Add @stratus/mcp-aws — MCP server framework for AWS (#1)

* Add @stratus/mcp-aws — MCP server framework for AWS

Convert to Bun workspaces monorepo and add @stratus/mcp-aws (v0.1.0),
a TypeScript library for building, deploying, and managing MCP servers
on AWS.

**Monorepo conversion:**
- Move stratus-sdk into packages/stratus-sdk/ (renames preserved)
- Root package.json with workspaces config
- Shared tsconfig.base.json, biome stays at root
- Hoisted devDeps (biome, typescript, @types/bun)

**@stratus/mcp-aws features (M1+M2+M3 of PRD):**
- McpServer with Vercel-level DX: `new McpServer("name@1.0")`
- Tool registration: 3 overloads, auto-coerced returns (string/object/array)
- Progressive disclosure: always/discoverable/hidden tiers, BM25 search,
  tools/list_changed notifications, session-scoped visibility
- Tool gating: role(), requires(), check(), rateLimit(), all(), any()
  with structured denial errors and prerequisite workflow enforcement
- Code mode: execute_workflow meta-tool, WorkerExecutor isolation,
  gate pre-validation, code-first disclosure mode
- Auth: apiKey(), cognito() factories, chainable, AsyncLocalStorage context
- Deploy: server.deploy() → Lambda + Function URL + IAM in ~20s
  with VPC, AWS_IAM, and private-only security modes
- Transports: server.lambda(), server.express(), server.bun(), server.stdio()
- Sessions: MemorySessionStore, DynamoSessionStore, SqliteSessionStore
- Observability: typed events (tool:call, tool:result, gate:denied, etc.)
- Security: SSRF protection, RFC 9728 OAuth metadata, WWW-Authenticate
- Composition: codeMcpServer(), createMcpHandler()

**Tests:** 258 local tests (<1s), plus AWS integration tests that deploy
real Lambda functions and verify resources via AWS CLI.

**Tested end-to-end:** Stratus agent → Azure OpenAI → deployed MCP server
on Lambda → tool execution → response back to agent.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix all 7 Copilot review comments

1. normalizeToolResult: remove Promise from param type (callers always await)
2. SSRF: tighten /^fd/i to /^fd[0-9a-f]{2}:/i (was matching fdic.gov)
3. createMcpHandler: accept factory function, create fresh server per request
4. Bun transport test: randomize ports to avoid CI flakes
5. Rename stdio-roundtrip.test.ts → mcp-protocol-roundtrip.test.ts
6. Async gates default to deny (was conservatively promoting — security fix)
7. codeMcpServer: detect sanitizeToolName collisions, throw on conflict

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix DynamoDB serialization crash + add full AWS E2E test

- Fix: DynamoDB session store crashed on AbortSignal in toolCallHistory
  params. Added safeClone() to strip non-serializable values before
  DynamoDB put.
- Fix: Lambda handler now saves session AFTER request processing so
  promoted tools and gate unlocks persist across requests.
- Fix: Bun.serve() uses globalThis.Bun to avoid crash when bundled
  for Node.js Lambda.
- Add: deploy config `policies` option for additional IAM policies
  (needed for DynamoDB access).
- Add: Full AWS E2E test (17 tests) covering auth, progressive
  disclosure, gate denial, code mode, DynamoDB session persistence,
  and basic tool calls — all on real deployed Lambda.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tylergibbs1

.gitignore

@@ -5,5 +5,5 @@ dist/
 .DS_Store
 *.log
 .breadcrumbs.json
-examples/test-models.json
-examples/test-todo.ts
+**/test-models.json
+**/test-todo.ts

README.md

@@ -522,10 +522,20 @@ try {
 }
 ```
 
+## Packages
+
+Stratus is a monorepo with two packages:
+
+| Package | Description |
+|---|---|
+| [`stratus-sdk`](packages/stratus-sdk/) | Agent SDK for Azure OpenAI (this README) |
+| [`@stratus/mcp-aws`](packages/mcp-aws/) | MCP server framework for AWS — deploy MCP servers to Lambda with progressive disclosure, tool gating, and code mode |
+
 ## Development
 
 ```bash
-bun test          # Run tests
+bun install       # Install all workspace dependencies
+bun test          # Run tests (all packages)
 bun run lint      # Lint with Biome
 bun run typecheck # TypeScript type checking
 ```

bun.lock

@@ -1,39 +1,15 @@
 {
-  "name": "stratus-sdk",
-  "version": "0.11.0",
-  "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./core": {
-      "types": "./dist/core/index.d.ts",
-      "import": "./dist/core/index.js"
-    },
-    "./azure": {
-      "types": "./dist/azure/index.d.ts",
-      "import": "./dist/azure/index.js"
-    }
-  },
-  "keywords": ["azure", "openai", "agent", "ai", "llm", "typescript", "tools", "streaming"],
-  "files": ["dist", "README.md"],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "lint": "biome check .",
-    "lint:fix": "biome check --write .",
-    "test": "bun test"
-  },
-  "peerDependencies": {
-    "zod": "^4.0.0"
-  },
-  "devDependencies": {
-    "@biomejs/biome": "^1.9.0",
-    "@types/bun": "^1.3.9",
-    "typescript": "^5.6.0",
-    "zod": "^4.0.0"
-  }
+	"private": true,
+	"workspaces": ["packages/*"],
+	"scripts": {
+		"lint": "biome check .",
+		"lint:fix": "biome check --write .",
+		"test": "bun run --filter '*' test",
+		"build": "bun run --filter '*' build"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^1.9.0",
+		"@types/bun": "^1.3.9",
+		"typescript": "^5.6.0"
+	}
 }