@clipform/mcp-server 3.3.2 → 3.8.0

package/dist/chunk-S6RYUVDM.js

@@ -0,0 +1,102 @@
+import {
+  CURRENT_PLAN_VERSIONS,
+  PLAN_LIMITS,
+  callApi
+} from "./chunk-JRASOR5T.js";
+import {
+  getMcpAuth
+} from "./chunk-VPF6MLKM.js";
+
+// src/lib/caps.ts
+var FULL_CAPS = Object.freeze({ media: true, research: true });
+function capsFromToolsets(toolsets) {
+  if (toolsets === void 0) return FULL_CAPS;
+  return {
+    media: toolsets.includes("media"),
+    research: toolsets.includes("research")
+  };
+}
+
+// src/lib/anon-notice.ts
+var ANON_PREVIEW_NOTICE = "Preview accounts are temporary - claim yours to keep your forms.";
+function anonPreviewNotice() {
+  return getMcpAuth()?.is_anonymous ? ANON_PREVIEW_NOTICE : null;
+}
+
+// src/lib/session-context.ts
+async function getSessionContextWithAuth() {
+  let me;
+  const authCtx = getMcpAuth();
+  if (authCtx?.loadInternalContent && !authCtx.api_key) {
+    const free = PLAN_LIMITS[CURRENT_PLAN_VERSIONS[0]];
+    me = {
+      auth_mode: "anonymous",
+      plan: {
+        name: free.name,
+        tier: free.tier,
+        node_limit: free.node_limit,
+        form_limit: free.form_limit ?? null,
+        custom_theme: free.custom_theme
+      }
+    };
+  } else {
+    let result;
+    try {
+      result = await callApi("/me", { method: "GET" });
+    } catch {
+      return { text: "", authMode: "anonymous" };
+    }
+    if (!result.ok) return { text: "", authMode: "anonymous" };
+    me = result.data;
+  }
+  const apiAuthMode = getMcpAuth()?.is_anonymous ? "anonymous" : me.auth_mode ?? "anonymous";
+  const authMode = apiAuthMode === "anonymous" ? "anonymous" : "authenticated";
+  const plan = me.plan;
+  const lines = [];
+  lines.push("## Your Session");
+  if (authMode === "authenticated") {
+    lines.push(
+      apiAuthMode === "api_key" ? "Auth: API key (workspace-scoped)" : "Auth: signed in (connected to a Clipform account)"
+    );
+    lines.push(`Workspace: ${me.workspace?.name ?? "Unknown"}`);
+  } else {
+    lines.push("Auth: anonymous (not connected to a Clipform account)");
+    if (me.workspace) {
+      lines.push(`Workspace: ${me.workspace.name}`);
+    }
+  }
+  lines.push(`Plan: ${plan.name} (tier ${plan.tier})`);
+  if (plan.node_limit !== null) {
+    lines.push(`Question limit: ${plan.node_limit} per form`);
+  } else {
+    lines.push("Questions: unlimited");
+  }
+  if (plan.form_limit !== null) {
+    lines.push(`Form limit: ${plan.form_limit} forms`);
+  } else {
+    lines.push("Forms: unlimited");
+  }
+  if (plan.custom_theme === false) {
+    lines.push("Custom themes: not available on this plan");
+  }
+  if (authMode === "anonymous") {
+    lines.push(`
+Anonymous session: forms are not tied to a Clipform account until you sign in.`);
+    lines.push(ANON_PREVIEW_NOTICE);
+  }
+  return { text: lines.join("\n"), authMode };
+}
+async function getSessionContext() {
+  const { text } = await getSessionContextWithAuth();
+  return text;
+}
+
+export {
+  FULL_CAPS,
+  capsFromToolsets,
+  ANON_PREVIEW_NOTICE,
+  anonPreviewNotice,
+  getSessionContextWithAuth,
+  getSessionContext
+};
+//# sourceMappingURL=chunk-S6RYUVDM.js.map

package/dist/chunk-S6RYUVDM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/caps.ts","../src/lib/anon-notice.ts","../src/lib/session-context.ts"],"sourcesContent":["import type { McpToolset } from \"@vid-master/config\";\n\n/**\n * What a connected surface can actually do, derived from the connect-time\n * toolset filter (#3309) so the guidance layers (server instructions, prompt\n * recipes, `clipform_get_workflow`, craft guides) never reference a tool the\n * surface doesn't register (#3681).\n *\n * The Claude Connectors Directory surface (`mcp.clipform.io/forms`) is\n * account + forms only: no media generation and no research helpers. A\n * workflow that still says \"call clipform_generate_tts\" there sends the model\n * at a tool that doesn't exist, which shows up in review as failed tool\n * calls. Every guidance producer takes a ServerCaps and gates on it.\n */\nexport interface ServerCaps {\n  /** Narration, video, image, music, render, and asset tools are registered. */\n  media: boolean;\n  /** News lookup and the generation audit log are registered. */\n  research: boolean;\n}\n\n/** Every toolset registered - stdio/npx and the bare remote endpoint. */\nexport const FULL_CAPS: ServerCaps = Object.freeze({ media: true, research: true });\n\nexport function capsFromToolsets(toolsets?: readonly McpToolset[]): ServerCaps {\n  if (toolsets === undefined) return FULL_CAPS;\n  return {\n    media: toolsets.includes(\"media\"),\n    research: toolsets.includes(\"research\"),\n  };\n}\n","import { getMcpAuth } from \"./auth-context.js\";\n\n/**\n * #4650: anonymous (preview) accounts are temporary. Date-free by design -\n * the purge is not enforced yet, so no expiry date or day count is promised\n * (exact dates are follow-up #4662). Defined once; every anonymous-lane\n * surface (create/update_form text, whoami, session resource) reuses it.\n */\nexport const ANON_PREVIEW_NOTICE =\n  \"Preview accounts are temporary - claim yours to keep your forms.\";\n\n/** The notice for an anonymous MCP caller, or null for everyone else. */\nexport function anonPreviewNotice(): string | null {\n  return getMcpAuth()?.is_anonymous ? ANON_PREVIEW_NOTICE : null;\n}\n","import { BUSINESS, PLAN_LIMITS, CURRENT_PLAN_VERSIONS } from \"@vid-master/config\";\nimport { callApi } from \"./api-client.js\";\nimport { ANON_PREVIEW_NOTICE } from \"./anon-notice.js\";\nimport { getMcpAuth } from \"./auth-context.js\";\n\nexport type AuthMode = \"authenticated\" | \"anonymous\";\n\nexport interface SessionContextResult {\n  text: string;\n  authMode: AuthMode;\n}\n\nexport async function getSessionContextWithAuth(): Promise<SessionContextResult> {\n  let me: any;\n  const authCtx = getMcpAuth();\n  if (authCtx?.loadInternalContent && !authCtx.api_key) {\n    // #4657: the no-workspace anon lane (get_workflow with no mint) has no\n    // workspace for /me to describe, so plan caps default to Free.\n    const free = PLAN_LIMITS[CURRENT_PLAN_VERSIONS[0]];\n    me = {\n      auth_mode: \"anonymous\",\n      plan: {\n        name: free.name,\n        tier: free.tier,\n        node_limit: free.node_limit,\n        form_limit: free.form_limit ?? null,\n        custom_theme: free.custom_theme,\n      },\n    };\n  } else {\n    let result;\n    try {\n      result = await callApi(\"/me\", { method: \"GET\" });\n    } catch {\n      return { text: \"\", authMode: \"anonymous\" };\n    }\n    if (!result.ok) return { text: \"\", authMode: \"anonymous\" };\n    me = result.data as any;\n  }\n  // The API's auth_mode is \"api_key\" | \"oauth\" | \"session\" | \"anonymous\".\n  // Anything credentialed counts as authenticated - the old `=== \"oauth\"`\n  // check matched nothing the API returns, so API-key sessions were labelled\n  // anonymous with a \"sign in to unlock\" nudge right next to their real\n  // plan (#412 F6).\n  // The anon MCP lane runs as a minted bot key (/me says \"api_key\"), so the\n  // auth context is the truth for anonymous (#4653).\n  const apiAuthMode: string = getMcpAuth()?.is_anonymous\n    ? \"anonymous\"\n    : ((me.auth_mode as string) ?? \"anonymous\");\n  const authMode: AuthMode = apiAuthMode === \"anonymous\" ? \"anonymous\" : \"authenticated\";\n  const plan = me.plan;\n  const lines: string[] = [];\n\n  lines.push(\"## Your Session\");\n  if (authMode === \"authenticated\") {\n    lines.push(\n      apiAuthMode === \"api_key\"\n        ? \"Auth: API key (workspace-scoped)\"\n        : \"Auth: signed in (connected to a Clipform account)\"\n    );\n    // Workspace NAME only - the workspace UUID and the raw user_id/company_id\n    // are internal database identifiers the model never needs (response\n    // hygiene / disclosure guard, #2976).\n    lines.push(`Workspace: ${me.workspace?.name ?? \"Unknown\"}`);\n  } else {\n    lines.push(\"Auth: anonymous (not connected to a Clipform account)\");\n    if (me.workspace) {\n      lines.push(`Workspace: ${me.workspace.name}`);\n    }\n  }\n  lines.push(`Plan: ${plan.name} (tier ${plan.tier})`);\n  if (plan.node_limit !== null) {\n    lines.push(`Question limit: ${plan.node_limit} per form`);\n  } else {\n    lines.push(\"Questions: unlimited\");\n  }\n  if (plan.form_limit !== null) {\n    lines.push(`Form limit: ${plan.form_limit} forms`);\n  } else {\n    lines.push(\"Forms: unlimited\");\n  }\n  if (plan.custom_theme === false) {\n    lines.push(\"Custom themes: not available on this plan\");\n  }\n  if (authMode === \"anonymous\") {\n    // Neutral statement of fact, no upsell/CTA copy (commerce sweep, #2976):\n    // an anonymous session's forms are not tied to an account until one signs in.\n    lines.push(`\\nAnonymous session: forms are not tied to a Clipform account until you sign in.`);\n    lines.push(ANON_PREVIEW_NOTICE);\n  }\n\n  return { text: lines.join(\"\\n\"), authMode };\n}\n\nexport async function getSessionContext(): Promise<string> {\n  const { text } = await getSessionContextWithAuth();\n  return text;\n}\n"],"mappings":";;;;;;;;;;AAsBO,IAAM,YAAwB,OAAO,OAAO,EAAE,OAAO,MAAM,UAAU,KAAK,CAAC;AAE3E,SAAS,iBAAiB,UAA8C;AAC7E,MAAI,aAAa,OAAW,QAAO;AACnC,SAAO;AAAA,IACL,OAAO,SAAS,SAAS,OAAO;AAAA,IAChC,UAAU,SAAS,SAAS,UAAU;AAAA,EACxC;AACF;;;ACtBO,IAAM,sBACX;AAGK,SAAS,oBAAmC;AACjD,SAAO,WAAW,GAAG,eAAe,sBAAsB;AAC5D;;;ACFA,eAAsB,4BAA2D;AAC/E,MAAI;AACJ,QAAM,UAAU,WAAW;AAC3B,MAAI,SAAS,uBAAuB,CAAC,QAAQ,SAAS;AAGpD,UAAM,OAAO,YAAY,sBAAsB,CAAC,CAAC;AACjD,SAAK;AAAA,MACH,WAAW;AAAA,MACX,MAAM;AAAA,QACJ,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,YAAY,KAAK;AAAA,QACjB,YAAY,KAAK,cAAc;AAAA,QAC/B,cAAc,KAAK;AAAA,MACrB;AAAA,IACF;AAAA,EACF,OAAO;AACL,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,QAAQ,OAAO,EAAE,QAAQ,MAAM,CAAC;AAAA,IACjD,QAAQ;AACN,aAAO,EAAE,MAAM,IAAI,UAAU,YAAY;AAAA,IAC3C;AACA,QAAI,CAAC,OAAO,GAAI,QAAO,EAAE,MAAM,IAAI,UAAU,YAAY;AACzD,SAAK,OAAO;AAAA,EACd;AAQA,QAAM,cAAsB,WAAW,GAAG,eACtC,cACE,GAAG,aAAwB;AACjC,QAAM,WAAqB,gBAAgB,cAAc,cAAc;AACvE,QAAM,OAAO,GAAG;AAChB,QAAM,QAAkB,CAAC;AAEzB,QAAM,KAAK,iBAAiB;AAC5B,MAAI,aAAa,iBAAiB;AAChC,UAAM;AAAA,MACJ,gBAAgB,YACZ,qCACA;AAAA,IACN;AAIA,UAAM,KAAK,cAAc,GAAG,WAAW,QAAQ,SAAS,EAAE;AAAA,EAC5D,OAAO;AACL,UAAM,KAAK,uDAAuD;AAClE,QAAI,GAAG,WAAW;AAChB,YAAM,KAAK,cAAc,GAAG,UAAU,IAAI,EAAE;AAAA,IAC9C;AAAA,EACF;AACA,QAAM,KAAK,SAAS,KAAK,IAAI,UAAU,KAAK,IAAI,GAAG;AACnD,MAAI,KAAK,eAAe,MAAM;AAC5B,UAAM,KAAK,mBAAmB,KAAK,UAAU,WAAW;AAAA,EAC1D,OAAO;AACL,UAAM,KAAK,sBAAsB;AAAA,EACnC;AACA,MAAI,KAAK,eAAe,MAAM;AAC5B,UAAM,KAAK,eAAe,KAAK,UAAU,QAAQ;AAAA,EACnD,OAAO;AACL,UAAM,KAAK,kBAAkB;AAAA,EAC/B;AACA,MAAI,KAAK,iBAAiB,OAAO;AAC/B,UAAM,KAAK,2CAA2C;AAAA,EACxD;AACA,MAAI,aAAa,aAAa;AAG5B,UAAM,KAAK;AAAA,+EAAkF;AAC7F,UAAM,KAAK,mBAAmB;AAAA,EAChC;AAEA,SAAO,EAAE,MAAM,MAAM,KAAK,IAAI,GAAG,SAAS;AAC5C;AAEA,eAAsB,oBAAqC;AACzD,QAAM,EAAE,KAAK,IAAI,MAAM,0BAA0B;AACjD,SAAO;AACT;","names":[]}

package/dist/{chunk-KHRY3A3M.js → chunk-V5AI2TSQ.js}

@@ -1,20 +1,32 @@
+import {
+  FULL_CAPS,
+  getSessionContext
+} from "./chunk-S6RYUVDM.js";
 import {
   ALL_VARIANTS,
   FORM_TYPES,
   FORM_TYPE_KEYS,
-  FULL_CAPS,
-  callApi,
-  getSessionContext
-} from "./chunk-65MTGAFF.js";
+  callApi
+} from "./chunk-JRASOR5T.js";
+import {
+  getMcpAuth
+} from "./chunk-VPF6MLKM.js";
 
 // src/lib/guides.ts
 var guidesPromise = null;
 async function loadGuides() {
-  const result = await callApi("/internal/mcp/guides", { method: "GET" });
-  if (!result.ok) {
-    throw new Error(`Failed to load guides: ${result.error}`);
+  const loader = getMcpAuth()?.loadInternalContent;
+  let data;
+  if (loader) {
+    data = await loader("guides");
+  } else {
+    const result = await callApi("/internal/mcp/guides", { method: "GET" });
+    if (!result.ok) {
+      throw new Error(`Failed to load guides: ${result.error}`);
+    }
+    data = result.data;
   }
-  const guides = result.data.guides ?? [];
+  const guides = data.guides ?? [];
   return new Map(guides.map((g) => [g.uri, g]));
 }
 async function fetchGuideText(uri) {
@@ -143,4 +155,4 @@ export {
   getGuideUri,
   registerResources
 };
-//# sourceMappingURL=chunk-KHRY3A3M.js.map
+//# sourceMappingURL=chunk-V5AI2TSQ.js.map

package/dist/chunk-V5AI2TSQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/guides.ts","../src/resources.ts"],"sourcesContent":["import { callApi } from \"./api-client.js\";\nimport { getMcpAuth } from \"./auth-context.js\";\nimport type { ServerCaps } from \"./caps.js\";\n\n/**\n * Craft guide bodies live server-side (#470) - the npm package is a shim\n * that fetches them at runtime instead of bundling them in the tarball.\n * One fetch per process (all ~30KB of guides in a single response), cached;\n * a failed fetch is NOT cached so the next read retries.\n */\n\nexport interface RemoteGuide {\n  type: string;\n  variant: string | null;\n  uri: string;\n  mimeType: string;\n  text: string;\n}\n\nlet guidesPromise: Promise<Map<string, RemoteGuide>> | null = null;\n\nasync function loadGuides(): Promise<Map<string, RemoteGuide>> {\n  // #4657: the anonymous no-workspace lane serves the static guides in-process.\n  const loader = getMcpAuth()?.loadInternalContent;\n  let data: Record<string, unknown>;\n  if (loader) {\n    data = await loader(\"guides\");\n  } else {\n    const result = await callApi(\"/internal/mcp/guides\", { method: \"GET\" });\n    if (!result.ok) {\n      throw new Error(`Failed to load guides: ${result.error}`);\n    }\n    data = result.data;\n  }\n  const guides = (data as { guides?: RemoteGuide[] }).guides ?? [];\n  return new Map(guides.map((g) => [g.uri, g]));\n}\n\n/** Fetch a guide body by its clipform:// URI. Returns null when unavailable. */\nexport async function fetchGuideText(uri: string): Promise<string | null> {\n  if (!guidesPromise) {\n    guidesPromise = loadGuides();\n  }\n  try {\n    const guides = await guidesPromise;\n    return guides.get(uri)?.text ?? null;\n  } catch (err) {\n    guidesPromise = null; // don't cache failures - retry on the next read\n    // Loud, not silent: a misconfigured API_URL/key otherwise degrades every\n    // guide to the stub with nothing in the logs.\n    console.error(`[guides] Failed to fetch ${uri}: ${err instanceof Error ? err.message : String(err)}`);\n    return null;\n  }\n}\n\n/** Shown in place of a guide when the API is unreachable or unauthenticated. */\nexport function guideFallbackText(uri: string): string {\n  return [\n    `# Guide unavailable`,\n    ``,\n    `The craft guide (${uri}) could not be loaded from the Clipform API.`,\n    `Guides are served at runtime and need a reachable API with a valid key -`,\n    `check API_URL and CLIPFORM_API_KEY, then try again.`,\n    ``,\n    `General principles in the meantime: write narration for the ear (short,`,\n    `conversational), never reveal answers in narration or media, and keep`,\n    `forms tight - every question must earn its place.`,\n  ].join(\"\\n\");\n}\n\n/**\n * Craft guide bodies are written for the full tool surface and mention the\n * narration/video tools by name. On a surface that doesn't register them\n * (the Claude Connectors Directory resource, #3681) prefix the guide with a\n * note so the model doesn't chase tools it can't call. The body itself is\n * untouched - the craft (question design, pacing) is the same either way.\n */\nexport function applyCapsToGuide(text: string, caps: ServerCaps): string {\n  if (caps.media) return text;\n  return [\n    \"> **This connection exposes form-building tools only** - no narration, video, image, or music tools. Where this guide mentions narration, media, or rendering, skip that part and carry the same craft into the written question text.\",\n    \"\",\n    text,\n  ].join(\"\\n\");\n}\n","import { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { getSessionContext } from \"./lib/session-context.js\";\nimport { FORM_TYPE_KEYS, FORM_TYPES, ALL_VARIANTS } from \"@vid-master/config\";\n\nexport const GUIDE_TYPES = FORM_TYPE_KEYS as readonly string[] as readonly [string, ...string[]];\nexport type GuideType = (typeof FORM_TYPE_KEYS)[number];\n\nexport const QUIZ_VARIANTS = ALL_VARIANTS as readonly string[] as readonly [string, ...string[]];\nexport type QuizVariant = (typeof ALL_VARIANTS)[number];\n// Guide BODIES are not bundled here (#470): the npm tarball ships only this\n// registration metadata. Text is fetched from the API at runtime - see\n// lib/guides.ts (cached per process, stub fallback when unreachable).\nimport { fetchGuideText, guideFallbackText, applyCapsToGuide } from \"./lib/guides.js\";\nimport { FULL_CAPS, type ServerCaps } from \"./lib/caps.js\";\n\nconst GUIDE_DESCRIPTIONS: Record<GuideType, string> = {\n  \"quiz\": \"Craft knowledge for writing engaging quizzes - difficulty curves, question psychology, narration style, scoring\",\n  \"survey\": \"Craft knowledge for feedback surveys, NPS, and research forms - brevity, rating scales, respondent fatigue\",\n  \"interview\": \"Craft knowledge for building interview forms - warm-up pacing, open questions, consent, video responses\",\n  \"funnel\": \"Craft knowledge for lead qualification funnels - planned feature, conditional routing coming soon\",\n  \"testimonial\": \"Craft knowledge for collecting testimonials and customer stories on video - storytelling prompts, comfort techniques, consent\",\n  \"application\": \"Craft knowledge for application and evaluation forms - multi-section structure, video responses for behavioural questions, screening\",\n  \"booking\": \"Craft knowledge for event registration and booking forms - minimal friction, video welcome, confirmation flow\",\n};\n\n// Sourced from config (single source of truth) so the agent-facing resource\n// descriptions can't drift from FORM_TYPES.quiz.variant_descriptions (#2534,\n// the exact pair packages/config/CLAUDE.md warns about).\nconst QUIZ_VARIANT_DESCRIPTIONS = FORM_TYPES.quiz.variant_descriptions;\n\nexport function getGuideUri(type: GuideType, variant?: QuizVariant): string {\n  if (type === \"quiz\" && variant) {\n    return `clipform://guides/quiz/${variant}`;\n  }\n  return `clipform://guides/${type}`;\n}\n\nasync function readGuide(uri: string, caps: ServerCaps): Promise<string> {\n  return applyCapsToGuide((await fetchGuideText(uri)) ?? guideFallbackText(uri), caps);\n}\n\nexport function registerResources(server: McpServer, caps: ServerCaps = FULL_CAPS) {\n  for (const type of GUIDE_TYPES) {\n    server.registerResource(\n      `guide-${type}`,\n      getGuideUri(type),\n      {\n        description: GUIDE_DESCRIPTIONS[type],\n        mimeType: \"text/markdown\",\n        annotations: { audience: [\"assistant\" as const], priority: 0.8 },\n      },\n      async () => ({\n        contents: [{\n          uri: getGuideUri(type),\n          mimeType: \"text/markdown\",\n          text: await readGuide(getGuideUri(type), caps),\n        }],\n      }),\n    );\n  }\n\n  for (const variant of QUIZ_VARIANTS) {\n    server.registerResource(\n      `guide-quiz-${variant}`,\n      getGuideUri(\"quiz\", variant),\n      {\n        description: QUIZ_VARIANT_DESCRIPTIONS[variant],\n        mimeType: \"text/markdown\",\n        annotations: { audience: [\"assistant\" as const], priority: 0.8 },\n      },\n      async () => ({\n        contents: [{\n          uri: getGuideUri(\"quiz\", variant),\n          mimeType: \"text/markdown\",\n          text: await readGuide(getGuideUri(\"quiz\", variant), caps),\n        }],\n      }),\n    );\n  }\n\n  server.registerResource(\n    \"context-session\",\n    \"clipform://context/session\",\n    {\n      description:\n        \"Current session info: auth mode, workspace name, plan name, and node/form limits. Read this before planning content to know your constraints.\",\n      mimeType: \"text/markdown\",\n      annotations: { audience: [\"assistant\"], priority: 1.0 },\n    },\n    async () => {\n      const text = await getSessionContext();\n      return {\n        contents: [\n          {\n            uri: \"clipform://context/session\",\n            mimeType: \"text/markdown\",\n            text: text || \"Session context unavailable - API may not be reachable.\",\n          },\n        ],\n      };\n    }\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,IAAI,gBAA0D;AAE9D,eAAe,aAAgD;AAE7D,QAAM,SAAS,WAAW,GAAG;AAC7B,MAAI;AACJ,MAAI,QAAQ;AACV,WAAO,MAAM,OAAO,QAAQ;AAAA,EAC9B,OAAO;AACL,UAAM,SAAS,MAAM,QAAQ,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AACtE,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,MAAM,0BAA0B,OAAO,KAAK,EAAE;AAAA,IAC1D;AACA,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAU,KAAoC,UAAU,CAAC;AAC/D,SAAO,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9C;AAGA,eAAsB,eAAe,KAAqC;AACxE,MAAI,CAAC,eAAe;AAClB,oBAAgB,WAAW;AAAA,EAC7B;AACA,MAAI;AACF,UAAM,SAAS,MAAM;AACrB,WAAO,OAAO,IAAI,GAAG,GAAG,QAAQ;AAAA,EAClC,SAAS,KAAK;AACZ,oBAAgB;AAGhB,YAAQ,MAAM,4BAA4B,GAAG,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACpG,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBAAkB,KAAqB;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,oBAAoB,GAAG;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AASO,SAAS,iBAAiB,MAAc,MAA0B;AACvE,MAAI,KAAK,MAAO,QAAO;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;;;AChFO,IAAM,cAAc;AAGpB,IAAM,gBAAgB;AAQ7B,IAAM,qBAAgD;AAAA,EACpD,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,aAAa;AAAA,EACb,UAAU;AAAA,EACV,eAAe;AAAA,EACf,eAAe;AAAA,EACf,WAAW;AACb;AAKA,IAAM,4BAA4B,WAAW,KAAK;AAE3C,SAAS,YAAY,MAAiB,SAA+B;AAC1E,MAAI,SAAS,UAAU,SAAS;AAC9B,WAAO,0BAA0B,OAAO;AAAA,EAC1C;AACA,SAAO,qBAAqB,IAAI;AAClC;AAEA,eAAe,UAAU,KAAa,MAAmC;AACvE,SAAO,iBAAkB,MAAM,eAAe,GAAG,KAAM,kBAAkB,GAAG,GAAG,IAAI;AACrF;AAEO,SAAS,kBAAkB,QAAmB,OAAmB,WAAW;AACjF,aAAW,QAAQ,aAAa;AAC9B,WAAO;AAAA,MACL,SAAS,IAAI;AAAA,MACb,YAAY,IAAI;AAAA,MAChB;AAAA,QACE,aAAa,mBAAmB,IAAI;AAAA,QACpC,UAAU;AAAA,QACV,aAAa,EAAE,UAAU,CAAC,WAAoB,GAAG,UAAU,IAAI;AAAA,MACjE;AAAA,MACA,aAAa;AAAA,QACX,UAAU,CAAC;AAAA,UACT,KAAK,YAAY,IAAI;AAAA,UACrB,UAAU;AAAA,UACV,MAAM,MAAM,UAAU,YAAY,IAAI,GAAG,IAAI;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,aAAW,WAAW,eAAe;AACnC,WAAO;AAAA,MACL,cAAc,OAAO;AAAA,MACrB,YAAY,QAAQ,OAAO;AAAA,MAC3B;AAAA,QACE,aAAa,0BAA0B,OAAO;AAAA,QAC9C,UAAU;AAAA,QACV,aAAa,EAAE,UAAU,CAAC,WAAoB,GAAG,UAAU,IAAI;AAAA,MACjE;AAAA,MACA,aAAa;AAAA,QACX,UAAU,CAAC;AAAA,UACT,KAAK,YAAY,QAAQ,OAAO;AAAA,UAChC,UAAU;AAAA,UACV,MAAM,MAAM,UAAU,YAAY,QAAQ,OAAO,GAAG,IAAI;AAAA,QAC1D,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,aACE;AAAA,MACF,UAAU;AAAA,MACV,aAAa,EAAE,UAAU,CAAC,WAAW,GAAG,UAAU,EAAI;AAAA,IACxD;AAAA,IACA,YAAY;AACV,YAAM,OAAO,MAAM,kBAAkB;AACrC,aAAO;AAAA,QACL,UAAU;AAAA,UACR;AAAA,YACE,KAAK;AAAA,YACL,UAAU;AAAA,YACV,MAAM,QAAQ;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-A5CFGL27.js → chunk-VPF6MLKM.js}

@@ -3,6 +3,8 @@ import { AsyncLocalStorage } from "async_hooks";
 var MCP_ANONYMOUS_HEADER = "x-clipform-anonymous";
 var MCP_AUTH_VIA_HEADER = "x-clipform-auth-via";
 var MCP_MINT_PROOF_HEADER = "x-clipform-mcp-mint-proof";
+var MCP_SESSION_PROOF_HEADER = "x-clipform-mcp-session-proof";
+var MCP_SESSION_ID_HEADER = "x-clipform-mcp-session-id";
 var storage = new AsyncLocalStorage();
 function runWithMcpAuth(ctx, fn) {
   return storage.run(ctx, fn);
@@ -20,8 +22,10 @@ export {
   MCP_ANONYMOUS_HEADER,
   MCP_AUTH_VIA_HEADER,
   MCP_MINT_PROOF_HEADER,
+  MCP_SESSION_PROOF_HEADER,
+  MCP_SESSION_ID_HEADER,
   runWithMcpAuth,
   getMcpAuth,
   runWithMcpTool
 };
-//# sourceMappingURL=chunk-A5CFGL27.js.map
+//# sourceMappingURL=chunk-VPF6MLKM.js.map

package/dist/chunk-VPF6MLKM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/auth-context.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Identity of the end-user a given MCP request is acting on behalf of.\n *\n * Populated by the in-process host (apps/api) after validating an OAuth\n * Bearer on /mcp. The MCP tool layer reads it to decide which workspace\n * forms should land in and which plan tier gates apply.\n *\n * NOT populated when the server runs as a local stdio process (npx) - in\n * that mode tools fall back to edit-token based auth.\n */\nexport interface McpAuthContext {\n  user_id: string;\n  workspace_id: string;\n  scopes: string[];\n  tool_name?: string;\n  api_key?: string;\n  // Set when the human behind this tool call is an anonymous Supabase\n  // session (apps/api's app-chat lane, #2983/#2984) - api-client.ts's\n  // getAuthHeaders reads it to mark the outgoing bot-key HTTP request so the\n  // API can propagate the restriction even though the request itself\n  // authenticates with an API key, not a JWT.\n  is_anonymous?: boolean;\n  // Set on the OAuth branch of apps/api's mcp/handler.ts when this request's\n  // bot API key was resolved on behalf of an OAuth-connected user (#3716) -\n  // api-client.ts's getAuthHeaders reads it to mark the outgoing request so\n  // /v1/me can report auth_mode \"oauth\" instead of the generic \"api_key\" the\n  // bot-key lane would otherwise get, even though the request itself\n  // authenticates with an API key, not an OAuth token.\n  auth_via?: \"oauth\";\n  // #3330 review fix (blocker 1): an HMAC proof (apps/api's mcp-mint-proof.ts)\n  // that THIS exact request's #1415 anon lane freshly minted a brand-new anon\n  // identity for `workspace_id` - set only on the mint branch of\n  // resolveAnonymousMcpAuth, never when auth was resolved via an inbound\n  // form_id (even the caller's own). Lets create-form.ts safely offer a\n  // same-UID claim link without ever deriving \"who to bind it to\" from a\n  // body-supplied id, which would let a batch smuggling another tenant's\n  // form_id alongside a create_form call mint a claim token for THAT\n  // tenant's identity instead of the caller's own.\n  mcp_mint_proof?: string;\n  // #4090: sibling of mcp_mint_proof, set when the anon lane REUSED a\n  // server-verified session binding (#4652) instead of minting. HMAC-bound\n  // to the bound {workspace, uid}; lets create-form.ts re-surface the claim\n  // link on later forms in the session.\n  mcp_session_proof?: string;\n  // #3822: set ONLY on the OAuth branch of apps/api's mcp/handler.ts. Lets a\n  // single tool call target another workspace the connected user belongs to\n  // (per-call, never per-request - see the #3330 note in the package\n  // CLAUDE.md). The host re-checks membership on every call and returns that\n  // workspace's own bot key, or null to mean \"act in the default workspace\n  // unchanged\" (target is the default, or a form_id the user can't reach -\n  // the API then answers exactly as it did before targeting existed). Anon + stdio contexts never carry it, so they\n  // stay pinned to one workspace.\n  resolveWorkspace?: (target: {\n    workspace_id?: string;\n    form_id?: string;\n  }) => Promise<{ workspace_id: string; workspace_name: string; api_key: string } | null>;\n  // #3822: the workspaces the connected user may target (same set\n  // resolveWorkspace accepts). OAuth lane only.\n  listWorkspaces?: () => Promise<{ id: string; name: string }[]>;\n  // #3822: the workspace picked at authorize time - what a call with no\n  // `workspace_id` acts in. OAuth lane only (workspace_id above is swapped\n  // per call when a target is resolved, this never is).\n  default_workspace_id?: string;\n  // #4657: set ONLY by apps/api's mcp/handler.ts for an anonymous request made\n  // entirely of `anon_no_workspace` tools (get_guide / get_workflow /\n  // list_assets). That lane has NO credential of any kind: the static content\n  // is served in-process through this loader instead of an HTTP callApi, so no\n  // secret or key ever sits in the anonymous context. Tools use it when\n  // present and callApi otherwise (stdio / published behaviour unchanged).\n  // #4657: decoded PostHog MCP `$session_id` from the inbound Mcp-Session-Id -\n  // ANALYTICS ONLY (stamped on funnel events). api-client.ts forwards it as\n  // MCP_SESSION_ID_HEADER; nothing about identity or access derives from it.\n  mcp_session_id?: string;\n  loadInternalContent?: (\n    kind: \"guides\" | \"assets\",\n    params?: { type?: string }\n  ) => Promise<Record<string, unknown>>;\n}\n\n/**\n * Marker header the in-process MCP tool layer sets on its outgoing API\n * requests (api-client.ts) when `is_anonymous` is true, so an anonymous\n * app-chat session can't launder itself into an unrestricted API-key caller\n * by asking the bot to publish/mint credentials on its behalf. apps/api's\n * authMiddleware / workspaceAccessMiddleware / requireWorkspaceWriteAuth\n * read this on the API-key path and set isAnonymous accordingly - trusting\n * it is safe because it can only RESTRICT a caller: a real integration that\n * sets this header on its own API-key requests only denies itself, it can\n * never use it to gain anonymous-JWT privileges it doesn't already have.\n */\nexport const MCP_ANONYMOUS_HEADER = \"x-clipform-anonymous\";\n\n/**\n * Marker header the in-process MCP tool layer sets on its outgoing API\n * requests (api-client.ts) when `auth_via` is \"oauth\", so /v1/me can report\n * `auth_mode: \"oauth\"` for an OAuth-connected user instead of the generic\n * \"api_key\" the bot-key lane would otherwise get (#3716). Label-only: it\n * changes nothing but the reported string. Trusting it from the wire is\n * safe because a direct API-key caller who sets this header on their own\n * request only mislabels their own whoami output - they gain no privilege,\n * exactly the same reasoning as MCP_ANONYMOUS_HEADER above (except that\n * header can only restrict, and this one can only relabel).\n */\nexport const MCP_AUTH_VIA_HEADER = \"x-clipform-auth-via\";\n\n/**\n * Carries `mcp_mint_proof` on the same outgoing bot-key request. Unlike\n * MCP_ANONYMOUS_HEADER (a boolean that can only ever RESTRICT), this header's\n * VALUE matters - it names an identity a claim token gets bound to - so its\n * value is HMAC-signed (mcp-mint-proof.ts) rather than trusted raw: a direct\n * external caller reaching `POST /v1/forms` with any valid workspace API key\n * could otherwise hand-set an unsigned \"mint uid\" header to an arbitrary\n * victim's uid themselves (#3330 review).\n */\nexport const MCP_MINT_PROOF_HEADER = \"x-clipform-mcp-mint-proof\";\n\n/** #4090: carries `mcp_session_proof` (same trust model as MCP_MINT_PROOF_HEADER: HMAC-verified server-side, never trusted raw). */\nexport const MCP_SESSION_PROOF_HEADER = \"x-clipform-mcp-session-proof\";\n\n/** Carries `mcp_session_id` to the API for funnel analytics only (#4657). */\nexport const MCP_SESSION_ID_HEADER = \"x-clipform-mcp-session-id\";\n\nconst storage = new AsyncLocalStorage<McpAuthContext>();\n\nexport function runWithMcpAuth<T>(ctx: McpAuthContext, fn: () => Promise<T> | T): Promise<T> | T {\n  return storage.run(ctx, fn);\n}\n\nexport function getMcpAuth(): McpAuthContext | undefined {\n  return storage.getStore();\n}\n\nexport function runWithMcpTool<T>(toolName: string, fn: () => Promise<T> | T): Promise<T> | T {\n  const parent = storage.getStore();\n  if (!parent) return fn();\n  return storage.run({ ...parent, tool_name: toolName }, fn);\n}\n"],"mappings":";AAAA,SAAS,yBAAyB;AA4F3B,IAAM,uBAAuB;AAa7B,IAAM,sBAAsB;AAW5B,IAAM,wBAAwB;AAG9B,IAAM,2BAA2B;AAGjC,IAAM,wBAAwB;AAErC,IAAM,UAAU,IAAI,kBAAkC;AAE/C,SAAS,eAAkB,KAAqB,IAA0C;AAC/F,SAAO,QAAQ,IAAI,KAAK,EAAE;AAC5B;AAEO,SAAS,aAAyC;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAEO,SAAS,eAAkB,UAAkB,IAA0C;AAC5F,QAAM,SAAS,QAAQ,SAAS;AAChC,MAAI,CAAC,OAAQ,QAAO,GAAG;AACvB,SAAO,QAAQ,IAAI,EAAE,GAAG,QAAQ,WAAW,SAAS,GAAG,EAAE;AAC3D;","names":[]}

package/dist/index.js

@@ -2,11 +2,12 @@
 import {
   JSONRPCMessageSchema,
   createServer
-} from "./chunk-7I765YTD.js";
-import "./chunk-5J5N7KTW.js";
-import "./chunk-KHRY3A3M.js";
-import "./chunk-65MTGAFF.js";
-import "./chunk-A5CFGL27.js";
+} from "./chunk-FC7D3235.js";
+import "./chunk-KWR2WJQI.js";
+import "./chunk-V5AI2TSQ.js";
+import "./chunk-S6RYUVDM.js";
+import "./chunk-JRASOR5T.js";
+import "./chunk-VPF6MLKM.js";
 import {
   setMcpVersion
 } from "./chunk-PBQ5BQWD.js";
@@ -17,10 +18,10 @@ import { readFileSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "process";
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
   constructor(options) {
@@ -57,7 +58,7 @@ function serializeMessage(message) {
   return JSON.stringify(message) + "\n";
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
   constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
     this._stdin = _stdin;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/src/server/stdio.ts","../../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/src/shared/stdio.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport { createServer } from \"./server.js\";\nimport { setMcpVersion } from \"./lib/telemetry.js\";\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\nconst pkg = JSON.parse(readFileSync(join(__dirname, \"..\", \"package.json\"), \"utf-8\"));\nsetMcpVersion(pkg.version);\n\nconst telemetryOff =\n  process.env.DO_NOT_TRACK === \"1\" || process.env.CLIPFORM_TELEMETRY === \"off\";\n\nconst server = createServer();\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\nconsole.error(`Clipform MCP Server v${pkg.version} running on stdio`);\nif (!telemetryOff) {\n  console.error(\"Telemetry enabled (server errors only). Set DO_NOT_TRACK=1 to disable.\");\n}\n",null,null],"mappings":";;;;;;;;;;;;;;;AACA,SAAS,oBAAoB;AAC7B,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;;;ACH9B,OAAOA,cAAa;;;ACEb,IAAM,gCAAgC,KAAK,OAAO;AAKnD,IAAO,aAAP,MAAiB;EAInB,YAAY,SAAoC;AAC5C,SAAK,iBAAiB,SAAS,iBAAiB;EACpD;EAEA,OAAO,OAAa;AAChB,UAAM,WAAW,KAAK,SAAS,UAAU,KAAK,MAAM;AACpD,QAAI,UAAU,KAAK,gBAAgB;AAC/B,WAAK,MAAK;AACV,YAAM,IAAI,MAAM,uCAAuC,KAAK,cAAc,QAAQ;IACtF;AACA,SAAK,UAAU,KAAK,UAAU,OAAO,OAAO,CAAC,KAAK,SAAS,KAAK,CAAC,IAAI;EACzE;EAEA,cAAW;AACP,QAAI,CAAC,KAAK,SAAS;AACf,aAAO;IACX;AAEA,UAAM,QAAQ,KAAK,QAAQ,QAAQ,IAAI;AACvC,QAAI,UAAU,IAAI;AACd,aAAO;IACX;AAEA,UAAM,OAAO,KAAK,QAAQ,SAAS,QAAQ,GAAG,KAAK,EAAE,QAAQ,OAAO,EAAE;AACtE,SAAK,UAAU,KAAK,QAAQ,SAAS,QAAQ,CAAC;AAC9C,WAAO,mBAAmB,IAAI;EAClC;EAEA,QAAK;AACD,SAAK,UAAU;EACnB;;AAGE,SAAU,mBAAmB,MAAY;AAC3C,SAAO,qBAAqB,MAAM,KAAK,MAAM,IAAI,CAAC;AACtD;AAEM,SAAU,iBAAiB,SAAuB;AACpD,SAAO,KAAK,UAAU,OAAO,IAAI;AACrC;;;ADvCM,IAAO,uBAAP,MAA2B;EAI7B,YACY,SAAmBC,SAAQ,OAC3B,UAAoBA,SAAQ,QACpC,SAQC;AAVO,SAAA,SAAA;AACA,SAAA,UAAA;AAJJ,SAAA,WAAW;AAuBnB,SAAA,UAAU,CAAC,UAAiB;AACxB,UAAI;AACA,aAAK,YAAY,OAAO,KAAK;AAC7B,aAAK,kBAAiB;MAC1B,SAAS,OAAO;AACZ,aAAK,UAAU,KAAc;AAC7B,aAAK,MAAK,EAAG,MAAM,MAAK;QAAE,CAAC;MAC/B;IACJ;AACA,SAAA,WAAW,CAAC,UAAgB;AACxB,WAAK,UAAU,KAAK;IACxB;AAnBI,SAAK,cAAc,IAAI,WAAW,EAAE,eAAe,SAAS,cAAa,CAAE;EAC/E;;;;EAuBA,MAAM,QAAK;AACP,QAAI,KAAK,UAAU;AACf,YAAM,IAAI,MACN,+GAA+G;IAEvH;AAEA,SAAK,WAAW;AAChB,SAAK,OAAO,GAAG,QAAQ,KAAK,OAAO;AACnC,SAAK,OAAO,GAAG,SAAS,KAAK,QAAQ;EACzC;EAEQ,oBAAiB;AACrB,WAAO,MAAM;AACT,UAAI;AACA,cAAM,UAAU,KAAK,YAAY,YAAW;AAC5C,YAAI,YAAY,MAAM;AAClB;QACJ;AAEA,aAAK,YAAY,OAAO;MAC5B,SAAS,OAAO;AACZ,aAAK,UAAU,KAAc;MACjC;IACJ;EACJ;EAEA,MAAM,QAAK;AAEP,SAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;AACpC,SAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;AAGtC,UAAM,yBAAyB,KAAK,OAAO,cAAc,MAAM;AAC/D,QAAI,2BAA2B,GAAG;AAG9B,WAAK,OAAO,MAAK;IACrB;AAGA,SAAK,YAAY,MAAK;AACtB,SAAK,UAAS;EAClB;EAEA,KAAK,SAAuB;AACxB,WAAO,IAAI,QAAQ,aAAU;AACzB,YAAM,OAAO,iBAAiB,OAAO;AACrC,UAAI,KAAK,QAAQ,MAAM,IAAI,GAAG;AAC1B,gBAAO;MACX,OAAO;AACH,aAAK,QAAQ,KAAK,SAAS,OAAO;MACtC;IACJ,CAAC;EACL;;;;ADlGJ,IAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AACxD,IAAM,MAAM,KAAK,MAAM,aAAa,KAAK,WAAW,MAAM,cAAc,GAAG,OAAO,CAAC;AACnF,cAAc,IAAI,OAAO;AAEzB,IAAM,eACJ,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,IAAI,uBAAuB;AAEzE,IAAM,SAAS,aAAa;AAC5B,IAAM,YAAY,IAAI,qBAAqB;AAC3C,MAAM,OAAO,QAAQ,SAAS;AAC9B,QAAQ,MAAM,wBAAwB,IAAI,OAAO,mBAAmB;AACpE,IAAI,CAAC,cAAc;AACjB,UAAQ,MAAM,wEAAwE;AACxF;","names":["process","process"]}
+{"version":3,"sources":["../src/index.ts","../../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/src/server/stdio.ts","../../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/src/shared/stdio.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport { createServer } from \"./server.js\";\nimport { setMcpVersion } from \"./lib/telemetry.js\";\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\nconst pkg = JSON.parse(readFileSync(join(__dirname, \"..\", \"package.json\"), \"utf-8\"));\nsetMcpVersion(pkg.version);\n\nconst telemetryOff =\n  process.env.DO_NOT_TRACK === \"1\" || process.env.CLIPFORM_TELEMETRY === \"off\";\n\nconst server = createServer();\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\nconsole.error(`Clipform MCP Server v${pkg.version} running on stdio`);\nif (!telemetryOff) {\n  console.error(\"Telemetry enabled (server errors only). Set DO_NOT_TRACK=1 to disable.\");\n}\n",null,null],"mappings":";;;;;;;;;;;;;;;;AACA,SAAS,oBAAoB;AAC7B,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;;;ACH9B,OAAOA,cAAa;;;ACEb,IAAM,gCAAgC,KAAK,OAAO;AAKnD,IAAO,aAAP,MAAiB;EAInB,YAAY,SAAoC;AAC5C,SAAK,iBAAiB,SAAS,iBAAiB;EACpD;EAEA,OAAO,OAAa;AAChB,UAAM,WAAW,KAAK,SAAS,UAAU,KAAK,MAAM;AACpD,QAAI,UAAU,KAAK,gBAAgB;AAC/B,WAAK,MAAK;AACV,YAAM,IAAI,MAAM,uCAAuC,KAAK,cAAc,QAAQ;IACtF;AACA,SAAK,UAAU,KAAK,UAAU,OAAO,OAAO,CAAC,KAAK,SAAS,KAAK,CAAC,IAAI;EACzE;EAEA,cAAW;AACP,QAAI,CAAC,KAAK,SAAS;AACf,aAAO;IACX;AAEA,UAAM,QAAQ,KAAK,QAAQ,QAAQ,IAAI;AACvC,QAAI,UAAU,IAAI;AACd,aAAO;IACX;AAEA,UAAM,OAAO,KAAK,QAAQ,SAAS,QAAQ,GAAG,KAAK,EAAE,QAAQ,OAAO,EAAE;AACtE,SAAK,UAAU,KAAK,QAAQ,SAAS,QAAQ,CAAC;AAC9C,WAAO,mBAAmB,IAAI;EAClC;EAEA,QAAK;AACD,SAAK,UAAU;EACnB;;AAGE,SAAU,mBAAmB,MAAY;AAC3C,SAAO,qBAAqB,MAAM,KAAK,MAAM,IAAI,CAAC;AACtD;AAEM,SAAU,iBAAiB,SAAuB;AACpD,SAAO,KAAK,UAAU,OAAO,IAAI;AACrC;;;ADvCM,IAAO,uBAAP,MAA2B;EAI7B,YACY,SAAmBC,SAAQ,OAC3B,UAAoBA,SAAQ,QACpC,SAQC;AAVO,SAAA,SAAA;AACA,SAAA,UAAA;AAJJ,SAAA,WAAW;AAuBnB,SAAA,UAAU,CAAC,UAAiB;AACxB,UAAI;AACA,aAAK,YAAY,OAAO,KAAK;AAC7B,aAAK,kBAAiB;MAC1B,SAAS,OAAO;AACZ,aAAK,UAAU,KAAc;AAC7B,aAAK,MAAK,EAAG,MAAM,MAAK;QAAE,CAAC;MAC/B;IACJ;AACA,SAAA,WAAW,CAAC,UAAgB;AACxB,WAAK,UAAU,KAAK;IACxB;AAnBI,SAAK,cAAc,IAAI,WAAW,EAAE,eAAe,SAAS,cAAa,CAAE;EAC/E;;;;EAuBA,MAAM,QAAK;AACP,QAAI,KAAK,UAAU;AACf,YAAM,IAAI,MACN,+GAA+G;IAEvH;AAEA,SAAK,WAAW;AAChB,SAAK,OAAO,GAAG,QAAQ,KAAK,OAAO;AACnC,SAAK,OAAO,GAAG,SAAS,KAAK,QAAQ;EACzC;EAEQ,oBAAiB;AACrB,WAAO,MAAM;AACT,UAAI;AACA,cAAM,UAAU,KAAK,YAAY,YAAW;AAC5C,YAAI,YAAY,MAAM;AAClB;QACJ;AAEA,aAAK,YAAY,OAAO;MAC5B,SAAS,OAAO;AACZ,aAAK,UAAU,KAAc;MACjC;IACJ;EACJ;EAEA,MAAM,QAAK;AAEP,SAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;AACpC,SAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;AAGtC,UAAM,yBAAyB,KAAK,OAAO,cAAc,MAAM;AAC/D,QAAI,2BAA2B,GAAG;AAG9B,WAAK,OAAO,MAAK;IACrB;AAGA,SAAK,YAAY,MAAK;AACtB,SAAK,UAAS;EAClB;EAEA,KAAK,SAAuB;AACxB,WAAO,IAAI,QAAQ,aAAU;AACzB,YAAM,OAAO,iBAAiB,OAAO;AACrC,UAAI,KAAK,QAAQ,MAAM,IAAI,GAAG;AAC1B,gBAAO;MACX,OAAO;AACH,aAAK,QAAQ,KAAK,SAAS,OAAO;MACtC;IACJ,CAAC;EACL;;;;ADlGJ,IAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AACxD,IAAM,MAAM,KAAK,MAAM,aAAa,KAAK,WAAW,MAAM,cAAc,GAAG,OAAO,CAAC;AACnF,cAAc,IAAI,OAAO;AAEzB,IAAM,eACJ,QAAQ,IAAI,iBAAiB,OAAO,QAAQ,IAAI,uBAAuB;AAEzE,IAAM,SAAS,aAAa;AAC5B,IAAM,YAAY,IAAI,qBAAqB;AAC3C,MAAM,OAAO,QAAQ,SAAS;AAC9B,QAAQ,MAAM,wBAAwB,IAAI,OAAO,mBAAmB;AACpE,IAAI,CAAC,cAAc;AACjB,UAAQ,MAAM,wEAAwE;AACxF;","names":["process","process"]}

package/dist/instrument.d.ts

@@ -24,9 +24,26 @@ interface InstrumentServerOptions {
      */
     reportMissing?: boolean;
 }
+/**
+ * #4623: per-request telemetry context stamped on every `$mcp_tool_call` /
+ * `$mcp_intent` in `beforeSend`. Analytics labels only - never an authority.
+ * Absent on the in-process lane, which then behaves exactly as before.
+ */
+interface McpTelemetryContext {
+    /** Resolved client bucket (chatgpt/claude_connector/mcp_other/automated). Kept
+     *  separate from the SDK's raw `$mcp_client_name`, which is NOT overwritten. */
+    clientOrigin?: string;
+    authMode?: "oauth" | "anon" | "api_key" | "none";
+    workspaceId?: string;
+    /** Anon lane: the minted/resolved anon uid, used as the distinctId so anon
+     *  tool calls join the person instead of all landing on "anonymous". */
+    anonUid?: string;
+    /** ChatGPT `_meta["openai/locale"]` (BCP 47). Language hint only - never location. */
+    clientLocale?: string;
+}
 declare function buildInstrumentOptions(mcpAuth: {
     user_id?: string;
-} | null, opts?: InstrumentServerOptions): MCPAnalyticsOptions;
+} | null, opts?: InstrumentServerOptions, telemetry?: McpTelemetryContext): MCPAnalyticsOptions;
 /**
  * Wraps the per-request/per-connection server with PostHog MCP analytics
  * (#3408, extended in-process #3432), additively - `mcp_request`/`$exception`
@@ -37,6 +54,6 @@ declare function buildInstrumentOptions(mcpAuth: {
  */
 declare function instrumentServer(server: unknown, posthogClient: McpAnalyticsClient | null, mcpAuth: {
     user_id?: string;
-} | null, opts?: InstrumentServerOptions): void;
+} | null, opts?: InstrumentServerOptions, telemetry?: McpTelemetryContext): void;
 
-export { type InstrumentServerOptions, buildInstrumentOptions, getMcpAnalyticsClient, instrumentServer, setMcpAnalyticsClient };
+export { type InstrumentServerOptions, type McpTelemetryContext, buildInstrumentOptions, getMcpAnalyticsClient, instrumentServer, setMcpAnalyticsClient };