@absolutejs/mcp 0.11.0 → 0.11.2

package/README.md

@@ -21,6 +21,12 @@ action request; allowed calls execute through a short-lived single-use lease and
 produce a receipt. Requestable denials return an `absolute.action_decision`
 payload containing the action id for an approval workflow.
 
+Agency is a required host peer (`>=0.7.1 <0.8.0`) and is externalized from the
+MCP build. This guarantees that every transport uses the host's one action
+ledger instead of embedding a private enforcement runtime. The package tests
+against exactly `0.7.1`; a new Agency minor requires an explicit compatibility
+release.
+
 ```ts
 import { createAgency, createMemoryAgencyStore } from "@absolutejs/agency";
 

package/dist/index.js

@@ -644,24 +644,8 @@ var createMcpOAuthProvider = (options) => {
     }
   };
 };
-// node_modules/@absolutejs/agency/dist/authzen.js
-var createCoazActionInput = ({
-  actor,
-  call,
-  effects = ["read"],
-  requiredScopes = []
-}) => ({
-  action: "call_tool",
-  actor,
-  context: { required_scopes: requiredScopes, source: "mcp" },
-  effects,
-  input: call.arguments,
-  resource: {
-    id: call.name,
-    properties: { server_id: call.serverId },
-    type: "mcp_tool"
-  }
-});
+// src/dispatch.ts
+import { createCoazActionInput } from "@absolutejs/agency/authzen";
 
 // src/jsonrpc.ts
 var JSONRPC_PARSE_ERROR = -32700;
@@ -907,7 +891,8 @@ var runTool = async (config, caller, scopes, id, name, args, meta, tool, context
       });
       const amount = tool.authorization.spend ? valueAtPath(args, tool.authorization.spend.amountMinorField) : undefined;
       const currency = tool.authorization.spend ? valueAtPath(args, tool.authorization.spend.currencyField) : undefined;
-      const idempotencyKey = tool.authorization.idempotencyKeyField ? valueAtPath(args, tool.authorization.idempotencyKeyField) : undefined;
+      const idempotencyBinding = tool.authorization.idempotency;
+      const idempotencyKey = idempotencyBinding?.mode === "field" ? valueAtPath(args, idempotencyBinding.field) : undefined;
       const requested = await agency.enforcement.request({
         ...actionInput,
         context: {