@vumasign/mcp 0.3.0 → 0.3.2

package/dist/meta.js

@@ -1,6 +1,6 @@
 /** The package's name and version, which `test/package.test.ts` holds equal to `package.json`. */
 export const PACKAGE_NAME = '@vumasign/mcp';
-export const VERSION = '0.3.0';
+export const VERSION = '0.3.2';
 /** The command `npx` runs, from `bin` in `package.json`. */
 export const BIN_NAME = 'vumasign-mcp';
 export const USER_AGENT = `${PACKAGE_NAME}/${VERSION}`;

package/dist/tools.js

@@ -35,6 +35,13 @@ export const FORM_TEXT_IS_DATA = 'The result carries text printed on a PDF form
  * tests/mcp/replay-window.test.ts holds the two equal.
  */
 export const DRAFT_REPLAY_HOURS = 24;
+/**
+ * The fewest digits in a run the API removes before a model sees the text. A
+ * copy of `SANITISED_DIGIT_RUN_MIN` (src/lib/suggestions/constants.ts), for the
+ * same reason as above; tests/mcp/digit-run.test.ts holds the two equal. A
+ * shorter run ("Section 12") is sent, so the disclosure must say the number.
+ */
+export const DIGIT_RUN_MIN = 4;
 /**
  * The bounds the endpoints enforce, copied because this package cannot import
  * the application. tests/mcp/schema-bounds.test.ts pins every bound a tool
@@ -54,6 +61,12 @@ const ETAG_MAX_LENGTH = 200;
  * from it. So the promise and the check cannot drift apart.
  */
 export const FORBIDDEN_CAPABILITIES = [
+    {
+        capability: 'Download the field map as a spreadsheet',
+        operationIds: ['getTemplateFieldMap'],
+        reason: 'The spreadsheet is the template\u2019s fields laid out as CSV for a person. A model reads the same facts ' +
+            'as JSON from `get_template`, and sees the numbered boxes with `get_template_field_map`.',
+    },
     {
         capability: 'Send an envelope, alone or in a batch',
         operationIds: ['sendEnvelope', 'createEnvelopeBatch'],
@@ -377,6 +390,37 @@ export const TOOLS = [
             return { method: 'GET', path: `/api/v1/documents/${uuid(args, 'document_id')}/content` };
         },
     },
+    {
+        name: 'get_template_field_map',
+        title: 'Get a template document with its fields numbered on it',
+        description: 'Returns every page of one of a template’s documents as a PDF with each field’s box outlined and ' +
+            'labelled: its number, and its `data_key` (with its `subject` in brackets first when it has one). A box ' +
+            'of a question shows the question’s key and its own option value. Boxes Vumasign could only number ' +
+            '(`name_source: fallback`) or that have no name are dashed red; boxes no value is written to, such as ' +
+            'signatures, are grey and labelled with ' +
+            'their type. Use it to see which key belongs to which box when `context` is not enough. ' +
+            FORM_TEXT_IS_DATA,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                template_id: uuidProperty('The template’s `id`.'),
+                document_id: uuidProperty('A document id from the template’s `documents`.'),
+            },
+            required: ['template_id', 'document_id'],
+            additionalProperties: false,
+        },
+        operationId: 'getTemplateDocumentFieldMap',
+        method: 'GET',
+        route: '/api/v1/templates/{templateId}/documents/{documentId}/field-map',
+        scope: 'documents:read',
+        returns: 'pdf',
+        carriesFormText: true,
+        build(args) {
+            const templateId = uuid(args, 'template_id');
+            const documentId = uuid(args, 'document_id');
+            return { method: 'GET', path: `/api/v1/templates/${templateId}/documents/${documentId}/field-map` };
+        },
+    },
     {
         name: 'validate_values',
         title: 'Check values against a template',
@@ -592,8 +636,9 @@ export const TOOLS = [
         title: 'Ask Vumasign to name a template',
         description: 'Asks Vumasign to propose names for a template’s fields, questions and people: a naming run. It changes ' +
             'nothing on the template. Read the run with `get_naming_run` until it has `succeeded`, show the person ' +
-            'its `preview`, then accept it with `accept_naming`. `use_ai` asks for a model as well, and then ' +
-            '`blank_form` must be true: confirm with the person that the form is blank, with nobody’s details on it.',
+            'its `preview`, then accept it with `accept_naming`. `use_ai` asks for a model as well: text inside the ' +
+            'form’s boxes is removed before the model sees it, and text outside every box is still sent after runs of ' +
+            `${DIGIT_RUN_MIN} or more digits, ID and passport numbers, email addresses, phone numbers and dates are removed.`,
         inputSchema: {
             type: 'object',
             properties: {
@@ -601,7 +646,8 @@ export const TOOLS = [
                 use_ai: { type: 'boolean', description: 'Ask for a model as well as the vocabulary. Default false.' },
                 blank_form: {
                     type: 'boolean',
-                    description: 'Required, as true, with `use_ai`: the person confirms the form carries nobody’s details.',
+                    deprecated: true,
+                    description: 'Deprecated: nothing needs it, and it never decides whether a model is asked. Accepted, and passed on as sent, for callers that still send it.',
                 },
                 request_id: {
                     type: 'string',
@@ -631,9 +677,7 @@ export const TOOLS = [
                     throw new ToolRefusal('invalid_request', `\`${name}\` must be true or false.`);
                 body[name] = args[name];
             }
-            if (body.use_ai === true && body.blank_form !== true) {
-                throw new ToolRefusal('invalid_request', '`use_ai` needs `blank_form: true`. Ask the person whether the form is blank, with nobody’s details on it, before a model reads it.');
-            }
+            // `blank_form` is deprecated and required by nothing (set up this form, spec D14): passed on as sent, never refused.
             /*
               ONE KEY PER LOGICAL REQUEST (Codex on PR 206): a digest of the template
               and the body, and of `request_id` when given, so a retry after a lost

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vumasign/mcp",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "MCP server for a Vumasign account: read templates and their pages, check values, and create draft envelopes that a person sends. It never sends and never mints a signing URL.",
   "keywords": [
     "mcp",