@thingd/sdk 0.47.2 → 0.47.4

package/dist/mcp/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAW7D,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IACtC,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,0BAA+B,GACvC,IAAI,CAstBN"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/mcp/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAW7D,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IACtC,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,0BAA+B,GACvC,IAAI,CA2vBN"}

package/dist/mcp/tools.js

@@ -143,6 +143,10 @@ export function registerThingdTools(server, db, options = {}) {
         },
     }, async ({ stream, event, actor, source }) => {
         assertWriteAllowed();
+        // Prevent direct writes to the protected audit stream
+        if (stream === audit.stream) {
+            throw new Error(`Stream '${stream}' is protected and cannot be written to directly`);
+        }
         const stored = await db.events.append(stream, event);
         await appendMcpAuditEvent(db, audit, {
             action: "events.append",
@@ -453,6 +457,7 @@ export function registerThingdTools(server, db, options = {}) {
                 .array(z.object({ id: z.string() }).passthrough())
                 .min(1)
                 .max(1000),
+            ...auditInputSchema,
         },
         annotations: {
             readOnlyHint: false,
@@ -460,10 +465,17 @@ export function registerThingdTools(server, db, options = {}) {
             idempotentHint: false,
             openWorldHint: false,
         },
-    }, async ({ collection, objects }) => {
+    }, async ({ collection, objects, actor, source }) => {
         assertWriteAllowed();
         assertCollectionAllowed(collection);
-        return jsonResult(await db.putBatch(collection, objects));
+        const result = await db.putBatch(collection, objects);
+        await appendMcpAuditEvent(db, audit, {
+            action: "objects.put_batch",
+            target: { collection, count: objects.length },
+            metadata: auditMetadata(actor, source),
+            result: { count: result.length },
+        });
+        return jsonResult(result);
     });
     server.registerTool("thing_objects_delete_batch", {
         title: "Delete Objects Batch",
@@ -471,6 +483,7 @@ export function registerThingdTools(server, db, options = {}) {
         inputSchema: {
             collection: z.string().min(1),
             ids: z.array(z.string().min(1)).min(1).max(1000),
+            ...auditInputSchema,
         },
         annotations: {
             readOnlyHint: false,
@@ -478,10 +491,16 @@ export function registerThingdTools(server, db, options = {}) {
             idempotentHint: true,
             openWorldHint: false,
         },
-    }, async ({ collection, ids }) => {
+    }, async ({ collection, ids, actor, source }) => {
         assertWriteAllowed();
         assertCollectionAllowed(collection);
         const deleted = await db.deleteBatch(collection, ids);
+        await appendMcpAuditEvent(db, audit, {
+            action: "objects.delete_batch",
+            target: { collection, count: ids.length },
+            metadata: auditMetadata(actor, source),
+            result: { deleted },
+        });
         return jsonResult({ deleted });
     });
     server.registerTool("thing_link_create", {
@@ -493,6 +512,7 @@ export function registerThingdTools(server, db, options = {}) {
             toRef: z.string().min(1),
             weight: z.number().optional(),
             metadataJson: z.string().optional(),
+            ...auditInputSchema,
         },
         annotations: {
             readOnlyHint: false,
@@ -500,15 +520,23 @@ export function registerThingdTools(server, db, options = {}) {
             idempotentHint: false,
             openWorldHint: false,
         },
-    }, async ({ fromRef, linkType, toRef, weight, metadataJson }) => {
+    }, async ({ fromRef, linkType, toRef, weight, metadataJson, actor, source }) => {
         assertWriteAllowed();
-        return jsonResult(await db.links.create(fromRef, linkType, toRef, weight, metadataJson));
+        const link = await db.links.create(fromRef, linkType, toRef, weight, metadataJson);
+        await appendMcpAuditEvent(db, audit, {
+            action: "link.create",
+            target: { fromRef, linkType, toRef },
+            metadata: auditMetadata(actor, source),
+            result: { id: link.id },
+        });
+        return jsonResult(link);
     });
     server.registerTool("thing_link_delete", {
         title: "Delete Link",
         description: "Delete a graph link by its id. Returns an object with a deleted boolean.",
         inputSchema: {
             id: z.string().min(1),
+            ...auditInputSchema,
         },
         annotations: {
             readOnlyHint: false,
@@ -516,9 +544,16 @@ export function registerThingdTools(server, db, options = {}) {
             idempotentHint: true,
             openWorldHint: false,
         },
-    }, async ({ id }) => {
+    }, async ({ id, actor, source }) => {
         assertWriteAllowed();
-        return jsonResult({ deleted: await db.links.delete(id) });
+        const deleted = await db.links.delete(id);
+        await appendMcpAuditEvent(db, audit, {
+            action: "link.delete",
+            target: { id },
+            metadata: auditMetadata(actor, source),
+            result: { deleted },
+        });
+        return jsonResult({ deleted });
     });
     server.registerTool("thing_link_get", {
         title: "Get Link",

package/dist/version.d.ts

@@ -2,5 +2,5 @@
  * The published version of the thingd SDK.
  * Updated automatically by semantic-release during the publish process.
  */
-export declare const SDK_VERSION = "0.47.1";
+export declare const SDK_VERSION = "0.47.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -2,4 +2,4 @@
  * The published version of the thingd SDK.
  * Updated automatically by semantic-release during the publish process.
  */
-export const SDK_VERSION = "0.47.1";
+export const SDK_VERSION = "0.47.3";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thingd/sdk",
-  "version": "0.47.2",
+  "version": "0.47.4",
   "description": "A fast object-first data engine for applications and AI agents.",
   "type": "module",
   "author": "Sayan Mohsin",
@@ -63,7 +63,7 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@thingd/native": "0.47.2"
+    "@thingd/native": "0.47.4"
   },
   "engines": {
     "node": ">=24.0.0"