@dforge-core/dforge-mcp 0.2.32 → 0.2.33

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@dforge-core/dforge-mcp`. This project uses semver-ish
 `0.1.0-rc.N` pre-release tags; the published version is set at publish time via
 the release workflow, so committed `package.json` versions are placeholders.
 
+## Unreleased
+
+**`isView` / `viewSql` are gone** (dForge-core#1312). SQL-view entities were in the
+entity schema and the references but never built: the entity installed as an empty table,
+and passed `dforge_module_validate` on the way. They are now rejected, and will not be built.
+
+- `dforge://schema/entity` drops both keys, so an editor flags them. Re-vendored from
+  `@dforge-core/metadata` — needs the metadata release that carries the change.
+- `dforge_module_validate` reports them through the CLI's static checks — needs the CLI
+  release that carries `ViewEntityValidator`.
+- The references say why, and what to use instead: a data view, a `G` total, the Query
+  Builder, or a stored-procedure report.
+
 ## 0.2.32
 
 **`auditHistory` levels in the vendored schemas were wrong.** The

package/dist/server.js

@@ -31002,7 +31002,7 @@ var import_node_crypto = require("crypto");
 var fs2 = __toESM(require("fs"));
 var path2 = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+dforge-cli@0.2.25/node_modules/@dforge-core/dforge-cli/dist/lib.mjs
+// node_modules/.pnpm/@dforge-core+dforge-cli@0.2.26/node_modules/@dforge-core/dforge-cli/dist/lib.mjs
 function buildManifest(opts, moduleId) {
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const manifest = {
@@ -31285,7 +31285,7 @@ function buildZedTasks() {
 var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+metadata@0.0.32/node_modules/@dforge-core/metadata/dist/index.js
+// node_modules/.pnpm/@dforge-core+metadata@0.0.33/node_modules/@dforge-core/metadata/dist/index.js
 var AggType = {
   Sum: "sum",
   Count: "count",
@@ -34597,7 +34597,7 @@ var path10 = __toESM(require("path"));
 var fs7 = __toESM(require("fs"));
 var path9 = __toESM(require("path"));
 
-// node_modules/.pnpm/@dforge-core+metadata@0.0.32/node_modules/@dforge-core/metadata/dist/dsl/index.js
+// node_modules/.pnpm/@dforge-core+metadata@0.0.33/node_modules/@dforge-core/metadata/dist/dsl/index.js
 var PUNCT3 = ["===", "!=="];
 var PUNCT2 = [
   "==",

package/package.json

@@ -1,49 +1,47 @@
 {
-	"name": "@dforge-core/dforge-mcp",
-	"version": "0.2.32",
-	"description": "MCP server for dForge module authoring. Exposes 35 scaffold/patch/validate/pack/install tools and schema resources so AI agents (Claude Code, Cursor, Zed) can create and ship dForge modules.",
-	"license": "MIT",
-	"homepage": "https://github.com/iash44/dForge-core",
-	"packageManager": "pnpm@11.22.0+sha512.1ff870c4c6133dfd88fb2afc46dd13d47f09c9794b438c6fdb47ca98caf3bc16381ee0be93a091b8e3824cf01f889f46d7d9e20910fb0be1ab0fb5baa80dd621",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/dforge-core/dforge-mcp.git"
-	},
-	"bin": {
-		"dforge-mcp": "dist/server.js",
-		"dforge-install-skills": "scripts/install-skills.mjs"
-	},
-	"files": [
-		"dist/",
-		"docs/",
-		"resources/",
-		"skills/",
-		"scripts/install-skills.mjs",
-		"README.md",
-		"CHANGELOG.md"
-	],
-	"main": "dist/server.js",
-	"engines": {
-		"node": ">=18"
-	},
-	"scripts": {
-		"build": "tsup",
-		"sync-schemas": "node scripts/vendor-schemas.cjs",
-		"prepublishOnly": "node scripts/vendor-schemas.cjs && tsup",
-		"typecheck": "tsc --noEmit",
-		"test": "vitest run",
-		"install-skills": "node scripts/install-skills.mjs"
-	},
-	"dependencies": {
-		"@dforge-core/dforge-cli": "^0.2.25",
-		"@dforge-core/metadata": "^0.0.32",
-		"@modelcontextprotocol/sdk": "^1.30.0",
-		"zod": "^4.4.3"
-	},
-	"devDependencies": {
-		"@types/node": "^26.2.0",
-		"tsup": "^8.5.1",
-		"typescript": "^6.0.3",
-		"vitest": "^4.1.10"
-	}
-}
+  "name": "@dforge-core/dforge-mcp",
+  "version": "0.2.33",
+  "description": "MCP server for dForge module authoring. Exposes 35 scaffold/patch/validate/pack/install tools and schema resources so AI agents (Claude Code, Cursor, Zed) can create and ship dForge modules.",
+  "license": "MIT",
+  "homepage": "https://github.com/iash44/dForge-core",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dforge-core/dforge-mcp.git"
+  },
+  "bin": {
+    "dforge-mcp": "dist/server.js",
+    "dforge-install-skills": "scripts/install-skills.mjs"
+  },
+  "files": [
+    "dist/",
+    "docs/",
+    "resources/",
+    "skills/",
+    "scripts/install-skills.mjs",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "main": "dist/server.js",
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@dforge-core/dforge-cli": "^0.2.26",
+    "@dforge-core/metadata": "^0.0.33",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
+  },
+  "scripts": {
+    "build": "tsup",
+    "sync-schemas": "node scripts/vendor-schemas.cjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "install-skills": "node scripts/install-skills.mjs"
+  }
+}

package/resources/docs/conventions.md

@@ -512,7 +512,7 @@ Two halves, both required:
 
 **`"default"` is the one exempt name** and means "no view" (full column set). It is what the ~100 shipped folder entries write, what `FolderExporter` writes back for a NULL `view_name`, and what the runtime auto-creates (column-less) for an entity reached without a folder binding — so rejecting it would fail every install. A module that really declares a view named `default` still gets it bound.
 
-Don't confuse the three things called "view": an **entity view** (`views`, this section) is column security; a **data view** (`ui/data_views.json`, referenced by a menu's `dataViewCode`) is a grid/kanban/calendar; `isView` + `viewSql` on an entity means it is backed by a SQL view. `folders.json`'s `viewName` binds the first.
+Don't confuse the two things called "view": an **entity view** (`views`, this section) is column security; a **data view** (`ui/data_views.json`, referenced by a menu's `dataViewCode`) is a grid/kanban/calendar. `folders.json`'s `viewName` binds the first. An entity is never backed by a SQL view — `isView` / `viewSql` are rejected; use a data view, a report or a stored procedure instead.
 
 ## Column Domains (`domains.json`)
 

package/resources/schemas/entity.schema.json

@@ -2,7 +2,7 @@
 	"$schema": "http://json-schema.org/draft-07/schema#",
 	"$id": "https://dforge.dev/schemas/entity.schema.json",
 	"title": "dForge Entity Definition",
-	"description": "Defines an entity (table/view mapping) for a dForge module",
+	"description": "Defines an entity (a table) for a dForge module",
 	"type": "object",
 	"anyOf": [
 		{ "required": ["fields"] },
@@ -24,16 +24,7 @@
 		},
 		"dbObject": {
 			"type": "string",
-			"description": "Database table or view name (defaults to entity code)"
-		},
-		"isView": {
-			"type": "boolean",
-			"description": "When true, entity maps to a SQL view (read-only, no DDL generation). Default: false (table-backed).",
-			"default": false
-		},
-		"viewSql": {
-			"type": "string",
-			"description": "SQL SELECT statement for view-backed entities (isView=true). Executed as CREATE OR REPLACE VIEW during module install."
+			"description": "Database table name (defaults to entity code)"
 		},
 		"toString": {
 			"description": "Display pattern using column placeholders, e.g. \"{first_name} {last_name}\" — the caption of a record wherever it is referenced. Every `{placeholder}` must name a field of the entity (trait columns included) and not a set; pack and install fail otherwise. Omitted, the install generates one from the fields and warns. Not declared on extension entities (with `extends`). No `type` constraint here because `toString` collides with Object.prototype.toString in JSON validators — they read the inherited function and reject it, even when the property is absent from the JSON."
@@ -151,7 +142,7 @@
 		},
 		"views": {
 			"type": "object",
-			"description": "Entity views keyed by view name — column-level security. Unrelated to 'isView'/'viewSql' (a SQL-view-backed entity) and to ui/data_views.json (grids, kanban, calendars). A folder binds one view per entity via ui/folders.json (entities.<code>.viewName); users working in that folder see ONLY the columns the view lists. Entities without views show the entity's full column set; a folder naming a view that isn't declared here FAILS the install, since resolving it to nothing would show every column \u2014 the opposite of what naming a view asks for. A view can only be declared by the entity's own module: an extension ('extends') declaring 'views' is rejected, because a view lists the complete column set and an extension knows only the columns it adds.",
+			"description": "Entity views keyed by view name — column-level security. Unrelated to ui/data_views.json (grids, kanban, calendars). A folder binds one view per entity via ui/folders.json (entities.<code>.viewName); users working in that folder see ONLY the columns the view lists. Entities without views show the entity's full column set; a folder naming a view that isn't declared here FAILS the install, since resolving it to nothing would show every column \u2014 the opposite of what naming a view asks for. A view can only be declared by the entity's own module: an extension ('extends') declaring 'views' is rejected, because a view lists the complete column set and an extension knows only the columns it adds.",
 			"propertyNames": {
 				"pattern": "^[a-zA-Z_][a-zA-Z0-9_-]*$",
 				"maxLength": 100

package/resources/schemas/translations.schema.json

@@ -32,9 +32,9 @@
 		},
 		"views": {
 			"type": "object",
-			"description": "Data view code → label.",
+			"description": "Data view code → label and description (the subtitle under the view title).",
 			"additionalProperties": {
-				"$ref": "#/$defs/labelOnly"
+				"$ref": "#/$defs/labelDesc"
 			}
 		},
 		"menus": {

package/skills/dforge-mcp-author/examples/column-security/README.md

@@ -60,8 +60,7 @@ correct: a data view describes the presentation, and the folder's entity view de
 what a user in that folder is allowed to see of it. The grid renders whichever
 columns survive the view — you do not maintain one data view per role.
 
-Entity views are also unrelated to the two other things called "view" here: a *data
-view* (`ui/data_views.json`) is a grid/kanban/calendar, and `isView` + `viewSql` on an
-entity means it is backed by a SQL view.
+Entity views are also unrelated to the other thing called "view" here: a *data view*
+(`ui/data_views.json`) is a grid/kanban/calendar.
 
 See `dforge://reference/security` → Column-level security for the full rules.

package/skills/dforge-mcp-author/references/data-views.md

@@ -4,7 +4,7 @@ Data views define how users see and interact with entity data. One entity can ha
 
 Lives in: `ui/data_views.json`
 
-> **Not to be confused with entity views.** An *entity view* (`views` on an entity file) is column-level **security** — which columns a folder may see at all — and is what `folders.json`'s `viewName` binds. A *data view* is a presentation of an entity, referenced by a menu's `dataViewCode`. A third thing, `isView` + `viewSql` on an entity, means the entity is backed by a SQL view. See `security.md` → Column-level security.
+> **Not to be confused with entity views.** An *entity view* (`views` on an entity file) is column-level **security** — which columns a folder may see at all — and is what `folders.json`'s `viewName` binds. A *data view* is a presentation of an entity, referenced by a menu's `dataViewCode`. See `security.md` → Column-level security.
 
 ## Structure
 

package/skills/dforge-mcp-author/references/security.md

@@ -318,16 +318,17 @@ Each of these is an install-time error, and each is silent at runtime if it slip
 
 `"viewName": "default"` means **no view** (full column set) and declares nothing. It is what every shipped module writes, and what the runtime auto-creates for an entity reached without a folder binding — so it is exempt from the checks above. A module that really declares a view named `default` still gets it bound.
 
-### Don't confuse the three "views"
+### Don't confuse the two "views"
 
 | Term | Where | What it is |
 |---|---|---|
 | **Entity view** | `entities/*.json` → `views` | Column-level security (this section) |
 | **Data view** | `ui/data_views.json` | A grid / kanban / calendar over an entity (`data-views.md`) |
-| **SQL view** | `entities/*.json` → `isView` + `viewSql` | An entity backed by a SQL view instead of a table |
 
 `viewName` in `folders.json` binds the first. Menus' `dataViewCode` references the second.
 
+There is no SQL-view entity. `isView` / `viewSql` are rejected at validate, pack and install: a view entity would duplicate the source entity's metadata, break when that module changes a column, and read around its row and column security. For a read-only slice use a data view (nav paths, `F` columns), a `G` total, the Query Builder, or a stored-procedure report — the last is the one way to show users a slice of an entity they have no rights on, behind an explicit `sp:` grant.
+
 ### When to use subfolders
 
 - **Multi-location modules** (warehouses, offices, branches) — one subfolder per location, filtered by location FK

package/skills/dforge-mcp-author/references/translations.md

@@ -38,7 +38,7 @@ Translation files mirror the module's content structure. Each translatable objec
         "crm.sales-rep": { "label": "Sales Representative" }
     },
     "views": {
-        "contacts": { "label": "Contacts" },
+        "contacts": { "label": "Contacts", "desc": "People associated with customers" },
         "contacts_list": { "label": "Contact List" },
         "contacts_gallery": { "label": "Contact Cards" }
     },
@@ -80,7 +80,7 @@ Translation files mirror the module's content structure. Each translatable objec
 | `entities` | Entity labels (`label`, `desc`) and all field labels | Entity codes → `{ label, desc, fields: { field_code: { label } } }` |
 | `folders` | Folder labels | Folder codes (root folder key from `ui/folders.json`) |
 | `roles` | Role display labels | Role codes (keys from `security/roles.json`, already module-qualified — e.g. `crm.admin`) → `{ label }` |
-| `views` | Data view labels | View codes (keys from `ui/data_views.json`) |
+| `views` | Data view labels and descriptions (`label`, `desc`) | View codes (keys from `ui/data_views.json`) → `{ label, desc }` |
 | `menus` | Menu node labels (root + nested items) | Menu root key → `{ label, items: { item_code: { label } } }` matching `ui/menus.json` structure |
 | `actions` | Action labels, descriptions, param labels **and param dropdown option labels** | Action codes (keys from `ui/actions.json`) → `{ label, desc, params: { param_cd: { label, options: { value: … } } } }` |
 | `reports` | Report dataset captions, param labels **and param dropdown option labels** | Report codes → `{ datasets: { ds_cd: { caption } }, params: { param_cd: { label, options: { value: … } } } }` |
@@ -242,7 +242,7 @@ If you include these sections, the install succeeds (they're silently ignored)
         "crm.sales-rep": { "label": "Vertriebsmitarbeiter" }
     },
     "views": {
-        "contacts": { "label": "Kontakte" }
+        "contacts": { "label": "Kontakte", "desc": "Personen, die mit Kunden verknüpft sind" }
     },
     "menus": {
         "crm_menu": {