMappingURL=mcp.tool.interface.d.ts.map

package/dist/mcp/interfaces/mcp.tool.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.tool.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/mcp.tool.interface.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACtF;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,iBAAiB,EAAE,CAAC;CACjD;AAED,wFAAwF;AACxF,eAAO,MAAM,SAAS,eAAsB,CAAC"}

package/dist/mcp/interfaces/mcp.tool.interface.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_TOOLS = void 0;
+/** Multi-provider DI token: consuming apps contribute McpToolContribution factories. */
+exports.MCP_TOOLS = Symbol("MCP_TOOLS");
+//# sourceMappingURL=mcp.tool.interface.js.map

package/dist/mcp/interfaces/mcp.tool.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.tool.interface.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/mcp.tool.interface.ts"],"names":[],"mappings":";;;AAmCA,wFAAwF;AAC3E,QAAA,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC"}

package/dist/mcp/mcp.module.d.ts

@@ -0,0 +1,23 @@
+/**
+ * MCP (Model Context Protocol) server module.
+ *
+ * Mounted by the bootstrap gate (`BootstrapOptions.mcp === true`) and served
+ * at `POST /mcp`, OAuth-authenticated and RBAC-gated. Exports McpToolRegistry
+ * so consuming apps can contribute additional tools via the MCP_TOOLS token.
+ *
+ * Module wiring notes:
+ * - `RbacPermissionModule` supplies RbacPermissionService (the RbacModule
+ *   proper is a config-requiring dynamic module and cannot be imported here).
+ * - Audit is NOT wired here: AbstractService.create/put audits internally when
+ *   the concrete entity service injects AuditService, so MCP writes audit
+ *   exactly like HTTP writes.
+ * - `SearchDocumentsTool` is provided locally: OperatorModule declares but
+ *   does not export it, and importing OperatorModule would drag in its
+ *   forwardRef(AssistantModule) cycle. Its dependencies (ToolFactory,
+ *   ContextualiserService) are exported by AgentsModule's inner modules.
+ * - EntityServiceRegistry, Neo4jService, ClsService and ConfigService resolve
+ *   through the global core/cls/config modules.
+ */
+export declare class McpModule {
+}
+//# sourceMappingURL=mcp.module.d.ts.map

package/dist/mcp/mcp.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.module.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.module.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAaa,SAAS;CAAG"}