@ductape/mcp 0.1.47 → 0.1.48

package/dist/index.js

@@ -576,6 +576,11 @@ ALL params are passed as a JSON array in positional order matching the SDK signa
   databases.update  [{ product, env, database, table, data: {key:value}, where: {field: value}, returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="update", targets={database, table})
   databases.delete  [{ product, env, database, table, where: {field: value}, returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="delete", targets={database, table})
   databases.upsert  [{ product, env, database, table, data: {key:value}, conflictKeys: string[], returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="upsert", targets={database, table})
+  NOTE on write operations (insert/update/delete/upsert): if the proxy returns "Authentication failed",
+  the publishable key does not have write access for that database. Write permissions are configured
+  in Workbench → Tokens → Publishable Key. An access key is required for write operations that are
+  not explicitly enabled for the publishable key. In that case the operation must be performed
+  server-side using a full Ductape SDK instance initialized with an access key.
   NOTE: ductape_generate_payload for databases returns:
     payload.input  — ready-to-use input with real field names in where/data, plus session and cache inside input
     meta.schema_context.database.fields          — { fieldName: { type, required, description?, sample? } } for the table
@@ -3418,7 +3423,14 @@ async function main() {
             return { content: [{ type: 'text', text: JSON.stringify(result ?? null, null, 2) }] };
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
+            let message = err instanceof Error ? err.message : String(err);
+            const isAuthFailed = /authentication failed/i.test(message);
+            const isDbWrite = args.module === 'databases' && /^(insert|update|delete|upsert)$/.test(args.method);
+            if (isAuthFailed && isDbWrite) {
+                message += '\n\nThe publishable key does not have write access for this database operation. ' +
+                    'Enable it in Workbench → Tokens → Publishable Key. ' +
+                    'If write access cannot be granted to the publishable key, perform this operation server-side using a full Ductape SDK instance initialized with an access key.';
+            }
             return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
         }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.1.47",
+  "version": "0.1.48",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",

package/src/index.ts

@@ -587,6 +587,11 @@ ALL params are passed as a JSON array in positional order matching the SDK signa
   databases.update  [{ product, env, database, table, data: {key:value}, where: {field: value}, returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="update", targets={database, table})
   databases.delete  [{ product, env, database, table, where: {field: value}, returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="delete", targets={database, table})
   databases.upsert  [{ product, env, database, table, data: {key:value}, conflictKeys: string[], returning?, session?, cache? }]  ← CALL ductape_generate_payload FIRST (operation_family="database", method="upsert", targets={database, table})
+  NOTE on write operations (insert/update/delete/upsert): if the proxy returns "Authentication failed",
+  the publishable key does not have write access for that database. Write permissions are configured
+  in Workbench → Tokens → Publishable Key. An access key is required for write operations that are
+  not explicitly enabled for the publishable key. In that case the operation must be performed
+  server-side using a full Ductape SDK instance initialized with an access key.
   NOTE: ductape_generate_payload for databases returns:
     payload.input  — ready-to-use input with real field names in where/data, plus session and cache inside input
     meta.schema_context.database.fields          — { fieldName: { type, required, description?, sample? } } for the table
@@ -3517,7 +3522,14 @@ async function main() {
       const result = await executeViaProxy(key, proxyModule, args.method, params);
       return { content: [{ type: 'text', text: JSON.stringify(result ?? null, null, 2) }] };
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
+      let message = err instanceof Error ? err.message : String(err);
+      const isAuthFailed = /authentication failed/i.test(message);
+      const isDbWrite = args.module === 'databases' && /^(insert|update|delete|upsert)$/.test(args.method);
+      if (isAuthFailed && isDbWrite) {
+        message += '\n\nThe publishable key does not have write access for this database operation. ' +
+          'Enable it in Workbench → Tokens → Publishable Key. ' +
+          'If write access cannot be granted to the publishable key, perform this operation server-side using a full Ductape SDK instance initialized with an access key.';
+      }
       return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
     }
   };