@ultimat3/action 25.2.0 → 26.1.0

package/README.md

@@ -256,7 +256,7 @@ Under the default style:
 | `checkout` (single word) | `POST /api/checkouts/invoke` | `checkout` |
 
 **One name, three surfaces** — `openapi.json`'s `x-ultimate.mcpTool`,
-`describeAction().mcp.tool` (what `x actions describe --json`, `x actions list --json`, the
+`describeAction().mcp.tool` (what `x actions show --json`, `x actions list --json`, the
 `actions.describe` dev MCP tool and the `/_x` Routes panel show) and the catalog `@ultimat3/mcp`
 serves. It was two until 2026-08: a `toToolName()` here snake_cased the published ones to
 `publish_post` while the server answered only `publishPost`, so an agent that read the published
@@ -839,7 +839,7 @@ never a pass — the assertion says which code got in the way and names `input:`
 | `X_ACTION_POLICY_MISSING` | registration without `policy:` | add `policy: can('…')` |
 | `X_RATE_LIMIT_INVALID` | `rateLimit:` with a non-positive or non-finite half — `windowMs: 0` refills infinitely. Owned by `@ultimat3/http`, which owns the conversion | make both positive, or delete the block |
 | `X_ACTION_DEPRECATION_INVALID` | `deprecated:` with a `since`/`sunset` that is not a date | use an ISO-8601 instant |
-| `X_INPUT_INVALID` | input failed the Standard Schema. Carries the rejections **twice**: the flattened line in `cause`, and the structured list in `meta.issues` — one value rendered two ways, `As of 2026-08-24` | `x actions describe <name> --json` |
+| `X_INPUT_INVALID` | input failed the Standard Schema. Carries the rejections **twice**: the flattened line in `cause`, and the structured list in `meta.issues` — one value rendered two ways, `As of 2026-08-24` | `x actions show <name> --json` |
 | `X_IDEMPOTENCY_CONFLICT` | key reused with a new payload / still in flight | new key, or retry later |
 | `X_IDEMPOTENCY_KEY_INVALID` | `Idempotency-Key:` sent blank (`Headers.get()` answers `''`, not `null`) or past 255 characters | send one unique value per request, or omit the header |
 | `X_IDEMPOTENCY_NOT_SHARED` | `configureIdempotency({ scope: 'shared' })` over a per-process (or scope-less) store | install `postgresIdempotencyStore({ executor, origin, reclaimAfterMs })` at boot |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/action",
-  "version": "25.2.0",
+  "version": "26.1.0",
   "description": "The action primitive: one declaration projected to route, OpenAPI, client, MCP tool, job handle, tests",
   "license": "MIT",
   "type": "module",
@@ -35,12 +35,12 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/cache": "25.2.0",
-    "@ultimat3/core": "25.2.0",
-    "@ultimat3/db": "25.2.0",
-    "@ultimat3/entity": "25.2.0",
-    "@ultimat3/http": "25.2.0",
-    "@ultimat3/policy": "25.2.0",
-    "@ultimat3/schema": "25.2.0"
+    "@ultimat3/cache": "26.1.0",
+    "@ultimat3/core": "26.1.0",
+    "@ultimat3/db": "26.1.0",
+    "@ultimat3/entity": "26.1.0",
+    "@ultimat3/http": "26.1.0",
+    "@ultimat3/policy": "26.1.0",
+    "@ultimat3/schema": "26.1.0"
   }
 }

package/src/action.ts

@@ -348,7 +348,7 @@ export function describeAction(target: AnyAction): ActionDescriptor {
       // a first honest `expose: false` read as a withdrawn capability and demand a major bump.
       expose: isMcpExposed(mcp),
       // The export name verbatim, which is the only name `@ultimat3/mcp` will answer a
-      // `tools/call` for. A derived one made every descriptor reader — `x actions describe
+      // `tools/call` for. A derived one made every descriptor reader — `x actions show
       // --json`, the `actions.describe` dev tool, the `/_x` panel — name a tool no surface
       // serves. `x.manifest.json` is not among them: it copies `expose` and `description` only.
       tool: name,

package/src/client.ts

@@ -224,7 +224,7 @@ function toUltimateError(
     issues: issuesFromWire(body['issues']),
     meta: metaFromWire(body['meta']),
     cause: stringOr(body['cause'] ?? body['detail'], `${name} failed with ${status}`),
-    fix: stringOr(body['fix'], `x actions describe ${name} --json`),
+    fix: stringOr(body['fix'], `x actions show ${name} --json`),
     // RFC-9457's `type` IS a documentation URI, so a server that sends no `docs` extension has
     // still offered one. Both travel, in preference order: `??` picked `docs` on presence alone,
     // so a `javascript:` one hid a perfectly good `type` behind it. `remoteDocs` takes the first

package/src/contract-test.ts

@@ -100,7 +100,7 @@ function assertDocumented(target: AnyAction, name: string): void {
 /**
  * The refusal when the published document does not name this action at its route. `name` is
  * whatever `.named()` was handed — nothing validates its alphabet — so it is screened where it
- * enters the `x actions describe` command (security audit of plan 101 sweep 1c).
+ * enters the `x actions show` command (security audit of plan 101 sweep 1c).
  */
 export function documentedDrift(
   path: string,
@@ -113,7 +113,7 @@ export function documentedDrift(
       : `OpenAPI document serves ${path} as ${owner}, so ${name} is not in the published contract`,
     owner === undefined
       ? 'x verify --json   # the contract suite is a step of it'
-      : `x actions describe ${renderFixShellArg(name, '<action>')} --json   # then rename it, or pin its own route with http: { path } in the ${name} definition`,
+      : `x actions show ${renderFixShellArg(name, '<action>')} --json   # then rename it, or pin its own route with http: { path } in the ${name} definition`,
   );
 }
 
@@ -138,7 +138,7 @@ function assertSampleable(target: AnyAction, name: string): void {
   const described = gaps.map((path) => describeSampleGap(target.input, path)).join(', ');
   throw new ContractDriftError(
     `${name}: no value can be synthesized for ${described}, so the denial would be unproven`,
-    `contractTestsFor(${name}, { input: { … } })   # x actions describe ${name} --json prints the schema`,
+    `contractTestsFor(${name}, { input: { … } })   # x actions show ${name} --json prints the schema`,
   );
 }
 
@@ -196,7 +196,7 @@ async function expectDenied(
     if (error.code !== 'X_INPUT_INVALID') throw error;
     throw new ContractDriftError(
       `${name} failed with ${error.code} before its policy decided, so the denial is unproven`,
-      `pass \`input:\` to contractTestsFor(${name}) — x actions describe ${name} --json prints the schema`,
+      `pass \`input:\` to contractTestsFor(${name}) — x actions show ${name} --json prints the schema`,
     );
   }
   throw new ContractDriftError(

package/src/errors-idempotency.ts

@@ -185,7 +185,7 @@ export class IdempotentReplayRedactedError extends UltimateError {
     super({
       code: 'X_IDEMPOTENT_REPLAY_REDACTED',
       cause: `the answer stored for idempotency key "${key}" had a secret-named field redacted when it settled, so it cannot be replayed faithfully`,
-      fix: "x actions describe '<action>' --json   # the call already ran and showed its secret once — read its effect with a query; a new Idempotency-Key runs it again (a second credential)",
+      fix: "x actions show '<action>' --json   # the call already ran and showed its secret once — read its effect with a query; a new Idempotency-Key runs it again (a second credential)",
       meta: { key, replayed: true },
     });
   }

package/src/errors.ts

@@ -187,9 +187,9 @@ export class InputInvalidError extends UltimateError {
     super({
       code: 'X_INPUT_INVALID',
       cause: `input for ${subject} "${name}" failed validation: ${detail}`,
-      fix: `x actions describe ${renderFixShellArg(name, '<action-name>')} --json  # prints the expected input schema`,
+      fix: `x actions show ${renderFixShellArg(name, '<action-name>')} --json  # prints the expected input schema`,
       // A remote caller holds the published schema — the MCP `inputSchema`, the OpenAPI request
-      // body — and cannot run `x actions describe`.
+      // body — and cannot run `x actions show`.
       callerFix:
         'correct the fields named in cause to match the published input schema (the tool inputSchema, or the OpenAPI request body) and send again — the same input is refused the same way',
       ...(issues === undefined ? {} : { meta: { issues } }),
@@ -208,7 +208,7 @@ export class OutputInvalidError extends UltimateError {
     super({
       code: 'X_OUTPUT_INVALID',
       cause: `action "${name}" returned a value its output schema rejects: ${detail}`,
-      fix: `x actions describe ${renderFixShellArg(name, '<action-name>')} --json  # compare the handler's return against \`output:\``,
+      fix: `x actions show ${renderFixShellArg(name, '<action-name>')} --json  # compare the handler's return against \`output:\``,
     });
   }
 }
@@ -353,7 +353,7 @@ export class RpcFailedError extends UltimateError {
     super({
       code: 'X_RPC_FAILED',
       cause: `${name} returned HTTP ${status} without a problem+json body`,
-      fix: `check the gateway in front of the app, then: x actions describe ${renderFixShellArg(name, '<action-name>')} --json`,
+      fix: `check the gateway in front of the app, then: x actions show ${renderFixShellArg(name, '<action-name>')} --json`,
       retry: retryForStatus('X_RPC_FAILED', status),
     });
   }

package/src/mutator.ts

@@ -226,7 +226,7 @@ function wrap<TInput extends StandardSchemaV1, TOutput extends StandardSchemaV1>
   return self;
 }
 
-/** The descriptor's name for a policy — the manifest and `x actions describe` print this. */
+/** The descriptor's name for a policy — the manifest and `x actions show` print this. */
 function strategyOf(conflict: ConflictPolicy): MutatorDescriptor['conflict'] {
   return typeof conflict === 'string' ? conflict : conflict.kind;
 }