meguro-mcp 0.2.9 → 0.2.12

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 All notable changes to `meguro-mcp` are recorded here. Versions follow Semantic Versioning.
 
+## 0.2.12 — 2026-08-11
+
+- Adds a credential-safe, state-aware `adminExecutionGuide` to `get_connection_details`, separating
+  hosted OAuth/public STDIO control-plane authentication from the per-store Admin data plane.
+- Adds authority-derived `admin_schema` execution requirements for run state, the exact inventory
+  read-before-write cursor, valid next calls, and the two-root `@idempotent` contract.
+- Adds immutable getting-started v13, product-guide v10, and documentation-index v9 resources while
+  preserving every prior documentation byte and digest. This is a prepared package candidate only;
+  it is not published or deployed.
+
+## 0.2.11 — 2026-08-11
+
+- Adds registry-derived `admin_recipes_list` discovery without exposing tenant or store data or
+  executing Admin probes.
+- Adds bounded authored-alias teaching for recipe misses and schema-authority-derived root-type
+  recovery while preserving exact successful `admin_schema` lookup behavior.
+- Adds immutable getting-started v12 and documentation-index v8 resources for the discovery path;
+  every prior documentation resource remains byte-identical.
+
+## 0.2.10 — 2026-08-10
+
+- Adds immutable getting-started v8, product-guide v5, and documentation-index v4 resources that
+  cross-link current guidance from one registry-derived currency authority; receipt-guide v7 remains
+  the current receipt guide.
+- Removes the remaining fixed Admin API version from current observation-plan metadata and derives
+  the declared target from the supported-version registry without changing historical resources.
+- Adds current troubleshooting for incompatible model data, assertion-family exercise guidance, and
+  the channel-abstraction explanation while preserving existing tool identities and input schemas.
+
 ## 0.2.9 — 2026-08-10
 
 - Keeps the full real-store history-run family in the public STDIO registry while the hosted OAuth

package/README.md

@@ -21,12 +21,12 @@ The configured hosted endpoints are environment-specific: dev uses
 `https://mcp-dev.meguro.io/mcp`, stage uses `https://mcp-stage.meguro.io/mcp`, and production uses
 `https://mcp.meguro.io/mcp`. Use the URL shown by the Console for the environment you intend to access.
 
-After connecting, read `meguro://docs/getting-started/v6` for the world-first operating sequence;
-for general Meguro questions, read `meguro://docs/product-guide/v3`. Both are available through
+After connecting, read `meguro://docs/getting-started/v13` for the world-first operating sequence;
+for general Meguro questions, read `meguro://docs/product-guide/v10`. Both are available through
 `resources/read` or the matching `docs_read({ topic, version })` fallback.
 
-The hosted server exposes 44 customer-safe tools and deliberately excludes `admin_probe` and
-`admin_schema`. Active grants are visible and revocable under Console → Settings → Connection → MCP
+The hosted server exposes 39 customer-safe tools and deliberately excludes `admin_probe`. Active
+grants are visible and revocable under Console → Settings → Connection → MCP
 authorizations.
 
 ## Transport boundaries
@@ -43,7 +43,7 @@ Console provides fast trusted proof and evidence inspection; the agency agent no
 
 <!-- BEGIN GENERATED MCP TOOL TABLE -->
 <!-- Run `npm run docs:tools --workspace meguro-mcp` to refresh this section from `tools/list`. -->
-This table is generated from the server's live `tools/list` response (47 tools).
+This table is generated from the server's live `tools/list` response (48 tools).
 
 | Tool | Title | Behavior annotations |
 |---|---|---|
@@ -94,6 +94,7 @@ This table is generated from the server's live `tools/list` response (47 tools).
 | `get_connection_details` | Get practice-store connection details | read-only · non-destructive · idempotent · closed-world |
 | `admin_probe` | Run an Admin API probe | read-write · non-destructive · non-idempotent · closed-world |
 | `admin_schema` | Look up the Admin API schema | read-only · non-destructive · idempotent · closed-world |
+| `admin_recipes_list` | List Admin API recipes | read-only · non-destructive · idempotent · closed-world |
 <!-- END GENERATED MCP TOOL TABLE -->
 
 ## Documentation resources
@@ -105,15 +106,21 @@ local stdio server and the hosted OAuth resource server:
 |---|---|
 | `meguro://docs/gate-policy/v1` | `6d647b3c78fd4e2d93f59a85b90a853096cc73e9cdfd6ba5e3ea505dc07b4aaf` |
 | `meguro://docs/gate-policy/v2` | `e49378fd745f71aab893db34864aefeb7345c9a25000ad328dfba4e44d007469` |
+| `meguro://docs/gate-policy/v3` | `bcd1434cddf99f42261081d9d217285ebf4a93d9e42d23a47bf577c8ee91fbe9` |
 | `meguro://docs/getting-started/v1` | `afd19ca6576ae2a8fb03c2e143d25d47fb739682f44180541dd13f779a5f29df` |
 | `meguro://docs/getting-started/v2` | `70fdbf36d68a6dd7abb93fe9b403f85c9c0323b3dc3472ab638c6cbe5982ec61` |
 | `meguro://docs/getting-started/v3` | `765cba2b68806f0b1d83255a1742d83ce71ebf7f65f8095e7076cd36e4a1ba6c` |
 | `meguro://docs/getting-started/v4` | `db534eb544e414be353d6cd4db8dfb9e8dba772dcb10d8287a1a27f8736e5307` |
 | `meguro://docs/getting-started/v5` | `156dcf81266f2bd4e4203dbd09661e49a481395ba4a63528f0540d8ea89bc285` |
 | `meguro://docs/getting-started/v6` | `34cf3ab48a32714b0c3edb24a7920843954172c0d5501e60574adc5a1058071f` |
+| `meguro://docs/getting-started/v7` | `650201c983138cb2c34cfef3e93611d510faf42d974f32762207216c3189ece1` |
+| `meguro://docs/index/v1` | `1d52205148a3438339238c9e65271b2c377cd0a96c7088d75de7f2dce9552843` |
+| `meguro://docs/index/v2` | `df861c87fa17db23d3173c1d900a884d39b228d493d7e35fcab9b2a531ae9aad` |
+| `meguro://docs/index/v3` | `422e91488281867aa2454223a8042248a667c57ea2ae56878bdb136693fe4894` |
 | `meguro://docs/product-guide/v1` | `e5450c1b4181cec4d6ed0a498dbff1cb25d2e223ff2228928aecbbce9674f074` |
 | `meguro://docs/product-guide/v2` | `b15590df7699f7ad685a30b0698e2c25b5b7b1531afa4e43e9f04a4b38ab9db2` |
 | `meguro://docs/product-guide/v3` | `8dc9e0fae91a2433ea7ca02b9278484250be0d336e2daac96f949da577487dc9` |
+| `meguro://docs/product-guide/v4` | `a874a1af1bcf18e7abe6b32b8d226a648b1292458010992528a551c270e9816e` |
 | `meguro://docs/receipt-guide/v1` | `9d8150258765d252cb7cc3bad307acdc429b0435ca22f0362b69cf7471e3a333` |
 | `meguro://docs/receipt-guide/v2` | `7df261021b48ce732e6043a8917f8a2673b1f83ff1d8790927abc18f34fb3f6f` |
 | `meguro://docs/receipt-guide/v3` | `c76b823aed8187834c8ae79a751b53d2720fe7245a31b0b195f440deac9b75cb` |
@@ -154,7 +161,7 @@ Use these tool names in order:
 
 1. `templates_list()` to discover the supported template keys.
 2. `stores_list()`, then reuse an owned store or call `store_create({ templateKey })`.
-3. `get_connection_details({ storeId })` through the explicit secure flow (`worldId` remains a legacy alias). Keep the returned values out of model/chat logs.
+3. `get_connection_details({ storeId })` through the explicit secure flow (`worldId` remains a legacy alias). Follow its structured `adminExecutionGuide`; keep returned credential values out of model/chat logs.
 4. `practice_run_start({ storeId, clock: { mode: "harness", simulationDays: 14, stepDays: 1 } })` — the same `storeId` the previous step took and returned.
 5. Launch the agency agent in its own environment with the stable returned `SHOPIFY_*` values.
 6. `practice_run_status({ attemptId })`, then `practice_run_checkpoint({ attemptId })`.
@@ -167,6 +174,12 @@ data-plane credential your commerce agent needs for the exact returned `*.meguro
 it as a secret, provide it only to that agent process, and keep it out of model/chat logs. It is not the
 account-scoped `MEGURO_API_TOKEN` and cannot control other stores or account resources.
 
+Hosted OAuth and the public package's `MEGURO_API_TOKEN` authenticate MCP/control-plane calls only.
+Admin GraphQL calls use the returned Admin URL and the per-store token in
+`X-Shopify-Access-Token`; never send the OAuth bearer to the Admin URL. Before one bounded write,
+read `admin_schema`'s `match.executionRequirements` for the required run state, any exact preflight
+read, valid next calls, and the authority-derived idempotency example.
+
 `manual`, `harness`, and `scheduled` are clock ownership modes. Raw Admin GraphQL requests do not each
 advance time. Practice-run status, checkpoint, and receipt responses deliberately exclude raw private
 evidence and credentials; `get_connection_details` is the one explicit credential-returning tool.
@@ -186,7 +199,7 @@ OAuth support. It requires a workspace-bound `meg_sk_…` API key and exposes th
 surface. Pin the exact public version in client configuration so a quickstart stays reproducible:
 
 ```bash
-npx -y meguro-mcp@0.2.9
+npx -y meguro-mcp@0.2.12
 ```
 
 ### Environment
@@ -204,7 +217,7 @@ claude mcp add meguro \
   -e MEGURO_API_BASE_URL=https://api-dev.meguro.io \
   -e MEGURO_API_TOKEN=meg_sk_... \
   -e MEGURO_DASHBOARD_URL=https://... \
-  -- npx -y meguro-mcp@0.2.9
+  -- npx -y meguro-mcp@0.2.12
 ```
 
 ### Register — Cursor (`.cursor/mcp.json`)
@@ -214,7 +227,7 @@ claude mcp add meguro \
   "mcpServers": {
     "meguro": {
       "command": "npx",
-      "args": ["-y", "meguro-mcp@0.2.9"],
+      "args": ["-y", "meguro-mcp@0.2.12"],
       "env": {
         "MEGURO_API_BASE_URL": "https://api-dev.meguro.io",
         "MEGURO_API_TOKEN": "meg_sk_...",
@@ -235,6 +248,6 @@ npm test --workspace meguro-mcp
 ```
 
 The test suite packs the public artifact, installs it into a temporary clean-room project, starts the
-installed binary, and requires `tools/list` to return exactly 46 tools without leaking supplied
+installed binary, and requires `tools/list` to return exactly 48 tools without leaking supplied
 credentials to stdout or stderr. Maintainers should follow [RELEASING.md](./RELEASING.md) for every
 version; release notes are in [CHANGELOG.md](./CHANGELOG.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "meguro-mcp",
-  "version": "0.2.9",
+  "version": "0.2.12",
   "private": false,
   "type": "module",
   "description": "Meguro control-plane MCP server: drive worlds, runs, and verdicts from your own AI tools.",