@dypai-ai/mcp 1.5.23 → 1.5.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dypai-ai/mcp",
-  "version": "1.5.23",
+  "version": "1.5.24",
   "description": "DYPAI MCP Server — AI agent toolkit for building and deploying full-stack apps",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -1078,10 +1078,11 @@ Mental translations: "edge function" → workflow with one code node; "cron" →
 3. **Treating \`dypai_push\` as a deploy** — it's "save as draft", not publish. Live traffic is untouched until \`manage_drafts(publish, confirm:true)\`. Push freely, only ask the user before publish.
 4. **\`public\` auth_mode with \`\${current_user_id}\`** — no JWT → placeholder empty → SQL fails or returns wrong data. Use \`jwt\` if you need the user.
 5. **Missing \`return: true\`** — endpoint returns \`null\`. Every path that should produce an HTTP response needs one node with \`return: true\`.
-6. **SQL return + \`output.type: object\` without \`response_cardinality\` or \`set_fields\`** — runtime body is \`[{...}]\` but the frontend expects \`{...}\`. Add top-level \`response_cardinality: single\` for direct SQL returns, or compose the public object with \`set_fields\`. \`dypai_validate\` errors with \`response_cardinality_required\`. Do not unwrap arrays in frontend code.
-7. **\`tool_ids\` in YAML instead of \`tools\`** — write \`tools: [name1, name2]\`. \`tool_ids\` bypasses the codec and fails silently in prod.
-8. **Putting workflow placeholders inside \`javascript_code.code\`** — code is raw JavaScript, so JS template literals like \`\${where.join(" AND ")}\` are safe and not rendered by DYPAI. Pass workflow values via \`input_data\`, \`ctx.nodes\`, \`ctx.user\`, or \`ctx.env\`; do not write \`\${input.email}\` inside code or set \`code\` from another node output.
-9. **Human endpoint names** — \`name: Listar videos\` in \`list-videos.yaml\` creates a draft the frontend cannot call as \`list-videos\`. \`dypai_validate\` and \`dypai_push\` reject this; fix the slug instead of testing around it.
+6. **SQL return + \`output.type: object\` without \`response_cardinality\` or \`set_fields\`** — runtime body is \`[{...}]\` but the frontend expects \`{...}\`. Add top-level \`response_cardinality: single\` for direct SQL returns, or compose the public object with \`set_fields operation: compose\`. \`dypai_validate\` errors with \`response_cardinality_required\`. Do not unwrap arrays in frontend code.
+7. **\`set_fields\` without \`operation\`** — runtime throws \`Unknown Set Fields operation: undefined\`. Wrapper responses need \`operation: compose\`; adding fields to upstream data uses \`operation: set\`. \`dypai_validate\` / \`backend_validate\` error with \`set_fields_operation_missing\`.
+8. **\`tool_ids\` in YAML instead of \`tools\`** — write \`tools: [name1, name2]\`. \`tool_ids\` bypasses the codec and fails silently in prod.
+9. **Putting workflow placeholders inside \`javascript_code.code\`** — code is raw JavaScript, so JS template literals like \`\${where.join(" AND ")}\` are safe and not rendered by DYPAI. Pass workflow values via \`input_data\`, \`ctx.nodes\`, \`ctx.user\`, or \`ctx.env\`; do not write \`\${input.email}\` inside code or set \`code\` from another node output.
+10. **Human endpoint names** — \`name: Listar videos\` in \`list-videos.yaml\` creates a draft the frontend cannot call as \`list-videos\`. \`dypai_validate\` and \`dypai_push\` reject this; fix the slug instead of testing around it.
 
 → Longer list of common pitfalls + fixes: \`search_docs("troubleshooting")\`.
 
@@ -1102,7 +1103,7 @@ Mental translations: "edge function" → workflow with one code node; "cron" →
 
 SDK is pre-configured at \`src/lib/dypai.ts\` (or \`src/dypai.ts\`). Import \`dypai\` from there. Every method returns \`{ data, error }\` — never throws.
 
-- **API**: \`dypai.api.get(name)\`, \`.post(name, body)\`, \`.put()\`, \`.delete()\`, \`.upload(name, file)\`, \`.stream(name, body)\`. \`response.data\` matches the endpoint \`output\` schema — if SQL returns row arrays, declare \`response_cardinality: single\` or use \`set_fields\`; never unwrap in the UI.
+- **API**: \`dypai.api.get(name)\`, \`.post(name, body)\`, \`.put()\`, \`.delete()\`, \`.upload(name, file)\`, \`.stream(name, body)\`. \`response.data\` matches the endpoint \`output\` schema — if SQL returns row arrays, declare \`response_cardinality: single\` or use \`set_fields operation: compose\`; never unwrap in the UI.
 - **Auth**: \`dypai.auth.signInWithPassword()\`, \`.signUp()\`, \`.signOut()\`, \`.getSession()\`. **Never** create login/signup workflows — auth is built-in.
 - **Hooks**: \`useAuth\`, \`useEndpoint\`, \`useAction\`, \`useUpload\`, \`useRealtime\`, \`<ProtectedRoute>\`.
 - **Rule**: NEVER \`fetch()\` directly — always through the SDK.
@@ -1143,7 +1144,7 @@ async function handleRequest(msg) {
     return makeResponse(id, {
       protocolVersion: "2024-11-05",
       capabilities: { tools: {} },
-      serverInfo: { name: "dypai", version: "1.5.23" },
+      serverInfo: { name: "dypai", version: "1.5.24" },
       instructions: SERVER_INSTRUCTIONS,
     })
   }

package/src/tools/sync/pull.js

@@ -287,6 +287,7 @@ workflow:
     #    \`return: true\` — it marks that node's output as the HTTP body.
     - id: build_response
       type: set_fields
+      operation: compose
       return: true
       fields:
         order_id: \${nodes.insert_order.id}
@@ -297,6 +298,7 @@ workflow:
     #    Multiple return nodes are fine as long as only one runs per execution.
     - id: out_of_stock
       type: set_fields
+      operation: compose
       return: true
       fields:
         error: out_of_stock

package/src/tools/sync/validate.js

@@ -30,6 +30,7 @@ import {
  * Outside the window, sql_table_not_found triggers a remote verification. */
 const SCHEMA_FRESHNESS_MS = 5 * 60 * 1000  // 5 minutes
 const VALID_RESPONSE_CARDINALITIES = new Set(["single", "many", "zero_or_one"])
+const VALID_SET_FIELDS_OPERATIONS = new Set(["set", "compose", "rename", "remove", "keep", "merge"])
 const DATABASE_ROW_ARRAY_OPS = new Set([
   "query",
   "custom_query",
@@ -804,7 +805,8 @@ function buildNodeOutputContracts(nodes, fileMap, ctx) {
     const params = nodeParams(node)
 
     if (nodeType === "set_fields") {
-      const op = nodeField(node, params, "operation") || "set"
+      const op = nodeField(node, params, "operation")
+      if (!op) continue
       const fields = nodeField(node, params, "fields")
       if (fields && typeof fields === "object" && !Array.isArray(fields)) {
         contracts.set(node.id, {
@@ -1437,6 +1439,28 @@ function validateEndpoint(entry, ctx) {
         }
       }
     }
+
+    if (nodeType === "set_fields") {
+      const params = nodeParams(node)
+      const op = nodeField(node, params, "operation")
+      if (!op) {
+        diagnostics.push({
+          severity: "error",
+          rule: "set_fields_operation_missing",
+          endpoint: name, file, loc: `workflow.nodes[${node.id || "?"}]`,
+          message: `set_fields node '${node.id || "(no id)"}' is missing operation.`,
+          fix_hint: "Add operation: compose when building a fresh response object, or operation: set when adding fields to upstream input.",
+        })
+      } else if (!VALID_SET_FIELDS_OPERATIONS.has(op)) {
+        diagnostics.push({
+          severity: "error",
+          rule: "set_fields_operation_invalid",
+          endpoint: name, file, loc: `workflow.nodes[${node.id || "?"}].operation`,
+          message: `set_fields node '${node.id || "(no id)"}' has unsupported operation '${op}'.`,
+          fix_hint: `Use one of: ${[...VALID_SET_FIELDS_OPERATIONS].join(", ")}.`,
+        })
+      }
+    }
     if (node.tool_ids !== undefined && node.tools === undefined) {
       const toolIds = Array.isArray(node.tool_ids) ? node.tool_ids : []
       const legacyUuidToolIds = toolIds.length === 0 || toolIds.every(isUuidString)