ServerEndpointExtensions class

Extension methods for mapping Novior.MentorAgent.Server endpoints.

Namespace: Novior.MentorAgent.Server.Extensions. Package: Novior.MentorAgent.Server.

public static class ServerEndpointExtensions

dotnet add package Novior.MentorAgent.Server

public static IEndpointRouteBuilder MapMentorAgentServer(this IEndpointRouteBuilder endpoints, string hubPath = "/mentor-hub", string ssePath = "/mentor/chat", Action<IEndpointConventionBuilder>? configureTransports = null)

Maps all Novior.MentorAgent.Server endpoints:

• /mentor-hub — SignalR hub (Blazor WASM, MAUI, console .NET)
• GET /mentor/chat — SSE streaming (React, Vue, fetch API, curl)
• POST /mentor/chat — SSE streaming with image attachments (roadmap #13)
• POST /mentor/approve — human-in-the-loop approve/deny (roadmap #16)
• POST /mentor/cancel — stop the in-flight turn of a SignalR connection
• GET /mentor/session and POST /mentor/session — save and restore the conversation of a SignalR connection, as a protected snapshot bound to its owner
• GET /mentor/admin/metrics — token & cost snapshot, role-gated (roadmap #9)
• GET /mentor/tour — onboarding tour steps (roadmap #18)

MCP and A2A endpoints are mapped separately via MapMentorAgentMcp() and MapMentorAgentA2A(), also in this package.

app.MapMentorAgentServer();          // SignalR + SSE
app.MapMentorAgentMcp();             // optional MCP server
app.MapMentorAgentA2A();             // optional A2A agent

Parameters

• hubPath: SignalR hub path. Default: /mentor-hub
• ssePath: SSE endpoint path. Default: /mentor/chat
• configureTransports: Applied to the hub and both SSE endpoints — the three that run a turn. This is where a host requires authentication on them: app.MapMentorAgentServer(configureTransports: e => e.RequireAuthorization()); Optional, and omitting it changes nothing (BUG-060). But the default is worth understanding before leaving it: POST /mentor/chat runs a paid turn for an anonymous caller. With AnonymousIdentity = Shared every anonymous caller has the memory key "anonymous", so one user's remembered facts are injected into another's turns — fine for a single-user demo, a cross-user leak for anything else. With PerSession, the default, nothing is shared, but each request or connection is a new key: neither memory nor RateLimitPerUser follows a person.
• endpoints: The application's endpoint route builder.