@ultimat3/mcp 12.0.0 → 14.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/mcp",
-  "version": "12.0.0",
+  "version": "14.0.0",
   "description": "MCP server, dev tools, and the action-to-tool projection \u2014 one authz system, two surfaces",
   "license": "MIT",
   "type": "module",
@@ -31,13 +31,13 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "12.0.0",
-    "@ultimat3/core": "12.0.0",
-    "@ultimat3/entity": "12.0.0",
-    "@ultimat3/http": "12.0.0",
-    "@ultimat3/jobs": "12.0.0",
-    "@ultimat3/policy": "12.0.0",
-    "@ultimat3/query": "12.0.0",
-    "@ultimat3/schema": "12.0.0"
+    "@ultimat3/action": "14.0.0",
+    "@ultimat3/core": "14.0.0",
+    "@ultimat3/entity": "14.0.0",
+    "@ultimat3/http": "14.0.0",
+    "@ultimat3/jobs": "14.0.0",
+    "@ultimat3/policy": "14.0.0",
+    "@ultimat3/query": "14.0.0",
+    "@ultimat3/schema": "14.0.0"
   }
 }

package/src/app-tool.ts

@@ -16,7 +16,7 @@ import { useContext } from '@ultimat3/core';
 import type { KnownPermission } from '@ultimat3/policy';
 import { can } from '@ultimat3/policy';
 import type { InferOutput, StandardSchemaV1 } from '@ultimat3/schema';
-import { formatIssues, validateAsync } from '@ultimat3/schema';
+import { formatIssues, toValidationIssues, validateAsync } from '@ultimat3/schema';
 import { asCallerContext } from './caller-context';
 import { McpToolUnsafeError } from './errors';
 import type { ProjectablePrimitive } from './from-action';
@@ -123,7 +123,17 @@ async function parseInput(
 ): Promise<InferOutput<StandardSchemaV1>> {
   const result = await validateAsync(schema, raw);
   if (result.issues !== undefined) {
-    throw new InputInvalidError(name, formatIssues(result.issues).join('; '));
+    // `toValidationIssues`, never the raw `result.issues` — the same normalisation
+    // `packages/action/src/validate.ts` does, for the same two reasons. A conforming library's
+    // issue object may carry members Ultimate's shape does not, INCLUDING the rejected value, and
+    // this list reaches an agent and the audit record. And the list is what a caller addresses a
+    // field by: passing only the joined line made an MCP rejection carry strictly less than the
+    // HTTP one, which puts the list on the problem document (`error-facts.ts`).
+    //
+    // `formatIssues(issues)` is byte-identical to `formatIssues(result.issues)`: that renderer
+    // reads `path` and `message`, which is exactly what `toValidationIssues` copies out.
+    const issues = toValidationIssues(result.issues);
+    throw new InputInvalidError(name, formatIssues(issues).join('; '), issues);
   }
   return result.value;
 }