@suluk/platform 0.1.5 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suluk/platform",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "The platform generator (C051): write one `definePlatform` manifest → it plans the shadcn-registry adds, generates the wired Hono entry, and merges each module's provision fragment into a single provision.config. The manifest compiles to a shadcn-add list + a C047 provision.config; the generator runs the adds + `@suluk/provision`. Turns the Suluk backend registry into a one-command platform. CANDIDATE tooling.",
   "publishConfig": {
   "access": "public"

package/src/catalog.ts

@@ -24,6 +24,8 @@ export const CATALOG: Record<string, CatalogEntry> = {
   // the contract is a MIDDLEWARE mount: it installs the scope gate (enforceApiKeyScope) + GET /api/openapi.json. Place it
   // after `auth` in the manifest so the gate runs after identity/apiKeyAuth set keyId/scopes. Derived + stateless.
   contract: { mount: { kind: "middleware", symbol: "mountContract", from: "./routes/contract" } },
+  // the API-as-MCP server + OAuth discovery + connections — a middleware mount (registers /api/mcp + /.well-known/*).
+  mcp: { mount: { kind: "middleware", symbol: "mountMcp", from: "./routes/mcp" }, provision: { symbol: "mcpProvision", from: "./src/provision/mcp" } },
   // feature routes mount under /api/* — where the caller-resolution + cors + rate-limit middleware live (toolfactory parity).
   credits: { mount: { kind: "route", path: "/api/credits", symbol: "creditsRoutes", from: "./routes/credits" }, provision: { symbol: "creditsProvision", from: "./src/provision/credits" } },
   keys: { mount: { kind: "route", path: "/api/keys", symbol: "keysRoutes", from: "./routes/keys" }, provision: { symbol: "keysProvision", from: "./src/provision/keys" } },
@@ -34,6 +36,7 @@ export const CATALOG: Record<string, CatalogEntry> = {
   webhooks: { mount: { kind: "route", path: "/api/webhooks", symbol: "webhooksRoutes", from: "./routes/webhooks" }, provision: { symbol: "webhooksProvision", from: "./src/provision/webhooks" } },
   // cross-cutting MIDDLEWARE (apply globally via app.use, emitted before any route) — not routed resources.
   "rate-limit": { mount: { kind: "middleware", symbol: "mountRateLimit", from: "./services/rate-limit" } },
+  "rate-credit": { mount: { kind: "middleware", symbol: "mountRateCredit", from: "./services/rate-credit" } }, // credit-backed free-tier bucket (KV binding)
   i18n: { mount: { kind: "middleware", symbol: "mountI18n", from: "./services/i18n" } },
   reference: { mount: { kind: "route", path: "/api/reference", symbol: "referenceRoutes", from: "./routes/reference" } }, // derived doc render — no provision
   admin: { mount: { kind: "route", path: "/api/admin", symbol: "adminRoutes", from: "./routes/admin" } }, // reads existing tables — no provision

package/src/manifest.ts

@@ -11,6 +11,12 @@ export interface PlatformManifest {
   /** the services to include, in mount order — resolved against the catalog. `app` + `auth` are implied if any is listed
    *  but list them for clarity; the base + foundation always come first. */
   services: string[];
+  /**
+   * Per-service static OPTIONS passed to that service's mount in the generated entry (a plain JSON-serializable object).
+   * E.g. enable MCP OAuth: `opts: { auth: { mcp: { loginPage, consentPage, resource, scopes } } }` → the entry emits
+   * `mountAuthRoutes(app, {...})`. Only JSON-safe values (no functions/env-refs — edit the generated entry for those).
+   */
+  opts?: Record<string, Record<string, unknown>>;
 }
 
 /** Validate + return the manifest (throws on an empty service list). */

package/src/plan.ts

@@ -23,25 +23,30 @@ export function planPlatform(manifest: PlatformManifest): PlatformPlan {
   return {
     services,
     adds: services.map((s) => `${manifest.registry}/${s}`),
-    entry: buildEntry(services),
+    entry: buildEntry(services, manifest.opts),
     provisionConfig: buildProvisionConfig(services),
   };
 }
 
-function buildEntry(services: string[]): string {
+function buildEntry(services: string[], opts?: Record<string, Record<string, unknown>>): string {
   const imports = ['import { createApp } from "./app";'];
   const middleware: string[] = [];
   const routes: string[] = [];
+  // per-service static options → a JSON literal passed to the mount (e.g. auth's mcp OAuth config). Empty ⇒ no 2nd arg.
+  const optOf = (s: string): string => {
+    const o = opts?.[s];
+    return o && Object.keys(o).length ? `, ${JSON.stringify(o)}` : "";
+  };
   // TWO passes: ALL middleware mounts (app.use / handler) emit BEFORE any route mount, so a cross-cutting concern
   // (auth, rate-limit, i18n) applies to every route regardless of where it sits in the manifest.
   for (const s of services) {
     const m = CATALOG[s].mount;
     if (m.kind === "middleware") {
       imports.push(`import { ${m.symbol} } from "${m.from}";`);
-      middleware.push(`${m.symbol}(app);`);
+      middleware.push(`${m.symbol}(app${optOf(s)});`);
     } else if (m.kind === "route") {
       imports.push(`import { ${m.symbol} } from "${m.from}";`);
-      routes.push(`app.route("${m.path}", ${m.symbol}());`);
+      routes.push(`app.route("${m.path}", ${m.symbol}(${optOf(s).replace(/^, /, "")}));`);
     }
   }
   const body = ["const app = createApp();", ...middleware, ...routes];

package/test/plan.test.ts

@@ -35,6 +35,13 @@ describe("planPlatform — manifest → shadcn adds + entry + provision.config",
   test("an unknown service throws", () => {
     expect(() => planPlatform({ name: "x", registry: "r", services: ["nope"] })).toThrow(/unknown service/);
   });
+
+  test("per-service opts are passed to the mount (e.g. auth mcp OAuth config)", () => {
+    const p = planPlatform(definePlatform({ name: "o", registry: "acme/reg", services: ["auth", "credits"], opts: { auth: { mcp: { resource: "https://api.x", scopes: ["credits:read"] } } } }));
+    expect(p.entry).toContain('mountAuthRoutes(app, {"mcp":{"resource":"https://api.x","scopes":["credits:read"]}});');
+    // a service with no opts still gets the bare call.
+    expect(p.entry).toContain('app.route("/api/credits", creditsRoutes());');
+  });
 });
 
 describe("cost (route + provision) + dev modules (journeys/audit — files only)", () => {
@@ -101,6 +108,20 @@ describe("cost (route + provision) + dev modules (journeys/audit — files only)
     expect(p.provisionConfig).not.toContain("adminProvision");
   });
 
+  test("mcp is a middleware mount (server + discovery + connections) with a provision fragment", () => {
+    const p = planPlatform(definePlatform({ name: "m", registry: "acme/reg", services: ["auth", "contract", "mcp", "credits"] }));
+    expect(p.entry).toContain('import { mountMcp } from "./routes/mcp";');
+    expect(p.entry).toContain("mountMcp(app);");
+    expect(p.entry).not.toContain('app.route("/api/mcp"'); // it's a mount, not a route
+    expect(p.provisionConfig).toContain("mcpProvision");
+  });
+
+  test("rate-credit is a middleware mount (KV binding) with NO provision fragment", () => {
+    const p = planPlatform(definePlatform({ name: "rc", registry: "acme/reg", services: ["auth", "rate-credit", "credits"] }));
+    expect(p.entry).toContain("mountRateCredit(app);");
+    expect(p.provisionConfig).not.toContain("rateCreditProvision");
+  });
+
   test("dev modules add shadcn refs but NO entry mount and NO provision fragment", () => {
     expect(plan.adds).toContain("acme/reg/journeys");
     expect(plan.adds).toContain("acme/reg/audit");