@clipform/mcp-server 3.3.2 → 3.7.1

package/dist/chunk-A5CFGL27.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/lib/auth-context.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Identity of the end-user a given MCP request is acting on behalf of.\n *\n * Populated by the in-process host (apps/api) after validating an OAuth\n * Bearer on /mcp. The MCP tool layer reads it to decide which workspace\n * forms should land in and which plan tier gates apply.\n *\n * NOT populated when the server runs as a local stdio process (npx) - in\n * that mode tools fall back to edit-token based auth.\n */\nexport interface McpAuthContext {\n  user_id: string;\n  workspace_id: string;\n  scopes: string[];\n  tool_name?: string;\n  api_key?: string;\n  // Set when the human behind this tool call is an anonymous Supabase\n  // session (apps/api's app-chat lane, #2983/#2984) - api-client.ts's\n  // getAuthHeaders reads it to mark the outgoing bot-key HTTP request so the\n  // API can propagate the restriction even though the request itself\n  // authenticates with an API key, not a JWT.\n  is_anonymous?: boolean;\n  // Set on the OAuth branch of apps/api's mcp/handler.ts when this request's\n  // bot API key was resolved on behalf of an OAuth-connected user (#3716) -\n  // api-client.ts's getAuthHeaders reads it to mark the outgoing request so\n  // /v1/me can report auth_mode \"oauth\" instead of the generic \"api_key\" the\n  // bot-key lane would otherwise get, even though the request itself\n  // authenticates with an API key, not an OAuth token.\n  auth_via?: \"oauth\";\n  // #3330 review fix (blocker 1): an HMAC proof (apps/api's mcp-mint-proof.ts)\n  // that THIS exact request's #1415 anon lane freshly minted a brand-new anon\n  // identity for `workspace_id` - set only on the mint branch of\n  // resolveAnonymousMcpAuth, never when auth was resolved via an inbound\n  // form_id (even the caller's own). Lets create-form.ts safely offer a\n  // same-UID claim link without ever deriving \"who to bind it to\" from a\n  // body-supplied id, which would let a batch smuggling another tenant's\n  // form_id alongside a create_form call mint a claim token for THAT\n  // tenant's identity instead of the caller's own.\n  mcp_mint_proof?: string;\n  // #3822: set ONLY on the OAuth branch of apps/api's mcp/handler.ts. Lets a\n  // single tool call target another workspace the connected user belongs to\n  // (per-call, never per-request - see the #3330 note in the package\n  // CLAUDE.md). The host re-checks membership on every call and returns that\n  // workspace's own bot key, or null to mean \"act in the default workspace\n  // unchanged\" (target is the default, or a form_id the user can't reach -\n  // the API then answers exactly as it did before targeting existed). Anon + stdio contexts never carry it, so they\n  // stay pinned to one workspace.\n  resolveWorkspace?: (target: {\n    workspace_id?: string;\n    form_id?: string;\n  }) => Promise<{ workspace_id: string; workspace_name: string; api_key: string } | null>;\n  // #3822: the workspaces the connected user may target (same set\n  // resolveWorkspace accepts). OAuth lane only.\n  listWorkspaces?: () => Promise<{ id: string; name: string }[]>;\n  // #3822: the workspace picked at authorize time - what a call with no\n  // `workspace_id` acts in. OAuth lane only (workspace_id above is swapped\n  // per call when a target is resolved, this never is).\n  default_workspace_id?: string;\n}\n\n/**\n * Marker header the in-process MCP tool layer sets on its outgoing API\n * requests (api-client.ts) when `is_anonymous` is true, so an anonymous\n * app-chat session can't launder itself into an unrestricted API-key caller\n * by asking the bot to publish/mint credentials on its behalf. apps/api's\n * authMiddleware / workspaceAccessMiddleware / requireWorkspaceWriteAuth\n * read this on the API-key path and set isAnonymous accordingly - trusting\n * it is safe because it can only RESTRICT a caller: a real integration that\n * sets this header on its own API-key requests only denies itself, it can\n * never use it to gain anonymous-JWT privileges it doesn't already have.\n */\nexport const MCP_ANONYMOUS_HEADER = \"x-clipform-anonymous\";\n\n/**\n * Marker header the in-process MCP tool layer sets on its outgoing API\n * requests (api-client.ts) when `auth_via` is \"oauth\", so /v1/me can report\n * `auth_mode: \"oauth\"` for an OAuth-connected user instead of the generic\n * \"api_key\" the bot-key lane would otherwise get (#3716). Label-only: it\n * changes nothing but the reported string. Trusting it from the wire is\n * safe because a direct API-key caller who sets this header on their own\n * request only mislabels their own whoami output - they gain no privilege,\n * exactly the same reasoning as MCP_ANONYMOUS_HEADER above (except that\n * header can only restrict, and this one can only relabel).\n */\nexport const MCP_AUTH_VIA_HEADER = \"x-clipform-auth-via\";\n\n/**\n * Carries `mcp_mint_proof` on the same outgoing bot-key request. Unlike\n * MCP_ANONYMOUS_HEADER (a boolean that can only ever RESTRICT), this header's\n * VALUE matters - it names an identity a claim token gets bound to - so its\n * value is HMAC-signed (mcp-mint-proof.ts) rather than trusted raw: a direct\n * external caller reaching `POST /v1/forms` with any valid workspace API key\n * could otherwise hand-set an unsigned \"mint uid\" header to an arbitrary\n * victim's uid themselves (#3330 review).\n */\nexport const MCP_MINT_PROOF_HEADER = \"x-clipform-mcp-mint-proof\";\n\nconst storage = new AsyncLocalStorage<McpAuthContext>();\n\nexport function runWithMcpAuth<T>(ctx: McpAuthContext, fn: () => Promise<T> | T): Promise<T> | T {\n  return storage.run(ctx, fn);\n}\n\nexport function getMcpAuth(): McpAuthContext | undefined {\n  return storage.getStore();\n}\n\nexport function runWithMcpTool<T>(toolName: string, fn: () => Promise<T> | T): Promise<T> | T {\n  const parent = storage.getStore();\n  if (!parent) return fn();\n  return storage.run({ ...parent, tool_name: toolName }, fn);\n}\n"],"mappings":";AAAA,SAAS,yBAAyB;AAyE3B,IAAM,uBAAuB;AAa7B,IAAM,sBAAsB;AAW5B,IAAM,wBAAwB;AAErC,IAAM,UAAU,IAAI,kBAAkC;AAE/C,SAAS,eAAkB,KAAqB,IAA0C;AAC/F,SAAO,QAAQ,IAAI,KAAK,EAAE;AAC5B;AAEO,SAAS,aAAyC;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAEO,SAAS,eAAkB,UAAkB,IAA0C;AAC5F,QAAM,SAAS,QAAQ,SAAS;AAChC,MAAI,CAAC,OAAQ,QAAO,GAAG;AACvB,SAAO,QAAQ,IAAI,EAAE,GAAG,QAAQ,WAAW,SAAS,GAAG,EAAE;AAC3D;","names":[]}

package/dist/chunk-KHRY3A3M.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/lib/guides.ts","../src/resources.ts"],"sourcesContent":["import { callApi } from \"./api-client.js\";\nimport type { ServerCaps } from \"./caps.js\";\n\n/**\n * Craft guide bodies live server-side (#470) - the npm package is a shim\n * that fetches them at runtime instead of bundling them in the tarball.\n * One fetch per process (all ~30KB of guides in a single response), cached;\n * a failed fetch is NOT cached so the next read retries.\n */\n\nexport interface RemoteGuide {\n  type: string;\n  variant: string | null;\n  uri: string;\n  mimeType: string;\n  text: string;\n}\n\nlet guidesPromise: Promise<Map<string, RemoteGuide>> | null = null;\n\nasync function loadGuides(): Promise<Map<string, RemoteGuide>> {\n  const result = await callApi(\"/internal/mcp/guides\", { method: \"GET\" });\n  if (!result.ok) {\n    throw new Error(`Failed to load guides: ${result.error}`);\n  }\n  const guides = (result.data as { guides?: RemoteGuide[] }).guides ?? [];\n  return new Map(guides.map((g) => [g.uri, g]));\n}\n\n/** Fetch a guide body by its clipform:// URI. Returns null when unavailable. */\nexport async function fetchGuideText(uri: string): Promise<string | null> {\n  if (!guidesPromise) {\n    guidesPromise = loadGuides();\n  }\n  try {\n    const guides = await guidesPromise;\n    return guides.get(uri)?.text ?? null;\n  } catch (err) {\n    guidesPromise = null; // don't cache failures - retry on the next read\n    // Loud, not silent: a misconfigured API_URL/key otherwise degrades every\n    // guide to the stub with nothing in the logs.\n    console.error(`[guides] Failed to fetch ${uri}: ${err instanceof Error ? err.message : String(err)}`);\n    return null;\n  }\n}\n\n/** Shown in place of a guide when the API is unreachable or unauthenticated. */\nexport function guideFallbackText(uri: string): string {\n  return [\n    `# Guide unavailable`,\n    ``,\n    `The craft guide (${uri}) could not be loaded from the Clipform API.`,\n    `Guides are served at runtime and need a reachable API with a valid key -`,\n    `check API_URL and CLIPFORM_API_KEY, then try again.`,\n    ``,\n    `General principles in the meantime: write narration for the ear (short,`,\n    `conversational), never reveal answers in narration or media, and keep`,\n    `forms tight - every question must earn its place.`,\n  ].join(\"\\n\");\n}\n\n/**\n * Craft guide bodies are written for the full tool surface and mention the\n * narration/video tools by name. On a surface that doesn't register them\n * (the Claude Connectors Directory resource, #3681) prefix the guide with a\n * note so the model doesn't chase tools it can't call. The body itself is\n * untouched - the craft (question design, pacing) is the same either way.\n */\nexport function applyCapsToGuide(text: string, caps: ServerCaps): string {\n  if (caps.media) return text;\n  return [\n    \"> **This connection exposes form-building tools only** - no narration, video, image, or music tools. Where this guide mentions narration, media, or rendering, skip that part and carry the same craft into the written question text.\",\n    \"\",\n    text,\n  ].join(\"\\n\");\n}\n","import { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { getSessionContext } from \"./lib/session-context.js\";\nimport { FORM_TYPE_KEYS, FORM_TYPES, ALL_VARIANTS } from \"@vid-master/config\";\n\nexport const GUIDE_TYPES = FORM_TYPE_KEYS as readonly string[] as readonly [string, ...string[]];\nexport type GuideType = (typeof FORM_TYPE_KEYS)[number];\n\nexport const QUIZ_VARIANTS = ALL_VARIANTS as readonly string[] as readonly [string, ...string[]];\nexport type QuizVariant = (typeof ALL_VARIANTS)[number];\n// Guide BODIES are not bundled here (#470): the npm tarball ships only this\n// registration metadata. Text is fetched from the API at runtime - see\n// lib/guides.ts (cached per process, stub fallback when unreachable).\nimport { fetchGuideText, guideFallbackText, applyCapsToGuide } from \"./lib/guides.js\";\nimport { FULL_CAPS, type ServerCaps } from \"./lib/caps.js\";\n\nconst GUIDE_DESCRIPTIONS: Record<GuideType, string> = {\n  \"quiz\": \"Craft knowledge for writing engaging quizzes - difficulty curves, question psychology, narration style, scoring\",\n  \"survey\": \"Craft knowledge for feedback surveys, NPS, and research forms - brevity, rating scales, respondent fatigue\",\n  \"interview\": \"Craft knowledge for building interview forms - warm-up pacing, open questions, consent, video responses\",\n  \"funnel\": \"Craft knowledge for lead qualification funnels - planned feature, conditional routing coming soon\",\n  \"testimonial\": \"Craft knowledge for collecting testimonials and customer stories on video - storytelling prompts, comfort techniques, consent\",\n  \"application\": \"Craft knowledge for application and evaluation forms - multi-section structure, video responses for behavioural questions, screening\",\n  \"booking\": \"Craft knowledge for event registration and booking forms - minimal friction, video welcome, confirmation flow\",\n};\n\n// Sourced from config (single source of truth) so the agent-facing resource\n// descriptions can't drift from FORM_TYPES.quiz.variant_descriptions (#2534,\n// the exact pair packages/config/CLAUDE.md warns about).\nconst QUIZ_VARIANT_DESCRIPTIONS = FORM_TYPES.quiz.variant_descriptions;\n\nexport function getGuideUri(type: GuideType, variant?: QuizVariant): string {\n  if (type === \"quiz\" && variant) {\n    return `clipform://guides/quiz/${variant}`;\n  }\n  return `clipform://guides/${type}`;\n}\n\nasync function readGuide(uri: string, caps: ServerCaps): Promise<string> {\n  return applyCapsToGuide((await fetchGuideText(uri)) ?? guideFallbackText(uri), caps);\n}\n\nexport function registerResources(server: McpServer, caps: ServerCaps = FULL_CAPS) {\n  for (const type of GUIDE_TYPES) {\n    server.registerResource(\n      `guide-${type}`,\n      getGuideUri(type),\n      {\n        description: GUIDE_DESCRIPTIONS[type],\n        mimeType: \"text/markdown\",\n        annotations: { audience: [\"assistant\" as const], priority: 0.8 },\n      },\n      async () => ({\n        contents: [{\n          uri: getGuideUri(type),\n          mimeType: \"text/markdown\",\n          text: await readGuide(getGuideUri(type), caps),\n        }],\n      }),\n    );\n  }\n\n  for (const variant of QUIZ_VARIANTS) {\n    server.registerResource(\n      `guide-quiz-${variant}`,\n      getGuideUri(\"quiz\", variant),\n      {\n        description: QUIZ_VARIANT_DESCRIPTIONS[variant],\n        mimeType: \"text/markdown\",\n        annotations: { audience: [\"assistant\" as const], priority: 0.8 },\n      },\n      async () => ({\n        contents: [{\n          uri: getGuideUri(\"quiz\", variant),\n          mimeType: \"text/markdown\",\n          text: await readGuide(getGuideUri(\"quiz\", variant), caps),\n        }],\n      }),\n    );\n  }\n\n  server.registerResource(\n    \"context-session\",\n    \"clipform://context/session\",\n    {\n      description:\n        \"Current session info: auth mode, workspace name, plan name, and node/form limits. Read this before planning content to know your constraints.\",\n      mimeType: \"text/markdown\",\n      annotations: { audience: [\"assistant\"], priority: 1.0 },\n    },\n    async () => {\n      const text = await getSessionContext();\n      return {\n        contents: [\n          {\n            uri: \"clipform://context/session\",\n            mimeType: \"text/markdown\",\n            text: text || \"Session context unavailable - API may not be reachable.\",\n          },\n        ],\n      };\n    }\n  );\n}\n"],"mappings":";;;;;;;;;;AAkBA,IAAI,gBAA0D;AAE9D,eAAe,aAAgD;AAC7D,QAAM,SAAS,MAAM,QAAQ,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AACtE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,0BAA0B,OAAO,KAAK,EAAE;AAAA,EAC1D;AACA,QAAM,SAAU,OAAO,KAAoC,UAAU,CAAC;AACtE,SAAO,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9C;AAGA,eAAsB,eAAe,KAAqC;AACxE,MAAI,CAAC,eAAe;AAClB,oBAAgB,WAAW;AAAA,EAC7B;AACA,MAAI;AACF,UAAM,SAAS,MAAM;AACrB,WAAO,OAAO,IAAI,GAAG,GAAG,QAAQ;AAAA,EAClC,SAAS,KAAK;AACZ,oBAAgB;AAGhB,YAAQ,MAAM,4BAA4B,GAAG,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACpG,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBAAkB,KAAqB;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,oBAAoB,GAAG;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AASO,SAAS,iBAAiB,MAAc,MAA0B;AACvE,MAAI,KAAK,MAAO,QAAO;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;;;ACvEO,IAAM,cAAc;AAGpB,IAAM,gBAAgB;AAQ7B,IAAM,qBAAgD;AAAA,EACpD,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,eAAe;AAAA,EACf,eAAe;AAAA,EACf,WAAW;AACb;AAKA,IAAM,4BAA4B,WAAW,KAAK;AAE3C,SAAS,YAAY,MAAiB,SAA+B;AAC1E,MAAI,SAAS,UAAU,SAAS;AAC9B,WAAO,0BAA0B,OAAO;AAAA,EAC1C;AACA,SAAO,qBAAqB,IAAI;AAClC;AAEA,eAAe,UAAU,KAAa,MAAmC;AACvE,SAAO,iBAAkB,MAAM,eAAe,GAAG,KAAM,kBAAkB,GAAG,GAAG,IAAI;AACrF;AAEO,SAAS,kBAAkB,QAAmB,OAAmB,WAAW;AACjF,aAAW,QAAQ,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,YAAY,IAAI;AAAA,MAChB;AAAA,QACE,aAAa,mBAAmB,IAAI;AAAA,QACpC,UAAU;AAAA,QACV,aAAa,EAAE,UAAU,CAAC,WAAoB,GAAG,UAAU,IAAI;AAAA,MACjE;AAAA,MACA,aAAa;AAAA,QACX,UAAU,CAAC;AAAA,UACT,KAAK,YAAY,IAAI;AAAA,UACrB,UAAU;AAAA,UACV,MAAM,MAAM,UAAU,YAAY,IAAI,GAAG,IAAI;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,aAAW,WAAW,eAAe;AACnC,WAAO;AAAA,MACL,cAAc,OAAO;AAAA,MACrB,YAAY,QAAQ,OAAO;AAAA,MAC3B;AAAA,QACE,aAAa,0BAA0B,OAAO;AAAA,QAC9C,UAAU;AAAA,QACV,aAAa,EAAE,UAAU,CAAC,WAAoB,GAAG,UAAU,IAAI;AAAA,MACjE;AAAA,MACA,aAAa;AAAA,QACX,UAAU,CAAC;AAAA,UACT,KAAK,YAAY,QAAQ,OAAO;AAAA,UAChC,UAAU;AAAA,UACV,MAAM,MAAM,UAAU,YAAY,QAAQ,OAAO,GAAG,IAAI;AAAA,QAC1D,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,aACE;AAAA,MACF,UAAU;AAAA,MACV,aAAa,EAAE,UAAU,CAAC,WAAW,GAAG,UAAU,EAAI;AAAA,IACxD;AAAA,IACA,YAAY;AACV,YAAM,OAAO,MAAM,kBAAkB;AACrC,aAAO;AAAA,QACL,UAAU;AAAA,UACR;AAAA,YACE,KAAK;AAAA,YACL,UAAU;AAAA,YACV,MAAM,QAAQ;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}