@clipform/mcp-server 3.0.0 → 3.3.0

package/dist/{chunk-HZMMOSEM.js → chunk-A5CFGL27.js}

@@ -24,4 +24,4 @@ export {
   getMcpAuth,
   runWithMcpTool
 };
-//# sourceMappingURL=chunk-HZMMOSEM.js.map
+//# sourceMappingURL=chunk-A5CFGL27.js.map

package/dist/chunk-A5CFGL27.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/auth-context.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Identity of the end-user a given MCP request is acting on behalf of.\n *\n * Populated by the in-process host (apps/api) after validating an OAuth\n * Bearer on /mcp. The MCP tool layer reads it to decide which workspace\n * forms should land in and which plan tier gates apply.\n *\n * NOT populated when the server runs as a local stdio process (npx) - in\n * that mode tools fall back to edit-token based auth.\n */\nexport interface McpAuthContext {\n  user_id: string;\n  workspace_id: string;\n  scopes: string[];\n  tool_name?: string;\n  api_key?: string;\n  // Set when the human behind this tool call is an anonymous Supabase\n  // session (apps/api's app-chat lane, #2983/#2984) - api-client.ts's\n  // getAuthHeaders reads it to mark the outgoing bot-key HTTP request so the\n  // API can propagate the restriction even though the request itself\n  // authenticates with an API key, not a JWT.\n  is_anonymous?: boolean;\n  // Set on the OAuth branch of apps/api's mcp/handler.ts when this request's\n  // bot API key was resolved on behalf of an OAuth-connected user (#3716) -\n  // api-client.ts's getAuthHeaders reads it to mark the outgoing request so\n  // /v1/me can report auth_mode \"oauth\" instead of the generic \"api_key\" the\n  // bot-key lane would otherwise get, even though the request itself\n  // authenticates with an API key, not an OAuth token.\n  auth_via?: \"oauth\";\n  // #3330 review fix (blocker 1): an HMAC proof (apps/api's mcp-mint-proof.ts)\n  // that THIS exact request's #1415 anon lane freshly minted a brand-new anon\n  // identity for `workspace_id` - set only on the mint branch of\n  // resolveAnonymousMcpAuth, never when auth was resolved via an inbound\n  // form_id (even the caller's own). Lets create-form.ts safely offer a\n  // same-UID claim link without ever deriving \"who to bind it to\" from a\n  // body-supplied id, which would let a batch smuggling another tenant's\n  // form_id alongside a create_form call mint a claim token for THAT\n  // tenant's identity instead of the caller's own.\n  mcp_mint_proof?: string;\n  // #3822: set ONLY on the OAuth branch of apps/api's mcp/handler.ts. Lets a\n  // single tool call target another workspace the connected user belongs to\n  // (per-call, never per-request - see the #3330 note in the package\n  // CLAUDE.md). The host re-checks membership on every call and returns that\n  // workspace's own bot key, or null to mean \"act in the default workspace\n  // unchanged\" (target is the default, or a form_id the user can't reach -\n  // the API then answers exactly as it did before targeting existed). Anon + stdio contexts never carry it, so they\n  // stay pinned to one workspace.\n  resolveWorkspace?: (target: {\n    workspace_id?: string;\n    form_id?: string;\n  }) => Promise<{ workspace_id: string; workspace_name: string; api_key: string } | null>;\n  // #3822: the workspaces the connected user may target (same set\n  // resolveWorkspace accepts). OAuth lane only.\n  listWorkspaces?: () => Promise<{ id: string; name: string }[]>;\n  // #3822: the workspace picked at authorize time - what a call with no\n  // `workspace_id` acts in. OAuth lane only (workspace_id above is swapped\n  // per call when a target is resolved, this never is).\n  default_workspace_id?: string;\n}\n\n/**\n * Marker header the in-process MCP tool layer sets on its outgoing API\n * requests (api-client.ts) when `is_anonymous` is true, so an anonymous\n * app-chat session can't launder itself into an unrestricted API-key caller\n * by asking the bot to publish/mint credentials on its behalf. apps/api's\n * authMiddleware / workspaceAccessMiddleware / requireWorkspaceWriteAuth\n * read this on the API-key path and set isAnonymous accordingly - trusting\n * it is safe because it can only RESTRICT a caller: a real integration that\n * sets this header on its own API-key requests only denies itself, it can\n * never use it to gain anonymous-JWT privileges it doesn't already have.\n */\nexport const MCP_ANONYMOUS_HEADER = \"x-clipform-anonymous\";\n\n/**\n * Marker header the in-process MCP tool layer sets on its outgoing API\n * requests (api-client.ts) when `auth_via` is \"oauth\", so /v1/me can report\n * `auth_mode: \"oauth\"` for an OAuth-connected user instead of the generic\n * \"api_key\" the bot-key lane would otherwise get (#3716). Label-only: it\n * changes nothing but the reported string. Trusting it from the wire is\n * safe because a direct API-key caller who sets this header on their own\n * request only mislabels their own whoami output - they gain no privilege,\n * exactly the same reasoning as MCP_ANONYMOUS_HEADER above (except that\n * header can only restrict, and this one can only relabel).\n */\nexport const MCP_AUTH_VIA_HEADER = \"x-clipform-auth-via\";\n\n/**\n * Carries `mcp_mint_proof` on the same outgoing bot-key request. Unlike\n * MCP_ANONYMOUS_HEADER (a boolean that can only ever RESTRICT), this header's\n * VALUE matters - it names an identity a claim token gets bound to - so its\n * value is HMAC-signed (mcp-mint-proof.ts) rather than trusted raw: a direct\n * external caller reaching `POST /v1/forms` with any valid workspace API key\n * could otherwise hand-set an unsigned \"mint uid\" header to an arbitrary\n * victim's uid themselves (#3330 review).\n */\nexport const MCP_MINT_PROOF_HEADER = \"x-clipform-mcp-mint-proof\";\n\nconst storage = new AsyncLocalStorage<McpAuthContext>();\n\nexport function runWithMcpAuth<T>(ctx: McpAuthContext, fn: () => Promise<T> | T): Promise<T> | T {\n  return storage.run(ctx, fn);\n}\n\nexport function getMcpAuth(): McpAuthContext | undefined {\n  return storage.getStore();\n}\n\nexport function runWithMcpTool<T>(toolName: string, fn: () => Promise<T> | T): Promise<T> | T {\n  const parent = storage.getStore();\n  if (!parent) return fn();\n  return storage.run({ ...parent, tool_name: toolName }, fn);\n}\n"],"mappings":";AAAA,SAAS,yBAAyB;AAyE3B,IAAM,uBAAuB;AAa7B,IAAM,sBAAsB;AAW5B,IAAM,wBAAwB;AAErC,IAAM,UAAU,IAAI,kBAAkC;AAE/C,SAAS,eAAkB,KAAqB,IAA0C;AAC/F,SAAO,QAAQ,IAAI,KAAK,EAAE;AAC5B;AAEO,SAAS,aAAyC;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAEO,SAAS,eAAkB,UAAkB,IAA0C;AAC5F,QAAM,SAAS,QAAQ,SAAS;AAChC,MAAI,CAAC,OAAQ,QAAO,GAAG;AACvB,SAAO,QAAQ,IAAI,EAAE,GAAG,QAAQ,WAAW,SAAS,GAAG,EAAE;AAC3D;","names":[]}

package/dist/{chunk-EXV5M7YV.js → chunk-ELK26KWM.js}

@@ -5,7 +5,7 @@ import {
   FULL_CAPS,
   callApi,
   getSessionContext
-} from "./chunk-KNOCYZHG.js";
+} from "./chunk-SEZ37YSH.js";
 
 // src/lib/guides.ts
 var guidesPromise = null;
@@ -143,4 +143,4 @@ export {
   getGuideUri,
   registerResources
 };
-//# sourceMappingURL=chunk-EXV5M7YV.js.map
+//# sourceMappingURL=chunk-ELK26KWM.js.map

package/dist/{chunk-KNOCYZHG.js → chunk-SEZ37YSH.js}

@@ -3,7 +3,7 @@ import {
   MCP_AUTH_VIA_HEADER,
   MCP_MINT_PROOF_HEADER,
   getMcpAuth
-} from "./chunk-HZMMOSEM.js";
+} from "./chunk-A5CFGL27.js";
 import {
   isAuthFault,
   isServerFault,
@@ -37,9 +37,10 @@ var FEATURES = {
   consent_documents: {
     name: "Agreement documents",
     description: "Attach a PDF agreement to a consent item, read inline in the viewer with scroll-to-accept",
-    enabled: false,
-    status: "beta",
-    category: "builder"
+    enabled: true,
+    status: "live",
+    category: "builder",
+    wentLiveAt: "2026-10-02"
   },
   node_logic: {
     name: "Node routing logic",
@@ -156,8 +157,8 @@ var FEATURES = {
     // Widened (#4338): the checkbox items are typed 'consent' (required,
     // blocks submission until checked) or 'opt_in' (optional) - see
     // CONSENT_TYPES in node-types.js and the viewer's Contact.tsx. Both are
-    // plain text checkboxes available to every creator with no gate; only
-    // attaching a PDF agreement document is gated (consent_documents, beta).
+    // plain text checkboxes available to every creator with no gate. Attaching
+    // a PDF agreement document is the separate consent_documents feature (live).
     description: "Structured fields (name, email, phone, company) with consent and opt-in checkboxes",
     enabled: true,
     status: "live",
@@ -794,6 +795,7 @@ var NODE_TYPES = {
     // Never appears in a completed submission's answers (system node, no
     // output_schema) - false is a no-op default, set for guard-test coverage.
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: null,
     config_schema: null,
     response_schema: null,
@@ -820,6 +822,7 @@ var NODE_TYPES = {
     show_in_results: true,
     // Short selected-option label - safe to render inline in a notification (#4154).
     notify_inline: true,
+    owner_scoped_config_keys: [],
     default_config: {
       selection_mode: "single",
       choice: { enable_branching: false, record_scores: false },
@@ -931,6 +934,7 @@ var NODE_TYPES = {
     // still swaps a recorded audio/video answer for a typed placeholder
     // based on the answer's own media type, not this flag.
     notify_inline: true,
+    owner_scoped_config_keys: [],
     default_config: {
       formats: [
         { order: 0, format: "text" },
@@ -1070,6 +1074,7 @@ var NODE_TYPES = {
     show_in_results: true,
     // A bare numeric value - short enough to render inline (#4154).
     notify_inline: true,
+    owner_scoped_config_keys: [],
     default_config: null,
     config_schema: {
       type: "object",
@@ -1107,6 +1112,13 @@ var NODE_TYPES = {
     // Structured provider data (calendly/google_meet), not a flat value -
     // a notification renders a typed placeholder instead (#4154).
     notify_inline: false,
+    // Object granularity, not a dotted path (#4618): every property under
+    // these provider objects (scheduling_url, event_type_uri, calendar_id) is
+    // the source workspace's own calendar, so save_form strips the whole
+    // object on cross-workspace copy. google_meet is included even though it
+    // is absent from the publish gate below (pre-existing drift, not widened
+    // here) because calendar_id is owner-scoped regardless.
+    owner_scoped_config_keys: ["calendly", "calcom", "google_meet"],
     default_config: null,
     config_schema: {
       type: "object",
@@ -1188,6 +1200,7 @@ var NODE_TYPES = {
     // Key contact fields (first name, email) are the whole point of a
     // notification for this node type - always inline (#4154).
     notify_inline: true,
+    owner_scoped_config_keys: [],
     default_config: {
       fields: [
         { id: "first_name", type: "first_name", label: "First Name", enabled: true, required: true },
@@ -1282,7 +1295,17 @@ var NODE_TYPES = {
               // document version they saw, and when they accepted.
               reached_end: { type: "boolean" },
               document_version: { type: "string" },
-              accepted_at: { type: "string" }
+              accepted_at: { type: "string" },
+              // Server-stamped on write (#4552) when the node's current document
+              // matches document_version; any client-supplied value is discarded.
+              document: {
+                type: "object",
+                properties: {
+                  storage_path: { type: "string" },
+                  url: { type: "string" },
+                  filename: { type: "string" }
+                }
+              }
             }
           },
           description: "Consent checkbox entries"
@@ -1321,7 +1344,15 @@ var NODE_TYPES = {
               // Scrollwrap audit trail (#2760), emitted only for document-gated items.
               reached_end: { type: "boolean" },
               document_version: { type: "string" },
-              accepted_at: { type: "string" }
+              accepted_at: { type: "string" },
+              // The exact agreement file accepted (#4552). storage_path is not emitted.
+              document: {
+                type: "object",
+                properties: {
+                  url: { type: "string" },
+                  filename: { type: "string" }
+                }
+              }
             }
           }
         }
@@ -1346,6 +1377,7 @@ var NODE_TYPES = {
     show_in_results: true,
     // Files, not a flat value - a notification renders a typed placeholder (#4154).
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: null,
     config_schema: {
       type: "object",
@@ -1437,6 +1469,7 @@ var NODE_TYPES = {
     show_in_results: true,
     // An image, not a flat value - a notification renders a typed placeholder (#4154).
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: {
       paper_color: "#FAF9F6",
       stroke_colors: ["#1F2937", "#EF4444", "#3B82F6", "#22C55E", "#FACC15"],
@@ -1610,6 +1643,7 @@ var NODE_TYPES = {
     // A captured photo/video, not a flat value - a notification renders a
     // typed placeholder (#4154).
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: null,
     config_schema: {
       type: "object",
@@ -1721,6 +1755,7 @@ var NODE_TYPES = {
     // notification, same as the other control nodes (redirect, link_list,
     // end_screen). Required by the #4154 notify_inline invariant.
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: {
       options: [
         { content: "Branch 1" },
@@ -1747,13 +1782,14 @@ var NODE_TYPES = {
     supports_media: false,
     is_system: false,
     show_in_results: true,
-    // Config keys that reference a workspace-scoped connected account (Stripe/etc
-    // via workspace_integrations). The SoT for save_form to strip on cross-workspace
-    // copy (#2064 part 2 - migration, not yet wired). Standing convention for any
-    // future OAuth/connected-account node (booking, shopify), not a payment special
-    // case - the publish gate's own showcase waiver (graph-validation.js) still
-    // names workspace_integration_id directly since it's the only per-type check today.
-    connection_config_keys: ["workspace_integration_id"],
+    // Config keys that are owner-scoped to the authoring workspace - a connected
+    // account (Stripe/etc via workspace_integrations), the owner's own uploaded
+    // files, or a calendar link - and so must NOT survive a cross-workspace copy
+    // (#4619/#4617/#4618/#4620 generalised this from the payment-only
+    // connection_config_keys). The SoT for save_form's strip. The publish gate's
+    // own showcase waiver (graph-validation.js) still names workspace_integration_id
+    // directly since it's the only per-type check today.
+    owner_scoped_config_keys: ["workspace_integration_id"],
     // A payment confirmation line is the whole point of a notification for
     // this node type - always inline (#4154).
     notify_inline: true,
@@ -1903,6 +1939,7 @@ var NODE_TYPES = {
     show_in_results: true,
     // Short selected-option label - safe to render inline (#4154).
     notify_inline: true,
+    owner_scoped_config_keys: [],
     default_config: {
       choice: { enable_branching: false },
       options: [
@@ -1967,6 +2004,7 @@ var NODE_TYPES = {
     show_in_results: false,
     // Short selected-option label - safe to render inline (#4154).
     notify_inline: true,
+    owner_scoped_config_keys: [],
     default_config: { options: [{ content: "Continue" }] },
     config_schema: {
       type: "object",
@@ -2008,6 +2046,7 @@ var NODE_TYPES = {
     // Terminal node - never appears in a completed submission's answers
     // (filtered by NON_COUNTABLE_FILTER); false is a no-op default.
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: { url: "", auto_redirect: true },
     config_schema: {
       type: "object",
@@ -2041,6 +2080,7 @@ var NODE_TYPES = {
     // Terminal node - never appears in a completed submission's answers
     // (filtered by NON_COUNTABLE_FILTER); false is a no-op default.
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: { links: [{ id: "default", url: "", title: "", description: "", order: 0 }], auto_redirect: false },
     config_schema: {
       type: "object",
@@ -2088,6 +2128,10 @@ var NODE_TYPES = {
     show_in_results: true,
     // Files, not a flat value - a notification renders a typed placeholder (#4154).
     notify_inline: false,
+    // The owner's own uploaded files (#4617) - stripped on cross-workspace
+    // copy so a forked node can't keep serving the source workspace's files;
+    // the publish gate's "No files uploaded" check then forces a fresh upload.
+    owner_scoped_config_keys: ["files"],
     default_config: null,
     config_schema: {
       type: "object",
@@ -2170,6 +2214,7 @@ var NODE_TYPES = {
     show_in_results: false,
     // No response_schema - never carries a flat answer value; false is a no-op default.
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: { provider: "shopify", cta_mode: "checkout", source_mode: "manual" },
     config_schema: {
       type: "object",
@@ -2241,6 +2286,7 @@ var NODE_TYPES = {
     // Terminal node - never appears in a completed submission's answers
     // (filtered by NON_COUNTABLE_FILTER); false is a no-op default.
     notify_inline: false,
+    owner_scoped_config_keys: [],
     default_config: {
       title: "Thank you!",
       message: "Your response has been submitted."
@@ -2303,8 +2349,8 @@ for (const [type, def] of Object.entries(NODE_TYPES)) {
 var NODE_TYPES_LIST = Object.entries(NODE_TYPES).map(([type, def]) => ({ type, ...def })).sort((a, b) => a.sort_order - b.sort_order);
 var ACTIVE_NODE_TYPES = Object.entries(NODE_TYPES).filter(([, def]) => def.is_active && !def.is_system).map(([type]) => type);
 var NODE_TYPE_KEYS = Object.keys(NODE_TYPES);
-var CONNECTION_CONFIG_KEYS = Object.fromEntries(
-  Object.entries(NODE_TYPES).filter(([, def]) => Array.isArray(def.connection_config_keys) && def.connection_config_keys.length > 0).map(([type, def]) => [type, def.connection_config_keys])
+var OWNER_SCOPED_CONFIG_KEYS = Object.fromEntries(
+  Object.entries(NODE_TYPES).filter(([, def]) => Array.isArray(def.owner_scoped_config_keys) && def.owner_scoped_config_keys.length > 0).map(([type, def]) => [type, def.owner_scoped_config_keys])
 );
 var RESPONSE_SCHEMAS = Object.fromEntries(
   Object.entries(NODE_TYPES).map(([k, v]) => [k, v.response_schema])
@@ -2593,7 +2639,6 @@ var HELP_TOPICS = {
   emailShare: { path: "/help/sharing", anchor: "share-by-email" },
   publicResults: { path: "/help/public-results", anchor: null },
   trash: { path: "/help/managing-forms", anchor: "trash" },
-  agreementVersions: { path: "/help/responses", anchor: "agreement-versions" },
   customDomains: { path: "/help/domains", anchor: null },
   customPath: { path: "/help/links", anchor: "custom-path-on-your-domain" },
   // Per-node-type deep-links into help/node-types.mdx (#3963). Keyed
@@ -2750,6 +2795,7 @@ var BUSINESS = {
 };
 var MEDIA_DIRECT_MAX_BYTES = 20 * 1024 * 1024;
 var MEDIA_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+var MEDIA_DOCUMENT_MAX_BYTES = 20 * 1024 * 1024;
 var SUPABASE_STORAGE_MAX_BYTES = 200 * 1024 * 1024;
 var VIDEO_COMPRESS_FLOOR_BYTES = 1 * 1024 * 1024;
 var HELP_LINKS = buildHelpLinks(BUSINESS.urls.docs);
@@ -3010,6 +3056,19 @@ var MCP_TOOL_TOOLSETS = {
   clipform_list_assets: "media",
   clipform_list_video_templates: "media"
 };
+var MCP_TOOL_SECURITY_SCHEMES = Object.freeze([
+  Object.freeze({ type: "noauth" }),
+  Object.freeze({ type: "oauth2", scopes: ["mcp"] })
+]);
+var MCP_TOOL_SECURITY = Object.freeze(
+  Object.fromEntries(
+    Object.keys(MCP_TOOL_TOOLSETS).map((name) => [name, MCP_TOOL_SECURITY_SCHEMES])
+  )
+);
+var MCP_ANON_PUBLISH_GATE = Object.freeze({
+  tool: "clipform_update_form",
+  argument: "is_live"
+});
 
 // src/lib/caps.ts
 var FULL_CAPS = Object.freeze({ media: true, research: true });
@@ -3117,10 +3176,14 @@ async function callApi(path, options = {}) {
         api_path: `${prefix}${path}`
       });
     }
+    const details = data.details;
+    const reason = details && typeof details.reason === "string" ? details.reason : void 0;
     return {
       ok: false,
       status: response.status,
-      error: errorMsg
+      error: errorMsg,
+      code: errorCode,
+      reason
     };
   }
   return { ok: true, data };
@@ -3139,12 +3202,28 @@ function recoveryHint(status, path) {
   }
   return void 0;
 }
-function errorResult(message) {
+function errorResult(message, meta) {
   return {
     content: [{ type: "text", text: message }],
-    isError: true
+    isError: true,
+    ...meta ? { _meta: meta } : {}
   };
 }
+var PROTECTED_RESOURCE_METADATA_URL = `${BUSINESS.urls.mcp}/.well-known/oauth-protected-resource`;
+function escapeChallengeValue(value) {
+  return value.replace(/[\r\n]/g, "").replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function isAnonymousAccountRequired(result) {
+  return result.status === 403 && result.code === "FORBIDDEN" && result.reason === "anonymous_not_allowed";
+}
+function authChallengeMeta(errorCode, description) {
+  const challenge = [
+    `Bearer error="${escapeChallengeValue(errorCode)}"`,
+    `error_description="${escapeChallengeValue(description)}"`,
+    `resource_metadata="${PROTECTED_RESOURCE_METADATA_URL}"`
+  ].join(", ");
+  return { "mcp/www_authenticate": [challenge] };
+}
 function textResult(text) {
   return {
     content: [{ type: "text", text }]
@@ -3226,13 +3305,17 @@ export {
   exposedCompositionIds,
   MCP_TOOL_TIERS,
   MCP_TOOL_TOOLSETS,
+  MCP_TOOL_SECURITY,
+  MCP_ANON_PUBLISH_GATE,
   FULL_CAPS,
   capsFromToolsets,
   callApi,
   errorResult,
+  isAnonymousAccountRequired,
+  authChallengeMeta,
   textResult,
   structuredResult,
   getSessionContextWithAuth,
   getSessionContext
 };
-//# sourceMappingURL=chunk-KNOCYZHG.js.map
+//# sourceMappingURL=chunk-SEZ37YSH.js.map