NewHeap.Platform.AI.AspNet.Common 7.9.0

NewHeap.Platform.AI.AspNet.Common

ASP.NET Core integration for NewHeap.Platform.AI.Common. It contributes an authenticated actor's active division and narrow capability grants only after configured IAuthorizationService policies succeed. The browser-supplied active division header is never treated as authorization by itself.

OIDC/JWT hosts that disable inbound claim mapping configure UseAuthenticatedClaims with one exact issuer or a collection of NhAiAspNetIssuerClaimMapping entries. Every accepted issuer owns its iss, sub, tenant and tenant-scope mapping. AddClaimScope remains global by default and has an issuer-specific overload when claim types differ between authorities. INhAiAuthenticatedInvocationContextResolver rejects missing or duplicate authority claims, principals carrying authority claims for more than one issuer, and issuers outside the configured set. The typed NhAiAspNetFailureCodes.IssuerNotAccepted result retains its existing wire value for compatible HTTP failure mapping. The invocation context keeps issuer, subject, tenant, and a collision-resistant issuer-qualified actor ID separate.

ASP.NET MCP hosts call WithNewHeapPlatformAITools() on the official IMcpServerBuilder. List and call requests resolve this authenticated context per request, use the generated catalog for both discovery and invocation, and return authorization failures as structured MCP tool errors. Startup rejects SDK registrations identified as NewHeap tools and wire-name collisions, while independently governed tools from other libraries may use WithTools, assembly scanning, or manual McpServerTool registration.

The integration adds bounded IDs and correlation metadata to the provider-neutral invocation context. It does not copy a ClaimsPrincipal, token, cookie, request body, prompt, or credential into that context.

INhAiBackgroundOperationRunAdapter maps a durable operation ID, attempt, idempotency key and fencing token into a non-human AI invocation. It persists only versioned checkpoint references, delegates approval waits to the general background-operation suspension contract, and leaves authoritative artifacts and conversation content application-owned.

INhAiBackgroundOperationIngestionAdapter binds ingestion to that durable run, uses the operation idempotency key, and stores a content-free completion checkpoint. Re-entry returns the checkpointed result without re-reading the source or generating embeddings again; a mismatched document or collection fails closed.