@dokebi/mcp 0.1.1 → 0.1.2

package/AI.md

@@ -163,10 +163,6 @@ The optional members are read at start, so a subclass defines them without `over
 
 Prompts and resources run with the same `checkGrant`, time budget and size limit (the JSON of the prompt or resource answer), and take tokens of the **`read` bucket** (with `limits` set, a `read` policy is required when prompts or resources exist; refused: `-32602` with `data: { code: LIMIT_EXCEEDED, retry_after }`); their failures are JSON-RPC errors: a DokebiError is `-32602` with `data: { code, message, hint?, next?, data? }` — one with a status of 500 or more (the server's state: a storage that is stopping answers `NOT_READY` 503, a limiter whose Redis is down `UNAVAILABLE`) is `-32603` with the same `data`, its `retryAfterMs` included —, a refused grant `-32602` `GRANT_REFUSED`, a timeout `-32603` `TOOL_TIMEOUT`, an unexpected error `-32603` `INTERNAL`.
 
-### Module actions as tools (`@dokebi/mcp/actions`, D-0202)
-
-`actionTools(module, { scope?, only? })` (module 0.4.2) makes one `McpTool` per action of a feature module's contract (`defineModule({ actions })`, @dokebi/module AI.md §2c): name `<module>.<action>`, `title` and `description` from the action (its permission, the version rule, the two steps of a dangerous one), `inputSchema` the action's fields (a dangerous one adds `confirm`), `annotations.destructiveHint` for a dangerous one. `handle` runs the module's general write with `context.request`: the same permission (`request.auth.can`), scope, input check, preview and confirm as `POST /actions/<module>/<action>`. A refusal is a tool error with its code (`VALIDATION_FAILED` with `data.rules`, `ACTION_CONFLICT`, `CONFIRM_REQUIRED` with `data.preview` and `data.confirm`); a result is `envelope({ fields: { action, result } })`. The run's `actor` is `{ type: 'ai', id: <the grant's user>, client: <its client name> }` for the audit row. Contribute them from the module's setup: `for (const tool of actionTools(module)) module.contribute(mcpTools, tool)` with `contributes: [mcpTools]`. **`scope`** defaults to the action's permission key: a token carries its scopes as abilities and `can(permission)` needs the permission among them, so list the permission keys (or `<module>.*`) in the resource's `scopes`; another scope refuses every call with `FORBIDDEN`. `only` picks actions by name; a name the module does not have throws `INVALID_ARGUMENT` (a typo never leaves a tool out quietly). The entry imports @dokebi/module (an optional peer).
-
 ## 6. One tool call
 
 After the scope check of §3: **limit** (`limits.<bucket>`, key `<bucket>:<grant id>`) → **checkGrant** → **input** → `handle` within `toolTimeoutMs` → **the envelope** → **transformResult** → **the picture limits** → **size** → the result. Every failure is a tool result with `isError: true`, never an HTTP error and never a 5xx.

package/dist/plugin.js

@@ -530,7 +530,7 @@ function debug(logger, message, fields) {
  */
 export const createPlugin = definePlugin({
     name: 'dokebi-mcp',
-    version: '0.1.1',
+    version: '0.1.2',
     core: '^0.4.2',
     options: declaration,
     contributes: [describePoint],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dokebi/mcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "MCP server for @dokebi/web on @dokebi/oauth: stateless Streamable HTTP, tool classes with checked schemas, a forced result envelope, per-grant limits and coded tool errors.",
   "keywords": [
     "dokebi",
@@ -28,10 +28,6 @@
     "./testing": {
       "types": "./dist/testing.d.ts",
       "import": "./dist/testing.js"
-    },
-    "./actions": {
-      "types": "./dist/actions.d.ts",
-      "import": "./dist/actions.js"
     }
   },
   "files": [
@@ -55,22 +51,18 @@
     "@dokebi/web": "^0.4.3",
     "@dokebi/oauth": "^0.1.0",
     "@dokebi/rate-limit": "^0.1.1",
-    "fastify": "^5.12.7",
-    "@dokebi/module": "^0.4.2"
+    "fastify": "^5.12.7"
   },
   "peerDependenciesMeta": {
     "@dokebi/rate-limit": {
       "optional": true
-    },
-    "@dokebi/module": {
-      "optional": true
     }
   },
   "devDependencies": {
     "@dokebi/app": "0.4.6",
     "@dokebi/auth": "0.4.2",
     "@dokebi/cluster": "0.4.2",
-    "@dokebi/module": "0.4.2",
+    "@dokebi/module": "0.4.3",
     "@dokebi/oauth": "0.1.1",
     "@dokebi/rate-limit": "0.1.1",
     "@dokebi/redis": "0.4.1",

package/dist/actions.d.ts

@@ -1,19 +0,0 @@
-import { type ModuleAction, type ModuleContext } from '@dokebi/module';
-import { McpTool } from './tool.js';
-/** Options of `actionTools`. */
-export interface ActionToolOptions {
-    /**
-     * The OAuth scope a grant needs for a tool, or a list of which any one is enough; a function
-     * picks it per action. Default: the action's permission key (`members.update`). An OAuth token
-     * carries its scopes as abilities and `request.auth.can(permission)` needs the permission among
-     * them, so a scope other than the permission (or `<module>.*`) refuses every call with FORBIDDEN.
-     */
-    readonly scope?: string | readonly string[] | ((action: {
-        readonly id: string;
-        readonly declaration: ModuleAction;
-    }) => string | readonly string[]);
-    /** The actions to offer, by name (default every action of the module); an unknown name throws. */
-    readonly only?: readonly string[];
-}
-/** One MCP tool per action of `module` (named `<module>.<action>`). */
-export declare function actionTools(module: ModuleContext, options?: ActionToolOptions): McpTool[];

package/dist/actions.js

@@ -1,88 +0,0 @@
-// Module actions as MCP tools (D-0202, `@dokebi/mcp/actions`): the module that owns the actions
-// contributes one tool per action to @dokebi/mcp (D-0130), and the tool runs the same runner as
-// the general write — the same permission, scope, input check, preview and confirm, result and
-// errors. The AI client's name reaches the run as `actor` (`{ type: 'ai', client }`) for the audit.
-//
-//   import { actionTools } from '@dokebi/mcp/actions';
-//   defineModule({ contributes: [mcpTools], actions, setup(module) {
-//     for (const tool of actionTools(module)) module.contribute(mcpTools, tool);
-//   } })
-import { inputSchema, runAction } from '@dokebi/module';
-import { envelope } from './envelope.js';
-import { McpError } from './errors.js';
-import { McpTool } from './tool.js';
-const text = (value) => value === undefined
-    ? ''
-    : typeof value === 'string'
-        ? value
-        : (value.en ?? Object.values(value)[0] ?? '');
-class ActionTool extends McpTool {
-    name;
-    title;
-    description;
-    inputSchema;
-    scope;
-    annotations;
-    #module;
-    #declaration;
-    constructor(module, name, declaration, scope) {
-        super();
-        this.#module = module;
-        this.#declaration = declaration;
-        this.name = `${module.module}.${name}`;
-        this.title = text(declaration.title);
-        const about = text(declaration.description);
-        this.description = [
-            `${this.title}${about ? `: ${about}` : ''}.`,
-            `Needs the permission ${declaration.permission}.`,
-            declaration.version
-                ? `Send ${declaration.version} as read with the row: a newer row answers ACTION_CONFLICT (read it again).`
-                : '',
-            declaration.danger
-                ? 'Dangerous: the first call answers CONFIRM_REQUIRED with data.preview and data.confirm. Show the preview to the user and call again with the same input and confirm only when they agree.'
-                : '',
-            'Fields left out are not changed; null clears a field that is not required.',
-        ]
-            .filter(Boolean)
-            .join(' ');
-        this.inputSchema = inputSchema(declaration);
-        this.scope = scope;
-        this.annotations = { destructiveHint: declaration.danger === true, readOnlyHint: false };
-    }
-    async handle(input, context) {
-        const { confirm, ...values } = input;
-        const answer = await runAction({
-            id: this.name,
-            module: this.#module.module,
-            declaration: this.#declaration,
-            context: () => this.#module,
-        }, context.request, confirm === undefined ? { input: values } : { input: values, confirm }, this.#module.logger);
-        return envelope({
-            fields: { action: answer.action, result: answer.result },
-            note: 'The action ran. result holds what the server returned (ids, counts).',
-        });
-    }
-}
-/** One MCP tool per action of `module` (named `<module>.<action>`). */
-export function actionTools(module, options = {}) {
-    // A name the module does not have is a typo, never a tool left out quietly (D-0202 review).
-    const missing = options.only?.find((name) => !Object.hasOwn(module.contract.actions, name));
-    if (missing !== undefined)
-        throw new McpError('INVALID_ARGUMENT', `Module ${module.module} has no action ${missing}`, {
-            fix: `Name only actions of module ${module.module} in only: ${Object.keys(module.contract.actions).join(', ')}.`,
-        });
-    const tools = [];
-    for (const [name, declaration] of Object.entries(module.contract.actions)) {
-        if (options.only && !options.only.includes(name))
-            continue;
-        const scope = typeof options.scope === 'function'
-            ? options.scope({ id: `${module.module}.${name}`, declaration })
-            : (options.scope ?? declaration.permission);
-        tools.push(new ActionTool(module, name, declaration, scope));
-    }
-    module.logger.log('debug', 'Action tools made', {
-        module: module.module,
-        tools: tools.map((tool) => tool.name),
-    });
-    return tools;
-}