@clipform/mcp-server 2.2.2 → 2.3.0

package/README.md

@@ -67,7 +67,7 @@ Your MCP client lists these automatically on connect (via `tools/list`). Full re
 | `clipform_list_forms` | List forms in your workspace with optional filtering. |
 | `clipform_get_form` | Retrieve a form's details including all nodes in sequential order. |
 | `clipform_update_form` | Update a form's title, publish status, settings, or tags. |
-| `clipform_delete_form` | Permanently delete a form and all its nodes. |
+| `clipform_delete_form` | Move a form and all its nodes to the trash. |
 | `clipform_add_node` | Add a new node to an existing form. |
 | `clipform_update_node` | Update one or more existing nodes' text, type, config, or options. |
 | `clipform_delete_node` | Delete a node from a form. |

package/dist/auth-context.js

@@ -2,7 +2,8 @@ import {
   getMcpAuth,
   runWithMcpAuth,
   runWithMcpTool
-} from "./chunk-HCZI2UJ5.js";
+} from "./chunk-V4L5RQWK.js";
+import "./chunk-G3PMV62Z.js";
 export {
   getMcpAuth,
   runWithMcpAuth,

package/dist/{chunk-HCZI2UJ5.js → chunk-G3PMV62Z.js}

@@ -28,27 +28,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// src/lib/auth-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-var storage = new AsyncLocalStorage();
-function runWithMcpAuth(ctx, fn) {
-  return storage.run(ctx, fn);
-}
-function getMcpAuth() {
-  return storage.getStore();
-}
-function runWithMcpTool(toolName, fn) {
-  const parent = storage.getStore();
-  if (!parent) return fn();
-  return storage.run({ ...parent, tool_name: toolName }, fn);
-}
-
 export {
   __commonJS,
   __export,
-  __toESM,
-  runWithMcpAuth,
-  getMcpAuth,
-  runWithMcpTool
+  __toESM
 };
-//# sourceMappingURL=chunk-HCZI2UJ5.js.map
+//# sourceMappingURL=chunk-G3PMV62Z.js.map

package/dist/chunk-G3PMV62Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-PBQ5BQWD.js

@@ -0,0 +1,60 @@
+// src/lib/telemetry.ts
+function isTelemetryEnabled() {
+  return process.env.DO_NOT_TRACK !== "1" && process.env.CLIPFORM_TELEMETRY !== "off";
+}
+var mcpVersion = "unknown";
+function setMcpVersion(version) {
+  mcpVersion = version;
+}
+function getApiBaseUrl() {
+  return process.env.API_URL || null;
+}
+var customReporter = null;
+function setErrorReporter(reporter) {
+  customReporter = reporter;
+}
+function reportError(report) {
+  if (customReporter) {
+    customReporter(report);
+    return;
+  }
+  if (!isTelemetryEnabled()) return;
+  const base = getApiBaseUrl();
+  if (!base) return;
+  const payload = {
+    ...report,
+    error_message: report.error_message.slice(0, 500),
+    mcp_version: mcpVersion,
+    runtime: detectRuntime(),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  fetch(`${base}/v1/telemetry/errors`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(payload),
+    signal: AbortSignal.timeout(2e3)
+  }).catch(() => {
+  });
+}
+function isServerFault(status) {
+  return status >= 500;
+}
+function isAuthFault(status, code) {
+  if (status === 401) return true;
+  if (status === 403) return code === "FORBIDDEN";
+  return false;
+}
+function detectRuntime() {
+  if (process.env.CLAUDE_CODE) return "claude-code";
+  if (process.env.CURSOR_SESSION_ID) return "cursor";
+  return "stdio";
+}
+
+export {
+  setMcpVersion,
+  setErrorReporter,
+  reportError,
+  isServerFault,
+  isAuthFault
+};
+//# sourceMappingURL=chunk-PBQ5BQWD.js.map

package/dist/chunk-PBQ5BQWD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/telemetry.ts"],"sourcesContent":["// Evaluated per-call (not frozen at module load) so a runtime env change is\n// actually observed - also what makes the ordering fix below testable.\nfunction isTelemetryEnabled(): boolean {\n  return process.env.DO_NOT_TRACK !== \"1\" && process.env.CLIPFORM_TELEMETRY !== \"off\";\n}\n\nlet mcpVersion = \"unknown\";\n\nexport function setMcpVersion(version: string) {\n  mcpVersion = version;\n}\n\nfunction getApiBaseUrl(): string | null {\n  return process.env.API_URL || null;\n}\n\nexport interface ErrorReport {\n  error_type: string;\n  error_message: string;\n  tool_name?: string;\n  status_code?: number;\n  api_path?: string;\n}\n\nexport type ErrorReporter = (report: ErrorReport) => void;\n\n// Overridable delivery mechanism (#2599 follow-up). The default below POSTs\n// to /v1/telemetry/errors - correct for the external stdio MCP client, which\n// runs as its own process talking to a real remote API over HTTP. The\n// in-process host (apps/api, via packages/mcp-client) runs this same package\n// IN the API process itself, so that default would have the API POST\n// itself: mcp_version is only ever set by the stdio bin (src/index.ts), so\n// the endpoint's version-format check 400s every in-process report, and\n// /v1/telemetry/errors' 10/min IP rate limit is shared across every\n// in-process channel on one loopback IP. The in-process host installs its\n// own reporter (apps/api/src/lib/mcp-telemetry-bridge.ts) that captures\n// straight through its own PostHog client instead. Exported so that bridge\n// can install it; pass null to restore the default HTTP reporter.\nlet customReporter: ErrorReporter | null = null;\n\nexport function setErrorReporter(reporter: ErrorReporter | null): void {\n  customReporter = reporter;\n}\n\nexport function reportError(report: ErrorReport) {\n  // An installed reporter (the in-process host) takes precedence over the\n  // opt-out gate below - DO_NOT_TRACK/CLIPFORM_TELEMETRY are an end-user\n  // choice for the EXTERNAL stdio client and have no server-side meaning;\n  // whatever those vars happen to be set to in the API's own environment\n  // must never silently suppress the AI channels' own error capture (#2599\n  // minor - the gate used to run before this check).\n  if (customReporter) {\n    customReporter(report);\n    return;\n  }\n\n  if (!isTelemetryEnabled()) return;\n\n  const base = getApiBaseUrl();\n  if (!base) return;\n\n  const payload = {\n    ...report,\n    error_message: report.error_message.slice(0, 500),\n    mcp_version: mcpVersion,\n    runtime: detectRuntime(),\n    timestamp: new Date().toISOString(),\n  };\n\n  fetch(`${base}/v1/telemetry/errors`, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/json\" },\n    body: JSON.stringify(payload),\n    signal: AbortSignal.timeout(2_000),\n  }).catch(() => {});\n}\n\nexport function isServerFault(status: number): boolean {\n  return status >= 500;\n}\n\n/**\n * Genuine auth failures - unlike 404/422 these are never ordinary user/agent\n * error, so they're worth reporting even though they're 4xx (#2599). A 401\n * has no other legitimate cause in this API, so it always reports. A 403,\n * though, is NOT always an auth fault here: PLAN_LIMIT and other\n * business-logic denials (feature gating) also respond 403, and those are\n * ordinary user error - exactly the noise this stays silent for. Only the\n * API's own `code` on the JSON error body (from `{ code, error }`, e.g.\n * `create-form.ts`'s ApiError) tells them apart, so a 403 only counts as an\n * auth fault when the code says so; an unrecognized/missing code on a 403\n * stays silent rather than risk misclassifying a new business-logic denial.\n */\nexport function isAuthFault(status: number, code?: string): boolean {\n  if (status === 401) return true;\n  if (status === 403) return code === \"FORBIDDEN\";\n  return false;\n}\n\nfunction detectRuntime(): string {\n  if (process.env.CLAUDE_CODE) return \"claude-code\";\n  if (process.env.CURSOR_SESSION_ID) return \"cursor\";\n  return \"stdio\";\n}\n"],"mappings":";AAEA,SAAS,qBAA8B;AACrC,SAAO,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,IAAI,uBAAuB;AAChF;AAEA,IAAI,aAAa;AAEV,SAAS,cAAc,SAAiB;AAC7C,eAAa;AACf;AAEA,SAAS,gBAA+B;AACtC,SAAO,QAAQ,IAAI,WAAW;AAChC;AAwBA,IAAI,iBAAuC;AAEpC,SAAS,iBAAiB,UAAsC;AACrE,mBAAiB;AACnB;AAEO,SAAS,YAAY,QAAqB;AAO/C,MAAI,gBAAgB;AAClB,mBAAe,MAAM;AACrB;AAAA,EACF;AAEA,MAAI,CAAC,mBAAmB,EAAG;AAE3B,QAAM,OAAO,cAAc;AAC3B,MAAI,CAAC,KAAM;AAEX,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,eAAe,OAAO,cAAc,MAAM,GAAG,GAAG;AAAA,IAChD,aAAa;AAAA,IACb,SAAS,cAAc;AAAA,IACvB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,GAAG,IAAI,wBAAwB;AAAA,IACnC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,IAC5B,QAAQ,YAAY,QAAQ,GAAK;AAAA,EACnC,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACnB;AAEO,SAAS,cAAc,QAAyB;AACrD,SAAO,UAAU;AACnB;AAcO,SAAS,YAAY,QAAgB,MAAwB;AAClE,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,IAAK,QAAO,SAAS;AACpC,SAAO;AACT;AAEA,SAAS,gBAAwB;AAC/B,MAAI,QAAQ,IAAI,YAAa,QAAO;AACpC,MAAI,QAAQ,IAAI,kBAAmB,QAAO;AAC1C,SAAO;AACT;","names":[]}

package/dist/{chunk-XKVU6UN7.js → chunk-QC4JULCW.js}

@@ -6,7 +6,7 @@ import {
   getWorkflowText,
   objectType,
   registerPrompts
-} from "./chunk-T6L5Z4J5.js";
+} from "./chunk-WCPHQ4GU.js";
 import {
   GUIDE_TYPES,
   QUIZ_VARIANTS,
@@ -14,7 +14,7 @@ import {
   getGuideUri,
   guideFallbackText,
   registerResources
-} from "./chunk-EOAGENT6.js";
+} from "./chunk-WNXTF76M.js";
 import {
   ACTIVE_NODE_TYPES,
   BUSINESS,
@@ -33,14 +33,16 @@ import {
   resolveFormType,
   structuredResult,
   textResult
-} from "./chunk-GZRTOCD2.js";
+} from "./chunk-YZJZ5NPL.js";
 import {
-  __commonJS,
-  __export,
-  __toESM,
   getMcpAuth,
   runWithMcpTool
-} from "./chunk-HCZI2UJ5.js";
+} from "./chunk-V4L5RQWK.js";
+import {
+  __commonJS,
+  __export,
+  __toESM
+} from "./chunk-G3PMV62Z.js";
 
 // ../../node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -17626,7 +17628,7 @@ function registerDeleteFormTool(server) {
     "clipform_delete_form",
     {
       title: "Delete Clipform",
-      description: `Permanently delete a form and all its nodes. This cannot be undone. Requires user confirmation before it runs.`,
+      description: `Move a form and all its nodes to the trash. It stops accepting responses immediately and can be restored later. Requires user confirmation before it runs.`,
       inputSchema: {
         form_id: external_exports.string().uuid().describe("The form UUID to delete (returned by clipform_create_form, not the short share_id from the URL)"),
         confirm: external_exports.boolean().optional().describe(CONFIRM_FIELD_DESCRIPTION)
@@ -17641,8 +17643,8 @@ function registerDeleteFormTool(server) {
     async ({ form_id, confirm }) => {
       const decision = await confirmDestructive(server, {
         alreadyConfirmed: confirm,
-        message: `Permanently delete form ${form_id} and all of its nodes? This cannot be undone.`,
-        relay: `Confirmation required: deleting form ${form_id} permanently removes it and all its nodes, and cannot be undone. Ask the user to confirm, then call clipform_delete_form again with confirm: true.`
+        message: `Move form ${form_id} to the trash? It stops accepting responses immediately and can be restored later.`,
+        relay: `Confirmation required: moving form ${form_id} to the trash stops it accepting responses immediately. It can be restored later. Ask the user to confirm, then call clipform_delete_form again with confirm: true.`
       });
       if (!decision.proceed) {
         return textResult(decision.message);
@@ -17653,7 +17655,7 @@ function registerDeleteFormTool(server) {
       if (!result.ok) {
         return errorResult(result.error);
       }
-      return textResult(`Form ${form_id} has been permanently deleted.`);
+      return textResult(`Form ${form_id} has been moved to the trash.`);
     }
   );
 }
@@ -19977,4 +19979,4 @@ export {
   RENDER_TIMING,
   createServer
 };
-//# sourceMappingURL=chunk-XKVU6UN7.js.map
+//# sourceMappingURL=chunk-QC4JULCW.js.map