@hasna/treasury 0.1.2

package/dist/mcp/compact.d.ts

@@ -0,0 +1,12 @@
+export interface ToolResult {
+    [x: string]: unknown;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}
+/** Wrap a JSON-serializable value as an MCP text result. */
+export declare function ok(value: unknown): ToolResult;
+/** Wrap an error as the canonical `{ code, message, suggestion }` envelope. */
+export declare function fail(error: unknown): ToolResult;
+//# sourceMappingURL=compact.d.ts.map

package/dist/mcp/compact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact.d.ts","sourceRoot":"","sources":["../../src/mcp/compact.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,4DAA4D;AAC5D,wBAAgB,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAE7C;AAED,+EAA+E;AAC/E,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAG/C"}

package/dist/mcp/http.d.ts

@@ -0,0 +1,38 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type ApiPrincipal } from "../server/auth.js";
+export declare const DEFAULT_MCP_HTTP_PORT = 8890;
+export declare const MCP_HTTP_NAME = "treasury";
+/**
+ * Bind host for the MCP HTTP transport. Defaults to loopback; a container/self-host
+ * deploy sets HASNA_TREASURY_MCP_BIND_HOST=0.0.0.0 so the published port is
+ * reachable. A non-loopback bind forces auth on and is asserted fail-closed at
+ * startup (see assertMcpServeSafety).
+ */
+export declare function resolveBindHost(): string;
+export declare function isHttpMode(): boolean;
+export declare function isStdioMode(): boolean;
+export declare function resolveHttpPort(defaultPort?: number): number;
+export declare function healthResponse(name?: string): Response;
+export declare function checkMcpRateLimit(key: string): boolean;
+export declare function resetMcpRateLimit(): void;
+/** Auth disabled only when explicitly off AND loopback AND local mode (fail-closed). */
+export declare function mcpAuthDisabled(hostname: string): boolean;
+/**
+ * Authenticate an /mcp request to a caller principal. Bearer required unless
+ * auth is explicitly disabled for local loopback dev (§5.1a).
+ */
+export declare function authenticateMcp(req: Request, hostname: string): ApiPrincipal | null;
+export declare function handleMcpHttpRequest(req: Request, hostname: string, createServer?: (principal: ApiPrincipal) => McpServer): Promise<Response>;
+/**
+ * Fail-closed startup assertion for the MCP HTTP transport, mirroring the serve
+ * tier's assertServeSafety (BUILD-SPEC §5.1a). A non-loopback bind OR cloud mode
+ * with no API credentials configured is almost certainly a misconfigured /
+ * open-intent deploy. Refuse to start and surface the misconfig instead of
+ * silently coming up "successfully" and 401'ing every caller at request time.
+ */
+export declare function assertMcpServeSafety(hostname: string): void;
+export declare function startHttpServer(port: number, options?: {
+    name?: string;
+    hostname?: string;
+}): Promise<ReturnType<typeof Bun.serve>>;
+//# sourceMappingURL=http.d.ts.map

package/dist/mcp/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAuD,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAI3G,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAC1C,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,wBAAgB,eAAe,CAAC,WAAW,SAAwB,GAAG,MAAM,CAe3E;AAED,wBAAgB,cAAc,CAAC,IAAI,SAAgB,GAAG,QAAQ,CAE7D;AAYD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAStD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKnF;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,CAAC,SAAS,EAAE,YAAY,KAAK,SAAuB,GACjE,OAAO,CAAC,QAAQ,CAAC,CAenB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAU3D;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,OAAO,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAyBvC"}

package/dist/mcp/index.d.ts

@@ -0,0 +1,32 @@
+#!/usr/bin/env bun
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type ApiPrincipal } from "../server/auth.js";
+import { type Profile } from "../services/registry.js";
+export declare function getProfile(): Profile;
+/** Whether a tool is registered under the active profile (standard/storage always on). */
+export declare function shouldRegisterTool(toolName: string, profile?: Profile): boolean;
+/**
+ * Full-scope local owner principal (stdio fallback + auth-off loopback dev only).
+ * It carries `bypass: true` so it has the SAME authority as the CLI's
+ * localOwnerContext (SYSTEM bypass): without it, entity-scoped ops would fail
+ * deny-by-default (no entity_ids) and the local-owner surface could not read or
+ * write any entity-anchored data. Scoped bearer credentials never get bypass.
+ */
+export declare function localOwnerPrincipal(): ApiPrincipal;
+/**
+ * Build a fully-wired MCP server bound to a specific authenticated caller
+ * principal. Domain tools authorize against THIS principal's scopes + entity
+ * set — never a SYSTEM bypass on the transport (§5.1a).
+ */
+export declare function buildServer(principal: ApiPrincipal, profile?: Profile): McpServer;
+/**
+ * Fail-closed guard for the stdio transport (BUILD-SPEC §5.1a). Unlike the HTTP
+ * transport, stdio has no bearer channel: it always runs as the SYSTEM-bypass
+ * localOwnerPrincipal(). That is only acceptable in local mode with auth off —
+ * the SAME condition mcpAuthDisabled() enforces for the HTTP loopback dev path.
+ * In cloud mode (or when API credentials are configured) stdio would hand a
+ * caller full unauthenticated bypass access to production Postgres, so we refuse
+ * to start instead of silently granting it.
+ */
+export declare function assertStdioSafety(): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAO,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAiB5D,wBAAgB,UAAU,IAAI,OAAO,CAIpC;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,OAAsB,GAAG,OAAO,CAI7F;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,YAAY,CASlD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,GAAE,OAAsB,GAAG,SAAS,CAM/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAcxC"}