tascan-mcp 3.16.0 → 3.16.1

package/index.js

@@ -15,6 +15,7 @@ import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
 const { TOOLS } = require('./tools.cjs');
+const crypto = require('crypto');   // B1 (migration 220): crypto.randomUUID() is a Node built-in, no new dependency
 
 const API_BASE = process.env.TASCAN_API_URL || 'https://app.tascan.io/api/v1';
 const API_KEY = process.env.TASCAN_API_KEY || '';
@@ -24,8 +25,11 @@ if (!API_KEY) {
   process.exit(1);
 }
 
-// Transport-bound REST call handed to every tool handler
-async function api(method, path, body) {
+// Transport-bound REST call handed to every tool handler.  B1 (migration 220): every POST/PUT sends an
+// Idempotency-Key — a fresh crypto.randomUUID() per call by default, or idemKey verbatim when a tool (e.g.
+// tascan_send_sms, tascan_request_payment, tascan_add_tasks) passes one through so a RETRIED call reuses the
+// same key instead of minting a new reservation (and re-running the handler) every time.
+async function api(method, path, body, idemKey) {
   const opts = {
     method,
     headers: {
@@ -36,6 +40,9 @@ async function api(method, path, body) {
   if (body && (method === 'POST' || method === 'PUT')) {
     opts.body = JSON.stringify(body);
   }
+  if (method === 'POST' || method === 'PUT') {
+    opts.headers['Idempotency-Key'] = idemKey || crypto.randomUUID();
+  }
   const resp = await fetch(API_BASE + path, opts);
   const data = await resp.json();
   if (!resp.ok) {
@@ -46,7 +53,7 @@ async function api(method, path, body) {
 api.key = API_KEY;   // raw-fetch tools read the key from here (S99: those functions now require auth)
 
 const server = new Server(
-  { name: 'tascan', version: '3.16.0' },
+  { name: 'tascan', version: '3.16.1' },
   { capabilities: { tools: {} } }
 );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tascan-mcp",
-  "version": "3.16.0",
+  "version": "3.16.1",
   "mcpName": "io.github.snowbikemike/tascan-mcp",
   "description": "TaScan MCP Server — Closed-loop autonomous operations protocol. 70 tools for projects, tasks, workers, QR codes, NFC tags, worker marketplace with consented SMS invites, geofenced zones with rules (work site / hazard + AI-verified PPE checkpoints / containment / restricted, breach alerts, zone compliance audit), AI condition assessment, worker passports, verification-gated gig payments, client invoicing from verified work (overtime / day rate / per diem / expenses), shareable report links (completion, client service report, project, evidence pack), signed Action Receipts (Ed25519 JWS), cross-entity search, duplicate-worker detection, worker identity merge, AI issue analysis, and autonomous remediation dispatch. 15 patents filed (470+ claims). Task. Scan. Done.",
   "type": "module",
@@ -14,6 +14,7 @@
   "files": [
     "index.js",
     "tools.cjs",
+    "tools-devices.cjs",
     "scopes.cjs",
     "README.md",
     "LICENSE"