@tryvira/mcp 0.1.14 → 0.1.16

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Vira / Esad Türkel
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Vira / Esad Türkel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,79 +1,79 @@
-# @tryvira/mcp
-
-MIT-licensed MCP client/server package. The Vira service, application, and
-backend remain proprietary and are governed separately.
-
-An npx-ready MCP server for Vira's existing scoped authority boundary.
-
-## Run it
-
-```bash
-npx @tryvira/mcp
-```
-
-The default transport is the official MCP transport. The legacy custom transport is an
-explicit migration option only: `VIRA_MCP_PROTOCOL_MODE=legacy npx @tryvira/mcp`.
-
-The launcher reads environment variables from its parent process. It does not automatically load a
-`.env` file. For a local shell, export the variables first; for an MCP client, put them in the
-client's `env` configuration:
-
-```dotenv
-VIRA_API_URL=http://127.0.0.1:4185
-VIRA_API_KEY=vira_dev_local.local-development-only-32chars
-VIRA_MCP_AUTH_TOKEN=replace-with-a-long-random-mcp-token
-VIRA_ORGANIZATION_ID=local-org
-VIRA_PROJECT_ID=local-project
-VIRA_ENVIRONMENT_ID=local
-```
-
-For example, an MCP client configuration uses the same names:
-
-```json
-{"env":{"VIRA_API_URL":"https://api.example","VIRA_API_KEY":"<customer-api-key>","VIRA_MCP_AUTH_TOKEN":"<mcp-token>","VIRA_ORGANIZATION_ID":"<org>","VIRA_PROJECT_ID":"<project>","VIRA_ENVIRONMENT_ID":"<environment>"}}
-```
-
-The default launcher uses MCP stdio. To run the optional HTTP transport explicitly, use
-`npx @tryvira/mcp --http`; it binds to `127.0.0.1` by default and requires `Authorization: Bearer
-<VIRA_MCP_AUTH_TOKEN>`. Effectful MCP tools are denied by default. Local-only effectful
-execution requires the explicit `VIRA_MCP_ALLOW_EFFECTFUL=true` opt-in; production never
-accepts that shortcut. Set `VIRA_MCP_BIND_PUBLIC=true` only when an authenticated reverse
-proxy or equivalent network boundary is present.
-
-Effectful MCP tools remain authority-gated; the launcher does not create a second execution or telemetry path.
-
-## What a client can discover
-
-After `initialize`, call `tools/list`. Read-only tools such as `resolve_semantic` may return
-semantic candidates. Effectful tools such as `resolve_runtime`, pack installation/release
-and Strategy execution call the configured authority endpoint and can be denied by scope,
-role, release state or policy.
-
-## Minimal MCP client configuration
-
-```json
-{
-  "mcpServers": {
-    "vira": {
-      "command": "npx",
-      "args": ["-y", "@tryvira/mcp"],
-      "env": {
-        "VIRA_API_URL": "https://api.example.invalid",
-        "VIRA_API_KEY": "<customer-api-key>",
-        "VIRA_MCP_AUTH_TOKEN": "<mcp-auth-token>",
-        "VIRA_MCP_AUTHORITY_URL": "https://api.example.invalid/v1/mcp/authorize",
-        "VIRA_ORGANIZATION_ID": "<organization>",
-        "VIRA_PROJECT_ID": "<project>",
-        "VIRA_ENVIRONMENT_ID": "<environment>"
-      }
-    }
-  }
-}
-```
-
-Never paste real credentials into a checked-in client configuration. For local-only effectful
-testing, use the local stack and its documented development credentials; the production
-authority path does not accept the local bypass.
-
-See [`docs/MCP_GUIDE.md`](../../docs/MCP_GUIDE.md) for JSON-RPC discovery, tool examples and
-authority/error behavior.
+# @tryvira/mcp
+
+MIT-licensed MCP client/server package. The Vira service, application, and
+backend remain proprietary and are governed separately.
+
+An npx-ready MCP server for Vira's existing scoped authority boundary.
+
+## Run it
+
+```bash
+npx @tryvira/mcp
+```
+
+The default transport is the official MCP transport. The legacy custom transport is an
+explicit migration option only: `VIRA_MCP_PROTOCOL_MODE=legacy npx @tryvira/mcp`.
+
+The launcher reads environment variables from its parent process. It does not automatically load a
+`.env` file. For a local shell, export the variables first; for an MCP client, put them in the
+client's `env` configuration:
+
+```dotenv
+VIRA_API_URL=http://127.0.0.1:4185
+VIRA_API_KEY=vira_dev_local.local-development-only-32chars
+VIRA_MCP_AUTH_TOKEN=replace-with-a-long-random-mcp-token
+VIRA_ORGANIZATION_ID=local-org
+VIRA_PROJECT_ID=local-project
+VIRA_ENVIRONMENT_ID=local
+```
+
+For example, an MCP client configuration uses the same names:
+
+```json
+{"env":{"VIRA_API_URL":"https://api.example","VIRA_API_KEY":"<customer-api-key>","VIRA_MCP_AUTH_TOKEN":"<mcp-token>","VIRA_ORGANIZATION_ID":"<org>","VIRA_PROJECT_ID":"<project>","VIRA_ENVIRONMENT_ID":"<environment>"}}
+```
+
+The default launcher uses MCP stdio. To run the optional HTTP transport explicitly, use
+`npx @tryvira/mcp --http`; it binds to `127.0.0.1` by default and requires `Authorization: Bearer
+<VIRA_MCP_AUTH_TOKEN>`. Effectful MCP tools are denied by default. Local-only effectful
+execution requires the explicit `VIRA_MCP_ALLOW_EFFECTFUL=true` opt-in; production never
+accepts that shortcut. Set `VIRA_MCP_BIND_PUBLIC=true` only when an authenticated reverse
+proxy or equivalent network boundary is present.
+
+Effectful MCP tools remain authority-gated; the launcher does not create a second execution or telemetry path.
+
+## What a client can discover
+
+After `initialize`, call `tools/list`. Read-only tools such as `resolve_semantic` may return
+semantic candidates. Effectful tools such as `resolve_runtime`, pack installation/release
+and Strategy execution call the configured authority endpoint and can be denied by scope,
+role, release state or policy.
+
+## Minimal MCP client configuration
+
+```json
+{
+  "mcpServers": {
+    "vira": {
+      "command": "npx",
+      "args": ["-y", "@tryvira/mcp"],
+      "env": {
+        "VIRA_API_URL": "https://api.example.invalid",
+        "VIRA_API_KEY": "<customer-api-key>",
+        "VIRA_MCP_AUTH_TOKEN": "<mcp-auth-token>",
+        "VIRA_MCP_AUTHORITY_URL": "https://api.example.invalid/v1/mcp/authorize",
+        "VIRA_ORGANIZATION_ID": "<organization>",
+        "VIRA_PROJECT_ID": "<project>",
+        "VIRA_ENVIRONMENT_ID": "<environment>"
+      }
+    }
+  }
+}
+```
+
+Never paste real credentials into a checked-in client configuration. For local-only effectful
+testing, use the local stack and its documented development credentials; the production
+authority path does not accept the local bypass.
+
+See [`docs/MCP_GUIDE.md`](../../docs/MCP_GUIDE.md) for JSON-RPC discovery, tool examples and
+authority/error behavior.

package/dist/cli.js

@@ -14,7 +14,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// packages/domain/src/scope-composer.ts
+// ../domain/src/scope-composer.ts
 import { createHash } from "node:crypto";
 function canonical(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -30,13 +30,13 @@ function assertComposedScopeIntegrity(composed) {
 }
 var digest;
 var init_scope_composer = __esm({
-  "packages/domain/src/scope-composer.ts"() {
+  "../domain/src/scope-composer.ts"() {
     "use strict";
     digest = (value) => createHash("sha256").update(canonical(value)).digest("hex");
   }
 });
 
-// packages/runtime/src/mcp-gateway.ts
+// ../runtime/src/mcp-gateway.ts
 import { createHash as createHash2 } from "node:crypto";
 function canonicalMcpJson(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -143,13 +143,13 @@ async function invokeMcpTool(input) {
   return Object.freeze({ ...body, provenanceDigest: createHash2("sha256").update(canonicalMcpJson(body)).digest("hex") });
 }
 var init_mcp_gateway = __esm({
-  "packages/runtime/src/mcp-gateway.ts"() {
+  "../runtime/src/mcp-gateway.ts"() {
     "use strict";
     init_scope_composer();
   }
 });
 
-// packages/runtime/src/mcp-provenance.ts
+// ../runtime/src/mcp-provenance.ts
 import { createHash as createHash3 } from "node:crypto";
 function verifyMcpResult2(result) {
   const { provenanceDigest: stored, ...body } = result;
@@ -163,13 +163,13 @@ function createMcpResultFromResponse(input) {
   return Object.freeze({ ...body, provenanceDigest: createHash3("sha256").update(canonicalMcpJson(body)).digest("hex") });
 }
 var init_mcp_provenance = __esm({
-  "packages/runtime/src/mcp-provenance.ts"() {
+  "../runtime/src/mcp-provenance.ts"() {
     "use strict";
     init_mcp_gateway();
   }
 });
 
-// packages/runtime/src/mcp-session.ts
+// ../runtime/src/mcp-session.ts
 import { createHash as createHash4, randomUUID } from "node:crypto";
 function assertMcpSession(session) {
   const { sessionDigest, ...base } = session;
@@ -183,14 +183,14 @@ function assertMcpSessionActive(session) {
 }
 var canonical2, digest2;
 var init_mcp_session = __esm({
-  "packages/runtime/src/mcp-session.ts"() {
+  "../runtime/src/mcp-session.ts"() {
     "use strict";
     canonical2 = (value) => value === null || typeof value !== "object" ? JSON.stringify(value) : Array.isArray(value) ? `[${value.map(canonical2).join(",")}]` : `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical2(value[key])}`).join(",")}}`;
     digest2 = (value) => createHash4("sha256").update(canonical2(value)).digest("hex");
   }
 });
 
-// apps/mcp-server/server.ts
+// ../../apps/mcp-server/server.ts
 import {
   createServer
 } from "node:http";
@@ -555,7 +555,7 @@ function readBody(request, limit) {
 }
 var requestToken, claimInvocation;
 var init_server = __esm({
-  "apps/mcp-server/server.ts"() {
+  "../../apps/mcp-server/server.ts"() {
     "use strict";
     init_mcp_gateway();
     init_mcp_provenance();
@@ -576,7 +576,7 @@ var init_server = __esm({
   }
 });
 
-// packages/runtime/src/mcp-invocation-service.ts
+// ../runtime/src/mcp-invocation-service.ts
 import { createHash as createHash5 } from "node:crypto";
 function assertReplayIdentity(invocation, authority, result) {
   const argumentsDigest = createHash5("sha256").update(canonicalMcpJson(invocation.arguments)).digest("hex");
@@ -605,17 +605,17 @@ async function executeMcpInvocation(input) {
   }
 }
 var init_mcp_invocation_service = __esm({
-  "packages/runtime/src/mcp-invocation-service.ts"() {
+  "../runtime/src/mcp-invocation-service.ts"() {
     "use strict";
     init_mcp_gateway();
     init_mcp_gateway();
   }
 });
 
-// packages/database/src/mcp-provenance-repository.ts
+// ../database/src/mcp-provenance-repository.ts
 var assertClaimInput, McpProvenanceRepository, SqlMcpProvenanceRepository;
 var init_mcp_provenance_repository = __esm({
-  "packages/database/src/mcp-provenance-repository.ts"() {
+  "../database/src/mcp-provenance-repository.ts"() {
     "use strict";
     init_mcp_provenance();
     init_scope_composer();
@@ -819,7 +819,7 @@ var init_mcp_provenance_repository = __esm({
   }
 });
 
-// apps/mcp-server/vira-server.ts
+// ../../apps/mcp-server/vira-server.ts
 function resolveViraMcpConfig(environment = process.env) {
   const baseUrl = (environment.VIRA_API_URL ?? "http://127.0.0.1:4185").replace(/\/$/, "");
   const apiKey = environment.VIRA_API_KEY ?? (environment.NODE_ENV === "production" ? "" : "vira_dev_local.local-development-only-32chars");
@@ -928,6 +928,35 @@ function createViraMcpOptions(config) {
       const { proposalId, transition, ...body } = args;
       return api(`/v1/teach/proposals/${encodeURIComponent(String(proposalId))}/${encodeURIComponent(String(transition))}`, body, `mcp:${tool}:${String(proposalId)}`);
     }
+    if (tool === "create_evaluation_plan") return api("/v1/evaluation-plans", args, `mcp:${tool}:${String(args.id)}`);
+    if (tool === "seal_evaluation_plan") return api(`/v1/evaluation-plans/${encodeURIComponent(String(args.planId))}/seal`, {}, `mcp:${tool}:${String(args.planId)}`);
+    if (tool === "create_improvement_proposal") {
+      const { evaluationId, ...body } = args;
+      return api(`/v1/evaluations/${encodeURIComponent(String(evaluationId))}/improvement-proposal`, body, `mcp:${tool}:${String(evaluationId)}`);
+    }
+    if (tool === "review_improvement_proposal") {
+      const { proposalId, action, ...body } = args;
+      return api(`/v1/behavior-improvement-proposals/${encodeURIComponent(String(proposalId))}`, { action, ...body }, `mcp:${tool}:${String(proposalId)}`);
+    }
+    if (tool === "create_behavior_revision_candidate") return api("/v1/behavior-revision-candidates", args, `mcp:${tool}:${String(args.id)}`);
+    if (tool === "evaluate_behavior_revision_candidate") {
+      const { candidateId, ...body } = args;
+      return api(`/v1/behavior-revision-candidates/${encodeURIComponent(String(candidateId))}/evaluate`, body, `mcp:${tool}:${String(candidateId)}`);
+    }
+    if (tool === "accept_behavior_revision_candidate") {
+      const { candidateId, candidateEvaluationId } = args;
+      return api(`/v1/behavior-revision-candidates/${encodeURIComponent(String(candidateId))}/accept`, { candidateEvaluationId }, `mcp:${tool}:${String(candidateId)}`);
+    }
+    if (tool === "create_pack_revision") return api("/v1/pack-revisions", args, `mcp:${tool}:${String(args.id)}`);
+    if (tool === "transition_pack_revision") {
+      const { revisionId, transition, ...body } = args;
+      return api(`/v1/pack-revisions/${encodeURIComponent(String(revisionId))}/${encodeURIComponent(String(transition))}`, body, `mcp:${tool}:${String(revisionId)}`);
+    }
+    if (tool === "materialize_pack_revision") {
+      const { revisionId, ...body } = args;
+      return api(`/v1/pack-revisions/${encodeURIComponent(String(revisionId))}/materialize`, body, `mcp:${tool}:${String(revisionId)}`);
+    }
+    if (tool === "get_pack_revision_diff") return api(`/v1/pack-revisions/${encodeURIComponent(String(args.revisionId))}/diff?organizationId=${encodeURIComponent(config.scope.organizationId)}&projectId=${encodeURIComponent(config.scope.projectId)}&environmentId=${encodeURIComponent(config.scope.environmentId)}`, void 0, `mcp:${tool}:${String(args.revisionId)}`);
     if (tool === "create_release") return api("/v1/releases", args, `mcp:${tool}:${String(args.releaseId ?? args.artifactId)}`);
     return lifecycleTransport.call(input);
   } };
@@ -954,7 +983,7 @@ function createViraMcpOptions(config) {
 }
 var tools;
 var init_vira_server = __esm({
-  "apps/mcp-server/vira-server.ts"() {
+  "../../apps/mcp-server/vira-server.ts"() {
     "use strict";
     init_server();
     init_mcp_invocation_service();
@@ -996,6 +1025,17 @@ var init_vira_server = __esm({
       { name: "review_discovery_candidate", description: "Record a human review decision for a scoped discovery candidate.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, kind: { type: "string" }, key: { type: "string" }, decision: { type: "string" }, payload: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "kind", "key", "decision"] } },
       { name: "create_observation", description: "Submit one scoped observation for discovery; it does not publish behavior.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, content: { type: "object" }, consent: { type: "boolean" } }, required: ["organizationId", "projectId", "environmentId", "id", "content", "consent"] } },
       { name: "start_evaluation", description: "Start a local evaluation for an existing artifact.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, targetArtifact: { type: "string" }, dataset: { type: "array" }, assertions: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "id", "targetArtifact", "dataset", "assertions"] } },
+      { name: "create_evaluation_plan", description: "Create an immutable OFF/current-on evaluation plan for a scoped behavior target.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, suiteId: { type: "string" }, suiteVersion: { type: "string" }, suiteDigest: { type: "string" }, datasetSnapshotDigest: { type: "string" }, evaluationPolicyDigest: { type: "string" }, arms: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "id", "suiteId", "suiteVersion", "suiteDigest", "datasetSnapshotDigest", "evaluationPolicyDigest", "arms"] } },
+      { name: "seal_evaluation_plan", description: "Seal an evaluation plan so its suite, dataset, and execution arms cannot drift.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, planId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "planId"] } },
+      { name: "create_improvement_proposal", description: "Create a Teach improvement proposal from a completed comparative evaluation.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, evaluationId: { type: "string" }, id: { type: "string" }, basePackId: { type: "string" }, basePackDigest: { type: "string" }, behaviorSet: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "evaluationId", "id", "basePackId", "basePackDigest"] } },
+      { name: "review_improvement_proposal", description: "Review a Teach improvement proposal without mutating canonical runtime state.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, proposalId: { type: "string" }, action: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "proposalId", "action"] } },
+      { name: "create_behavior_revision_candidate", description: "Create an immutable behavior revision candidate from a reviewed Teach improvement proposal.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, sourceTeachProposalId: { type: "string" }, parentRevisionId: { type: "string" }, parentRevisionDigest: { type: "string" }, changeSet: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "id", "sourceTeachProposalId", "parentRevisionId", "parentRevisionDigest", "changeSet"] } },
+      { name: "evaluate_behavior_revision_candidate", description: "Evaluate a candidate using provider-backed dataset assertions; client scores are not accepted.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, candidateId: { type: "string" }, dataset: { type: "array" }, assertions: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "candidateId", "dataset"] } },
+      { name: "accept_behavior_revision_candidate", description: "Accept a candidate only when a passed evaluation is bound to its immutable digest.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, candidateId: { type: "string" }, candidateEvaluationId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "candidateId", "candidateEvaluationId"] } },
+      { name: "create_pack_revision", description: "Create a draft Pack Revision from an accepted behavior candidate.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, id: { type: "string" }, packKey: { type: "string" }, version: { type: "string" }, behaviorRevisionCandidateId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "id", "packKey", "version", "behaviorRevisionCandidateId"] } },
+      { name: "transition_pack_revision", description: "Validate, request approval, approve, or release a governed Pack Revision.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, revisionId: { type: "string" }, transition: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "revisionId", "transition"] } },
+      { name: "materialize_pack_revision", description: "Materialize an approved Pack Revision into canonical runtime state.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, revisionId: { type: "string" }, packId: { type: "string" }, variables: { type: "object" } }, required: ["organizationId", "projectId", "environmentId", "revisionId", "packId"] } },
+      { name: "get_pack_revision_diff", description: "Read the immutable lineage and change summary for a Pack Revision.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, revisionId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "revisionId"] } },
       { name: "compile_behavior_capsule", description: "Compile a persisted scoped Behavior VM capsule and return its receipt.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, programId: { type: "string" }, input: { type: "string" }, selection: { type: "object" }, candidates: { type: "array" } }, required: ["organizationId", "projectId", "environmentId", "programId", "input"] } },
       { name: "serve_behavior_projection", description: "Serve the active scoped behavior projection through the governed runtime boundary.", effectful: true, inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" }, programId: { type: "string" }, input: { type: "string" }, provider: { type: "string" }, protocol: { type: "string" } }, required: ["organizationId", "projectId", "environmentId", "input", "provider"] } },
       { name: "list_packs", description: "Read scoped behavior packs.", inputSchema: { type: "object", properties: { organizationId: { type: "string" }, projectId: { type: "string" }, environmentId: { type: "string" } }, required: ["organizationId", "projectId", "environmentId"] } },
@@ -1009,10 +1049,10 @@ var init_vira_server = __esm({
   }
 });
 
-// packages/database/src/mcp-session-repository.ts
+// ../database/src/mcp-session-repository.ts
 var SqlMcpSessionRepository;
 var init_mcp_session_repository = __esm({
-  "packages/database/src/mcp-session-repository.ts"() {
+  "../database/src/mcp-session-repository.ts"() {
     "use strict";
     init_mcp_session();
     SqlMcpSessionRepository = class {
@@ -1051,7 +1091,7 @@ var init_mcp_session_repository = __esm({
   }
 });
 
-// apps/mcp-server/official-stdio.ts
+// ../../apps/mcp-server/official-stdio.ts
 import { McpServer } from "@modelcontextprotocol/server";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { z } from "zod";
@@ -1068,16 +1108,16 @@ function serveOfficialViraMcp(options) {
       });
     }
     return server;
-  });
+  }, { legacy: "reject" });
 }
 var init_official_stdio = __esm({
-  "apps/mcp-server/official-stdio.ts"() {
+  "../../apps/mcp-server/official-stdio.ts"() {
     "use strict";
     init_mcp_gateway();
   }
 });
 
-// packages/database/src/postgres-adapter.ts
+// ../database/src/postgres-adapter.ts
 import { Pool } from "pg";
 function validateSql(sql) {
   if (!sql.trim()) throw new Error("POSTGRES_SQL_REQUIRED");
@@ -1119,12 +1159,12 @@ function createPostgresPool(input = {}) {
   return { pool, close: () => pool.end() };
 }
 var init_postgres_adapter = __esm({
-  "packages/database/src/postgres-adapter.ts"() {
+  "../database/src/postgres-adapter.ts"() {
     "use strict";
   }
 });
 
-// packages/database/src/postgres-migrations.ts
+// ../database/src/postgres-migrations.ts
 import { createHash as createHash6 } from "node:crypto";
 function splitSql(sql) {
   const statements = [];
@@ -1274,12 +1314,12 @@ async function applyPostgresMigrations(client, migrations) {
   }
 }
 var init_postgres_migrations = __esm({
-  "packages/database/src/postgres-migrations.ts"() {
+  "../database/src/postgres-migrations.ts"() {
     "use strict";
   }
 });
 
-// packages/database/src/postgres-runtime.ts
+// ../database/src/postgres-runtime.ts
 import { readFile, readdir } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -1289,13 +1329,24 @@ async function defaultMigrationPaths() {
   return entries.filter((entry) => entry.isFile() && /^\d+_.+\.sql$/i.test(entry.name)).map((entry) => resolve(migrationDirectory, entry.name)).sort((left, right) => left.localeCompare(right, "en"));
 }
 async function openPostgresRuntime(options = {}) {
-  const { pool, close } = createPostgresPool({ databaseUrl: options.databaseUrl, max: options.maxConnections, ssl: options.ssl });
+  const maxConnections = options.maxConnections ?? Number(process.env.VIRA_DB_POOL_MAX ?? 10);
+  const { pool, close } = createPostgresPool({ databaseUrl: options.databaseUrl, max: maxConnections, ssl: options.ssl });
   const database = createPostgresDatabase({ pool, databaseUrl: options.databaseUrl });
   try {
     if (!options.skipMigrations && process.env.VIRA_WORKER_SKIP_MIGRATIONS !== "true") {
       const migrations = [];
       const migrationPaths = options.migrationPaths ?? await defaultMigrationPaths();
-      for (const path of migrationPaths) migrations.push({ id: path.split(/[\\/]/).pop().replace(/\.sql$/i, ""), sql: await readFile(path, "utf8") });
+      for (const path of migrationPaths) {
+        const id = path.split(/[\\/]/).pop().replace(/\.sql$/i, "");
+        const migration = { id, sql: await readFile(path, "utf8") };
+        if (id === "001_vnext_foundation") {
+          migration.legacyChecksums = ["d1a175e1b8af20bcf9bc650fb299626513532e4d18da429569251eff69475427"];
+        }
+        if (id === "019_postgres_explicit_public_deny_policies") {
+          migration.legacyChecksums = ["162658a065737b36c0cedb6f1294d497074e69b5b744bbfe10e42363427c23a9"];
+        }
+        migrations.push(migration);
+      }
       const client = await pool.connect();
       try {
         await applyPostgresMigrations(client, migrations);
@@ -1311,7 +1362,7 @@ async function openPostgresRuntime(options = {}) {
 }
 var here;
 var init_postgres_runtime = __esm({
-  "packages/database/src/postgres-runtime.ts"() {
+  "../database/src/postgres-runtime.ts"() {
     "use strict";
     init_postgres_adapter();
     init_postgres_migrations();
@@ -1319,7 +1370,7 @@ var init_postgres_runtime = __esm({
   }
 });
 
-// packages/database/src/production-sqlite.ts
+// ../database/src/production-sqlite.ts
 import { access, readFile as readFile2, writeFile } from "node:fs/promises";
 import { existsSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname as dirname2, resolve as resolve2 } from "node:path";
@@ -1823,7 +1874,7 @@ async function openProductionSqlite({ databaseUrl = process.env.DATABASE_URL } =
 }
 var root, require2, migrationCandidates;
 var init_production_sqlite = __esm({
-  "packages/database/src/production-sqlite.ts"() {
+  "../database/src/production-sqlite.ts"() {
     "use strict";
     root = dirname2(fileURLToPath2(import.meta.url));
     require2 = createRequire(import.meta.url);
@@ -1834,7 +1885,7 @@ var init_production_sqlite = __esm({
   }
 });
 
-// packages/database/src/runtime-database.ts
+// ../database/src/runtime-database.ts
 var runtime_database_exports = {};
 __export(runtime_database_exports, {
   createProductionDatabase: () => createProductionDatabase,
@@ -1874,14 +1925,14 @@ async function openRuntimeDatabase(options = {}) {
   throw new Error("DATABASE_URL_UNSUPPORTED");
 }
 var init_runtime_database = __esm({
-  "packages/database/src/runtime-database.ts"() {
+  "../database/src/runtime-database.ts"() {
     "use strict";
     init_postgres_runtime();
     init_production_sqlite();
   }
 });
 
-// packages/database/src/postgres-mcp-repository.ts
+// ../database/src/postgres-mcp-repository.ts
 var postgres_mcp_repository_exports = {};
 __export(postgres_mcp_repository_exports, {
   PostgresMcpProvenanceRepository: () => PostgresMcpProvenanceRepository,
@@ -1889,7 +1940,7 @@ __export(postgres_mcp_repository_exports, {
 });
 var provenanceSelect, PostgresMcpProvenanceRepository, PostgresMcpSessionRepository;
 var init_postgres_mcp_repository = __esm({
-  "packages/database/src/postgres-mcp-repository.ts"() {
+  "../database/src/postgres-mcp-repository.ts"() {
     "use strict";
     init_mcp_provenance();
     init_mcp_session();
@@ -1965,7 +2016,7 @@ var init_postgres_mcp_repository = __esm({
   }
 });
 
-// apps/mcp-server/start.ts
+// ../../apps/mcp-server/start.ts
 var start_exports = {};
 __export(start_exports, {
   startMcpStdio: () => startMcpStdio
@@ -2011,7 +2062,7 @@ async function startMcpStdio() {
   process.once("SIGINT", close);
 }
 var init_start = __esm({
-  "apps/mcp-server/start.ts"() {
+  "../../apps/mcp-server/start.ts"() {
     "use strict";
     init_server();
     init_vira_server();
@@ -2023,7 +2074,7 @@ var init_start = __esm({
   }
 });
 
-// packages/mcp/src/cli.ts
+// src/cli.ts
 init_vira_server();
 if (process.argv.includes("--http") || process.env.VIRA_MCP_TRANSPORT === "http") {
   await startHttp();

package/dist/index.js

@@ -1,8 +1,8 @@
-// packages/runtime/src/mcp-gateway.ts
+// ../runtime/src/mcp-gateway.ts
 import { createHash as createHash2 } from "node:crypto";
 import { isIP } from "node:net";
 
-// packages/domain/src/scope-composer.ts
+// ../domain/src/scope-composer.ts
 import { createHash } from "node:crypto";
 function canonical(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -18,7 +18,7 @@ function assertComposedScopeIntegrity(composed) {
   return true;
 }
 
-// packages/runtime/src/mcp-gateway.ts
+// ../runtime/src/mcp-gateway.ts
 var MCP_PROTOCOL_VERSIONS = ["2026-07-28", "2025-11-25", "2025-03-26"];
 function negotiateMcpProtocolVersion(offered) {
   const value = String(offered ?? "");