@ductape/mcp 0.2.34 → 0.2.35

package/dist/index.js

@@ -316,8 +316,16 @@ PRODUCT RUNTIME SNAPSHOT — REQUIRED FOR SERVER INITIALIZATION:
   product runtime snapshot during onModuleInit, before the application accepts traffic. The
   snapshot preloads connected App versions/actions plus database actions/schema metadata, graphs,
   vectors, storage, brokers/topics, sessions, notifications, resilience assets, agents, functions,
-  and caches into the execution bootstrap cache. External provider/database connections remain
-  lazy and pooled.
+  and caches into the execution bootstrap cache. It also hydrates the selected Workbench App
+  connection for product+env (variables and token_access credentials). Do not emit api.config()
+  or api.oauth() boilerplate when that connection is already configured on the product. Explicit
+  api.config() is only a process-local override and has higher precedence. credential_access login
+  material remains isolated to the auth action and its encrypted refresh path. External provider/
+  database connections remain lazy and pooled.
+
+  Features, Quotas, Fallbacks, health checks, and direct api.run calls all reuse this same hydrated
+  connection through the action processor. Never create a second connection or copy secrets into a
+  Feature/Quota/Fallback definition. Reference the existing connected App access_tag and action tag.
 
   Runtime synchronization is enabled by default when product + env are present. Do not set
   runtimeSync:false merely to simplify generated code. Configure it only when the user has an
@@ -492,6 +500,7 @@ ALL params are passed as a JSON array in positional order matching the SDK signa
     ductape_cli("products apps list --product <id_or_tag> --json") ← compact linked apps only
     ductape_cli("products apps actions list --product <id_or_tag> --app <app_tag> --json")
     ductape_cli("products apps actions get --product <id_or_tag> --app <app_tag> --action <action_tag> --json")
+    ductape_cli("products apps configure --product <id_or_tag> --app <app_or_access_tag> --connection-file ductape/apps/<app_tag>/connection.json --json")
 
   SDK method signatures (for reference, admin key only):
   product.create        [data: { name, description, tag?, envs?: [{slug, name}] }]
@@ -503,6 +512,7 @@ ALL params are passed as a JSON array in positional order matching the SDK signa
   product.apps.add      [product_tag, app: { access_tag, envs: [{ app_env_slug, product_env_slug, variables?, auth? }] }]
   product.apps.list     [product_tag]
   product.apps.fetch    [product_tag, access_tag]
+  product.apps.update   [product_tag, access_tag, { envs }]  ← prefer CLI configure; it preserves omitted auth/variables
 
 ━━━ MODULE: app ━━━
   app.create    [data: { app_name: string, description: string, unique?: boolean }]
@@ -1205,6 +1215,11 @@ const marketplaceConnectInputSchema = z.object({
         product_env_slug: z.string().min(1),
     })).min(1).describe('Explicit app-to-product environment mappings. Include every product environment that will use the app.'),
 });
+const appConnectionConfigureInputSchema = z.object({
+    product_tag: z.string().min(1).describe('Product containing the existing App connection.'),
+    app_tag: z.string().min(1).describe('Connected App tag or exact product access tag returned by products apps list.'),
+    file: z.string().min(1).describe('Canonical JSON file under ductape/apps/<app-tag>/connection.json containing { envs: [...] }.'),
+});
 const marketplaceInspectInputSchema = z.object({
     app_tag: z.string().min(1).describe('Exact public app tag returned by ductape_marketplace_discover.'),
 });
@@ -3073,20 +3088,49 @@ CONNECT A DISCOVERED APP THROUGH MCP:
   4. Match each product environment explicitly to one environment exposed by the app.
   5. Call ductape_marketplace_connect({ product_tag, app_tag, environments }).
   6. Verify with ductape_cli("products apps list --product <product_tag> --json").
+  7. If the App requires variables or auth, create the canonical file at
+     ductape/apps/<app_tag>/connection.json and call ductape_app_connection_configure. A bare
+     connect only establishes access + environment mapping; it does not invent configuration.
   Never guess environment mappings or action tags. Connecting mutates product configuration;
   obtain user approval when the user has not already requested the connection.
 
-  CONFIRMED LIMITATION (2026-08-17): both ductape_marketplace_connect and the equivalent
-  ductape_cli("products apps connect --product <tag> --app <app-tag> --env-map ...") reject any
-  app that is not marked public in the marketplace, with error
-  App "<tag>" is not public in the marketplace. This includes apps a user creates themselves under
-  their own tag (e.g. a private "ductape:paystack") — private/workspace-owned apps CANNOT be
-  connected to a product through MCP or CLI at all, only through Workbench, even though
-  ductape_marketplace_inspect can still read a private app's full action catalogue (inspect and
-  connect have different visibility rules). If you hit this, do not keep retrying — tell the user
-  the app must be connected via Workbench, and once they confirm it's connected, verify with
-  ductape_cli("products apps list --product <product_tag> --json") rather than attempting the
-  connect call again.
+  Visibility: public marketplace Apps and private Apps owned by the current workspace can be
+  connected. A private App owned by another workspace must be rejected; do not retry around that
+  ownership boundary.
+
+CONNECTION FILE — REQUIRED SHAPE:
+  File: ductape/apps/<app_tag>/connection.json
+  {
+    "envs": [{
+      "product_env_slug": "prd",
+      "app_env_slug": "production",
+      "variables": [{ "key": "region", "value": "ng" }],
+      "auth": {
+        "auth_tag": "secret-key",
+        "data": {
+          "headers": { "Authorization": "$Secret{PAYSTACK_SECRET_KEY}" },
+          "query": {}, "params": {}, "body": {}
+        }
+      }
+    }]
+  }
+
+  Before writing this file, inspect the exact App version/auth/action schemas. auth.data must have
+  headers/query/params/body objects and must match the selected auth schema. Never guess an auth_tag,
+  variable key, input location, or required field. Store credentials with secrets.create first and
+  write $Secret{KEY}, never plaintext, into the connection file.
+
+CREATE/REPAIR/ROTATE:
+  ductape_cli("products apps configure --product <product_tag> --app <app_or_access_tag> \
+    --connection-file ductape/apps/<app_tag>/connection.json --json")
+  The command is merge-safe: an omitted auth or variables field preserves the existing saved field.
+  Providing auth or variables explicitly replaces that field for the named product environment.
+  It never returns saved credential values. Include only environments intentionally being changed;
+  other existing mappings are retained. To repair an old connection with no mapping, add its row.
+
+  After configuration, verify the non-secret summary with products apps list, then inspect the exact
+  action contract. Do not test a payment or other side-effecting action merely to verify connection
+  persistence unless the user explicitly requests a safe test and supplies appropriate test input.
 
 ONLY after all five steps can any code call:
   ctx.api.run({ app: '<app_tag>', action: '<action_tag>', input: { ... } })   ← in a feature handler
@@ -5731,6 +5775,12 @@ const integrateEndpointHandler = async (args) => {
             'Run: ductape_cli("products apps connect --product <product_tag> --app <app_tag> --env-map ' +
                 '<app_env>:<product_env> [repeat --env-map per environment] --json"). If the app is a public ' +
                 'marketplace app, ductape_marketplace_connect does the same thing in one call.',
+            'If the App declares variables or auth, connecting is not the end: call ductape_schema for the ' +
+                'exact app/auth contract, store credential values with secrets.create, write ' +
+                'ductape/apps/<app_tag>/connection.json using $Secret{KEY} references, and call ' +
+                'ductape_app_connection_configure. Never put plaintext secrets in the asset file.',
+            'For an already-connected App, skip connect and use configure. Omitted auth/variables preserve ' +
+                'the current encrypted values, so mapping-only repairs must not force credential rotation.',
         ],
     });
     stages.push({
@@ -5933,6 +5983,11 @@ const DUCTAPE_FIRST_DOCTRINE = 'Follow this checklist before defaulting to plain
     '(ductape.functions.register/use) — register portable business logic once and reuse it across ' +
     'every Feature that needs it. Call ductape_schema before constructing any new resource file, ' +
     'so you match the exact required shape rather than guessing.\n\n' +
+    '7. A Workbench App connection is perpetual product+environment runtime configuration. Once its ' +
+    'environment mapping, variables, and auth are saved, generated server code must initialize the ' +
+    'SDK with product+env and await ready(); do not repeat api.config/api.oauth in every codebase. ' +
+    'Direct actions, Features, Quotas, Fallbacks, and health checks reuse that hydrated connection. ' +
+    'Use api.config only when the user explicitly asks for a local override.\n\n' +
     'Default assumption for any backend built through this MCP server: orchestration goes through ' +
     'Features, provider risk goes through Quotas/Fallback, credentials go through Secrets, shared ' +
     'capability goes through reuse, and the ductape/ folder is what ships — not a database table ' +
@@ -6679,6 +6734,28 @@ async function main() {
                 command: `products apps connect --product ${shellArgument(args.product_tag)} --app ${shellArgument(args.app_tag)}${mappings} --json`,
             });
         });
+        server.registerTool('ductape_app_connection_configure', {
+            title: 'Configure a Connected Ductape App',
+            description: 'Configure, repair, or rotate an existing product App connection from its canonical JSON asset. ' +
+                'Inspect the App/auth schema first, store secrets separately, use $Secret{KEY} references, and ' +
+                'keep the file under ductape/apps/<app-tag>/connection.json. Omitted auth or variables preserve ' +
+                'the saved encrypted field; the tool never reads credential values back.',
+            inputSchema: appConnectionConfigureInputSchema,
+        }, async (args) => {
+            const normalized = args.file.replace(/\\/g, '/');
+            if (!/(^|\/)ductape\/apps\/[^/]+\/connection\.json$/.test(normalized)) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({
+                                error: 'INVALID_ASSET_PATH',
+                                message: 'Connection assets must be permanent JSON files at ductape/apps/<app-tag>/connection.json.',
+                            }, null, 2) }],
+                    isError: true,
+                };
+            }
+            return cliHandler({
+                command: `products apps configure --product ${shellArgument(args.product_tag)} --app ${shellArgument(args.app_tag)} --connection-file ${shellArgument(args.file)} --json`,
+            });
+        });
         server.registerTool('ductape_integrate_endpoint', {
             title: 'Integrate a New Endpoint',
             description: 'Call this FIRST whenever the user wants to integrate a new API endpoint — before writing any ' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.2.34",
+  "version": "0.2.35",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",