@doclift/workflows-mcp 0.1.2 → 0.2.0

package/README.md

@@ -48,6 +48,34 @@ carries the same rights it carries on the REST API — no more.
 }
 ```
 
+### Authorise the whole server, once
+
+This server carries 35 tools, 22 of which write. A client that asks per tool
+interrupts a build dozens of times, and a prompt that fails to surface is
+indistinguishable from a server that has stopped answering — the call simply
+waits until the client's tool timeout, having never reached the API. Grant the
+server in one rule instead.
+
+In Claude Code, add it to `permissions.allow` — in `.claude/settings.json` to
+share it with the repository, `.claude/settings.local.json` to keep it to
+yourself, or `~/.claude/settings.json` for every project:
+
+```json
+{
+  "permissions": {
+    "allow": ["mcp__doclift-workflows"]
+  }
+}
+```
+
+The bare server name covers every tool it exposes, now and after an upgrade;
+`mcp__doclift-workflows__*` is the same rule spelled with a wildcard. The server
+segment is the key you gave the server under `mcpServers`, not the package name:
+declare it as `doclift` and the rule reads `mcp__doclift`.
+
+Other clients name their permissions differently; the rule above is the one this
+project has verified.
+
 ## Calling it from a terminal
 
 `bin/mcp-call.mjs` speaks to the server over the same stdio transport a real

package/dist/guidance.js

@@ -112,6 +112,19 @@ the markup, and the render answers 200. \`workflow_selfcheck\` reports these as
 \`clipped_bands\`. A band is a line, not a paragraph: legal text belongs in a
 content section, which flows onto the next page instead of being cut.
 
+**2 septies. A list on a variable is a rule, not a hint.** \`allowed_values\`
+used to be decorative on a workflow and is not any more: a generation sending a
+value the list does not hold is refused with a 422 naming the variable, the
+value and what was expected. The comparison is trimmed and case-insensitive —
+\`"FR"\` satisfies a list holding \`"fr"\` — because it is the comparison the
+conditions make, and a payload the engine would render correctly must not be
+turned away. \`workflow_payload_contract\` lists the constrained names under
+\`constrained\`.
+
+Which makes the list worth declaring for a value a condition tests. A condition
+comparing against something the list does not hold can never match, and nothing
+warns you: the section simply never appears.
+
 **3. Declaring inline what the theme already says freezes the document.** It
 looks identical today and stops following the theme forever. Set the theme, then
 write only what departs from it. This is the mistake that costs the most and

package/dist/tools/checks.js

@@ -33,8 +33,9 @@ export const registerChecks = (server, api, base) => {
     })));
     server.registerTool('workflow_payload_contract', {
         title: 'What a generation payload must carry',
-        description: 'The variables a generation call has to send for this workflow, which are required, which rows ' +
-            'a collection must carry, and the limits on them. Read this before calling workflow_render.',
+        description: 'The variables a generation call has to send for this workflow: which are required, which carry ' +
+            'a list of allowed values the generation enforces, which rows a collection must carry, and the ' +
+            'limits on them. Read this before calling workflow_render.',
         inputSchema: { id: templateId },
         annotations: { readOnlyHint: true },
     }, async ({ id }) => respond(await api.get(`${base}/templates/${id}/payload_contract`)));
@@ -234,6 +235,7 @@ const selfcheck = (validation, template, payload) => {
         workflow: template === null ? null : { id: template['id'], title: template['title'], published: template['published'] },
         publishable: validation.publishable ?? null,
         required_variables: payload === null ? null : payload['required'],
+        constrained_variables: payload === null ? null : payload['constrained'],
         checklist: lines,
         outstanding: lines.filter((line) => line.status === 'todo').length,
     };

package/dist/tools/variables.js

@@ -25,7 +25,11 @@ export const registerVariables = (server, api, base) => {
             description: z.string().min(1).describe('Required. What the variable holds, for whoever fills it in.'),
             required: z.boolean().optional(),
             seed_value: z.string().optional().describe('What the preview shows in its place.'),
-            allowed_values: z.array(z.string()).optional().describe('select and radio only.'),
+            allowed_values: z
+                .array(z.string())
+                .optional()
+                .describe('select and radio only. Enforced at generation: a value outside the list is refused ' +
+                'with a 422, compared trimmed and case-insensitively, exactly as a condition compares it.'),
             fields: z.array(z.record(z.unknown())).optional().describe('The row columns of a collection.'),
         },
         annotations: { readOnlyHint: false, destructiveHint: false },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doclift/workflows-mcp",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "MCP server over the Doclift workflow authoring API",
   "license": "MIT",
   "homepage": "https://www.doclift.io/docs/getting-started",
@@ -36,7 +36,7 @@
   "devDependencies": {
     "@types/node": "^22.10.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "vitest": "^5.0.1"
   },
   "engines": {
     "node": ">=20"