@miadi/connector 0.1.5 → 0.1.7

package/dist/tools.js

@@ -16,7 +16,7 @@ import { reviewIdOf, videoIdOf } from "./reviews.js";
 import { SCOPE_APPROVE, SCOPE_CONTRIBUTE } from "./oauth.js";
 import { CIRCLES, CIRCLE_IDS, CLAIM_CATEGORIES, DOMAINS, HANDOFF_STATES, current, newRecordId, } from "./records.js";
 import { VERSION } from "./version.js";
-import { DECISIONS, consequenceOf, decide, isApprovable, readQueueState } from "./approve.js";
+import { AlreadyDecided, DECISIONS, KIND_LABELS, consequenceOf, decide, isApprovable, readQueueState } from "./approve.js";
 import { DECISIONS_CARD_HTML, DECISIONS_CARD_URI, DECISION_TOKENS_META } from "./decisions.js";
 import { join } from "node:path";
 import { artefactVisibility, readArtefactWeave, saveResearchArtefact } from "@miadi/inquiry-weave";
@@ -84,6 +84,39 @@ function episodeRef(input) {
 }
 export function registerTools(server, ctx) {
     const { config, miadi, reviews, ledger } = ctx;
+    // One server is made per request, so the person a tool call runs for is this request's viewer.
+    let viewer;
+    /**
+     * The signed-in person, held to Miadi's read tier unless the tool says
+     * otherwise: a person Miadi gives no API tier reaches only get_capabilities.
+     */
+    const who = (extra, minTier = "read") => {
+        const found = personOf(extra);
+        if (minTier === "read")
+            requireTier(found.person, "read");
+        viewer = found.person;
+        return found;
+    };
+    /**
+     * What a record shows to the viewer. Below the write tier, someone else's
+     * record keeps its story but not the operator details a session view also
+     * withholds (session, cwd, the seat a brief went to) nor long bodies.
+     */
+    const redact = (r) => {
+        if (!viewer || viewer.api_tier === "write" || r.actor.person_id === viewer.id)
+            return r;
+        const body = { ...r.body };
+        for (const k of ["session", "cwd", "session_id"])
+            delete body[k];
+        for (const k of ["markdown", "transcript"])
+            if (typeof body[k] === "string")
+                body[k] = `${body[k].length} chars`;
+        const receipt = r.completion_receipt ? { ...r.completion_receipt } : undefined;
+        if (receipt)
+            for (const k of ["to", "file", "session_id"])
+                delete receipt[k];
+        return { ...r, body, ...(receipt ? { completion_receipt: receipt } : {}) };
+    };
     const actorOf = (person, auth) => {
         const client = ctx.oauthState.read().clients[auth.clientId];
         return { person_id: person.id, name: person.name, client_id: auth.clientId, ...(client?.client_name ? { client_name: client.client_name } : {}) };
@@ -91,7 +124,11 @@ export function registerTools(server, ctx) {
     const approvalUrl = (id) => `${config.publicUrl}/approve/${encodeURIComponent(id)}`;
     const append = (kind, person, auth, fields) => {
         if (fields.idempotency_key) {
-            const prior = ledger.all().find((r) => r.kind === kind && r.idempotency_key === fields.idempotency_key && r.actor.person_id === person.id);
+            // A request already decided (approved, declined, sent back) is not handed back: the same key makes a new one.
+            const prior = all().find((r) => r.kind === kind &&
+                r.idempotency_key === fields.idempotency_key &&
+                r.actor.person_id === person.id &&
+                (r.approval_state === undefined || r.approval_state === "awaiting_approval" || r.approval_state === "not_required"));
             if (prior)
                 return prior;
         }
@@ -105,7 +142,9 @@ export function registerTools(server, ctx) {
             ...fields,
         });
     };
-    const records = () => current(ledger.all());
+    /** Every record, folded; for logic. What a tool returns goes through `shown`. */
+    const all = () => current(ledger.all());
+    const records = () => all().map(redact);
     const uploads = new ResearchUploads(join(config.stateDir, "uploads"));
     const touching = (ref) => records().filter((r) => r.refs.includes(ref) || r.evidence_refs.includes(ref) || r.id === ref);
     // ── reads ──────────────────────────────────────────────────────────────
@@ -115,7 +154,7 @@ export function registerTools(server, ctx) {
         inputSchema: {},
         annotations: READ,
     }, wrap(async (_args, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra, "none");
         const miadiUp = await miadi.get(person.token, "/api/identity/me").then(() => "reachable", (e) => (e instanceof MiadiError && e.status === 0 ? "unavailable" : "reachable"));
         return {
             service: "@miadi/connector",
@@ -146,7 +185,7 @@ export function registerTools(server, ctx) {
         inputSchema: { ref: z.string().min(1) },
         annotations: READ,
     }, wrap(async ({ ref }, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         const r = ref.trim();
         const cited = touching(r);
         if (/^session:/.test(r)) {
@@ -163,6 +202,7 @@ export function registerTools(server, ctx) {
         if (issue) {
             const res = await fetch(`https://api.github.com/repos/${issue[1]}/${issue[2]}/issues/${issue[3]}`, {
                 headers: { accept: "application/vnd.github+json", ...(process.env.GITHUB_TOKEN ? { authorization: `Bearer ${process.env.GITHUB_TOKEN}` } : {}) },
+                signal: AbortSignal.timeout(15_000),
             });
             if (!res.ok)
                 return { ref: r, kind: "github_issue", state: res.status === 404 ? "not_found_or_private" : `github_${res.status}`, cited_by: cited };
@@ -200,7 +240,7 @@ export function registerTools(server, ctx) {
         inputSchema: {},
         annotations: READ,
     }, wrap(async (_args, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         const open = records().filter((r) => r.kind === "handoff" && r.state !== "completed" && r.state !== "withdrawn");
         const talking = await miadi.get(person.token, "/api/circles").then((b) => (b.circles ?? []).map((c) => ({ id: c.id, name: c.name, intention: c.intention, member: c.member ?? undefined })), (e) => ({ state: e instanceof MiadiError ? `miadi_${e.status}` : "unavailable" }));
         return {
@@ -215,7 +255,7 @@ export function registerTools(server, ctx) {
         inputSchema: { circle_id: z.string().min(1) },
         annotations: READ,
     }, wrap(async ({ circle_id }, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         const five = CIRCLES.find((c) => c.id === circle_id.toLowerCase());
         if (five) {
             const mine = records().filter((r) => r.circle === five.id || r.to_circle === five.id || r.from_circle === five.id);
@@ -241,7 +281,7 @@ export function registerTools(server, ctx) {
         },
         annotations: READ,
     }, wrap(async (args, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         requireTier(person, "write");
         const qs = new URLSearchParams();
         if (args.episode)
@@ -263,7 +303,7 @@ export function registerTools(server, ctx) {
         inputSchema: { session_id: z.string().min(8) },
         annotations: READ,
     }, wrap(async ({ session_id }, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         requireTier(person, "write");
         const id = session_id.replace(/^session:/, "");
         const session = await miadi.get(person.token, `/api/session/${encodeURIComponent(id)}`);
@@ -275,7 +315,7 @@ export function registerTools(server, ctx) {
         inputSchema: { episode: z.string().min(1).describe("miadi-chronicle://<n>, an episode number or its folder.") },
         annotations: READ,
     }, wrap(async ({ episode }, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         const ref = episodeRef(episode);
         const [files, screenwalks, epReviews] = await Promise.all([
             miadi.get(person.token, `/api/chronicle/episodes/${ref}/files`).catch(asState),
@@ -296,7 +336,7 @@ export function registerTools(server, ctx) {
         inputSchema: { episode: z.string().optional(), subject_ref: z.string().optional() },
         annotations: READ,
     }, wrap(async ({ episode, subject_ref }, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         const evals = records().filter((r) => r.kind === "observation" && typeof r.body?.assessment === "string");
         const scoped = subject_ref ? evals.filter((r) => r.refs.includes(subject_ref)) : evals;
         return {
@@ -311,7 +351,7 @@ export function registerTools(server, ctx) {
         inputSchema: { project: z.string().optional().describe("NCP studio project id, e.g. chimera."), episode: z.string().optional() },
         annotations: READ,
     }, wrap(async ({ project, episode }, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         let ncp = "give a project id to read its story beats";
         if (project) {
             ncp = await miadi.get(person.token, `/api/ncp/projects/${encodeURIComponent(project)}`).then((b) => ({ project: project, beats: collectBeats(b?.project), validation: b?.validation ?? null }), asState);
@@ -325,7 +365,7 @@ export function registerTools(server, ctx) {
         inputSchema: { query: z.string().min(1) },
         annotations: READ,
     }, wrap(async ({ query }, extra) => {
-        const { person } = personOf(extra);
+        const { person } = who(extra);
         const id = reviewIdOf(query);
         if (id) {
             const r = await reviews.get(id);
@@ -371,7 +411,7 @@ export function registerTools(server, ctx) {
         inputSchema: { ref: z.string().optional(), circle: circle.optional(), state: z.enum(HANDOFF_STATES).optional() },
         annotations: READ,
     }, wrap(async ({ ref, circle: c, state }, extra) => {
-        personOf(extra);
+        who(extra);
         let list = records().filter((r) => r.kind === "handoff" || r.kind === "source_intent");
         if (ref)
             list = list.filter((r) => r.id === ref || r.refs.includes(ref) || r.evidence_refs.includes(ref));
@@ -394,7 +434,7 @@ export function registerTools(server, ctx) {
         },
         annotations: READ,
     }, wrap(async (a, extra) => {
-        personOf(extra);
+        who(extra);
         let list = records();
         if (a.kind)
             list = list.filter((r) => r.kind === a.kind);
@@ -413,7 +453,7 @@ export function registerTools(server, ctx) {
         inputSchema: { record_id: z.string().min(1) },
         annotations: READ,
     }, wrap(async ({ record_id }, extra) => {
-        personOf(extra);
+        who(extra);
         const r = records().find((x) => x.id === record_id);
         if (!r)
             return { state: "not_found", record_id };
@@ -433,7 +473,7 @@ export function registerTools(server, ctx) {
         inputSchema: { query: z.string().min(1) },
         annotations: READ,
     }, wrap(async ({ query }, extra) => {
-        personOf(extra);
+        who(extra);
         const needle = query.toLowerCase();
         const results = [];
         if (reviews.canSearch) {
@@ -456,7 +496,7 @@ export function registerTools(server, ctx) {
         inputSchema: { id: z.string().min(1) },
         annotations: READ,
     }, wrap(async ({ id }, extra) => {
-        personOf(extra);
+        who(extra);
         const reviewId = reviewIdOf(id);
         if (reviewId) {
             const r = await reviews.get(reviewId);
@@ -490,7 +530,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         return append("observation", person, auth, {
             claim_category: a.claim_category,
@@ -511,7 +551,7 @@ export function registerTools(server, ctx) {
         inputSchema: { question: z.string().min(1).max(5000), refs, circle: circle.optional(), episode: z.string().optional(), ...base },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         return append("inquiry", person, auth, {
             circle: a.circle,
@@ -529,7 +569,7 @@ export function registerTools(server, ctx) {
         inputSchema: { from: z.string().min(1), to: z.string().min(1), relation: z.string().min(1).max(80), note: z.string().max(2000).optional(), ...base },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         return append("link", person, auth, {
             refs: [a.from, a.to],
@@ -552,7 +592,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         return append("observation", person, auth, {
             circle: "story",
@@ -579,7 +619,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         return append("observation", person, auth, {
             circle: "evaluation",
@@ -604,7 +644,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         const video = videoIdOf(a.video);
         if (!video)
@@ -634,7 +674,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         return append("handoff", person, auth, {
             from_circle: a.from_circle,
@@ -662,14 +702,20 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
-        const target = records().find((r) => r.id === a.record_id);
+        const target = all().find((r) => r.id === a.record_id);
         if (!target)
             return { state: "not_found", record_id: a.record_id };
         if (!["handoff", "inquiry", "source_intent", "observation", "work_proposal"].includes(target.kind)) {
             throw new ToolRefusal("not_updatable", `A ${target.kind} changes through its approval, not here.`);
         }
+        if (target.actor.person_id !== person.id && person.api_tier !== "write") {
+            throw new ToolRefusal("forbidden", "Only the person who made this record, or someone with Miadi's write tier, moves it on.");
+        }
+        if (isApprovable(target) && a.completion_receipt) {
+            throw new ToolRefusal("not_updatable", "A request's receipt comes from its decision, not from update_handoff.");
+        }
         append(target.kind, person, auth, {
             supersedes: target.id,
             refs: target.refs,
@@ -693,7 +739,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         const r = append("work_proposal", person, auth, {
             circle: a.circle,
@@ -720,7 +766,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         const start = new Date(a.start);
         if (Number.isNaN(start.getTime()))
@@ -744,7 +790,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         const id = a.session_id.replace(/^session:/, "");
         const r = append("session_completion_proposal", person, auth, {
@@ -771,7 +817,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         const r = append("run_request", person, auth, {
             circle: a.circle,
@@ -799,7 +845,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         const reviewId = a.review_id ? reviewIdOf(a.review_id) : null;
         const video = a.video ? videoIdOf(a.video) : null;
@@ -834,7 +880,7 @@ export function registerTools(server, ctx) {
         inputSchema: { review_id: z.string().min(8), version: z.number().int().min(1), episode: z.string().optional(), ...base },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         const id = reviewIdOf(a.review_id);
         if (!id)
@@ -865,7 +911,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         const id = reviewIdOf(a.review_id);
         if (!id)
@@ -899,7 +945,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         if (!config.inquiryRoot || !config.inquiryRepo)
             throw new ToolRefusal("unavailable", "This connector host has no inquiry shelf configured.");
@@ -968,7 +1014,7 @@ export function registerTools(server, ctx) {
         },
         annotations: WRITE,
     }, wrap(async (a, extra) => {
-        const { person, auth } = personOf(extra);
+        const { person, auth } = who(extra);
         requireContribute(auth);
         if (Boolean(a.episode) === Boolean(a.new_episode_title)) {
             throw new ToolRefusal("invalid_input", "Name either an existing episode or a new episode title, not both.");
@@ -1003,15 +1049,6 @@ export function registerTools(server, ctx) {
         return { ...r, approval_url: approvalUrl(r.id) };
     }));
     // ── decisions inside the conversation ─────────────────────────────────
-    const KIND_LABEL = {
-        run_request: "Agent run",
-        work_proposal: "Work proposal",
-        review_operation_request: "Review operation",
-        deep_diver_request: "Deep Diver",
-        review_episode_link_request: "Review into an episode",
-        inquiry_episode_request: "Inquiry into an episode",
-        session_completion_proposal: "Session ending",
-    };
     const titleOf = (r) => {
         const b = r.body;
         const t = b.title ?? b.task ?? b.desired_outcome ?? b.reason ?? b.operation ?? b.artefact ?? r.intention ?? r.kind;
@@ -1043,9 +1080,9 @@ export function registerTools(server, ctx) {
         _meta: { ui: { resourceUri: DECISIONS_CARD_URI }, "openai/outputTemplate": DECISIONS_CARD_URI, "openai/toolInvocation/invoking": "Gathering requests", "openai/toolInvocation/invoked": "Requests shown" },
     }, async ({ record_id }, extra) => {
         try {
-            const { person, auth } = personOf(extra);
+            const { person, auth } = who(extra);
             const writer = person.api_tier === "write";
-            const waiting = records()
+            const waiting = all()
                 .filter((r) => r.approval_state === "awaiting_approval" && isApprovable(r))
                 .filter((r) => writer || r.actor.person_id === person.id)
                 .filter((r) => !record_id || r.id === record_id)
@@ -1060,7 +1097,7 @@ export function registerTools(server, ctx) {
             const decisions = waiting.map((r) => ({
                 id: r.id,
                 kind: r.kind,
-                kind_label: KIND_LABEL[r.kind] ?? r.kind,
+                kind_label: KIND_LABELS[r.kind] ?? r.kind,
                 title: titleOf(r),
                 by: r.actor.name,
                 via: r.actor.client_name,
@@ -1100,16 +1137,17 @@ export function registerTools(server, ctx) {
             decision_token: z.string().min(10).max(200),
         },
         annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
-        _meta: { ui: { resourceUri: DECISIONS_CARD_URI, visibility: ["app"] }, "openai/widgetAccessible": true },
+        // A card-only tool renders nothing itself: ChatGPT refuses a widget on a private tool.
+        _meta: { ui: { visibility: ["app"] }, "openai/widgetAccessible": true },
     }, async (a, extra) => {
         try {
-            const { person, auth } = personOf(extra);
+            const { person, auth } = who(extra);
             if (!auth.scopes.includes(SCOPE_APPROVE))
                 throw new ToolRefusal("insufficient_scope", "This sign-in does not allow approving inside this client.");
             requireTier(person, "write");
             if (!ctx.decisionTokens || !ctx.approval)
                 throw new ToolRefusal("unavailable", "In-chat decisions are not configured on this connector.");
-            const r = records().find((x) => x.id === a.record_id);
+            const r = all().find((x) => x.id === a.record_id);
             if (!isApprovable(r))
                 throw new ToolRefusal("not_found", "No request with that id.");
             const check = ctx.decisionTokens.verify(a.decision_token, r.id, person.id, auth.clientId);
@@ -1135,8 +1173,8 @@ export function registerTools(server, ctx) {
             return { structuredContent: out, content: [{ type: "text", text: JSON.stringify(out, null, 2) }] };
         }
         catch (error) {
-            if (error instanceof ToolRefusal) {
-                const out = { error: error.code, message: error.message };
+            if (error instanceof ToolRefusal || error instanceof AlreadyDecided) {
+                const out = error instanceof AlreadyDecided ? { error: "already_decided", message: error.message } : { error: error.code, message: error.message };
                 return { isError: true, structuredContent: out, content: [{ type: "text", text: JSON.stringify(out, null, 2) }] };
             }
             return fail({ error: "failed", message: error instanceof Error ? error.message : String(error) });

package/dist/uploads.d.ts

@@ -1,4 +1,6 @@
 export declare const MAX_UPLOAD_CHARS = 5000000;
+/** An upload whose last part never came is dropped after a day. */
+export declare const UPLOAD_TTL_MS: number;
 export declare class UploadRefusal extends Error {
 }
 export declare class ResearchUploads {
@@ -24,4 +26,5 @@ export declare class ResearchUploads {
         text: string;
         meta: Record<string, unknown>;
     };
+    private prune;
 }

package/dist/uploads.js

@@ -4,10 +4,12 @@
  * joined in order, exactly, and the upload is removed. One person's upload is
  * never readable by another.
  */
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 export const MAX_UPLOAD_CHARS = 5_000_000;
+/** An upload whose last part never came is dropped after a day. */
+export const UPLOAD_TTL_MS = 24 * 3600 * 1000;
 export class UploadRefusal extends Error {
 }
 export class ResearchUploads {
@@ -22,6 +24,7 @@ export class ResearchUploads {
     }
     receive(personId, input) {
         mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        this.prune();
         let up;
         if (input.upload_id) {
             const p = this.path(input.upload_id);
@@ -51,4 +54,18 @@ export class ResearchUploads {
         rmSync(this.path(up.id), { force: true });
         return { complete: true, upload_id: up.id, text, meta: up.meta };
     }
+    prune(now = Date.now()) {
+        for (const name of readdirSync(this.dir)) {
+            if (!/^upload-[0-9a-f-]{36}\.json$/.test(name))
+                continue;
+            const p = join(this.dir, name);
+            try {
+                if (now - statSync(p).mtimeMs > UPLOAD_TTL_MS)
+                    rmSync(p, { force: true });
+            }
+            catch {
+                /* removed by another call meanwhile */
+            }
+        }
+    }
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.5";
+export declare const VERSION = "0.1.7";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.1.5";
+export const VERSION = "0.1.7";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miadi/connector",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "The Miadi connector: one remote MCP service through which a person signed in with their Miadi person token, from ChatGPT or any MCP client, reads sessions, reviews, episodes and circles and records observations, inquiries, handoffs and proposals with their name on each record.",
   "license": "MIT",
   "author": "Miadi",
@@ -30,6 +30,7 @@
     "@miadi/node-service-kit": "0.1.2",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.2.1",
     "zod": "^4.4.0"
   },
   "devDependencies": {