@dypai-ai/mcp 1.5.18 → 1.5.22

package/src/tools/sync/validate.js

@@ -19,6 +19,11 @@ import { join, resolve as resolvePath } from "path"
 import { fetchRemoteState, readLocalState, readLocalConfig, readLocalRealtime } from "./planner.js"
 import { proxyToolCall } from "../proxy.js"
 import { dumpPublicSchema } from "./schema-dump.js"
+import {
+  sqlProvesSingleRow,
+  outputSchemaPropertyNames,
+  workflowOutputKeys,
+} from "../../lib/workflow-placeholder-contract.js"
 
 /** schema.sql is considered "fresh" if it was written less than this ago.
  * Within the freshness window, we trust it without re-checking the remote.
@@ -424,6 +429,10 @@ function nodeField(node, params, key) {
   return node?.[key] ?? params?.[key]
 }
 
+function isUuidString(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)
+}
+
 function lookupFileMapContent(fileMap, ref) {
   if (!fileMap || typeof ref !== "string" || !ref.trim()) return ""
   const key = ref.trim()
@@ -740,6 +749,11 @@ function inferSqlCardinality(sqlText) {
   const sql = stripSqlForInference(sqlText)
   if (!sql) return null
   if (hasTopLevelLimitOne(sql) || hasTopLevelFetchOne(sql)) return "single"
+  // INSERT ... RETURNING is one row unless the caller uses bulk mode.
+  // UPDATE/DELETE ... RETURNING may affect many existing rows, so keep those as "many".
+  if (/\breturning\b/i.test(sql) && /^insert\b/i.test(sql.trim())) {
+    return "single"
+  }
   const startsLikeRead = /^(select|with)\b/i.test(sql)
   if (startsLikeRead && hasTopLevelSetOperation(sql)) return "many"
   const outerSelectList = findOuterSelectList(sql)
@@ -785,9 +799,14 @@ function buildNodeOutputContracts(nodes, fileMap, ctx) {
     if (op === "query" || op === "custom_query") {
       const query = nodeField(node, params, "query") || lookupFileMapContent(fileMap, nodeField(node, params, "query_file"))
       const inferred = inferSelectOutputColumns(query)
+      const declared = nodeField(node, params, "output_cardinality") || node.output_cardinality
+      const cardinality =
+        declared === "single" || declared === "many"
+          ? declared
+          : inferSqlCardinality(query)
       contracts.set(node.id, {
         type: "array",
-        cardinality: inferSqlCardinality(query),
+        cardinality,
         properties: inferred.properties,
         strict: inferred.strict,
       })
@@ -895,6 +914,33 @@ function parseNodeOutputRef(path) {
   return { nodeId, indexed, prop }
 }
 
+function buildNodeTypeMap(nodes) {
+  const map = new Map()
+  for (const node of nodes || []) {
+    if (!node || typeof node !== "object" || !node.id) continue
+    map.set(node.id, node.type ?? node.node_type)
+  }
+  return map
+}
+
+function validateStripeNodePlaceholder({ expr, path, nodeId, nodeTypes, endpoint, file, loc }) {
+  const nodeType = nodeTypes.get(nodeId)
+  if (nodeType !== "stripe") return null
+  const prefix = `nodes.${nodeId}.`
+  if (!path.startsWith(prefix)) return null
+  const rest = path.slice(prefix.length)
+  if (!rest || rest.startsWith("output.")) return null
+  return {
+    severity: "error",
+    rule: "stripe_output_wrong_path",
+    endpoint, file, loc,
+    message: `\${${expr}} is not the Stripe node output shape. Stripe returns { success, output: { metadata: { id, url, ... } } }.`,
+    fix_hint:
+      `Use \${nodes.${nodeId}.output.metadata.url} for checkout URL and \${nodes.${nodeId}.output.metadata.id} for session id. ` +
+      `See search_docs('stripe payments').`,
+  }
+}
+
 function validateNodeOutputRef({ expr, path, contract, endpoint, file, loc }) {
   const ref = parseNodeOutputRef(path)
   if (!ref || !ref.prop || !contract) return null
@@ -919,7 +965,9 @@ function validateNodeOutputRef({ expr, path, contract, endpoint, file, loc }) {
       rule: "node_output_many_direct_property",
       endpoint, file, loc,
       message: `\${${expr}} reads property '${ref.prop}' directly from node '${ref.nodeId}', but that node is inferred to return many rows.`,
-      fix_hint: `Use \${nodes.${ref.nodeId}} for the full array, or \${nodes.${ref.nodeId}[0].${ref.prop}} if you intentionally want the first row.`,
+      fix_hint:
+        `For multi-row query results, use \${nodes.${ref.nodeId}[0].${ref.prop}} for the first row, \${nodes.${ref.nodeId}} for the full array, or a set_fields / javascript_code node. ` +
+        `For INSERT ... RETURNING (single row), prefer \${nodes.${ref.nodeId}.${ref.prop}} without [0].`,
     }
   }
 
@@ -949,8 +997,10 @@ function validateEndpoint(entry, ctx) {
   const file = ctx.fileByName[name] || `endpoints/${name}.yaml`
 
   const inputProps = doc.input?.properties || {}
-  const nodeIds = new Set((doc.workflow?.nodes || []).map(n => n.id))
-  const outputContracts = buildNodeOutputContracts(doc.workflow?.nodes || [], fileMap, ctx)
+  const workflowNodes = doc.workflow?.nodes || []
+  const nodeIds = new Set(workflowNodes.map(n => n.id))
+  const nodeTypes = buildNodeTypeMap(workflowNodes)
+  const outputContracts = buildNodeOutputContracts(workflowNodes, fileMap, ctx)
 
   const jwt = ruleUsesJwt(doc.trigger)
 
@@ -1038,6 +1088,17 @@ function validateEndpoint(entry, ctx) {
             missingNodeRefs.set(nodeId, { loc, expr })
           }
         } else {
+          const stripeDiag = validateStripeNodePlaceholder({
+            expr,
+            path: e,
+            nodeId,
+            nodeTypes,
+            endpoint: name,
+            file,
+            loc,
+          })
+          if (stripeDiag) diagnostics.push(stripeDiag)
+
           const outputDiag = validateNodeOutputRef({
             expr,
             path: e,
@@ -1311,6 +1372,45 @@ function validateEndpoint(entry, ctx) {
         }
       }
     }
+    if (node.tool_ids !== undefined && node.tools === undefined) {
+      const toolIds = Array.isArray(node.tool_ids) ? node.tool_ids : []
+      const legacyUuidToolIds = toolIds.length === 0 || toolIds.every(isUuidString)
+      diagnostics.push({
+        severity: legacyUuidToolIds ? "warn" : "error",
+        rule: "tool_ids_used",
+        endpoint: name, file, loc: `workflow.nodes[${node.id}]`,
+        message: legacyUuidToolIds
+          ? `Node '${node.id}' uses legacy 'tool_ids' in YAML. Prefer 'tools: [<endpoint-name>, ...]' for portable project files.`
+          : `Node '${node.id}' uses 'tool_ids' with non-UUID values in YAML. The codec only resolves endpoint names via 'tools'.`,
+        fix_hint: legacyUuidToolIds
+          ? `This is allowed for compatibility with older/manual projects, but tools: is the canonical YAML field. See placeholder-cheatsheet.md.`
+          : `Replace tool_ids with tools: [<endpoint-name>, ...]. See placeholder-cheatsheet.md.`,
+        example_fix: "tools: [search-patients, book-appointment]",
+      })
+    }
+
+    const declaredCardinality =
+      nodeField(node, nodeParams(node), "output_cardinality") || node.output_cardinality
+    if (
+      nodeType === "dypai_database" &&
+      (nodeField(node, nodeParams(node), "operation") === "query" ||
+        nodeField(node, nodeParams(node), "operation") === "custom_query") &&
+      declaredCardinality === "single"
+    ) {
+      const query =
+        nodeField(node, nodeParams(node), "query") ||
+        lookupFileMapContent(ctx.fileMap || {}, nodeField(node, nodeParams(node), "query_file"))
+      if (query && !sqlProvesSingleRow(query)) {
+        diagnostics.push({
+          severity: "warn",
+          rule: "output_cardinality_unproven",
+          endpoint: name, file, loc: `workflow.nodes[${node.id}]`,
+          message: `Node '${node.id}' declares output_cardinality: single but SQL does not prove a single row (add LIMIT 1, aggregate without GROUP BY, or INSERT ... RETURNING).`,
+          fix_hint: "Add LIMIT 1 to the query or remove output_cardinality if the query can return multiple rows.",
+        })
+      }
+    }
+
     // node_type exists in catalog?
     if (ctx.knownTypes.size && !ctx.knownTypes.has(nodeType)) {
       const suggestions = [...ctx.knownTypes].filter(t => levenshteinSmall(t, nodeType) <= 2).slice(0, 3)
@@ -1564,6 +1664,19 @@ function validateEndpoint(entry, ctx) {
     }
   }
 
+  const webhookCred = doc.trigger?.webhook?.credential
+  if (webhookCred && !ctx.remoteCredentials.has(webhookCred)) {
+    diagnostics.push({
+      severity: "error",
+      rule: "credential_not_found",
+      endpoint: name, file, loc: "trigger.webhook.credential",
+      message: `credential '${webhookCred}' is not defined remotely.`,
+      fix_hint: ctx.remoteCredentials.size
+        ? `Available: ${[...ctx.remoteCredentials].join(", ")}. For Stripe webhooks use type stripe_webhook, recommended name stripe-webhook.`
+        : "Create stripe-webhook (type stripe_webhook) in the dashboard. See search_docs('stripe payments').",
+    })
+  }
+
   // ── Edge sanity: catch typos in workflow.edges before runtime ────────────
   // The engine silently skips edges whose `from`/`to` doesn't resolve to a
   // node id, which manifests as "node never ran" — extremely hard to debug.
@@ -1604,12 +1717,40 @@ function validateEndpoint(entry, ctx) {
   // that don't reconverge), "last to finish" is non-deterministic and
   // almost certainly not what the author intended.
   const allNodes = doc.workflow?.nodes || []
+  const triggerKeys = Object.keys(doc.trigger || {})
+  const NEEDS_RESPONSE = new Set(["http_api", "webhook"])
+  const needsResponse = triggerKeys.some(k => NEEDS_RESPONSE.has(k))
+  const hasReturn = allNodes.some(n => n?.return === true || n?.is_return === true)
+
+  if (needsResponse && allNodes.length > 0 && !hasReturn) {
+    diagnostics.push({
+      severity: "warn",
+      rule: "endpoint_missing_return",
+      endpoint: name, file, loc: "workflow.nodes",
+      message:
+        "HTTP/webhook endpoint has no node marked 'return: true'. The engine may return an unintended node output.",
+      fix_hint: "Mark exactly one terminal node with 'return: true' (usually your set_fields or response node).",
+    })
+  }
+
+  const declaredOutputProps = outputSchemaPropertyNames(doc.output)
+  const mappedOutputKeys = workflowOutputKeys(doc.workflow?.output)
+  if (declaredOutputProps.size > 0 && mappedOutputKeys.size > 0) {
+    const unknownKeys = [...mappedOutputKeys].filter(k => !declaredOutputProps.has(k))
+    if (unknownKeys.length > 0) {
+      diagnostics.push({
+        severity: "warn",
+        rule: "endpoint_output_mismatch",
+        endpoint: name, file, loc: "workflow.output",
+        message:
+          `workflow.output declares keys not present in the endpoint output schema: ${unknownKeys.join(", ")}.`,
+        fix_hint: `Add them to output.properties or rename workflow.output keys. Declared: ${[...declaredOutputProps].join(", ")}.`,
+      })
+    }
+  }
+
   if (allNodes.length > 1) {
-    const hasReturn = allNodes.some(n => n?.return === true || n?.is_return === true)
     if (!hasReturn) {
-      const triggerKeys = Object.keys(doc.trigger || {})
-      const NEEDS_RESPONSE = new Set(["http_api", "webhook"])
-      const needsResponse = triggerKeys.some(k => NEEDS_RESPONSE.has(k))
       if (needsResponse) {
         // Find terminal nodes (no outgoing edges).
         const edgeList = Array.isArray(doc.workflow?.edges) ? doc.workflow.edges : []
@@ -1960,11 +2101,13 @@ export async function runValidation(rootDir, projectId) {
 
 export const __testing = {
   buildNodeOutputContracts,
+  buildNodeTypeMap,
   extractRuntimePaths,
   inferSelectOutputColumns,
   inferSqlCardinality,
   unsupportedRuntimePlaceholder,
   validateNodeOutputRef,
+  validateStripeNodePlaceholder,
 }
 
 export const dypaiValidateTool = {