@weave-kit/engine 0.1.0

package/dist/adapters/mcp/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/mcp/http.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAGxH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIhD,OAAO,EAAE,eAAe,EAAqB,MAAM,eAAe,CAAC;AAGnE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C;;;;;;;;;;;;GAYG;AAEH,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAA6C,EAAE,aAAiC;IACnG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAIF,CAAC;IACpB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,UAAkB,EAAE,aAAgD,EAAE,OAAiC,EAAE,EAAE;QAC3H,IAAI,OAAO,GAAG,aAAa,CAAC;QAC5B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,GAAG,OAA8C,CAAC;YACtD,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC;QACjE,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAa,CAAC;YAC/C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAa,CAAC,CAAC;IAC7D,CAAC,CAAyB,CAAC;AAC7B,CAAC;AA4BD,gFAAgF;AAChF,SAAS,eAAe,CACtB,UAAyB,EACzB,OAAmB,EACnB,IAAY,EACZ,IAAa;IAEb,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,iBAAiB,CAAC,KAAK;QAClC,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,IAAI,IAAI,EAAE;QAC7C,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,mBAAmB;QAC9B,IAAI,EAAE;YACJ,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YAC1B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YACzB,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE;YACnC,IAAI;SACL;QACD,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAiB;IACvE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC9F,MAAM,YAAY,GAAoB,IAAI,CAAC,YAAY,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,qGAAqG;IACrG,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACvD,SAAS,UAAU,CAAC,OAAmB;QACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,SAAS,WAAW,CAAC,SAAmC;QACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAC7B,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;gBAC/B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;aAChC,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,4EAA4E;gBAC5E,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;YAC/E,MAAM,MAAM,GAAkB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,EAAE,GAAG,CAAC,CAAC;YACxH,OAAO,MAAmC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,SAAS,aAAa,CAAC,QAAgB,EAAE,KAAmB;QAC1D,MAAM,KAAK,GAAiB,EAAkB,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,GAAW,EAAE,EAAE;gBACpC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;gBAC/B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtD,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAuB,EAAE,KAAmB;QAChE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,IAAI,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAe,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtG,sFAAsF;YACtF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YACjD,MAAM,MAAM,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YACxG,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,YAAY;gBACZ,IAAI;gBACJ,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5F,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,8EAA8E;QAC9E,oEAAoE;QACpE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,SAAS;YAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpE,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEzB,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/mcp/index.d.ts

@@ -0,0 +1,78 @@
+import type { FastifyInstance } from 'fastify';
+import type { Locale, RbacSubject, ToolDefinition } from '../../core/index.js';
+import type { AuditSink } from '../../core/audit/index.js';
+import type { AlertSink } from '../../core/provider/alerts/index.js';
+import type { IdentityResolver } from '../../core/provider/identity/index.js';
+import type { ToolExecutor } from '../../runtime/tools/index.js';
+import type { Authenticator } from '../auth/index.js';
+import { type RateLimitConfig } from './guardrails.js';
+import type { McpEngine } from './types.js';
+/**
+ * MCP adapter assembly. `registerMcp` wires the session store + guardrails +
+ * per-session transports onto a fastify app under `/mcp`. The assembly layer
+ * (createEngine) injects the real sinks: alerts from `infrastructure/alerts`,
+ * audit from the audit subsystem (or NOOP), identity from `mcp.identities`.
+ */
+export interface EngineMcpConfig {
+    /** default true: adapters.* undeclared = enabled */
+    enabled?: boolean;
+    /** HTTP path the endpoint is mounted on; defaults to `/mcp` */
+    endpoint?: string;
+    guardrails?: {
+        rateLimit?: RateLimitConfig;
+        /** alerts sink config (channel/url/...) — consumed by the assembly layer's createAlerts */
+        alerts?: {
+            channel?: 'console' | 'webhook' | 'slack';
+            url?: string;
+            headers?: Record<string, string>;
+            timeoutMs?: number;
+            webhookUrl?: string;
+            slackChannel?: string;
+            slackUsername?: string;
+        };
+    };
+    /**
+     * on-behalf-of identity source: a static directory (`ref → subject`) or a
+     * custom resolver. A resolver may be async and load the user (and their
+     * roles/team) from the customer's own database.
+     */
+    identities?: Record<string, RbacSubject> | IdentityResolver;
+}
+export interface McpRegisterDeps {
+    engine: McpEngine;
+    authenticator: Authenticator;
+    mcp: EngineMcpConfig | undefined;
+    locale: Locale;
+    audit?: AuditSink;
+    alerts?: AlertSink;
+    /** M10 custom tools (loaded definitions + protocol-agnostic executor) */
+    tools?: {
+        defs: ToolDefinition[];
+        executor: ToolExecutor;
+    };
+    /**
+     * CORS origin to allow on hijacked MCP responses (mirrors
+     * `adapters.rest.cors.origin`). The streamable-HTTP transport hijacks the
+     * reply, which bypasses the @fastify/cors onSend hook — so the header is
+     * written here for browser-based MCP clients.
+     */
+    corsOrigin?: string | string[] | boolean;
+}
+export interface McpServerHandle {
+    /** closes all transports/servers and clears the session store */
+    close(): Promise<void>;
+}
+/**
+ * Register the MCP endpoint on an existing fastify app. Sinks are injected:
+ * `audit` (buffered audit sink or NOOP), `alerts` (defaults to a console sink),
+ * identity (`mcp.identities`: static directory or a customer-provided resolver).
+ */
+export declare function registerMcp(app: FastifyInstance, deps: McpRegisterDeps): McpServerHandle;
+export { McpSessionStore } from './session.js';
+export type { McpSession, SessionInput } from './session.js';
+export { createGuardrails } from './guardrails.js';
+export type { RateLimitConfig, McpGuardrails } from './guardrails.js';
+export type { McpEngine, McpToolSpec, McpToolResult, JsonSchema } from './types.js';
+export { compileToolsFor } from './generate.js';
+export { registerMcpRoutes } from './http.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE;QACX,SAAS,CAAC,EAAE,eAAe,CAAC;QAC5B,2FAA2F;QAC3F,MAAM,CAAC,EAAE;YACP,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;YAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjC,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;SACxB,CAAC;KACH,CAAC;IACF;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,gBAAgB,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,yEAAyE;IACzE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3D;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,GAAG,eAAe,CAqCxF;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/adapters/mcp/index.js

@@ -0,0 +1,46 @@
+import { McpSessionStore } from './session.js';
+import { createGuardrails } from './guardrails.js';
+import { registerMcpRoutes } from './http.js';
+/**
+ * Register the MCP endpoint on an existing fastify app. Sinks are injected:
+ * `audit` (buffered audit sink or NOOP), `alerts` (defaults to a console sink),
+ * identity (`mcp.identities`: static directory or a customer-provided resolver).
+ */
+export function registerMcp(app, deps) {
+    const { engine, authenticator, mcp, locale, audit, alerts, tools, corsOrigin } = deps;
+    // default resolver over a static directory; a function identity source wins
+    const identityResolver = typeof mcp?.identities === 'function'
+        ? mcp.identities
+        : (ref) => {
+            const subject = (mcp?.identities ?? {});
+            return subject[ref] ?? null;
+        };
+    const guardrails = createGuardrails({
+        rateLimit: mcp?.guardrails?.rateLimit,
+        alerts,
+        audit,
+    });
+    const sessionStore = new McpSessionStore();
+    registerMcpRoutes(app, {
+        engine,
+        authenticator,
+        identityResolver,
+        guardrails,
+        sessionStore,
+        locale,
+        tools,
+        endpoint: mcp?.endpoint,
+        corsOrigin,
+    });
+    return {
+        async close() {
+            guardrails.dispose();
+            sessionStore.dispose();
+        },
+    };
+}
+export { McpSessionStore } from './session.js';
+export { createGuardrails } from './guardrails.js';
+export { compileToolsFor } from './generate.js';
+export { registerMcpRoutes } from './http.js';
+//# sourceMappingURL=index.js.map

package/dist/adapters/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/mcp/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAwB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AA2D9C;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAoB,EAAE,IAAqB;IACrE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEtF,4EAA4E;IAC5E,MAAM,gBAAgB,GACpB,OAAO,GAAG,EAAE,UAAU,KAAK,UAAU;QACnC,CAAC,CAAC,GAAG,CAAC,UAAU;QAChB,CAAC,CAAC,CAAC,GAAW,EAAE,EAAE;YACd,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAgC,CAAC;YACvE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9B,CAAC,CAAC;IAER,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS;QACrC,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3C,iBAAiB,CAAC,GAAG,EAAE;QACrB,MAAM;QACN,aAAa;QACb,gBAAgB;QAChB,UAAU;QACV,YAAY;QACZ,MAAM;QACN,KAAK;QACL,QAAQ,EAAE,GAAG,EAAE,QAAQ;QACvB,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,KAAK;YACT,UAAU,CAAC,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/adapters/mcp/introspection.d.ts

@@ -0,0 +1,4 @@
+import type { McpToolResult, ToolExecContext } from './types.js';
+export declare function listObjectsHandler(_args: Record<string, unknown>, ctx: ToolExecContext): Promise<McpToolResult>;
+export declare function describeObjectHandler(args: Record<string, unknown>, ctx: ToolExecContext): Promise<McpToolResult>;
+//# sourceMappingURL=introspection.d.ts.map

package/dist/adapters/mcp/introspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/introspection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAcjE,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAGrH;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAGvH"}

package/dist/adapters/mcp/introspection.js

@@ -0,0 +1,20 @@
+import { describeObject, listObjectDescriptors } from '../../core/object/describe.js';
+/**
+ * Introspection tools: `list_objects` (objects the identity can read) and
+ * `describe_object` (schema + the identity's effective permissions). Both are
+ * filtered by RBAC — excluded fields are stripped from the description. The
+ * logic is protocol-agnostic and shared with the REST metadata endpoints
+ * (`core/object/describe.js`); this file only binds it to the MCP text result.
+ */
+function textResult(text, isError = false) {
+    return { content: [{ type: 'text', text }], isError };
+}
+export async function listObjectsHandler(_args, ctx) {
+    const visible = listObjectDescriptors(ctx.engine.registry, ctx.session.user.roles);
+    return textResult(JSON.stringify({ objects: visible }));
+}
+export async function describeObjectHandler(args, ctx) {
+    const descriptor = describeObject(ctx.engine.registry, String(args.name ?? ''), ctx.session.user.roles, ctx.engine.locale);
+    return textResult(JSON.stringify(descriptor));
+}
+//# sourceMappingURL=introspection.js.map

package/dist/adapters/mcp/introspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.js","sourceRoot":"","sources":["../../../src/adapters/mcp/introspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAGtF;;;;;;GAMG;AAEH,SAAS,UAAU,CAAC,IAAY,EAAE,OAAO,GAAG,KAAK;IAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B,EAAE,GAAoB;IAC3F,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAA6B,EAAE,GAAoB;IAC7F,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3H,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/adapters/mcp/session.d.ts

@@ -0,0 +1,46 @@
+import type { RbacSubject } from '../../core/index.js';
+/**
+ * Session model for the MCP adapter. A session is established at the first
+ * `initialize` handshake: the agent's API-key subject is authenticated at the
+ * HTTP layer and the proxied user identity is bound from the
+ * `X-Weavekit-On-Behalf-Of` header. `tools/list` filters the tool surface by
+ * `user`, and `tools/call` enforces RBAC against `user` (double layer).
+ */
+export interface McpSession {
+    /** SDK transport session id (from the Mcp-Session-Id header) */
+    id: string;
+    /** the agent's API key */
+    agentKey: string;
+    /** agent subject from the Bearer key (authenticator.resolve) */
+    agentSubject: RbacSubject;
+    /** proxied user identity the agent acts on behalf of (RBAC decisions use this) */
+    user: RbacSubject;
+    /** the on-behalf-of reference this session was bound with */
+    onBehalfOf: string;
+    createdAt: Date;
+    lastActivity: Date;
+}
+export interface SessionInput {
+    agentKey: string;
+    agentSubject: RbacSubject;
+    user: RbacSubject;
+    onBehalfOf: string;
+}
+/** default TTL: sessions idle for this long are dropped lazily */
+export declare const SESSION_TTL_MS: number;
+/**
+ * In-memory session store keyed by SDK session id. TTL expiry is lazy: `get`
+ * drops the entry when the last activity is older than the TTL, so no timer is
+ * required. `dispose` clears everything (used by engine.close()).
+ */
+export declare class McpSessionStore {
+    private readonly sessions;
+    create(id: string, input: SessionInput, now?: Date): McpSession;
+    /** look up a session, refreshing `lastActivity`; undefined when unknown or expired */
+    get(id: string, now?: Date): McpSession | undefined;
+    delete(id: string): void;
+    /** all live sessions (used for shutdown cleanup) */
+    list(): McpSession[];
+    dispose(): void;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/adapters/mcp/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,YAAY,EAAE,WAAW,CAAC;IAC1B,kFAAkF;IAClF,IAAI,EAAE,WAAW,CAAC;IAClB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,WAAW,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,eAAO,MAAM,cAAc,QAAiB,CAAC;AAE7C;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAE1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,GAAE,IAAiB,GAAG,UAAU;IAW3E,sFAAsF;IACtF,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,UAAU,GAAG,SAAS;IAW/D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIxB,oDAAoD;IACpD,IAAI,IAAI,UAAU,EAAE;IAIpB,OAAO,IAAI,IAAI;CAGhB"}

package/dist/adapters/mcp/session.js

@@ -0,0 +1,43 @@
+/** default TTL: sessions idle for this long are dropped lazily */
+export const SESSION_TTL_MS = 30 * 60 * 1000;
+/**
+ * In-memory session store keyed by SDK session id. TTL expiry is lazy: `get`
+ * drops the entry when the last activity is older than the TTL, so no timer is
+ * required. `dispose` clears everything (used by engine.close()).
+ */
+export class McpSessionStore {
+    sessions = new Map();
+    create(id, input, now = new Date()) {
+        const session = {
+            id,
+            ...input,
+            createdAt: now,
+            lastActivity: now,
+        };
+        this.sessions.set(id, session);
+        return session;
+    }
+    /** look up a session, refreshing `lastActivity`; undefined when unknown or expired */
+    get(id, now = new Date()) {
+        const session = this.sessions.get(id);
+        if (session === undefined)
+            return undefined;
+        if (now.getTime() - session.lastActivity.getTime() > SESSION_TTL_MS) {
+            this.sessions.delete(id);
+            return undefined;
+        }
+        session.lastActivity = now;
+        return session;
+    }
+    delete(id) {
+        this.sessions.delete(id);
+    }
+    /** all live sessions (used for shutdown cleanup) */
+    list() {
+        return [...this.sessions.values()];
+    }
+    dispose() {
+        this.sessions.clear();
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/adapters/mcp/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/adapters/mcp/session.ts"],"names":[],"mappings":"AA+BA,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACT,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE1D,MAAM,CAAC,EAAU,EAAE,KAAmB,EAAE,MAAY,IAAI,IAAI,EAAE;QAC5D,MAAM,OAAO,GAAe;YAC1B,EAAE;YACF,GAAG,KAAK;YACR,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;SAClB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sFAAsF;IACtF,GAAG,CAAC,EAAU,EAAE,MAAY,IAAI,IAAI,EAAE;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;YACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,EAAU;QACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,oDAAoD;IACpD,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/adapters/mcp/tools.d.ts

@@ -0,0 +1,8 @@
+import type { ObjectDefinition } from '../../core/index.js';
+import type { McpToolResult, ToolExecContext } from './types.js';
+export declare function searchHandler(def: ObjectDefinition, args: Record<string, unknown>, ctx: ToolExecContext): Promise<McpToolResult>;
+export declare function getHandler(def: ObjectDefinition, args: Record<string, unknown>, ctx: ToolExecContext): Promise<McpToolResult>;
+export declare function createHandler(def: ObjectDefinition, args: Record<string, unknown>, ctx: ToolExecContext): Promise<McpToolResult>;
+export declare function updateHandler(def: ObjectDefinition, args: Record<string, unknown>, ctx: ToolExecContext): Promise<McpToolResult>;
+export declare function deleteHandler(def: ObjectDefinition, args: Record<string, unknown>, ctx: ToolExecContext): Promise<McpToolResult>;
+//# sourceMappingURL=tools.d.ts.map

package/dist/adapters/mcp/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAe,MAAM,qBAAqB,CAAC;AAOzE,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA2HjE,wBAAsB,aAAa,CACjC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,aAAa,CAAC,CAUxB;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,aAAa,CAAC,CAOxB"}

package/dist/adapters/mcp/tools.js

@@ -0,0 +1,149 @@
+import { SchemaError, primaryKeyOf } from '../../core/index.js';
+import { SORT_DIRS, resolvePagination } from '../../runtime/data-access/index.js';
+import { ACTION_PREFIXES, AUDIT_ACTOR_TYPES } from '../../core/audit/index.js';
+/** the tool argument name carrying the primary key (mirrors the generated schema) */
+function pkArg(def) {
+    return primaryKeyOf(def) ?? 'id';
+}
+/**
+ * Tool execution handlers. Every call:
+ *  - resolves the effective subject (session.user, or the on-behalf-of override)
+ *  - runs through the RBAC-decorated data-access layer (double layer — the tool
+ *    *surface* was already filtered by RBAC at compile time)
+ *  - audits the attempt (success or failure) through the injected sink
+ *  - maps SchemaError → `isError` result with a localized message
+ */
+const ON_BEHALF_OF = 'onBehalfOf';
+function ctxWithSubject(ctx, subject) {
+    return { pool: ctx.engine.pool, registry: ctx.engine.registry, subject, locale: ctx.engine.locale };
+}
+/** call-level `onBehalfOf` override: resolve a different identity for this call */
+async function effectiveSubject(args, ctx) {
+    const override = args[ON_BEHALF_OF];
+    if (override === undefined)
+        return ctx.session.user;
+    const resolved = await ctx.resolveIdentity(String(override));
+    if (resolved === null) {
+        throw new SchemaError('mcp.identity.unknown', { ref: String(override) }, ctx.engine.locale);
+    }
+    return resolved;
+}
+/** audit one tool attempt (fire-and-forget, failure-tolerant) */
+function auditToolCall(ctx, tool, objectName, subject, args, isError, errorCode, errorDetail) {
+    const { agentKey, agentSubject, onBehalfOf } = ctx.session;
+    const changes = { ...args };
+    delete changes[ON_BEHALF_OF];
+    const event = {
+        actorType: AUDIT_ACTOR_TYPES.AGENT,
+        actorId: agentKey,
+        action: `${ACTION_PREFIXES.MCP_TOOL}.${tool}`,
+        objectName,
+        changes,
+        isError,
+        errorCode,
+        meta: {
+            onBehalfOf,
+            subjectId: subject.id,
+            roles: subject.roles,
+            agentLabel: agentSubject.id,
+            tool,
+            // raw failure detail for internal forensics only — never returned to the caller
+            ...(errorDetail !== undefined ? { errorDetail } : {}),
+        },
+        timestamp: new Date(),
+    };
+    void ctx.guardrails.audit(event);
+}
+function textResult(text, isError = false) {
+    return { content: [{ type: 'text', text }], isError };
+}
+function errorResult(error, ctx) {
+    if (error instanceof SchemaError) {
+        return textResult(error.localize(ctx.engine.locale), true);
+    }
+    // non-SchemaError (e.g. a raw driver/SQL error) must not leak internals to
+    // the caller — return a generic message; the real detail stays in the audit
+    // event (meta.errorDetail).
+    return textResult(new SchemaError('http.internal', {}, ctx.engine.locale).message, true);
+}
+async function callProtected(ctx, tool, objectName, args, subject, run) {
+    if (!ctx.guardrails.checkRateLimit(ctx.session.agentKey)) {
+        const msg = new SchemaError('mcp.rateLimited', {}, ctx.engine.locale);
+        auditToolCall(ctx, tool, objectName, subject, args, true, msg.code);
+        return errorResult(msg, ctx);
+    }
+    try {
+        const result = await run();
+        auditToolCall(ctx, tool, objectName, subject, args, false, undefined);
+        return result;
+    }
+    catch (error) {
+        const code = error instanceof SchemaError ? error.code : undefined;
+        const detail = error instanceof SchemaError ? undefined : (error instanceof Error ? error.message : String(error));
+        auditToolCall(ctx, tool, objectName, subject, args, true, code, detail);
+        return errorResult(error, ctx);
+    }
+}
+function toFindOptions(args) {
+    const options = {};
+    if (args.filter !== undefined && typeof args.filter === 'object')
+        options.filter = args.filter;
+    if (typeof args.limit === 'number')
+        options.limit = args.limit;
+    if (typeof args.offset === 'number')
+        options.offset = args.offset;
+    if (Array.isArray(args.fields))
+        options.fields = args.fields;
+    if (Array.isArray(args.sort)) {
+        options.sort = args.sort.map((s) => ({
+            field: s.field,
+            dir: s.direction === 'desc' ? SORT_DIRS.DESC : SORT_DIRS.ASC,
+        }));
+    }
+    return options;
+}
+export async function searchHandler(def, args, ctx) {
+    const subject = await effectiveSubject(args, ctx);
+    return callProtected(ctx, `search_${def.name}`, def.name, args, subject, async () => {
+        const { rows, total } = await ctx.engine.dataAccess.find(def.name, toFindOptions(args), ctxWithSubject(ctx, subject));
+        const { limit, offset } = resolvePagination(toFindOptions(args));
+        return textResult(JSON.stringify({ rows, total, limit, offset }));
+    });
+}
+export async function getHandler(def, args, ctx) {
+    const subject = await effectiveSubject(args, ctx);
+    return callProtected(ctx, `get_${def.name}`, def.name, args, subject, async () => {
+        const id = String(args[pkArg(def)] ?? '');
+        const record = await ctx.engine.dataAccess.findOne(def.name, id, ctxWithSubject(ctx, subject));
+        if (record === null) {
+            throw new SchemaError('data.recordNotFound', { object: def.name, id }, ctx.engine.locale);
+        }
+        return textResult(JSON.stringify(record));
+    });
+}
+export async function createHandler(def, args, ctx) {
+    const subject = await effectiveSubject(args, ctx);
+    return callProtected(ctx, `create_${def.name}`, def.name, args, subject, async () => {
+        const data = (args.data ?? {});
+        const record = await ctx.engine.dataAccess.create(def.name, data, ctxWithSubject(ctx, subject));
+        return textResult(JSON.stringify(record));
+    });
+}
+export async function updateHandler(def, args, ctx) {
+    const subject = await effectiveSubject(args, ctx);
+    return callProtected(ctx, `update_${def.name}`, def.name, args, subject, async () => {
+        const id = String(args[pkArg(def)] ?? '');
+        const changes = (args.changes ?? {});
+        const record = await ctx.engine.dataAccess.update(def.name, id, changes, ctxWithSubject(ctx, subject));
+        return textResult(JSON.stringify(record));
+    });
+}
+export async function deleteHandler(def, args, ctx) {
+    const subject = await effectiveSubject(args, ctx);
+    return callProtected(ctx, `delete_${def.name}`, def.name, args, subject, async () => {
+        const id = String(args[pkArg(def)] ?? '');
+        await ctx.engine.dataAccess.delete(def.name, id, ctxWithSubject(ctx, subject));
+        return textResult(JSON.stringify({ ok: true, id }));
+    });
+}
+//# sourceMappingURL=tools.js.map

package/dist/adapters/mcp/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/adapters/mcp/tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGhE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAElF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG/E,qFAAqF;AACrF,SAAS,KAAK,CAAC,GAAqB;IAClC,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AAEH,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,SAAS,cAAc,CAAC,GAAoB,EAAE,OAAoB;IAChE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AACtG,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,gBAAgB,CAAC,IAA6B,EAAE,GAAoB;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iEAAiE;AACjE,SAAS,aAAa,CACpB,GAAoB,EACpB,IAAY,EACZ,UAA8B,EAC9B,OAAoB,EACpB,IAA6B,EAC7B,OAAgB,EAChB,SAA6B,EAC7B,WAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IAC3D,MAAM,OAAO,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACrD,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,iBAAiB,CAAC,KAAK;QAClC,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,IAAI,IAAI,EAAE;QAC7C,UAAU;QACV,OAAO;QACP,OAAO;QACP,SAAS;QACT,IAAI,EAAE;YACJ,UAAU;YACV,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,YAAY,CAAC,EAAE;YAC3B,IAAI;YACJ,gFAAgF;YAChF,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,KAAK,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAAO,GAAG,KAAK;IAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,GAAoB;IACvD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,4BAA4B;IAC5B,OAAO,UAAU,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,IAAY,EACZ,UAA8B,EAC9B,IAA6B,EAC7B,OAAoB,EACpB,GAAiC;IAEjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,iBAAiB,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtE,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,MAAM,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACnH,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAA+B,CAAC;IACxH,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC/D,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAkB,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAI,IAAI,CAAC,IAAqD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,EAAE,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAqB,EACrB,IAA6B,EAC7B,GAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACtH,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAqB,EACrB,IAA6B,EAC7B,GAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/F,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAqB,EACrB,IAA6B,EAC7B,GAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAChG,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAqB,EACrB,IAA6B,EAC7B,GAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACvG,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAqB,EACrB,IAA6B,EAC7B,GAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/E,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/mcp/types.d.ts

@@ -0,0 +1,46 @@
+import type { Pool } from 'pg';
+import type { Locale, ObjectRegistry, ToolJsonSchema } from '../../core/index.js';
+import type { ObjectDataAccess } from '../../runtime/data-access/index.js';
+import type { McpSession } from './session.js';
+import type { McpGuardrails } from './guardrails.js';
+import type { IdentityResolver } from '../../core/provider/identity/index.js';
+/**
+ * Shared types for the MCP adapter (`src/adapters/mcp`). The adapter depends on
+ * core contracts + the data-access type contract only; infrastructure/subsystem
+ * implementations are injected by the assembly layer (createEngine).
+ */
+/** minimal JSON Schema subset the tool surface needs — shared with core/tools (single source) */
+export type { ToolJsonSchema as JsonSchema } from '../../core/index.js';
+/** the engine surface MCP tools operate through (data-access + registry + pool) */
+export interface McpEngine {
+    registry: ObjectRegistry;
+    pool: Pool;
+    dataAccess: ObjectDataAccess;
+    locale: Locale;
+}
+/** everything one tool-call handler needs at execution time */
+export interface ToolExecContext {
+    engine: McpEngine;
+    session: McpSession;
+    guardrails: McpGuardrails;
+    resolveIdentity: IdentityResolver;
+}
+/** a compiled MCP tool (per-session; the surface is filtered by RBAC) */
+export interface McpToolSpec {
+    name: string;
+    description: string;
+    inputSchema: ToolJsonSchema;
+    handler(args: Record<string, unknown>, ctx: ToolExecContext): Promise<McpToolResult>;
+}
+/** the tool-call result envelope exposed to generate/tools/http */
+export interface McpToolResult {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}
+/** tool name prefixes / introspection names — single source in core/tools (M10a) */
+export { INTROSPECTION_TOOLS, TOOL_PREFIXES } from '../../core/index.js';
+export type { ToolPrefix } from '../../core/index.js';
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/mcp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;GAIG;AAEH,iGAAiG;AACjG,YAAY,EAAE,cAAc,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAExE,mFAAmF;AACnF,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,gBAAgB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,aAAa,CAAC;IAC1B,eAAe,EAAE,gBAAgB,CAAC;CACnC;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,cAAc,CAAC;IAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACtF;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,oFAAoF;AACpF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/adapters/mcp/types.js

@@ -0,0 +1,3 @@
+/** tool name prefixes / introspection names — single source in core/tools (M10a) */
+export { INTROSPECTION_TOOLS, TOOL_PREFIXES } from '../../core/index.js';
+//# sourceMappingURL=types.js.map

package/dist/adapters/mcp/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/adapters/mcp/types.ts"],"names":[],"mappings":"AA8CA,oFAAoF;AACpF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/adapters/ops/index.d.ts

@@ -0,0 +1,20 @@
+import type { FastifyInstance } from 'fastify';
+import type { Pool } from 'pg';
+/**
+ * Operational routes, registered unconditionally (independent of any adapter
+ * toggle) so the deployment can always probe the process:
+ *
+ * - `GET /health` — liveness: the process is up (never touches the database).
+ * - `GET /ready`  — readiness: the engine can serve traffic (checks PostgreSQL).
+ * - `GET /version` — build identity for troubleshooting / compatibility checks.
+ */
+export interface OpsDeps {
+    pool: Pool;
+    version: string;
+}
+export interface OpsResult {
+    status: 'ok' | 'error';
+    db?: 'up' | 'down';
+}
+export declare function registerOpsRoutes(app: FastifyInstance, deps: OpsDeps): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/ops/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/ops/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B;;;;;;;GAOG;AAEH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;CACpB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAoB3E"}

package/dist/adapters/ops/index.js

@@ -0,0 +1,20 @@
+export function registerOpsRoutes(app, deps) {
+    const { pool, version } = deps;
+    app.get('/health', async () => {
+        return { status: 'ok' };
+    });
+    app.get('/ready', async (_request, reply) => {
+        try {
+            await pool.query('SELECT 1');
+            return { status: 'ok', db: 'up' };
+        }
+        catch {
+            reply.status(503);
+            return { status: 'error', db: 'down' };
+        }
+    });
+    app.get('/version', async () => {
+        return { name: 'weavekit', version };
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/adapters/ops/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/ops/index.ts"],"names":[],"mappings":"AAsBA,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAa;IACnE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE/B,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAsB,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAmB,EAAsB,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;QAC7B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/approvals.d.ts

@@ -0,0 +1,15 @@
+import type { FastifyInstance } from 'fastify';
+import type { RestDeps, RestOptions } from './plugin.js';
+/**
+ * Approval queue routes (D1 depth-1 read + local write; MCP tools deferred):
+ *   GET  {prefix}/approvals — paged list with status/action/actorKey/time filters
+ *   POST {prefix}/approvals/:key/approve — resolve a pending entry (admin)
+ *   POST {prefix}/approvals/:key/reject — resolve a pending entry (admin)
+ *
+ * Reads and writes are gated to `adminRoles` (the queue carries request args —
+ * a write authority boundary). Approver id comes from the authenticated subject;
+ * resolution is audited (A7) by the queue facade. Cross-instance remote
+ * approve/reject (depth 2) is not implemented.
+ */
+export declare function registerApprovalsRoutes(app: FastifyInstance, deps: RestDeps, options?: RestOptions): void;
+//# sourceMappingURL=approvals.d.ts.map

package/dist/adapters/rest/approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAI/D,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAqCzD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,WAAgB,GAAG,IAAI,CA2C7G"}