@ductape/mcp 0.2.35 → 0.2.37

package/dist/index.js

@@ -527,6 +527,9 @@ ALL params are passed as a JSON array in positional order matching the SDK signa
     ductape_cli("apps actions list --app <app_tag> --json")
     ductape_cli("apps actions get --app <app_tag> --action <action_tag> --json")
     ductape_cli("apps actions delete --app <app_tag> --action <action_tag>")
+  Reuse the same canonical full action asset for create and update. An unchanged top-level tag is
+  accepted and stripped locally before the immutable action is patched; never create a second
+  partial-update file. A tag that differs from --action is rejected before any mutation.
   NOTE: the flag is --action-file, NOT -f/--file — that flag belongs to the parent "apps" command
   (used by "apps create"/"apps update"), and Commander resolves a flag shared by an ancestor and a
   descendant against the ancestor, so -f here would silently never reach this subcommand. Verified
@@ -1445,6 +1448,7 @@ const ADMIN_SUBCOMMANDS = [
     'workspaces',
     'link', 'unlink', 'init',
     'products', 'apps', 'marketplace',
+    'features',
     'resources',
     'notifications',
     'events',
@@ -3105,6 +3109,9 @@ CONNECTION FILE — REQUIRED SHAPE:
       "product_env_slug": "prd",
       "app_env_slug": "production",
       "variables": [{ "key": "region", "value": "ng" }],
+      "credentials": {
+        "headers:Authorization": "$Secret{PAYSTACK_SECRET_KEY}"
+      },
       "auth": {
         "auth_tag": "secret-key",
         "data": {
@@ -3115,6 +3122,27 @@ CONNECTION FILE — REQUIRED SHAPE:
     }]
   }
 
+  Authentication is OPTIONAL. If the App defines an auth scheme, use auth with its exact auth_tag.
+  If it has no formal auth scheme but actions declare reusable credential fields, use credentials
+  with location-prefixed keys: headers:<key>, query:<key>, params:<key>, or body:<key>. Leave both
+  auth and credentials absent when the environment does not require authentication. Never create a
+  fake auth_tag merely to store a header.
+
+  OAUTH/TOKEN ACCESS: OAuth grants and shared tokens belong to the product App connection, not to
+  Feature input and not to repeated api.oauth() calls in application code. Inspect the App auth
+  scheme; when it uses oauth2, token_access, credential_access, or fetch_credential_access, direct
+  the user through the provider-consent/login flow in Workbench and preserve the resulting encrypted
+  connection auth for every mapped product environment. Agents must never request, print, or write
+  access/refresh tokens into the repository. Application code initializes Ductape with product+env,
+  awaits ready(), and calls the action; runtime auth injection and token refresh are platform-managed.
+  api.oauth() remains only an explicit process-local override for a connection the user deliberately
+  has not persisted.
+
+  SHARED CONFIG: derive candidate keys from the selected App version's action schemas across headers,
+  query, params, and body. Deduplicate by <location>:<key>, prefer fields reused by several actions,
+  and present the exact candidates to the user. Never ask the user to invent or type a key name that
+  is already declared by an action. Only the value/$Secret reference is user-supplied.
+
   Before writing this file, inspect the exact App version/auth/action schemas. auth.data must have
   headers/query/params/body objects and must match the selected auth schema. Never guess an auth_tag,
   variable key, input location, or required field. Store credentials with secrets.create first and
@@ -3123,8 +3151,8 @@ CONNECTION FILE — REQUIRED SHAPE:
 CREATE/REPAIR/ROTATE:
   ductape_cli("products apps configure --product <product_tag> --app <app_or_access_tag> \
     --connection-file ductape/apps/<app_tag>/connection.json --json")
-  The command is merge-safe: an omitted auth or variables field preserves the existing saved field.
-  Providing auth or variables explicitly replaces that field for the named product environment.
+  The command is merge-safe: an omitted auth, credentials, or variables field preserves the existing
+  saved field. Providing one explicitly replaces that field for the named product environment.
   It never returns saved credential values. Include only environments intentionally being changed;
   other existing mappings are retained. To repair an old connection with no mapping, add its row.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/mcp",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "MCP server that exposes Ductape SDK operations via the backend proxy",
   "type": "module",
   "main": "dist/index.js",