@walkeros/mcp 4.7.1 → 4.7.2-next-1791213015481

package/README.md

@@ -129,7 +129,7 @@ The server registers 19 tools.
 | `walkeros://reference/flow-schema` | Flow configuration structure and connection rules               |
 | `walkeros://reference/event-model` | Event naming, properties, and auto-populated fields             |
 | `walkeros://reference/mapping`     | Mapping syntax: data, map, loop, set, condition, policy         |
-| `walkeros://reference/consent`     | The consent model at destination, rule, and field level         |
+| `walkeros://reference/consent`     | The consent model at destination and field level                |
 | `walkeros://reference/variables`   | Variable patterns: `$var`, `$env`, `$secret`, `$code`, `$store` |
 | `walkeros://reference/contract`    | Event schemas, wildcards, and inheritance                       |
 | `walkeros://reference/openapi`     | The live OpenAPI 3.1 document of the app this server talks to   |
@@ -148,11 +148,11 @@ Read these before writing a configuration by hand.
 
 ## Environment variables
 
-| Variable              | Required | Default                   | Purpose                                                                   |
-| --------------------- | -------- | ------------------------- | ------------------------------------------------------------------------- |
-| `WALKEROS_TOKEN`      | No       | none                      | Automation token (`wos_pat_...`), an alternative to the `auth` tool login |
-| `WALKEROS_PROJECT_ID` | No       | none                      | Active project ID (`proj_...`)                                            |
-| `WALKEROS_APP_URL`    | No       | `https://app.walkeros.io` | Base URL override                                                         |
+| Variable              | Required | Default                   | Purpose                                                                    |
+| --------------------- | -------- | ------------------------- | -------------------------------------------------------------------------- |
+| `WALKEROS_TOKEN`      | No       | none                      | Automation token (`wos_pat_...`), an alternative to the `auth` tool login  |
+| `WALKEROS_PROJECT_ID` | No       | none                      | Project (`proj_...`) for calls without `projectId`, ahead of `set_default` |
+| `WALKEROS_APP_URL`    | No       | `https://app.walkeros.io` | Base URL override                                                          |
 
 ## Programmatic usage
 
@@ -193,6 +193,11 @@ AI SDK, call `createToolHandlers(client, version, runtime)` or import
 `TOOL_DEFINITIONS` and supply your own `ToolClient`. The stdio binary stays
 available as `@walkeros/mcp/stdio` and the `walkeros-mcp` bin entry.
 
+A `ToolClient` served inside a host that authenticates every request itself
+returns `'host'` from `credentialSource()`. The `auth` tool then reports the
+connection as logged in, answers `login` with "no login needed" and refuses
+`logout`, which never reaches the client: the connection ends in the host.
+
 A `ToolClient` may implement `checkContract()` and `openapiDocument()`. The
 `diagnostics` tool reports the first as its contract verdict, `unknown` when it
 is absent; the `walkeros://reference/openapi` resource serves the second.

package/dist/index.d.ts

@@ -370,6 +370,8 @@ interface ToolClient {
     }): Promise<unknown>;
     setDefaultProject(projectId: string): void;
     getDefaultProject(): string | null;
+    /** Every project's flows, as an array of `{ project: { id, name }, flows }`
+     *  groups whose `flows` are the rows `listFlows` answers for that project. */
     listAllFlows(options?: {
         sort?: string;
         order?: 'asc' | 'desc';
@@ -524,15 +526,24 @@ interface ToolClient {
         timeoutMs?: number;
     }): Promise<DeviceLoginResult>;
     whoami(): Promise<unknown>;
-    /** Where a credential would come from, without resolving or refreshing it. */
-    credentialSource(): 'env' | 'config' | null;
+    /**
+     * Where a credential would come from, without resolving or refreshing it:
+     * `'env'` (`WALKEROS_TOKEN`), `'config'` (a stored login), `'host'` (the
+     * door is served inside a host that authenticates every request itself, so
+     * this process holds no login to start or end), or null (none).
+     */
+    credentialSource(): 'env' | 'config' | 'host' | null;
     /**
      * Retire the session. Where the credential was issued to this process, that
      * means revoking it with the server before dropping it locally; a plane
-     * holding a bearer it did not issue reports nothing deleted.
+     * holding a bearer it did not issue reports nothing deleted. `envCleared`
+     * reports that the door also dropped a `WALKEROS_TOKEN` from its own process
+     * environment, which only a door that owns its process does. The `auth`
+     * tool never calls this on a `'host'` door.
      */
     logout(): Promise<{
         deleted: boolean;
+        envCleared?: boolean;
     }>;
     /**
      * The base URL of the walkerOS app this door talks to, without a trailing
@@ -762,7 +773,14 @@ declare class HttpToolClient implements ToolClient {
     deleteProject(options: {
         projectId?: string;
     }): Promise<unknown>;
+    /** Refuses while `WALKEROS_PROJECT_ID` names another project (see the CLI). */
     setDefaultProject(projectId: string): void;
+    /**
+     * `WALKEROS_PROJECT_ID`, then the CLI config's default, through the same
+     * resolution the CLI's own commands use. Read here, at the door that owns
+     * this process's environment, never in the shared tool layer: a hosted door
+     * runs in a server process whose variables are no person's selection.
+     */
     getDefaultProject(): string | null;
     listAllFlows(options?: {
         sort?: string;
@@ -828,8 +846,8 @@ declare class HttpToolClient implements ToolClient {
     /**
      * Observe session lifecycle over the CLI's authenticated boundary. The trio
      * routes through the same `apiFetch` as every other method here, so token
-     * resolution, base URL, and `ApiError` shaping (which `isAuthError` reads)
-     * stay identical to the rest of the client.
+     * resolution, base URL, and `ApiError` shaping (which
+     * `isAuthenticationError` reads) stay identical to the rest of the client.
      */
     startObserveSession(options: StartObserveSessionOptions): Promise<ObserveSessionResult>;
     getObserveSession(options: ObserveSessionRef): Promise<ObserveSessionResult>;
@@ -906,8 +924,15 @@ declare class HttpToolClient implements ToolClient {
     }): Promise<DeviceLoginResult>;
     whoami(): Promise<unknown>;
     credentialSource(): 'env' | 'config' | null;
+    /**
+     * Revoke and drop the stored session, then clear a `WALKEROS_TOKEN` from
+     * this process: the local door owns its environment, so a later call in the
+     * same session no longer authenticates with it.
+     */
     logout(): Promise<{
         deleted: boolean;
+        superseded: boolean;
+        envCleared: boolean;
     }>;
     /**
      * The app this local door talks to: `WALKEROS_APP_URL`, then the CLI config