@amirhosseinnateghi/vibed-mcp 0.1.2 → 0.1.4

package/dist/index.js

@@ -1248,10 +1248,10 @@ var require_decode = __commonJS({
           this.state = EntityDecoderState.NumericDecimal;
           return this.stateNumericDecimal(str2, offset);
         };
-        EntityDecoder2.prototype.addToNumericResult = function(str2, start, end, base) {
+        EntityDecoder2.prototype.addToNumericResult = function(str2, start, end, base2) {
           if (start !== end) {
             var digitCount = end - start;
-            this.result = this.result * Math.pow(base, digitCount) + parseInt(str2.substr(start, digitCount), base);
+            this.result = this.result * Math.pow(base2, digitCount) + parseInt(str2.substr(start, digitCount), base2);
             this.consumed += digitCount;
           }
         };
@@ -5986,6 +5986,18 @@ import { dirname, extname, isAbsolute, join, resolve } from "node:path";
 // ../sandbox/src/index.ts
 var import_node_html_parser = __toESM(require_dist(), 1);
 
+// ../shared/src/terms.ts
+var ITEM = {
+  /** lowercase singular — "vibe" */
+  one: "vibe",
+  /** lowercase plural — "vibes" */
+  many: "vibes",
+  /** Capitalized singular — "Vibe" */
+  One: "Vibe",
+  /** Capitalized plural — "Vibes" */
+  Many: "Vibes"
+};
+
 // ../shared/src/constants.ts
 var CATEGORIES = [
   "Game",
@@ -5998,10 +6010,13 @@ var CATEGORIES = [
   "Other"
 ];
 var VISIBILITY = ["public", "unlisted"];
+var COVER_MODES = ["image", "gif"];
 var EXPERIENCE_SOURCE = ["builder", "import", "remix"];
+var PUSH_PROVIDERS = ["webpush", "fcm", "apns"];
+var DEVICE_PLATFORMS = ["web", "ios", "android"];
 var config = {
-  ARTIFACT_MAX_BYTES: intEnv("ARTIFACT_MAX_BYTES", 3145728),
-  // 3 MB
+  ARTIFACT_MAX_BYTES: intEnv("ARTIFACT_MAX_BYTES", 8388608),
+  // 8 MB — headroom for an embedded audio track
   ARTIFACT_ALLOWED_ORIGINS: strEnv(
     "ARTIFACT_ALLOWED_ORIGINS",
     "fonts.googleapis.com,fonts.gstatic.com,cdnjs.cloudflare.com,cdn.jsdelivr.net,unpkg.com"
@@ -6022,8 +6037,33 @@ var config = {
   // Light model that auto-tags the experience category. Falls back to a keyword
   // heuristic if the call fails.
   BUILDER_CLASSIFIER_MODEL: strEnv("BUILDER_CLASSIFIER_MODEL", "gemini-2.5-flash"),
-  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 8192),
+  // Speech-to-text model for the builder's voice input (docs/builder-architecture.md).
+  // Gemini 2.5 Flash transcribes the recorded clip via GapGPT's OpenAI-compatible
+  // chat API (an `input_audio` content part) — verified to accept the exact
+  // formats browsers produce (Chrome webm/opus, Safari mp4). It's multilingual,
+  // so Persian and English speech both work with no per-language config.
+  BUILDER_TRANSCRIBE_MODEL: strEnv("BUILDER_TRANSCRIBE_MODEL", "gemini-2.5-flash"),
+  // Upload cap for a voice clip. A minute of webm/opus is ~250KB; 8MB is ample
+  // headroom while still bounding what one request can hand the model.
+  BUILDER_TRANSCRIBE_MAX_BYTES: intEnv("BUILDER_TRANSCRIBE_MAX_BYTES", 8388608),
+  // Output budget per model call. 8k proved too small in prod — a rich game is
+  // ~7-8k tokens of file alone, and a truncated file used to slip through as a
+  // text dump. 24576 was probed OK against every catalog model on GapGPT.
+  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 24576),
   BUILDER_MAX_MESSAGES: intEnv("BUILDER_MAX_MESSAGES", 30),
+  // Hard cap for a single build turn (across the model + one repair). The build
+  // runs detached from the request, so this — not the browser — is what stops a
+  // runaway/abandoned turn. The provider's own 90s per-stall timeout still applies.
+  // Never cut a LIVE generation — these two guards only catch dead work:
+  // stall = total silence (not even a keep-alive byte) long enough to mean the
+  // connection is dead (TCP half-open never errors on its own); the turn cap is
+  // a platform-cost safety ceiling for the whole turn incl. one repair pass.
+  BUILDER_STALL_TIMEOUT_MS: intEnv("BUILDER_STALL_TIMEOUT_MS", 3e5),
+  BUILDER_TURN_TIMEOUT_MS: intEnv("BUILDER_TURN_TIMEOUT_MS", 9e5),
+  // Once a build has run this long, the UI nudges the user to go explore, and on
+  // completion the server drops a notification (§7.1) — so a slow build never
+  // traps them staring at a spinner.
+  BUILDER_SLOW_MS: intEnv("BUILDER_SLOW_MS", 12e3),
   DEFAULT_LOCALE: strEnv("DEFAULT_LOCALE", "en")
 };
 function strEnv(key, fallback) {
@@ -6046,6 +6086,31 @@ function boolEnv(key, fallback) {
   return v === "true" || v === "1";
 }
 
+// ../shared/src/notifications.ts
+var NOTIF_VERB = {
+  like_milestone: `liked your ${ITEM.one}`,
+  comment: `commented on your ${ITEM.one}`,
+  reply: "replied to your comment",
+  follow: "started following you",
+  mention: "mentioned you",
+  remix: `remixed your ${ITEM.one}`
+};
+var SYSTEM_NOTIF = {
+  build_ready: { icon: "\u2728", text: "Your build is ready \u2014 tap to see it", tone: "info" },
+  build_failed: { icon: "\u26A0\uFE0F", text: "A build didn't finish \u2014 tap to try again", tone: "error" },
+  // Moderation reject (spec §9): the vibe never went live (or was pulled), so
+  // the inbox row must carry everything — title + reason arrive in the payload.
+  post_rejected: { icon: "\u{1F6AB}", text: `Your ${ITEM.one} didn't pass moderation`, tone: "error" }
+};
+var NOTIF_PREF_GROUPS = ["follow", "comments", "likes", "remixes", "builder"];
+var NOTIF_GROUP_LABEL = {
+  follow: { title: "New followers", hint: "when someone follows you" },
+  comments: { title: "Comments", hint: "comments, replies & mentions" },
+  likes: { title: "Likes", hint: `when your ${ITEM.many} hit like milestones` },
+  remixes: { title: "Remixes", hint: `when someone remixes your ${ITEM.one}` },
+  builder: { title: "Builder", hint: "when a build finishes or fails" }
+};
+
 // ../shared/src/policy.ts
 function boolEnv2(key, fallback) {
   const v = typeof process !== "undefined" ? process.env[key] : void 0;
@@ -9726,23 +9791,23 @@ var ZodEffects = class extends ZodType {
     }
     if (effect.type === "transform") {
       if (ctx.common.async === false) {
-        const base = this._def.schema._parseSync({
+        const base2 = this._def.schema._parseSync({
           data: ctx.data,
           path: ctx.path,
           parent: ctx
         });
-        if (!isValid(base))
+        if (!isValid(base2))
           return INVALID;
-        const result = effect.transform(base.value, checkCtx);
+        const result = effect.transform(base2.value, checkCtx);
         if (result instanceof Promise) {
           throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
         }
         return { status: status.value, value: result };
       } else {
-        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base) => {
-          if (!isValid(base))
+        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base2) => {
+          if (!isValid(base2))
             return INVALID;
-          return Promise.resolve(effect.transform(base.value, checkCtx)).then((result) => ({
+          return Promise.resolve(effect.transform(base2.value, checkCtx)).then((result) => ({
             status: status.value,
             value: result
           }));
@@ -10118,10 +10183,107 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// ../shared/src/storage.ts
+var STORAGE = {
+  /** Total shared bytes per post (values, serialized). */
+  SHARED_MAX_BYTES: intEnv("STORE_SHARED_MAX_BYTES", 1048576),
+  // 1 MB
+  /** Total shared records (rows) per post. */
+  SHARED_MAX_RECORDS: intEnv("STORE_SHARED_MAX_RECORDS", 5e3),
+  /** Serialized size cap for a single value. */
+  VALUE_MAX_BYTES: intEnv("STORE_VALUE_MAX_BYTES", 16384),
+  // 16 KB
+  /** Records a single author may hold in one post (anti-flood / anti-grief). */
+  AUTHOR_MAX_RECORDS: intEnv("STORE_AUTHOR_MAX_RECORDS", 100),
+  /** Distinct collections per post. */
+  MAX_COLLECTIONS: intEnv("STORE_MAX_COLLECTIONS", 32),
+  /** Local-tier budget per (post, identity) — enforced by the host broker. */
+  LOCAL_MAX_BYTES: intEnv("STORE_LOCAL_MAX_BYTES", 262144),
+  // 256 KB
+  /** Max records returnable in one query page. */
+  QUERY_MAX_LIMIT: intEnv("STORE_QUERY_MAX_LIMIT", 100),
+  /**
+   * Platform kill-switch for anonymous shared writes. ON by default: the real
+   * gate is per-post owner opt-in (`anon_writes` + writePolicy `anyone`), so a
+   * post only accepts guest writes when its owner turns them on. Set the env to
+   * `false` to disable anon writes platform-wide regardless of per-post config.
+   */
+  ANON_WRITES_AVAILABLE: boolEnv("STORE_ANON_WRITES_AVAILABLE", true)
+};
+var COLLECTION_RE = /^[a-z0-9][a-z0-9:_-]{0,63}$/;
+var collectionSchemaStore = external_exports.string().regex(COLLECTION_RE, "invalid collection name");
+var STORE_KEY_RE = /^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,127}$/;
+var RESERVED_STORE_KEYS = ["submit", "rank", "increment"];
+var storeKeySchema = external_exports.string().regex(STORE_KEY_RE, "invalid key").refine((k) => !RESERVED_STORE_KEYS.includes(k), {
+  message: "reserved key"
+});
+var STORE_WRITE_POLICIES = ["anyone", "logged_in", "owner_only"];
+var STORE_SORTS = ["num", "-num", "created", "-created"];
+var storeValueSchema = external_exports.unknown().refine(
+  (v) => {
+    try {
+      const s = JSON.stringify(v);
+      return s !== void 0 && byteLength(s) <= STORAGE.VALUE_MAX_BYTES;
+    } catch {
+      return false;
+    }
+  },
+  { message: `value must be JSON-serializable and <= ${STORAGE.VALUE_MAX_BYTES} bytes` }
+);
+var storePutSchema = external_exports.object({
+  value: storeValueSchema,
+  /** Optimistic concurrency: fail with `conflict` unless current version matches. */
+  ifVersion: external_exports.number().int().positive().optional()
+});
+var storeAppendSchema = external_exports.object({
+  value: storeValueSchema,
+  /** Optional numeric field to index (sorting/leaderboards). */
+  num: external_exports.number().finite().optional()
+});
+var storeIncrementSchema = external_exports.object({
+  delta: external_exports.number().int().min(-1e6).max(1e6).default(1)
+});
+var storeSubmitSchema = external_exports.object({
+  /** The number that ranks this author (mapped into `num`). */
+  score: external_exports.number().finite(),
+  /** Conflict rule when the author already has a row. */
+  keep: external_exports.enum(["max", "min", "last"]).default("max"),
+  /** Small display payload stored alongside (same value-size gate). */
+  meta: storeValueSchema.optional()
+});
+var storeQuerySchema = external_exports.object({
+  sort: external_exports.enum(STORE_SORTS).default("-created"),
+  limit: external_exports.coerce.number().int().min(1).max(STORAGE.QUERY_MAX_LIMIT).default(30),
+  cursor: external_exports.string().max(200).optional(),
+  /** Only the caller's records. */
+  mine: external_exports.coerce.boolean().default(false)
+});
+var storeAdminSchema = external_exports.discriminatedUnion("action", [
+  external_exports.object({ action: external_exports.literal("freeze") }),
+  external_exports.object({ action: external_exports.literal("unfreeze") }),
+  external_exports.object({ action: external_exports.literal("set_policy"), writePolicy: external_exports.enum(STORE_WRITE_POLICIES) }),
+  external_exports.object({ action: external_exports.literal("set_anon_writes"), anonWrites: external_exports.boolean() }),
+  external_exports.object({ action: external_exports.literal("reset"), collection: collectionSchemaStore.optional() })
+]);
+var storageOptInSchema = external_exports.object({
+  local: external_exports.boolean().default(false),
+  shared: external_exports.boolean().default(false)
+});
+function byteLength(s) {
+  if (typeof TextEncoder !== "undefined") return new TextEncoder().encode(s).length;
+  let n = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.codePointAt(i);
+    n += c <= 127 ? 1 : c <= 2047 ? 2 : c <= 65535 ? 3 : (i++, 4);
+  }
+  return n;
+}
+
 // ../shared/src/schemas.ts
 var handleSchema = external_exports.string().regex(/^[a-z0-9_.]{3,24}$/, "3\u201324 chars: a\u2013z, 0\u20139, _ or .");
 var categorySchema = external_exports.enum(CATEGORIES);
 var visibilitySchema = external_exports.enum(VISIBILITY);
+var coverModeSchema = external_exports.enum(COVER_MODES);
 var sourceSchema = external_exports.enum(EXPERIENCE_SOURCE);
 var tagsSchema = external_exports.array(external_exports.string().min(1).max(40)).max(10).transform(
   (tags) => Array.from(
@@ -10135,8 +10297,12 @@ var publishSchema = external_exports.object({
   tags: tagsSchema,
   remixable: external_exports.boolean().default(true),
   visibility: visibilitySchema.default("public"),
+  coverMode: coverModeSchema.default("gif"),
   draftArtifactKey: external_exports.string().min(1),
-  buildSessionId: external_exports.string().uuid().optional()
+  buildSessionId: external_exports.string().uuid().optional(),
+  /** Storage opt-in override; when omitted, publish auto-detects from the source
+   *  (docs/post-storage.md §9 — default off, enabled only when actually used). */
+  storage: storageOptInSchema.optional()
 });
 var patchExperienceSchema = external_exports.object({
   title: external_exports.string().min(1).max(120).optional(),
@@ -10144,25 +10310,44 @@ var patchExperienceSchema = external_exports.object({
   tags: tagsSchema.optional(),
   category: categorySchema.optional(),
   remixable: external_exports.boolean().optional(),
-  visibility: visibilitySchema.optional()
+  visibility: visibilitySchema.optional(),
+  coverMode: coverModeSchema.optional()
 });
 var commentSchema = external_exports.object({
   body: external_exports.string().min(1).max(500),
   parentId: external_exports.string().uuid().optional()
 });
 var eventSchema = external_exports.object({
-  kind: external_exports.enum(["impression", "play", "play_time", "share"]),
+  // "record"/"screenshot" fire when a viewer captures the vibe (see the in-iframe
+  // bridge capture flow, docs/architecture.md §5.4). Plain-text `viewEvents.kind`
+  // column, so new kinds need no migration.
+  kind: external_exports.enum(["impression", "play", "play_time", "share", "record", "screenshot"]),
   ms: external_exports.number().int().nonnegative().optional()
 });
 var createBuildSchema = external_exports.object({
   mode: external_exports.enum(["ai", "remix"]),
   remixParentId: external_exports.string().uuid().optional()
 });
+var turnAttachmentSchema = external_exports.object({
+  kind: external_exports.enum(["image", "audio", "file", "sketch"]),
+  key: external_exports.string().max(300).default(""),
+  name: external_exports.string().max(200),
+  // NUL bytes break Postgres jsonb (and mean binary-not-text) — strip defensively.
+  text: external_exports.string().max(5e4).transform((t) => t.replace(/\u0000/g, "")).optional()
+});
+var createTurnRequestSchema = external_exports.object({
+  clientTurnId: external_exports.string().uuid(),
+  content: external_exports.string().max(4e3).default(""),
+  attachments: external_exports.array(turnAttachmentSchema).max(6).optional(),
+  model: external_exports.string().max(100).optional()
+}).refine((v) => v.content.trim().length > 0 || (v.attachments?.length ?? 0) > 0, {
+  message: "Send a message or an attachment."
+});
 var builderAttachmentSchema = external_exports.object({
-  kind: external_exports.enum(["image", "file"]),
+  kind: external_exports.enum(["image", "file", "audio"]),
   name: external_exports.string().max(200),
-  dataUrl: external_exports.string().max(8e6).optional(),
-  // ~6MB image as base64 data URL
+  // base64 data URL for image/audio (~8.7MB raw fits, covering a short song).
+  dataUrl: external_exports.string().max(12e6).optional(),
   text: external_exports.string().max(5e4).optional()
 });
 var builderMessageSchema = external_exports.object({
@@ -10194,10 +10379,21 @@ var reportSchema = external_exports.object({
 var patchMeSchema = external_exports.object({
   displayName: external_exports.string().min(1).max(60).optional(),
   bio: external_exports.string().max(300).optional(),
-  avatar: external_exports.string().url().optional(),
+  // A stored image URL, or "" to remove the photo and fall back to the color avatar.
+  avatar: external_exports.string().url().or(external_exports.literal("")).optional(),
+  // Fallback avatar colour (used when there's no photo). Hex like #6C4CF1.
+  avatarBg: external_exports.string().regex(/^#[0-9a-fA-F]{6}$/, "hex colour, e.g. #6C4CF1").optional(),
   handle: handleSchema.optional()
   // once
 });
+var waitlistSchema = external_exports.object({
+  email: external_exports.string().trim().email().max(200),
+  note: external_exports.string().trim().max(500).optional()
+});
+var waitlistReviewSchema = external_exports.object({
+  requestId: external_exports.string().uuid(),
+  action: external_exports.enum(["approve", "reject"])
+});
 var aiConnectionSchema = external_exports.object({
   provider: external_exports.enum(AI_PROVIDERS),
   apiKey: external_exports.string().trim().min(12).max(300)
@@ -10211,28 +10407,225 @@ var feedQuerySchema = external_exports.object({
 var searchQuerySchema = external_exports.object({
   q: external_exports.string().default(""),
   tab: external_exports.enum(["experiences", "tags", "creators"]).default("experiences"),
-  remixableOnly: external_exports.coerce.boolean().default(false),
+  // Query params arrive as strings; z.coerce.boolean() is just Boolean(x), so
+  // "false"/"0" would (wrongly) become true and the filter could never be turned
+  // off. Parse the string explicitly: only "true"/"1" (or a real boolean) is true.
+  remixableOnly: external_exports.union([external_exports.boolean(), external_exports.string()]).optional().transform((v) => v === true || v === "true" || v === "1"),
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(30).default(15)
 });
+var registerPushDeviceSchema = external_exports.object({
+  provider: external_exports.enum(PUSH_PROVIDERS),
+  token: external_exports.string().trim().min(16).max(4096),
+  keys: external_exports.record(external_exports.string().max(512)).default({}),
+  platform: external_exports.enum(DEVICE_PLATFORMS).default("web"),
+  userAgent: external_exports.string().trim().max(400).default("")
+}).superRefine((v, ctx) => {
+  if (v.provider === "webpush" && (!v.keys.p256dh || !v.keys.auth)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["keys"],
+      message: "webpush requires keys.p256dh and keys.auth"
+    });
+  }
+});
+var unregisterPushDeviceSchema = external_exports.object({
+  token: external_exports.string().trim().min(16).max(4096)
+});
+var notificationsQuerySchema = external_exports.object({
+  filter: external_exports.enum(["all", "mentions", "remixes"]).default("all"),
+  // Keyset cursor: the `createdAt` ISO timestamp of the last item seen.
+  cursor: external_exports.string().datetime({ offset: true }).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(80).default(30)
+});
+var notifPrefsPatchSchema = external_exports.object({
+  enabled: external_exports.boolean().optional(),
+  groups: external_exports.record(external_exports.enum(NOTIF_PREF_GROUPS), external_exports.boolean()).optional()
+});
 
-// ../shared/src/models.ts
-var BUILDER_MODELS = [
-  // ── Free (selectable now) — good quality, reasonable price ─────────
-  { id: "claude-sonnet-4-20250514", label: "Claude Sonnet 4", tier: "free", note: "Best for polished HTML", vision: true },
-  { id: "gemini-2.5-flash", label: "Gemini 2.5 Flash", tier: "free", note: "Fast \xB7 great UI \xB7 cheap", vision: true },
-  { id: "gpt-4o-mini", label: "GPT-4o mini", tier: "free", note: "Cheap & reliable", vision: true },
-  { id: "gpt-5-mini", label: "GPT-5 mini", tier: "free", note: "Newer, capable", vision: true },
-  { id: "gpt-5.1-codex", label: "GPT-5.1 Codex", tier: "free", note: "Code specialist" },
-  { id: "deepseek-v4-pro", label: "DeepSeek V4 Pro", tier: "free", note: "Strong coder \xB7 great value" },
-  { id: "deepseek-v4-flash", label: "DeepSeek V4 Flash", tier: "free", note: "Fast \xB7 very cheap" },
-  { id: "gapgpt-qwen-3.6", label: "Qwen 3.6", tier: "free", note: "Good value" },
-  // ── Subscription (locked until billing is enabled) — premium ──────
-  { id: "claude-opus-4-8", label: "Claude Opus 4.8", tier: "subscription", note: "Top quality", vision: true },
-  { id: "gpt-5.2-pro", label: "GPT-5.2 Pro", tier: "subscription", note: "Premium" },
-  { id: "gemini-3-pro-preview", label: "Gemini 3 Pro", tier: "subscription", note: "Premium", vision: true }
+// ../shared/src/builderEvents.ts
+var BUILD_EVENT_VERSION = 1;
+var BUILD_PHASES = [
+  "queued",
+  // accepted, waiting for a worker slot
+  "thinking",
+  // model connected, no visible output yet (keep-alives flowing)
+  "writing",
+  // streaming the vibe's code/prose
+  "validating",
+  // sandbox pass on the produced artifact
+  "repairing"
+  // one automatic fix round after a validation failure
 ];
-var FREE_IDS = new Set(BUILDER_MODELS.filter((m) => m.tier === "free").map((m) => m.id));
+var base = { v: external_exports.literal(BUILD_EVENT_VERSION), turnId: external_exports.string() };
+var buildEventSchema = external_exports.discriminatedUnion("type", [
+  /** Assistant prose delta (never contains the HTML code block). */
+  external_exports.object({ ...base, type: external_exports.literal("token"), text: external_exports.string() }),
+  /**
+   * Honest heartbeat, ~every 2s while the turn runs: real elapsed ms, real
+   * output-token count, and the executor's actual phase. The UI renders this
+   * as a live counter — a number that moves because work is happening.
+   */
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("progress"),
+    phase: external_exports.enum(BUILD_PHASES),
+    elapsedMs: external_exports.number(),
+    tokensOut: external_exports.number()
+  }),
+  /** Friendly status chip ("index.html", "Fixing a couple of things…"). */
+  external_exports.object({ ...base, type: external_exports.literal("status"), summary: external_exports.string() }),
+  /** First-message category classification. */
+  external_exports.object({ ...base, type: external_exports.literal("category"), category: external_exports.string() }),
+  /** The validated draft landed. Preview loads it from the draft URL. */
+  external_exports.object({ ...base, type: external_exports.literal("artifact"), artifactKey: external_exports.string() }),
+  /** Terminal: failure with taxonomy code + human message. */
+  external_exports.object({
+    ...base,
+    type: external_exports.literal("error"),
+    code: external_exports.string(),
+    message: external_exports.string()
+  }),
+  /** Terminal: success. */
+  external_exports.object({ ...base, type: external_exports.literal("done") })
+]);
+
+// ../shared/src/i18n.ts
+var en = {
+  "nav.home": "Home",
+  "nav.search": "Search",
+  "nav.create": "Create",
+  "nav.notifications": "Notifications",
+  "nav.profile": "Profile",
+  "feed.explore": "Explore",
+  "feed.following": "Following",
+  "feed.tapToInteract": "Tap to interact",
+  "feed.loading": `Loading ${ITEM.one}`,
+  "feed.exit": "Exit",
+  "feed.remixedFrom": "Remixed from @{handle}",
+  "feed.remixedFromRemoved": `Remixed from a removed ${ITEM.one}`,
+  "feed.newVersionOf": "New version of {title}",
+  "feed.end.title": "You're all caught up",
+  "feed.end.body": `No new ${ITEM.many} right now \u2014 remix one you loved, or check back soon.`,
+  "feed.end.remix": "Find something to remix",
+  "feed.end.top": "Back to top",
+  "rail.like": "Like",
+  "rail.comment": "Comment",
+  "rail.remix": "Remix",
+  "rail.save": "Save",
+  "rail.share": "Share",
+  "comments.title": "Comments",
+  "comments.placeholder": "Add a comment\u2026",
+  "comments.reply": "Reply",
+  "comments.empty": "No comments yet \u2014 be the first.",
+  "comments.post": "Post",
+  "share.title": "Share",
+  "share.copyLink": "Copy link",
+  "share.copied": "Link copied",
+  "capture.record": "Record",
+  "capture.screenshot": "Screenshot",
+  "capture.recording": "Recording",
+  "capture.stop": "Stop",
+  "capture.preparing": "Preparing\u2026",
+  "capture.processing": "Finishing\u2026",
+  "capture.preview.videoTitle": "Your clip",
+  "capture.preview.imageTitle": "Your screenshot",
+  "capture.save": "Save",
+  "capture.shareVia": "Share via\u2026",
+  "capture.retry": "Try again",
+  "capture.error": "Capture failed \u2014 try again.",
+  "capture.allowShare": "Allow \u201CShare this tab\u201D to record \u2014 it captures just the vibe.",
+  "capture.pickTab": "Choose \u201CThis Tab\u201D so it records only the vibe.",
+  "capture.unsupported": `This ${ITEM.one} can't be captured yet. Try again in a moment.`,
+  "create.title": "Create",
+  "create.buildWithAI": "Build with AI",
+  "create.import": "Import",
+  "create.remix": "Remix something",
+  "create.prompt.placeholder": "Describe what you want to build\u2026",
+  "create.prompt.starters": "Start from a template",
+  "builder.publish": "Publish",
+  "builder.thinking": "Building\u2026",
+  "builder.updated": "Updated \u2713",
+  "builder.placeholder": "Ask for a change\u2026",
+  "builder.mockNotice": "Preview builder \u2014 AI generation is mocked for now.",
+  "import.title": "Import",
+  "import.paste": "Paste HTML, or drop an .html file",
+  "import.validate": "Validate",
+  "import.warnings": "Warnings",
+  "publish.title": "Publish",
+  "publish.postTitle": "Title",
+  "publish.caption": "Caption",
+  "publish.category": "Category",
+  "publish.remixable": "Allow remixes",
+  "publish.public": "Public",
+  "publish.unlisted": "Unlisted",
+  "publish.cta": "Publish",
+  "publish.remixCredit": "Remixing @{handle} \u2014 {title}",
+  "publish.toast.published": "Published! \u{1F389}",
+  "publish.toast.remix": "Remix published \u{1F501} @{handle} was credited",
+  "remix.confirmTitle": "Remixing @{handle}'s {title}",
+  "remix.confirmBody": `They'll be credited on your ${ITEM.one}. Attribution can't be removed.`,
+  "remix.start": "Start remixing",
+  "remix.galleryTitle": "Remixes",
+  "remix.sortPopular": "Popular",
+  "remix.sortRecent": "Recent",
+  "remix.count": "{n} remixes",
+  "remix.identicalWarn": "This looks identical to the original \u2014 publish anyway?",
+  "search.placeholder": `Search ${ITEM.many}, tags, creators`,
+  "search.tab.experiences": ITEM.Many,
+  "search.tab.tags": "Hashtags",
+  "search.tab.creators": "Creators",
+  "search.remixableOnly": "Remixable only",
+  "search.trending": "Trending",
+  "profile.tab.experiences": ITEM.Many,
+  "profile.tab.remixes": "Remixes",
+  "profile.tab.saved": "Saved",
+  "profile.followers": "followers",
+  "profile.following": "following",
+  "profile.likes": "likes",
+  "profile.follow": "Follow",
+  "profile.unfollow": "Following",
+  "profile.edit": "Edit profile",
+  "notifs.all": "All",
+  "notifs.mentions": "Mentions",
+  "notifs.remixes": "Remixes",
+  "notifs.remixedYou": `@{handle} remixed your ${ITEM.one}`,
+  "notifs.liked": `@{handle} liked your ${ITEM.one}`,
+  "notifs.commented": "@{handle} commented",
+  "notifs.followed": "@{handle} started following you",
+  "notifs.empty": "Nothing here yet.",
+  "collections.title": "Saved",
+  "collections.new": "New collection",
+  "analytics.title": "Analytics",
+  "analytics.views": "Views",
+  "analytics.plays": "Plays",
+  "analytics.playRate": "Play rate",
+  "analytics.avgTime": "Avg. time",
+  "analytics.likes": "Likes",
+  "analytics.comments": "Comments",
+  "analytics.shares": "Shares",
+  "analytics.saves": "Saves",
+  "analytics.remixes": "Remixes",
+  "post.options": `${ITEM.One} options`,
+  "post.analytics": "View analytics",
+  "post.edit": "Edit caption",
+  "post.delete": `Delete ${ITEM.one}`,
+  "post.deleteConfirm": `Delete this ${ITEM.one}? This can't be undone.`,
+  "post.captionPlaceholder": "Write a caption\u2026",
+  "auth.signIn": "Sign in",
+  "auth.google": "Continue with Google",
+  "auth.github": "Continue with GitHub",
+  "auth.dev": "Dev login",
+  "auth.needAccount": "Sign in to like, comment, and remix.",
+  "common.cancel": "Cancel",
+  "common.save": "Save",
+  "common.back": "Back",
+  "common.retry": "Retry",
+  "common.loading": "Loading\u2026",
+  "common.report": "Report",
+  "common.delete": "Delete",
+  "common.views": "{n} views"
+};
 
 // ../shared/src/tokens.ts
 var colors = {
@@ -10335,6 +10728,15 @@ function validate(html, opts) {
     errors.push({ code: "NOT_HTML", message: "Content is not parseable as HTML." });
     return { ok: false, errors, warnings };
   }
+  const scriptOpens = (html.match(/<script\b/gi) ?? []).length;
+  const scriptCloses = (html.match(/<\/script\s*>/gi) ?? []).length;
+  if (scriptOpens > scriptCloses) {
+    errors.push({
+      code: "TRUNCATED_DOC",
+      message: "The file ends mid-<script> \u2014 it looks cut off. Regenerate or paste the complete file."
+    });
+    return { ok: false, errors, warnings };
+  }
   if (on("frames") && root.querySelector("iframe, frame, object, embed")) {
     errors.push({
       code: "FRAME_TAG",
@@ -10419,6 +10821,12 @@ function validate(html, opts) {
       }
     }
   }
+  if (/(localStorage|sessionStorage|indexedDB|document\s*\.\s*cookie)/.test(html)) {
+    warnings.push({
+      code: "BROWSER_STORAGE",
+      message: "Uses browser storage (localStorage/sessionStorage/indexedDB/cookies), which throws inside the vibed sandbox. Port persistence to window.vibed.storage (local per-viewer, shared collective)."
+    });
+  }
   const lower = html.toLowerCase();
   const hasCredField = root.querySelector('input[type="email"], input[type="text"], input[type="tel"]') != null && /(password|passcode|otp|verify|sign\s*in|log\s*in|account)/i.test(html);
   if (hasCredField) {
@@ -10932,22 +11340,38 @@ function normalizeCategory(input) {
   const match = CATEGORIES.find((c) => c.toLowerCase() === input.toLowerCase());
   return match ?? "Other";
 }
-async function publishArtifact(client, html, meta, projectDir) {
-  const imported = await apiFetch(client, "POST", "/imports", { html });
+async function importDraft(client, html) {
+  const r = await apiFetch(client, "POST", "/imports", { html });
+  return { draftArtifactKey: r.draftArtifactKey, previewUrl: r.previewUrl };
+}
+async function publishDraft(client, draftArtifactKey, meta, html, projectDir) {
   const exp = await apiFetch(client, "POST", "/experiences", {
-    title: meta.title?.trim() || inferTitle(html, projectDir),
+    title: meta.title?.trim() || (html ? inferTitle(html, projectDir ?? ".") : "Untitled"),
     caption: meta.caption ?? "",
     category: normalizeCategory(meta.category),
     tags: meta.tags ?? [],
     remixable: meta.remixable ?? true,
     visibility: meta.visibility ?? "public",
-    draftArtifactKey: imported.draftArtifactKey
+    draftArtifactKey
   });
   return { id: exp.id, status: exp.status, url: `${client.apiBase}/e/${exp.id}` };
 }
+async function publishArtifact(client, html, meta, projectDir) {
+  const { draftArtifactKey } = await importDraft(client, html);
+  return publishDraft(client, draftArtifactKey, meta, html, projectDir);
+}
+function experienceIdFrom(input) {
+  const m = input.match(/\/e\/([0-9a-f-]{36})/i);
+  return (m?.[1] ?? input.trim()).toLowerCase();
+}
+async function deleteExperience(client, idOrUrl) {
+  const id = experienceIdFrom(idOrUrl);
+  await apiFetch(client, "DELETE", `/experiences/${id}`);
+  return id;
+}
 
 // src/index.ts
-var SERVER_INFO = { name: "vibed", version: "0.1.0" };
+var SERVER_INFO = { name: "vibed", version: "0.1.4" };
 var PROTOCOL_VERSION = "2024-11-05";
 var CATEGORIES2 = ["Game", "Invitation", "Story", "News", "Quiz", "Tool", "Art", "Other"];
 var pendingLogin = null;
@@ -11022,12 +11446,47 @@ After the user approves, call vibed_login_wait.`;
       }
     }
   },
+  {
+    name: "vibed_draft",
+    description: "Bundle the project and upload it as a PRIVATE draft, returning a hosted, sandboxed PREVIEW link (\u2026/p/<id>/) and a draftKey. Publishes nothing \u2014 the link is in no feed, profile, or search; only someone with it can open it. Show the preview to the user, then call vibed_publish with the returned draftKey once they approve. Requires sign-in.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "Project directory (default: current directory)" },
+        entry: { type: "string" },
+        build: { type: "boolean" },
+        api: { type: "string", description: "API base URL (default: production)" }
+      }
+    },
+    run: async (a) => {
+      const dir2 = resolve2(str(a.path, "."));
+      const cfg = await loadConfig({ api: str(a.api) || void 0 });
+      if (!cfg.token) return "Not signed in. Use vibed_login first.";
+      const result = await bundleProject(dir2, {
+        entry: str(a.entry) || void 0,
+        build: bool(a.build, true),
+        onLog: (m) => process.stderr.write(m + "\n")
+      });
+      if (!result.ok || !result.html) {
+        return `No preview \u2014 the project isn't vibeable yet.
+
+${formatReport(result)}`;
+      }
+      const d = await importDraft({ apiBase: cfg.apiBase, token: cfg.token }, result.html);
+      return `\u2713 Private preview (not published): ${d.previewUrl ?? "(no preview URL)"}
+Show it to the user. To publish it, call vibed_publish with draftKey: ${d.draftArtifactKey}`;
+    }
+  },
   {
     name: "vibed_publish",
-    description: "Bundle the project and publish it as a vibed Experience. Requires sign-in (vibed_whoami / vibed_login). Confirm the title and category with the user first \u2014 publishing is public. Returns the published URL, or the blockers if it isn't vibeable.",
+    description: "Publish a vibed Experience. Pass draftKey (from vibed_draft) to promote an already-previewed draft \u2014 the recommended flow \u2014 or pass path to bundle + publish in one shot. Requires sign-in (vibed_whoami / vibed_login). Confirm the title and category with the user first \u2014 publishing is public. Returns the published URL, or the blockers if it isn't vibeable.",
     inputSchema: {
       type: "object",
       properties: {
+        draftKey: {
+          type: "string",
+          description: "Promote this draft (from vibed_draft) instead of bundling path"
+        },
         path: { type: "string", description: "Project directory (default: current directory)" },
         title: { type: "string", description: "Title (default: page <title>/<h1>/folder name)" },
         category: { type: "string", enum: CATEGORIES2, description: "Experience category" },
@@ -11041,9 +11500,23 @@ After the user approves, call vibed_login_wait.`;
       }
     },
     run: async (a) => {
-      const dir2 = resolve2(str(a.path, "."));
       const cfg = await loadConfig({ api: str(a.api) || void 0 });
       if (!cfg.token) return "Not signed in. Use vibed_login first.";
+      const client = { apiBase: cfg.apiBase, token: cfg.token };
+      const meta = {
+        title: str(a.title) || void 0,
+        category: str(a.category) || void 0,
+        tags: Array.isArray(a.tags) ? a.tags : void 0,
+        caption: str(a.caption) || void 0,
+        remixable: bool(a.remixable, true),
+        visibility: bool(a.unlisted, false) ? "unlisted" : "public"
+      };
+      const draftKey = str(a.draftKey);
+      if (draftKey) {
+        const outcome2 = await publishDraft(client, draftKey, meta);
+        return `\u2713 Published (${outcome2.status}): ${outcome2.url}`;
+      }
+      const dir2 = resolve2(str(a.path, "."));
       const result = await bundleProject(dir2, {
         entry: str(a.entry) || void 0,
         build: bool(a.build, true),
@@ -11054,21 +11527,29 @@ After the user approves, call vibed_login_wait.`;
 
 ${formatReport(result)}`;
       }
-      const outcome = await publishArtifact(
-        { apiBase: cfg.apiBase, token: cfg.token },
-        result.html,
-        {
-          title: str(a.title) || void 0,
-          category: str(a.category) || void 0,
-          tags: Array.isArray(a.tags) ? a.tags : void 0,
-          caption: str(a.caption) || void 0,
-          remixable: bool(a.remixable, true),
-          visibility: bool(a.unlisted, false) ? "unlisted" : "public"
-        },
-        dir2
-      );
+      const outcome = await publishArtifact(client, result.html, meta, dir2);
       return `\u2713 Published (${outcome.status}): ${outcome.url}`;
     }
+  },
+  {
+    name: "vibed_delete",
+    description: "Delete one of your vibed posts, by experience id or a \u2026/e/<id> share URL. Owner-only (the server rejects deleting someone else's post). Destructive \u2014 confirm the specific post with the user first. Requires sign-in.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        target: { type: "string", description: "Experience id or https://\u2026/e/<id> URL" },
+        api: { type: "string", description: "API base URL (default: production)" }
+      },
+      required: ["target"]
+    },
+    run: async (a) => {
+      const target = str(a.target);
+      if (!target) return "Provide the post's id or its \u2026/e/<id> URL.";
+      const cfg = await loadConfig({ api: str(a.api) || void 0 });
+      if (!cfg.token) return "Not signed in. Use vibed_login first.";
+      const id = await deleteExperience({ apiBase: cfg.apiBase, token: cfg.token }, target);
+      return `\u2713 Deleted post ${id}.`;
+    }
   }
 ];
 function write(msg) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amirhosseinnateghi/vibed-mcp",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "vibed MCP server — make it vibed from any MCP client (Codex, Cursor, Gemini, …): check, login, and publish tools",
   "license": "MIT",
   "type": "module",