@questpie/mcp 3.28.5 → 3.28.6

package/dist/{create-server-CEWFf041.mjs → create-server-Ty80vPGh.mjs}

@@ -237,6 +237,7 @@ function normalizePolicy(defaults, override) {
 		workload: defaults.workload,
 		operationWorkloads: { ...defaults.operationWorkloads ?? {} },
 		fields: defaults.fields,
+		relationLoading: defaults.relationLoading,
 		description: defaults.description
 	};
 	if (override === void 0) return base;
@@ -1244,6 +1245,7 @@ function toRequestContext(ctx, accessMode) {
 	return {
 		session: ctx.session,
 		principal: ctx.principal,
+		actor: ctx.actor,
 		locale: ctx.locale,
 		defaultLocale: ctx.defaultLocale,
 		localeFallback: ctx.localeFallback,
@@ -1251,7 +1253,10 @@ function toRequestContext(ctx, accessMode) {
 		stage: ctx.stage,
 		requestId: ctx.requestId,
 		traceId: ctx.traceId,
+		workload: ctx.workload,
+		logger: ctx.logger,
 		db: ctx.db,
+		request: ctx.request,
 		"~contextExtensions": ctx["~contextExtensions"]
 	};
 }
@@ -1555,7 +1560,12 @@ async function executeWorkloadTool(boundary, authorized, metadata, execution, in
 //#endregion
 //#region src/server/crud-tools.ts
 const idSchema = z.union([z.string(), z.number()]);
-const deleteSchema = z.object({ id: idSchema }).strict();
+function optimisticConcurrencyEnabled(collection) {
+	return collection.state?.options?.optimisticConcurrency === true;
+}
+function expectedRevisionShape(collection) {
+	return optimisticConcurrencyEnabled(collection) ? { expectedRevision: z.number().int().min(1) } : {};
+}
 const MAX_QUERY_FIELDS = 64;
 const MAX_WHERE_DEPTH = 3;
 const MAX_LOGICAL_CLAUSES = 16;
@@ -1617,7 +1627,7 @@ function relationLoadSchema(relations) {
 function collectionReadSchemas(collection, policy) {
 	const fields = allowedEntityFieldNames(collection, policy);
 	const common = {
-		with: relationLoadSchema(allowedEntityRelationNames(collection, policy)).optional(),
+		with: relationLoadSchema(policy.relationLoading === false ? [] : allowedEntityRelationNames(collection, policy)).optional(),
 		columns: columnsSchema(fields).optional(),
 		locale: z.string().max(64).optional(),
 		includeDeleted: z.boolean().optional(),
@@ -1645,7 +1655,7 @@ function collectionReadSchemas(collection, policy) {
 function globalOperationBaseSchema(global, policy) {
 	const fields = allowedEntityFieldNames(global, policy);
 	return {
-		with: relationLoadSchema(allowedEntityRelationNames(global, policy)).optional(),
+		with: relationLoadSchema(policy.relationLoading === false ? [] : allowedEntityRelationNames(global, policy)).optional(),
 		columns: columnsSchema(fields).optional(),
 		locale: z.string().max(64).optional(),
 		stage: z.string().max(64).optional()
@@ -1656,10 +1666,14 @@ const COLLECTION_OPERATIONS = [
 		name: "list",
 		kind: "read",
 		description: (name) => `List ${name} records.`,
-		execute: (crud, input, ctx, maxLimit) => crud.find({
-			...input,
-			limit: Math.min(input.limit ?? maxLimit, maxLimit)
-		}, ctx)
+		execute: (crud, input, ctx, maxLimit) => {
+			const { sort, ...options } = input;
+			return crud.find({
+				...options,
+				...sort === void 0 ? {} : { orderBy: sort },
+				limit: Math.min(input.limit ?? maxLimit, maxLimit)
+			}, ctx);
+		}
 	},
 	{
 		name: "count",
@@ -1691,14 +1705,18 @@ const COLLECTION_OPERATIONS = [
 		description: (name) => `Update a ${name} record by id.`,
 		execute: (crud, input, ctx) => crud.updateById({
 			id: input.id,
-			data: input.data
+			data: input.data,
+			...input.expectedRevision === void 0 ? {} : { expectedRevision: input.expectedRevision }
 		}, ctx)
 	},
 	{
 		name: "delete",
 		kind: "delete",
 		description: (name) => `Delete a ${name} record by id.`,
-		execute: (crud, input, ctx) => crud.deleteById({ id: input.id }, ctx)
+		execute: (crud, input, ctx) => crud.deleteById({
+			id: input.id,
+			...input.expectedRevision === void 0 ? {} : { expectedRevision: input.expectedRevision }
+		}, ctx)
 	}
 ];
 const GLOBAL_OPERATIONS = [{
@@ -1719,9 +1737,14 @@ function collectionOperationSchema(operationName, collection, policy) {
 	if (operationName === "create") return z.object({ data: createCollectionDataSchema(collection, "create", policy) }).strict();
 	if (operationName === "update") return z.object({
 		id: idSchema,
-		data: createCollectionDataSchema(collection, "update", policy)
+		data: createCollectionDataSchema(collection, "update", policy),
+		...expectedRevisionShape(collection)
+	}).strict();
+	if (operationName === "delete") return z.object({
+		id: idSchema,
+		...expectedRevisionShape(collection)
 	}).strict();
-	return collectionReadSchemas(collection, policy)[operationName] ?? deleteSchema;
+	return collectionReadSchemas(collection, policy)[operationName];
 }
 function globalOperationSchema(operationName, global, policy) {
 	if (operationName === "update") return z.object({
@@ -1732,13 +1755,10 @@ function globalOperationSchema(operationName, global, policy) {
 }
 async function questpieAllows(scope, ctx, kind, name, operationName) {
 	if (scope.accessMode === "system") return true;
-	const crudContext = {
-		db: ctx.db ?? scope.app.db,
-		session: ctx.session,
-		locale: ctx.locale,
-		accessMode: scope.accessMode,
-		stage: ctx.stage
-	};
+	const crudContext = toRequestContext({
+		...ctx,
+		db: ctx.db ?? scope.app.db
+	}, scope.accessMode);
 	if (kind === "collection") {
 		const collection = scope.app.getCollections()[name];
 		const schema$1 = await introspectCollection(collection, crudContext, scope.app);
@@ -2039,24 +2059,18 @@ function executeResource(scope, operation, input, extra, invoke) {
 async function collectionSchema(scope, name) {
 	const ctx = await scope.getContext();
 	const collection = scope.app.getCollections()[name];
-	return introspectCollection(collection, {
-		db: ctx.db ?? scope.app.db,
-		session: ctx.session,
-		locale: ctx.locale,
-		accessMode: scope.accessMode,
-		stage: ctx.stage
-	}, scope.app);
+	return introspectCollection(collection, toRequestContext({
+		...ctx,
+		db: ctx.db ?? scope.app.db
+	}, scope.accessMode), scope.app);
 }
 async function globalSchema(scope, name) {
 	const ctx = await scope.getContext();
 	const global = scope.app.getGlobals()[name];
-	return introspectGlobal(global, {
-		db: ctx.db ?? scope.app.db,
-		session: ctx.session,
-		locale: ctx.locale,
-		accessMode: scope.accessMode,
-		stage: ctx.stage
-	}, scope.app);
+	return introspectGlobal(global, toRequestContext({
+		...ctx,
+		db: ctx.db ?? scope.app.db
+	}, scope.accessMode), scope.app);
 }
 async function visibleCollections(scope, catalog) {
 	const entries = [];

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { n as mcpModule } from "./index-C3gm6ar5.mjs";
-import { A as McpWorkloadAuthorizer, B as WorkloadMcpServerOptions, C as McpToolConfig, D as McpWorkloadAuditEvent, E as McpTransportKind, F as McpWorkloadHandoffInput, I as McpWorkloadRequirement, L as McpWorkloadToolFacts, M as McpWorkloadContextBindingInput, N as McpWorkloadExecutionControl, O as McpWorkloadAuthorization, P as McpWorkloadHandoff, R as McpWorkloadToolKind, S as McpStdioConfig, T as McpToolHandlerArgs, _ as McpProgrammaticToolResult, a as McpAccessRule, b as McpResourcesConfig, c as McpCrudConfig, d as McpExecutionDiagnosticEvent, f as McpExecutionLimits, g as McpProgrammaticTool, h as McpProgrammaticRequestOptions, i as McpAccessMode, j as McpWorkloadContextBinder, k as McpWorkloadAuthorizationRequest, l as McpEntityPolicy, m as McpHttpConfig, n as QuestpieApp, o as McpAccessRuleContext, p as McpExecutionOptions, r as mcpPublicErrorCode, s as McpConfig, t as startStdioServer, u as McpExecutionConfig, v as McpPublicErrorCode, w as McpToolDefinition, x as McpRoutesConfig, y as McpRequiredScopes, z as McpWorkloadToolPort } from "./stdio-YoM70-42.mjs";
+import { A as McpWorkloadAuthorizer, B as WorkloadMcpServerOptions, C as McpToolConfig, D as McpWorkloadAuditEvent, E as McpTransportKind, F as McpWorkloadHandoffInput, I as McpWorkloadRequirement, L as McpWorkloadToolFacts, M as McpWorkloadContextBindingInput, N as McpWorkloadExecutionControl, O as McpWorkloadAuthorization, P as McpWorkloadHandoff, R as McpWorkloadToolKind, S as McpStdioConfig, T as McpToolHandlerArgs, _ as McpProgrammaticToolResult, a as McpAccessRule, b as McpResourcesConfig, c as McpCrudConfig, d as McpExecutionDiagnosticEvent, f as McpExecutionLimits, g as McpProgrammaticTool, h as McpProgrammaticRequestOptions, i as McpAccessMode, j as McpWorkloadContextBinder, k as McpWorkloadAuthorizationRequest, l as McpEntityPolicy, m as McpHttpConfig, n as QuestpieApp, o as McpAccessRuleContext, p as McpExecutionOptions, r as mcpPublicErrorCode, s as McpConfig, t as startStdioServer, u as McpExecutionConfig, v as McpPublicErrorCode, w as McpToolDefinition, x as McpRoutesConfig, y as McpRequiredScopes, z as McpWorkloadToolPort } from "./stdio-C3663EKG.mjs";
 import { t as mcpPlugin } from "./plugin-CMR-wkeP.mjs";
 import { AppContext, Questpie, RequestContext, ScopeOperationKind, defaultOperationScope, introspectRoutes } from "questpie";
 import { z } from "zod";
@@ -30,6 +30,7 @@ interface ResolvedMcpPolicy {
     include?: string[];
     exclude?: string[];
   };
+  relationLoading?: boolean;
   description?: string;
 }
 /** Normalize an {@link McpRequiredScopes} declaration to a scope list. */

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { S as scopesFromContext, _ as resolveMcpCatalog, a as customToolWorkloadIdentity, b as requiredScopesForOperation, c as createWorkloadMcpBoundary, f as McpAccessDeniedError, g as toMcpToolError, h as mcpPublicErrorCode, i as customToolDescriptor, l as createRuntimeScope, m as assertBoundedMcpValue, n as createWorkloadMcpServer, o as executeCustomToolCall, p as McpPublicError, r as customToolAllows, s as authorizeWorkload, t as createMcpServer, u as createWorkloadMcpRelease, v as defaultOperationScope, w as mcpTool, x as scopeGateAllows, y as normalizeRequiredScopes } from "./create-server-CEWFf041.mjs";
-import { n as mcp_default, t as mcpModule } from "./mcp-CLfbFUnD.mjs";
+import { S as scopesFromContext, _ as resolveMcpCatalog, a as customToolWorkloadIdentity, b as requiredScopesForOperation, c as createWorkloadMcpBoundary, f as McpAccessDeniedError, g as toMcpToolError, h as mcpPublicErrorCode, i as customToolDescriptor, l as createRuntimeScope, m as assertBoundedMcpValue, n as createWorkloadMcpServer, o as executeCustomToolCall, p as McpPublicError, r as customToolAllows, s as authorizeWorkload, t as createMcpServer, u as createWorkloadMcpRelease, v as defaultOperationScope, w as mcpTool, x as scopeGateAllows, y as normalizeRequiredScopes } from "./create-server-Ty80vPGh.mjs";
+import { n as mcp_default, t as mcpModule } from "./mcp-BVefYLQh.mjs";
 import { t as mcpPlugin } from "./plugin-BZQe1pji.mjs";
-import { t as startStdioServer } from "./stdio-CgIPiPUb.mjs";
+import { t as startStdioServer } from "./stdio-CiEieZ1y.mjs";
 import { randomUUID } from "node:crypto";
 
 //#region src/server/workload-tool-port.ts

package/dist/{mcp-CLfbFUnD.mjs → mcp-BVefYLQh.mjs}

@@ -1,4 +1,4 @@
-import { C as validateMcpPrincipal, d as getAppMcpRelease, m as assertBoundedMcpValue, t as createMcpServer } from "./create-server-CEWFf041.mjs";
+import { C as validateMcpPrincipal, d as getAppMcpRelease, m as assertBoundedMcpValue, t as createMcpServer } from "./create-server-Ty80vPGh.mjs";
 import { t as mcpPlugin } from "./plugin-BZQe1pji.mjs";
 import { route } from "questpie";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";

package/dist/modules/mcp.mjs

@@ -1,3 +1,3 @@
-import { t as mcpModule } from "../mcp-CLfbFUnD.mjs";
+import { t as mcpModule } from "../mcp-BVefYLQh.mjs";
 
 export { mcpModule };

package/dist/{stdio-YoM70-42.d.mts → stdio-C3663EKG.d.mts}

@@ -60,6 +60,8 @@ type McpEntityPolicy = boolean | {
     include?: string[];
     exclude?: string[];
   };
+  /** Allow callers to expand relation fields with `with`. Defaults to true. */
+  relationLoading?: boolean;
   description?: string;
 };
 interface McpCrudConfig {

package/dist/{stdio-CgIPiPUb.mjs → stdio-CiEieZ1y.mjs}

@@ -1,4 +1,4 @@
-import { t as createMcpServer } from "./create-server-CEWFf041.mjs";
+import { t as createMcpServer } from "./create-server-Ty80vPGh.mjs";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 //#region src/server/stdio.ts

package/dist/stdio.d.mts

@@ -1,2 +1,2 @@
-import { t as startStdioServer } from "./stdio-YoM70-42.mjs";
+import { t as startStdioServer } from "./stdio-C3663EKG.mjs";
 export { startStdioServer };

package/dist/stdio.mjs

@@ -1,3 +1,3 @@
-import { t as startStdioServer } from "./stdio-CgIPiPUb.mjs";
+import { t as startStdioServer } from "./stdio-CiEieZ1y.mjs";
 
 export { startStdioServer };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@questpie/mcp",
-	"version": "3.28.5",
+	"version": "3.28.6",
 	"description": "Model Context Protocol server for QUESTPIE apps, under the app's own access rules",
 	"repository": {
 		"type": "git",
@@ -70,7 +70,7 @@
 	},
 	"dependencies": {
 		"@modelcontextprotocol/sdk": "^1.29.0",
-		"questpie": "^3.28.5",
+		"questpie": "^3.28.6",
 		"zod": "^4.2.1"
 	},
 	"devDependencies": {
@@ -80,6 +80,6 @@
 		"tsdown": "^0.18.3"
 	},
 	"peerDependencies": {
-		"questpie": "^3.28.5"
+		"questpie": "^3.28.6"
 	}
 }