@tryvira/mcp 0.1.11 → 0.1.13

package/README.md

@@ -1,79 +1,79 @@
-# @tryvira/mcp
-
-MIT-licensed MCP client/server package. The Vira service, application, and
-backend remain proprietary and are governed separately.
-
-An npx-ready MCP server for Vira's existing scoped authority boundary.
-
-## Run it
-
-```bash
-npx @tryvira/mcp
-```
-
-The default transport is the official MCP transport. The legacy custom transport is an
-explicit migration option only: `VIRA_MCP_PROTOCOL_MODE=legacy npx @tryvira/mcp`.
-
-The launcher reads environment variables from its parent process. It does not automatically load a
-`.env` file. For a local shell, export the variables first; for an MCP client, put them in the
-client's `env` configuration:
-
-```dotenv
-VIRA_API_URL=http://127.0.0.1:4185
-VIRA_API_KEY=vira_dev_local.local-development-only-32chars
-VIRA_MCP_AUTH_TOKEN=replace-with-a-long-random-mcp-token
-VIRA_ORGANIZATION_ID=local-org
-VIRA_PROJECT_ID=local-project
-VIRA_ENVIRONMENT_ID=local
-```
-
-For example, an MCP client configuration uses the same names:
-
-```json
-{"env":{"VIRA_API_URL":"https://api.example","VIRA_API_KEY":"<customer-api-key>","VIRA_MCP_AUTH_TOKEN":"<mcp-token>","VIRA_ORGANIZATION_ID":"<org>","VIRA_PROJECT_ID":"<project>","VIRA_ENVIRONMENT_ID":"<environment>"}}
-```
-
-The default launcher uses MCP stdio. To run the optional HTTP transport explicitly, use
-`npx @tryvira/mcp --http`; it binds to `127.0.0.1` by default and requires `Authorization: Bearer
-<VIRA_MCP_AUTH_TOKEN>`. Effectful MCP tools are denied by default. Local-only effectful
-execution requires the explicit `VIRA_MCP_ALLOW_EFFECTFUL=true` opt-in; production never
-accepts that shortcut. Set `VIRA_MCP_BIND_PUBLIC=true` only when an authenticated reverse
-proxy or equivalent network boundary is present.
-
-Effectful MCP tools remain authority-gated; the launcher does not create a second execution or telemetry path.
-
-## What a client can discover
-
-After `initialize`, call `tools/list`. Read-only tools such as `resolve_semantic` may return
-semantic candidates. Effectful tools such as `resolve_runtime`, pack installation/release
-and Strategy execution call the configured authority endpoint and can be denied by scope,
-role, release state or policy.
-
-## Minimal MCP client configuration
-
-```json
-{
-  "mcpServers": {
-    "vira": {
-      "command": "npx",
-      "args": ["-y", "@tryvira/mcp"],
-      "env": {
-        "VIRA_API_URL": "https://api.example.invalid",
-        "VIRA_API_KEY": "<customer-api-key>",
-        "VIRA_MCP_AUTH_TOKEN": "<mcp-auth-token>",
-        "VIRA_MCP_AUTHORITY_URL": "https://api.example.invalid/v1/mcp/authorize",
-        "VIRA_ORGANIZATION_ID": "<organization>",
-        "VIRA_PROJECT_ID": "<project>",
-        "VIRA_ENVIRONMENT_ID": "<environment>"
-      }
-    }
-  }
-}
-```
-
-Never paste real credentials into a checked-in client configuration. For local-only effectful
-testing, use the local stack and its documented development credentials; the production
-authority path does not accept the local bypass.
-
-See [`docs/MCP_GUIDE.md`](../../docs/MCP_GUIDE.md) for JSON-RPC discovery, tool examples and
-authority/error behavior.
+# @tryvira/mcp
+
+MIT-licensed MCP client/server package. The Vira service, application, and
+backend remain proprietary and are governed separately.
+
+An npx-ready MCP server for Vira's existing scoped authority boundary.
+
+## Run it
+
+```bash
+npx @tryvira/mcp
+```
+
+The default transport is the official MCP transport. The legacy custom transport is an
+explicit migration option only: `VIRA_MCP_PROTOCOL_MODE=legacy npx @tryvira/mcp`.
+
+The launcher reads environment variables from its parent process. It does not automatically load a
+`.env` file. For a local shell, export the variables first; for an MCP client, put them in the
+client's `env` configuration:
+
+```dotenv
+VIRA_API_URL=http://127.0.0.1:4185
+VIRA_API_KEY=vira_dev_local.local-development-only-32chars
+VIRA_MCP_AUTH_TOKEN=replace-with-a-long-random-mcp-token
+VIRA_ORGANIZATION_ID=local-org
+VIRA_PROJECT_ID=local-project
+VIRA_ENVIRONMENT_ID=local
+```
+
+For example, an MCP client configuration uses the same names:
+
+```json
+{"env":{"VIRA_API_URL":"https://api.example","VIRA_API_KEY":"<customer-api-key>","VIRA_MCP_AUTH_TOKEN":"<mcp-token>","VIRA_ORGANIZATION_ID":"<org>","VIRA_PROJECT_ID":"<project>","VIRA_ENVIRONMENT_ID":"<environment>"}}
+```
+
+The default launcher uses MCP stdio. To run the optional HTTP transport explicitly, use
+`npx @tryvira/mcp --http`; it binds to `127.0.0.1` by default and requires `Authorization: Bearer
+<VIRA_MCP_AUTH_TOKEN>`. Effectful MCP tools are denied by default. Local-only effectful
+execution requires the explicit `VIRA_MCP_ALLOW_EFFECTFUL=true` opt-in; production never
+accepts that shortcut. Set `VIRA_MCP_BIND_PUBLIC=true` only when an authenticated reverse
+proxy or equivalent network boundary is present.
+
+Effectful MCP tools remain authority-gated; the launcher does not create a second execution or telemetry path.
+
+## What a client can discover
+
+After `initialize`, call `tools/list`. Read-only tools such as `resolve_semantic` may return
+semantic candidates. Effectful tools such as `resolve_runtime`, pack installation/release
+and Strategy execution call the configured authority endpoint and can be denied by scope,
+role, release state or policy.
+
+## Minimal MCP client configuration
+
+```json
+{
+  "mcpServers": {
+    "vira": {
+      "command": "npx",
+      "args": ["-y", "@tryvira/mcp"],
+      "env": {
+        "VIRA_API_URL": "https://api.example.invalid",
+        "VIRA_API_KEY": "<customer-api-key>",
+        "VIRA_MCP_AUTH_TOKEN": "<mcp-auth-token>",
+        "VIRA_MCP_AUTHORITY_URL": "https://api.example.invalid/v1/mcp/authorize",
+        "VIRA_ORGANIZATION_ID": "<organization>",
+        "VIRA_PROJECT_ID": "<project>",
+        "VIRA_ENVIRONMENT_ID": "<environment>"
+      }
+    }
+  }
+}
+```
+
+Never paste real credentials into a checked-in client configuration. For local-only effectful
+testing, use the local stack and its documented development credentials; the production
+authority path does not accept the local bypass.
+
+See [`docs/MCP_GUIDE.md`](../../docs/MCP_GUIDE.md) for JSON-RPC discovery, tool examples and
+authority/error behavior.

package/dist/cli.js

@@ -969,7 +969,7 @@ var init_vira_server = __esm({
       { name: "submit_teach_evidence", description: "Submit scoped evidence to the Teach lifecycle.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, source: { type: "string" }, content: { type: "string" }, consent: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "id", "content", "consent"] } },
       { name: "create_teach_proposal", description: "Create a reviewed Teach proposal from admitted evidence.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, evidenceId: { type: "string" }, controlPointId: { type: "string" }, summary: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "evidenceId", "controlPointId", "summary"] } },
       { name: "transition_teach_proposal", description: "Review, evaluate, or promote a Teach proposal.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, proposalId: { type: "string" }, transition: { type: "string" }, decision: { type: "string" }, score: { type: "number" }, evaluationId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "proposalId", "transition"] } },
-      { name: "create_release", description: "Create a scoped release after evaluation and approval.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, releaseId: { type: "string" }, artifactId: { type: "string" }, evaluationId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "artifactId"] } },
+      { name: "create_release", description: "Create a scoped release using either provider-backed evaluation or explicit manual approval with step-up evidence.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, releaseId: { type: "string" }, artifactId: { type: "string" }, evaluationId: { type: "string" }, manualApproval: { type: "object", properties: { reason: { type: "string" } }, required: ["reason"] }, stepUp: { type: "object", properties: { id: { type: "string" }, assertion: { type: "string" }, purpose: { type: "string" } }, required: ["id", "assertion", "purpose"] } }, required: ["organizationId", "projectId", "environmentId", "artifactId"] } },
       { name: "resolve_semantic", description: "Resolve input through the governed semantic runtime.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, input: { type: "string" }, sessionId: { type: "string" }, profile: { type: "object" }, selection: { type: "object" }, candidates: { type: "array" }, timeoutMs: { type: "number" } }, required: ["organizationId", "projectId", "environmentId", "input"] } },
       { name: "resolve_runtime", description: "Resolve a persisted BehaviorPoint through the governed runtime boundary. behaviorPoint may be omitted when semanticContext supplies the selected canonical route.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, behaviorPoint: { type: "string" }, executionBoundary: { type: "object" }, semanticContext: { type: "object" } }, required: ["organizationId", "projectId", "environmentId"] } },
       { name: "create_signal_discovery_proposal", description: "Propose a discovered signal for scoped human review.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, signalStableKey: { type: "string" }, evidenceEventIds: { type: "array", items: { type: "string" } }, suggestedProducerType: { type: "string" }, suggestedProducerKey: { type: "string" }, confidence: { type: "number" } }, required: ["organizationId", "projectId", "environmentId", "signalStableKey", "evidenceEventIds"] } },
@@ -1092,8 +1092,10 @@ function createPostgresDatabase(input) {
   }, transaction: async (work) => {
     if (typeof work !== "function") throw new Error("DATABASE_WORK_REQUIRED");
     const client = await input.pool.connect();
+    const timeoutMs = Math.max(1e3, Number(process.env.VIRA_DB_STATEMENT_TIMEOUT_MS ?? 6e5));
     try {
       await client.query("BEGIN");
+      await client.query(`SET LOCAL statement_timeout = ${timeoutMs}`);
       const result = await work(client);
       await client.query("COMMIT");
       return result;
@@ -1111,7 +1113,8 @@ function createPostgresDatabase(input) {
 function createPostgresPool(input = {}) {
   const connectionString = input.databaseUrl ?? process.env.DATABASE_URL;
   if (!connectionString?.startsWith("postgres")) throw new Error("POSTGRES_DATABASE_URL_REQUIRED");
-  const config = { connectionString, max: input.max ?? 10, idleTimeoutMillis: 3e4, connectionTimeoutMillis: 1e4, ...input.ssl ? { ssl: { rejectUnauthorized: false } } : {} };
+  const statementTimeoutMs = Math.max(1e3, Number(process.env.VIRA_DB_STATEMENT_TIMEOUT_MS ?? 6e5));
+  const config = { connectionString, max: input.max ?? 10, idleTimeoutMillis: 3e4, connectionTimeoutMillis: 1e4, statement_timeout: statementTimeoutMs, ...input.ssl ? { ssl: { rejectUnauthorized: false } } : {} };
   const pool = new Pool(config);
   return { pool, close: () => pool.end() };
 }
@@ -1277,25 +1280,28 @@ var init_postgres_migrations = __esm({
 });
 
 // ../database/src/postgres-runtime.ts
-import { readFile } from "node:fs/promises";
+import { readFile, readdir } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+async function defaultMigrationPaths() {
+  const migrationDirectory = resolve(here, "../migrations");
+  const entries = await readdir(migrationDirectory, { withFileTypes: true });
+  return entries.filter((entry) => entry.isFile() && /^\d+_.+\.sql$/i.test(entry.name)).map((entry) => resolve(migrationDirectory, entry.name)).sort((left, right) => left.localeCompare(right, "en"));
+}
 async function openPostgresRuntime(options = {}) {
   const { pool, close } = createPostgresPool({ databaseUrl: options.databaseUrl, max: options.maxConnections, ssl: options.ssl });
   const database = createPostgresDatabase({ pool, databaseUrl: options.databaseUrl });
   try {
-    const migrations = [];
-    const migrationPaths = options.migrationPaths ?? [...defaultMigrationPaths, resolve(here, "../migrations/006_postgres_control_plane_repositories.sql")];
-    for (const path of migrationPaths) {
-      const id = path.split(/[\\/]/).pop().replace(/\.sql$/i, "");
-      const legacyChecksums = id === "001_vnext_foundation" ? ["d1a175e1b8af20bcf9bc650fb299626513532e4d18da429569251eff69475427"] : void 0;
-      migrations.push({ id, sql: await readFile(path, "utf8"), ...legacyChecksums ? { legacyChecksums } : {} });
-    }
-    const client = await pool.connect();
-    try {
-      await applyPostgresMigrations(client, migrations);
-    } finally {
-      client.release();
+    if (!options.skipMigrations && process.env.VIRA_WORKER_SKIP_MIGRATIONS !== "true") {
+      const migrations = [];
+      const migrationPaths = options.migrationPaths ?? await defaultMigrationPaths();
+      for (const path of migrationPaths) migrations.push({ id: path.split(/[\\/]/).pop().replace(/\.sql$/i, ""), sql: await readFile(path, "utf8") });
+      const client = await pool.connect();
+      try {
+        await applyPostgresMigrations(client, migrations);
+      } finally {
+        client.release();
+      }
     }
     return { ...database, close };
   } catch (error) {
@@ -1303,35 +1309,13 @@ async function openPostgresRuntime(options = {}) {
     throw error;
   }
 }
-var here, defaultMigrationPaths;
+var here;
 var init_postgres_runtime = __esm({
   "../database/src/postgres-runtime.ts"() {
     "use strict";
     init_postgres_adapter();
     init_postgres_migrations();
     here = dirname(fileURLToPath(import.meta.url));
-    defaultMigrationPaths = [
-      resolve(here, "../migrations/001_vnext_foundation.sql"),
-      resolve(here, "../migrations/002_session_handoff_approvals.sql"),
-      resolve(here, "../migrations/003_mfa_totp.sql"),
-      resolve(here, "../migrations/004_behavior_strategy_execution.sql"),
-      resolve(here, "../migrations/005_postgres_runtime_completeness.sql"),
-      resolve(here, "../migrations/007_postgres_native_support_repositories.sql"),
-      resolve(here, "../migrations/008_postgres_identity_session_repositories.sql"),
-      resolve(here, "../migrations/009_postgres_runtime_repair.sql"),
-      resolve(here, "../migrations/010_postgres_receipt_lineage_repair.sql"),
-      resolve(here, "../migrations/011_postgres_semantic_activation_receipts.sql"),
-      resolve(here, "../migrations/012_strategy_release_lineage.sql"),
-      resolve(here, "../migrations/013_strategy_variant_definition.sql"),
-      resolve(here, "../migrations/014_strategy_step_recovery_action.sql"),
-      resolve(here, "../migrations/015_strategy_total_recoveries.sql"),
-      resolve(here, "../migrations/016_postgres_studio_tenant_auth.sql"),
-      resolve(here, "../migrations/017_postgres_security_advisor_hardening.sql"),
-      resolve(here, "../migrations/018_postgres_foreign_key_indexes.sql"),
-      resolve(here, "../migrations/019_postgres_explicit_public_deny_policies.sql"),
-      resolve(here, "../migrations/020_semantic_registry_task_index.sql"),
-      resolve(here, "../migrations/021_unique_ai_system_names.sql")
-    ];
   }
 });
 
@@ -1542,7 +1526,10 @@ async function openProductionSqlite({ databaseUrl = process.env.DATABASE_URL } =
     environment_id TEXT,
     authority_digest TEXT,
     artifact_id TEXT,
-    promotion_version INTEGER
+    promotion_version INTEGER,
+    approval_mode TEXT NOT NULL DEFAULT 'EVALUATED',
+    approval_reason TEXT,
+    approval_receipt_digest TEXT
   )`);
   for (const statement of [
     "ALTER TABLE release_manifests ADD COLUMN authority_digest TEXT",
@@ -1553,7 +1540,10 @@ async function openProductionSqlite({ databaseUrl = process.env.DATABASE_URL } =
     "ALTER TABLE release_manifests ADD COLUMN strategy_digest TEXT",
     "ALTER TABLE release_manifests ADD COLUMN strategy_artifact_digest TEXT",
     "ALTER TABLE release_manifests ADD COLUMN program_digest TEXT",
-    "ALTER TABLE release_manifests ADD COLUMN evaluation_digest TEXT"
+    "ALTER TABLE release_manifests ADD COLUMN evaluation_digest TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN approval_mode TEXT NOT NULL DEFAULT 'EVALUATED'",
+    "ALTER TABLE release_manifests ADD COLUMN approval_reason TEXT",
+    "ALTER TABLE release_manifests ADD COLUMN approval_receipt_digest TEXT"
   ]) {
     try {
       database.run(statement);