@clipform/mcp-server 2.2.2 → 2.3.0

package/dist/chunk-V4L5RQWK.js

@@ -0,0 +1,21 @@
+// src/lib/auth-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var storage = new AsyncLocalStorage();
+function runWithMcpAuth(ctx, fn) {
+  return storage.run(ctx, fn);
+}
+function getMcpAuth() {
+  return storage.getStore();
+}
+function runWithMcpTool(toolName, fn) {
+  const parent = storage.getStore();
+  if (!parent) return fn();
+  return storage.run({ ...parent, tool_name: toolName }, fn);
+}
+
+export {
+  runWithMcpAuth,
+  getMcpAuth,
+  runWithMcpTool
+};
+//# sourceMappingURL=chunk-V4L5RQWK.js.map

package/dist/{chunk-HCZI2UJ5.js.map → chunk-V4L5RQWK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/lib/auth-context.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Identity of the end-user a given MCP request is acting on behalf of.\n *\n * Populated by the in-process host (apps/api) after validating an OAuth\n * Bearer on /mcp. The MCP tool layer reads it to decide which workspace\n * forms should land in and which plan tier gates apply.\n *\n * NOT populated when the server runs as a local stdio process (npx) - in\n * that mode tools fall back to edit-token based auth.\n */\nexport interface McpAuthContext {\n  user_id: string;\n  workspace_id: string;\n  scopes: string[];\n  tool_name?: string;\n  api_key?: string;\n}\n\nconst storage = new AsyncLocalStorage<McpAuthContext>();\n\nexport function runWithMcpAuth<T>(ctx: McpAuthContext, fn: () => Promise<T> | T): Promise<T> | T {\n  return storage.run(ctx, fn);\n}\n\nexport function getMcpAuth(): McpAuthContext | undefined {\n  return storage.getStore();\n}\n\nexport function runWithMcpTool<T>(toolName: string, fn: () => Promise<T> | T): Promise<T> | T {\n  const parent = storage.getStore();\n  if (!parent) return fn();\n  return storage.run({ ...parent, tool_name: toolName }, fn);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,yBAAyB;AAoBlC,IAAM,UAAU,IAAI,kBAAkC;AAE/C,SAAS,eAAkB,KAAqB,IAA0C;AAC/F,SAAO,QAAQ,IAAI,KAAK,EAAE;AAC5B;AAEO,SAAS,aAAyC;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAEO,SAAS,eAAkB,UAAkB,IAA0C;AAC5F,QAAM,SAAS,QAAQ,SAAS;AAChC,MAAI,CAAC,OAAQ,QAAO,GAAG;AACvB,SAAO,QAAQ,IAAI,EAAE,GAAG,QAAQ,WAAW,SAAS,GAAG,EAAE;AAC3D;","names":[]}
+{"version":3,"sources":["../src/lib/auth-context.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Identity of the end-user a given MCP request is acting on behalf of.\n *\n * Populated by the in-process host (apps/api) after validating an OAuth\n * Bearer on /mcp. The MCP tool layer reads it to decide which workspace\n * forms should land in and which plan tier gates apply.\n *\n * NOT populated when the server runs as a local stdio process (npx) - in\n * that mode tools fall back to edit-token based auth.\n */\nexport interface McpAuthContext {\n  user_id: string;\n  workspace_id: string;\n  scopes: string[];\n  tool_name?: string;\n  api_key?: string;\n}\n\nconst storage = new AsyncLocalStorage<McpAuthContext>();\n\nexport function runWithMcpAuth<T>(ctx: McpAuthContext, fn: () => Promise<T> | T): Promise<T> | T {\n  return storage.run(ctx, fn);\n}\n\nexport function getMcpAuth(): McpAuthContext | undefined {\n  return storage.getStore();\n}\n\nexport function runWithMcpTool<T>(toolName: string, fn: () => Promise<T> | T): Promise<T> | T {\n  const parent = storage.getStore();\n  if (!parent) return fn();\n  return storage.run({ ...parent, tool_name: toolName }, fn);\n}\n"],"mappings":";AAAA,SAAS,yBAAyB;AAoBlC,IAAM,UAAU,IAAI,kBAAkC;AAE/C,SAAS,eAAkB,KAAqB,IAA0C;AAC/F,SAAO,QAAQ,IAAI,KAAK,EAAE;AAC5B;AAEO,SAAS,aAAyC;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAEO,SAAS,eAAkB,UAAkB,IAA0C;AAC5F,QAAM,SAAS,QAAQ,SAAS;AAChC,MAAI,CAAC,OAAQ,QAAO,GAAG;AACvB,SAAO,QAAQ,IAAI,EAAE,GAAG,QAAQ,WAAW,SAAS,GAAG,EAAE;AAC3D;","names":[]}

package/dist/{chunk-T6L5Z4J5.js → chunk-WCPHQ4GU.js}

@@ -2,10 +2,10 @@ import {
   WORKFLOW_TYPES,
   getDiscoveryParams,
   getSessionContextWithAuth
-} from "./chunk-GZRTOCD2.js";
+} from "./chunk-YZJZ5NPL.js";
 import {
   __export
-} from "./chunk-HCZI2UJ5.js";
+} from "./chunk-G3PMV62Z.js";
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -4708,4 +4708,4 @@ export {
   getWorkflowText,
   registerPrompts
 };
-//# sourceMappingURL=chunk-T6L5Z4J5.js.map
+//# sourceMappingURL=chunk-WCPHQ4GU.js.map

package/dist/{chunk-EOAGENT6.js → chunk-WNXTF76M.js}

@@ -4,7 +4,7 @@ import {
   FORM_TYPE_KEYS,
   callApi,
   getSessionContext
-} from "./chunk-GZRTOCD2.js";
+} from "./chunk-YZJZ5NPL.js";
 
 // src/lib/guides.ts
 var guidesPromise = null;
@@ -133,4 +133,4 @@ export {
   getGuideUri,
   registerResources
 };
-//# sourceMappingURL=chunk-EOAGENT6.js.map
+//# sourceMappingURL=chunk-WNXTF76M.js.map

package/dist/{chunk-GZRTOCD2.js → chunk-YZJZ5NPL.js}

@@ -1,6 +1,11 @@
 import {
   getMcpAuth
-} from "./chunk-HCZI2UJ5.js";
+} from "./chunk-V4L5RQWK.js";
+import {
+  isAuthFault,
+  isServerFault,
+  reportError
+} from "./chunk-PBQ5BQWD.js";
 
 // ../config/features.js
 var FEATURES = {
@@ -331,9 +336,9 @@ var FEATURES = {
     status: "planned",
     category: "sharing"
   },
-  embed_slots: {
-    name: "Embed slots",
-    description: "Named slots that point an embed at a form, so content can be swapped from the dashboard without changing the embed code",
+  dynamic_link: {
+    name: "Dynamic links",
+    description: "A named link that points at a form, so the target can be swapped from the dashboard without changing the embed code or printed link",
     enabled: false,
     status: "beta",
     category: "sharing"
@@ -1049,7 +1054,10 @@ var NODE_TYPES = {
       type: "object",
       properties: {
         max_files: { max: 20, min: 1, type: "number", label: "Max files", default: 5, description: "Maximum number of files respondents can upload" },
-        max_file_size_mb: { max: 500, min: 1, type: "number", label: "Max file size (MB)", default: 50, description: "Maximum size per file (1-500 MB)" },
+        // Capped at 50, not 500: respondent file uploads go straight to the Supabase
+        // `file-uploads` bucket, and SUPABASE_STORAGE_MAX_BYTES is a hard ceiling there.
+        // Anything above it passed validation and then 500'd at the storage layer (#2556).
+        max_file_size_mb: { max: 50, min: 1, type: "number", label: "Max file size (MB)", default: 50, description: "Maximum size per file (1-50 MB)" },
         allowed_media_types: {
           type: "array",
           items: { enum: ["images", "videos", "documents", "all"], type: "string" },
@@ -2195,6 +2203,7 @@ var BUSINESS = {
   urls: getUrls()
 };
 var MEDIA_DIRECT_MAX_BYTES = 20 * 1024 * 1024;
+var SUPABASE_STORAGE_MAX_BYTES = 50 * 1024 * 1024;
 var VIDEO_COMPRESS_FLOOR_BYTES = 1 * 1024 * 1024;
 var HELP_LINKS = buildHelpLinks(BUSINESS.urls.docs);
 var CONTACT_FIELDS = [
@@ -2279,50 +2288,17 @@ function exposedCompositionIds(includeNonPublic) {
 var SCENE_LAYER_COMPOSITION_IDS = COMPOSITION_REGISTRY.filter((c) => c.scene_layer).map((c) => c.id);
 var MCP_TOOL_TIERS = {};
 
-// src/lib/telemetry.ts
-var telemetryEnabled = process.env.DO_NOT_TRACK !== "1" && process.env.CLIPFORM_TELEMETRY !== "off";
-var mcpVersion = "unknown";
-function setMcpVersion(version) {
-  mcpVersion = version;
-}
-function getApiBaseUrl() {
-  return process.env.API_URL || null;
-}
-function reportError(report) {
-  if (!telemetryEnabled) return;
-  const base = getApiBaseUrl();
-  if (!base) return;
-  const payload = {
-    ...report,
-    error_message: report.error_message.slice(0, 500),
-    mcp_version: mcpVersion,
-    runtime: detectRuntime(),
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  fetch(`${base}/v1/telemetry/errors`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(payload),
-    signal: AbortSignal.timeout(2e3)
-  }).catch(() => {
-  });
-}
-function isServerFault(status) {
-  return status >= 500;
-}
-function detectRuntime() {
-  if (process.env.CLAUDE_CODE) return "claude-code";
-  if (process.env.CURSOR_SESSION_ID) return "cursor";
-  return "stdio";
-}
-
 // src/lib/api-client.ts
-function getApiBaseUrl2() {
+function getApiBaseUrl() {
   const url = process.env.API_URL;
   if (!url) {
-    throw new Error(
-      "API_URL must be set (e.g. http://localhost:3003 or https://api.clipform.io)"
-    );
+    const message = "API_URL must be set (e.g. http://localhost:3003 or https://api.clipform.io)";
+    reportError({
+      error_type: "config_error",
+      error_message: message,
+      tool_name: getMcpAuth()?.tool_name
+    });
+    throw new Error(message);
   }
   return url;
 }
@@ -2330,14 +2306,20 @@ function getAuthHeaders() {
   const authCtx = getMcpAuth();
   const apiKey = authCtx?.api_key || process.env.CLIPFORM_API_KEY;
   if (!apiKey) {
-    throw new Error("CLIPFORM_API_KEY must be set.");
+    const message = "CLIPFORM_API_KEY must be set.";
+    reportError({
+      error_type: "config_error",
+      error_message: message,
+      tool_name: authCtx?.tool_name
+    });
+    throw new Error(message);
   }
   return { "Authorization": `Bearer ${apiKey}` };
 }
 async function callApi(path, options = {}) {
   const { body, params, timeoutMs = 3e4 } = options;
   const method = options.method || (body ? "POST" : "GET");
-  const base = getApiBaseUrl2();
+  const base = getApiBaseUrl();
   const prefix = path.startsWith("/internal/") ? "" : "/v1";
   let url = `${base}${prefix}${path}`;
   if (params) {
@@ -2383,7 +2365,8 @@ Error: ${message}`
     const hint = recoveryHint(response.status, path);
     const apiMsg = data.error || `API error (${response.status})`;
     const errorMsg = hint ? `${apiMsg} - ${hint}` : apiMsg;
-    if (isServerFault(response.status)) {
+    const errorCode = typeof data.code === "string" ? data.code : void 0;
+    if (isServerFault(response.status) || isAuthFault(response.status, errorCode)) {
       reportError({
         error_type: `http_${response.status}`,
         error_message: errorMsg,
@@ -2504,7 +2487,6 @@ export {
   SLIDESHOW_TRANSITIONS,
   exposedCompositionIds,
   MCP_TOOL_TIERS,
-  setMcpVersion,
   callApi,
   errorResult,
   textResult,
@@ -2512,4 +2494,4 @@ export {
   getSessionContextWithAuth,
   getSessionContext
 };
-//# sourceMappingURL=chunk-GZRTOCD2.js.map
+//# sourceMappingURL=chunk-YZJZ5NPL.js.map