@lumibase/mcp-server 1.0.0-rc.2 → 1.0.0-rc.3

package/dist/index.cjs

@@ -234,6 +234,7 @@ var GOVERNED_TOOLS = {
   // `field_name` is this transport's name for the field; the skill reads `name`.
   // Renamed explicitly rather than dropped (see repro R17).
   delete_field: { skill: "deleteField", rename: { field_name: "name" } },
+  create_relation: { skill: "createRelation" },
   delete_relation: { skill: "deleteRelation" },
   // ── access ───────────────────────────────────────────────────────────────
   delete_role: { skill: "deleteRole" },
@@ -241,12 +242,16 @@ var GOVERNED_TOOLS = {
   // ── automation ───────────────────────────────────────────────────────────
   delete_flow: { skill: "deleteFlow" },
   run_flow: { skill: "runFlow" },
+  create_intent: { skill: "createIntent" },
   delete_intent: { skill: "deleteIntent" },
   // ── config ───────────────────────────────────────────────────────────────
   upsert_setting: { skill: "upsertSetting" },
   delete_setting: { skill: "deleteSetting" },
   create_translation: { skill: "createTranslation" },
+  update_translation: { skill: "updateTranslation" },
   delete_translation: { skill: "deleteTranslation" },
+  create_webhook: { skill: "createWebhook" },
+  update_webhook: { skill: "updateWebhook" },
   delete_webhook: { skill: "deleteWebhook" },
   // ── api keys / users / teams ──────────────────────────────────────────────
   create_api_key: { skill: "createApiKey" },
@@ -262,7 +267,17 @@ var GOVERNED_TOOLS = {
   add_team_member: { skill: "addTeamMember", rename: { id: "teamId" } },
   remove_team_member: { skill: "removeTeamMember", rename: { id: "teamId" } },
   // ── extensions ───────────────────────────────────────────────────────────
-  uninstall_extension: { skill: "uninstallExtension" }
+  uninstall_extension: { skill: "uninstallExtension" },
+  // ── cdc ──────────────────────────────────────────────────────────────────
+  // The change-feed skills name the subscription `subscriptionId` (as
+  // `getCdcSubscriptionStatus`/`replayCdcSubscription` do); the CRUD-generated
+  // stdio tool takes it as `id`, like every other `delete_*` tool.
+  // Known divergence, not a skipped gate: the harness builds `SubscriptionService`
+  // without `cache`/`audit`, so REST's `cdc_subscription_deleted` audit-log row
+  // and feed-flag cache eviction do not happen on this path. The run, tool-call
+  // and approval rows record the deletion instead, and the flag cache expires on
+  // its own TTL.
+  delete_cdc_subscription: { skill: "deleteCdcSubscription", rename: { id: "subscriptionId" } }
 };
 var UNGOVERNED_MUTATIONS = {
   // Skill exists, but the canonical contract is narrower than what this tool
@@ -271,17 +286,14 @@ var UNGOVERNED_MUTATIONS = {
   create_policy: "contract-narrower-than-tool: enforceTfa/ipAllow/ipDeny/validFrom/validUntil",
   create_role: "contract-narrower-than-tool: systemKey",
   cdc_subscription_replay: "contract-narrower-than-tool: cursor has no canonical counterpart",
-  // Skill exists but has no canonical input contract yet.
-  create_cdc_subscription: "no-canonical-contract",
-  delete_cdc_subscription: "no-canonical-contract",
-  create_flow: "no-canonical-contract",
-  create_intent: "no-canonical-contract",
-  create_relation: "no-canonical-contract",
-  create_webhook: "no-canonical-contract",
-  update_webhook: "no-canonical-contract",
-  update_translation: "no-canonical-contract",
-  install_extension: "no-canonical-contract",
-  update_extension: "no-canonical-contract",
+  create_cdc_subscription: "contract-narrower-than-tool: payload_mode \u2014 the createCdcSubscription handler never forwards it, so a snapshot subscription would be created as reference",
+  // Skill and canonical contract both exist and accept the advertised arguments,
+  // but the skill's handler skips checks the REST route applies. Routing would
+  // add HITL and remove those checks, so these stay on REST until the handler
+  // carries them.
+  create_flow: "skill-weaker-than-rest: createFlow skips the active-graph validation and schedule-cron check of POST /flows and never sets nextRunAt, so an active schedule flow would never fire",
+  install_extension: "skill-weaker-than-rest: installExtension skips the bundle signature check, the reserved lumibase-* namespace check and the per-action extensions:* permission probes of POST /extensions",
+  update_extension: "skill-weaker-than-rest: updateExtension skips the per-action extensions:* permission probes, the unverified-official enable refusal, sandbox cache eviction and CDC subscription sync of PATCH /extensions/:id",
   // No skill at all: nothing to route to. Listed so the set is closed.
   add_policy_permission: "no-skill",
   apply_access_import: "no-skill",

package/dist/index.js

@@ -233,6 +233,7 @@ var GOVERNED_TOOLS = {
   // `field_name` is this transport's name for the field; the skill reads `name`.
   // Renamed explicitly rather than dropped (see repro R17).
   delete_field: { skill: "deleteField", rename: { field_name: "name" } },
+  create_relation: { skill: "createRelation" },
   delete_relation: { skill: "deleteRelation" },
   // ── access ───────────────────────────────────────────────────────────────
   delete_role: { skill: "deleteRole" },
@@ -240,12 +241,16 @@ var GOVERNED_TOOLS = {
   // ── automation ───────────────────────────────────────────────────────────
   delete_flow: { skill: "deleteFlow" },
   run_flow: { skill: "runFlow" },
+  create_intent: { skill: "createIntent" },
   delete_intent: { skill: "deleteIntent" },
   // ── config ───────────────────────────────────────────────────────────────
   upsert_setting: { skill: "upsertSetting" },
   delete_setting: { skill: "deleteSetting" },
   create_translation: { skill: "createTranslation" },
+  update_translation: { skill: "updateTranslation" },
   delete_translation: { skill: "deleteTranslation" },
+  create_webhook: { skill: "createWebhook" },
+  update_webhook: { skill: "updateWebhook" },
   delete_webhook: { skill: "deleteWebhook" },
   // ── api keys / users / teams ──────────────────────────────────────────────
   create_api_key: { skill: "createApiKey" },
@@ -261,7 +266,17 @@ var GOVERNED_TOOLS = {
   add_team_member: { skill: "addTeamMember", rename: { id: "teamId" } },
   remove_team_member: { skill: "removeTeamMember", rename: { id: "teamId" } },
   // ── extensions ───────────────────────────────────────────────────────────
-  uninstall_extension: { skill: "uninstallExtension" }
+  uninstall_extension: { skill: "uninstallExtension" },
+  // ── cdc ──────────────────────────────────────────────────────────────────
+  // The change-feed skills name the subscription `subscriptionId` (as
+  // `getCdcSubscriptionStatus`/`replayCdcSubscription` do); the CRUD-generated
+  // stdio tool takes it as `id`, like every other `delete_*` tool.
+  // Known divergence, not a skipped gate: the harness builds `SubscriptionService`
+  // without `cache`/`audit`, so REST's `cdc_subscription_deleted` audit-log row
+  // and feed-flag cache eviction do not happen on this path. The run, tool-call
+  // and approval rows record the deletion instead, and the flag cache expires on
+  // its own TTL.
+  delete_cdc_subscription: { skill: "deleteCdcSubscription", rename: { id: "subscriptionId" } }
 };
 var UNGOVERNED_MUTATIONS = {
   // Skill exists, but the canonical contract is narrower than what this tool
@@ -270,17 +285,14 @@ var UNGOVERNED_MUTATIONS = {
   create_policy: "contract-narrower-than-tool: enforceTfa/ipAllow/ipDeny/validFrom/validUntil",
   create_role: "contract-narrower-than-tool: systemKey",
   cdc_subscription_replay: "contract-narrower-than-tool: cursor has no canonical counterpart",
-  // Skill exists but has no canonical input contract yet.
-  create_cdc_subscription: "no-canonical-contract",
-  delete_cdc_subscription: "no-canonical-contract",
-  create_flow: "no-canonical-contract",
-  create_intent: "no-canonical-contract",
-  create_relation: "no-canonical-contract",
-  create_webhook: "no-canonical-contract",
-  update_webhook: "no-canonical-contract",
-  update_translation: "no-canonical-contract",
-  install_extension: "no-canonical-contract",
-  update_extension: "no-canonical-contract",
+  create_cdc_subscription: "contract-narrower-than-tool: payload_mode \u2014 the createCdcSubscription handler never forwards it, so a snapshot subscription would be created as reference",
+  // Skill and canonical contract both exist and accept the advertised arguments,
+  // but the skill's handler skips checks the REST route applies. Routing would
+  // add HITL and remove those checks, so these stay on REST until the handler
+  // carries them.
+  create_flow: "skill-weaker-than-rest: createFlow skips the active-graph validation and schedule-cron check of POST /flows and never sets nextRunAt, so an active schedule flow would never fire",
+  install_extension: "skill-weaker-than-rest: installExtension skips the bundle signature check, the reserved lumibase-* namespace check and the per-action extensions:* permission probes of POST /extensions",
+  update_extension: "skill-weaker-than-rest: updateExtension skips the per-action extensions:* permission probes, the unverified-official enable refusal, sandbox cache eviction and CDC subscription sync of PATCH /extensions/:id",
   // No skill at all: nothing to route to. Listed so the set is closed.
   add_policy_permission: "no-skill",
   apply_access_import: "no-skill",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumibase/mcp-server",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.3",
   "description": "LumiBase MCP server — lets AI assistants manage the full LumiBase Content OS: collections, fields, items, relations, RBAC (roles/policies/permissions/API keys), users & teams, intents, flows, webhooks, translations & translation memory, search, media & transform presets, read-only insights, presets, editorial workflow, content releases, share links, read-only deployments, extensions, and site administration.",
   "license": "Apache-2.0",
   "type": "module",
@@ -27,13 +27,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "zod": "^4.5.4"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.6.2",
     "tsup": "^8.5.1",
     "typescript": "^5.6.2",
-    "vitest": "^5.0.0"
+    "vitest": "^5.0.1"
   },
   "files": [
     "dist"