@clipform/mcp-server 4.2.0 → 4.2.2

package/dist/{chunk-YKJV5LZQ.js → chunk-XOV5ILOJ.js}

@@ -29,7 +29,7 @@ import {
   union,
   unknown,
   url
-} from "./chunk-5RUWQOYD.js";
+} from "./chunk-APCG2RRD.js";
 import {
   GUIDE_TYPES,
   QUIZ_VARIANTS,
@@ -38,13 +38,18 @@ import {
   getGuideUri,
   guideFallbackText,
   registerResources
-} from "./chunk-TXUWAYBZ.js";
+} from "./chunk-5AAKB4S5.js";
 import {
+  ANON_PREVIEW_LINK_LABEL,
   ANON_PREVIEW_NOTICE,
+  ANON_PREVIEW_ONLY_NOTICE,
+  CLAIM_URL_DESCRIPTION,
   FULL_CAPS,
+  PREVIEW_URL_DESCRIPTION,
   anonPreviewNotice,
-  capsFromToolsets
-} from "./chunk-PDI6VJYQ.js";
+  capsFromToolsets,
+  isPreviewViewerUrl
+} from "./chunk-FGTU764J.js";
 import {
   ACTIVE_NODE_TYPES,
   CONTACT_FIELDS,
@@ -66,7 +71,7 @@ import {
   resolveFormType,
   structuredResult,
   textResult
-} from "./chunk-4IAURGG7.js";
+} from "./chunk-KZNBYHHR.js";
 import {
   getMcpAuth,
   runWithMcpAuth,
@@ -4774,6 +4779,37 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+  if (schema === void 0) return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === void 0 ? outcome.value : void 0;
+}
+function inputResponse(responses, key) {
+  if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"])) return {
+    kind: "roots",
+    roots: candidate["roots"]
+  };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+    kind: "sampling",
+    result: candidate
+  };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
@@ -16283,7 +16319,7 @@ function registerCreateFormTool(server) {
     "clipform_create_form",
     {
       title: "Create Clipform",
-      description: `Create a new Clipform (interactive video-style form). Returns a viewer URL and form ID. When connected via an authenticated MCP client (e.g. claude.ai), the form lands directly in the user's workspace. Anonymous sessions build into a temporary account of their own: forms stay drafts with a private preview link. Some results also include a one-time claim URL that signs the user into that account; relay it when present.
+      description: `Create a new Clipform (interactive video-style form). Returns a viewer URL and form ID (an anonymous build's link is a private preview where answers are not saved). When connected via an authenticated MCP client (e.g. claude.ai), the form lands directly in the user's workspace. Anonymous sessions build into a temporary account of their own: forms stay drafts with a private preview link. Some results also include a one-time claim URL that signs the user into that account; relay it when present.
 
 ${ONBOARDING_OFFER_TOOL_CUE}
 
@@ -16313,12 +16349,20 @@ Example: A form that asks a question, collects contact info, then finishes:
       }),
       outputSchema: external_exports.object({
         form_id: external_exports.string().describe("Form UUID - pass to follow-up tools"),
-        // #3330: an anonymous session's viewer_url is a scoped preview link
-        // (only the caller can open it) until the account is claimed and the
-        // form is published - only an authenticated/claimed workspace's
-        // create returns a genuinely live URL here.
-        viewer_url: external_exports.string().describe("Form URL for respondents - a live public URL once authenticated/published, or a scoped preview-only link for an anonymous session"),
-        dashboard_url: external_exports.string().optional().describe("Builder URL (sign in to edit)"),
+        // #4845 expand/contract. The deployed ChatGPT schema is
+        // additionalProperties:false, so emitting a field it does not declare
+        // is invalid until the Rescan approves a schema that declares it.
+        // Order: (a) deploy the schema declaring preview_url / claim_url /
+        // is_preview as optional, emitting NOTHING new (this step);
+        // (b) Rescan; (c) once approved, emit them; (d) a later Rescan-approved
+        // CONTRACT step drops the anonymous viewer_url / dashboard_url
+        // duplicates. See SUBMISSION.md. Until (c), structuredContent stays
+        // key-for-key what origin/main emitted (approved-schema.test.ts).
+        viewer_url: external_exports.string().describe("Form URL for respondents - the live public URL. For an anonymous build this is a private preview link: answers are not saved, do not share it with respondents."),
+        dashboard_url: external_exports.string().optional().describe("Builder URL (sign in to edit). For an anonymous build this is a one-time claim link, not an editor."),
+        is_preview: external_exports.boolean().optional().describe("True when this is an anonymous preview build (answers are not saved), false otherwise."),
+        preview_url: external_exports.string().optional().describe(`Anonymous builds only. ${PREVIEW_URL_DESCRIPTION}`),
+        claim_url: external_exports.string().optional().describe(`Anonymous builds only. ${CLAIM_URL_DESCRIPTION}`),
         nodes: external_exports.array(external_exports.object({ id: external_exports.string(), type: external_exports.string(), prompt: external_exports.string() })).describe("Created nodes in order - IDs for attach_node_media / update_node"),
         plan: external_exports.object({ name: external_exports.string(), auth_mode: external_exports.string() }).optional().describe("Plan and auth context for this session"),
         workspace_name: external_exports.string().optional().describe("Name of the workspace the form was created in")
@@ -16411,7 +16455,7 @@ Example: A form that asks a question, collects contact info, then finishes:
       });
       if (!createResult.ok) {
         const message = `Form NOT created (nothing was saved): ${createResult.error}`;
-        return isAnonymousAccountRequired(createResult) ? errorResult(message, authChallengeMeta("invalid_token", createResult.apiMessage ?? message)) : errorResult(message);
+        return isAnonymousAccountRequired(createResult) ? errorResult(message, authChallengeMeta("insufficient_scope", createResult.apiMessage ?? message)) : errorResult(message);
       }
       const { data } = createResult;
       const formId = data.form_id;
@@ -16433,6 +16477,8 @@ Example: A form that asks a question, collects contact info, then finishes:
       const truncate2 = (s, n = 60) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
       const lines = [
         isPreview ? `Form created as a preview draft.` : `Form created and live.`,
+        // #4845: lead with the in-chat path (wording defined once in lib/anon-notice.ts).
+        ...isPreview ? [``, ANON_PREVIEW_ONLY_NOTICE] : [],
         ``,
         `Title: ${title}`,
         ...planContext?.is_authenticated && planContext.workspace_name ? [`Workspace: ${planContext.workspace_name}`] : [],
@@ -16441,18 +16487,18 @@ Example: A form that asks a question, collects contact info, then finishes:
         `Node IDs (use directly with attach_node_media / update_node - no get_form round-trip needed):`,
         ...createdNodes.map((n) => `- [${n.type}] "${truncate2(n.prompt)}": ${n.id}`),
         ``,
-        isPreview ? `PREVIEW URL (draft - only you can open this, not yet visible to respondents): ${data.viewer_url}` : `FORM URL (live - share this with respondents): ${data.viewer_url}`
+        isPreview ? `PREVIEW URL (draft - answers are not saved, only you can open this, not for respondents): ${data.viewer_url}` : `FORM URL (live - share this with respondents): ${data.viewer_url}`
       ];
       if (formUrl) {
         lines.push(
-          isPreview ? `CLAIM URL (one-time - sign up to claim and publish): ${formUrl}` : `DASHBOARD URL (sign in to edit and manage): ${formUrl}`
+          isPreview ? `CLAIM URL (fallback - or open this one-time link to sign up in the browser): ${formUrl}` : `DASHBOARD URL (sign in to edit and manage): ${formUrl}`
         );
       }
       const firstUrlLabel = isPreview ? "PREVIEW" : "FORM";
       const secondUrlLabel = isPreview ? "CLAIM" : "DASHBOARD";
       lines.push(
         ``,
-        isPreview ? `This form is a preview - claim and publish to start collecting responses.${formUrl ? " Open the CLAIM URL to sign up and claim the account this form already belongs to, then republish" : " Sign up to claim the account this form already belongs to and republish"} with clipform_update_form (is_live: true). The PREVIEW URL never becomes public on its own.` : `The form is live and accessible at the FORM URL above. Edits and media attached AFTER this point are NOT visible to respondents until you re-send is_live: true via clipform_update_form - republishing is the expected final step of a build, never skip it after attaching media/narration.`,
+        isPreview ? `This form is a preview, not live. When the user says "publish it", call clipform_update_form (is_live: true); it prompts them to sign in. The PREVIEW URL never becomes public on its own.` : `The form is live and accessible at the FORM URL above. Edits and media attached AFTER this point are NOT visible to respondents until you re-send is_live: true via clipform_update_form - republishing is the expected final step of a build, never skip it after attaching media/narration.`,
         formUrl ? `The URLs above are exact values; constructed or guessed URLs return 404. Use the ${firstUrlLabel} URL and ${secondUrlLabel} URL as shown.` : `The ${firstUrlLabel} URL above is an exact value; constructed or guessed URLs return 404.`,
         `Pass form_id on follow-up tools (get_form, add_node, attach_node_media, etc.).`
       );
@@ -16923,7 +16969,11 @@ function formatFormState(data) {
   const urls = projectUrls(data);
   if (urls) {
     lines.push(``, `Links (exact values - constructed or guessed URLs return 404):`);
-    if (urls.viewer) lines.push(`  Viewer (respondent view): ${urls.viewer}`);
+    if (urls.viewer) {
+      lines.push(
+        isPreviewViewerUrl(urls.viewer) ? `  ${ANON_PREVIEW_LINK_LABEL}: ${urls.viewer}` : `  Viewer (respondent view): ${urls.viewer}`
+      );
+    }
     if (urls.builder) lines.push(`  Builder: ${urls.builder}`);
     if (urls.summary) lines.push(`  Summary: ${urls.summary}`);
     if (urls.responses) lines.push(`  Responses: ${urls.responses}`);
@@ -16932,6 +16982,7 @@ function formatFormState(data) {
     if (urls.embed) lines.push(`  Embed: ${urls.embed}`);
     if (urls.dynamic_link) lines.push(`  Dynamic link: ${urls.dynamic_link}`);
   }
+  if (isPreviewViewerUrl(urls?.viewer)) lines.push(``, ANON_PREVIEW_ONLY_NOTICE);
   lines.push(``, `Nodes (in order):`);
   for (let i = 0; i < nodes.length; i++) {
     const q = nodes[i];
@@ -16972,7 +17023,7 @@ function registerGetFormTool(server) {
         is_live: external_exports.boolean().describe("Whether the form is published"),
         has_unpublished_changes: external_exports.boolean().describe("Live form has edits not yet republished"),
         urls: external_exports.object({
-          viewer: external_exports.string().optional().describe("Live respondent link, or a scoped preview link for an anonymous caller's draft. Omitted for a non-anonymous caller's unpublished draft."),
+          viewer: external_exports.string().optional().describe("Live respondent link, or - for an anonymous caller's draft - a private preview link where answers are not saved (do not share it with respondents). Omitted for a non-anonymous caller's unpublished draft."),
           builder: external_exports.string().optional().describe("Build tab - the node/canvas editor. Not present for an anonymous caller."),
           summary: external_exports.string().optional().describe("Summary tab - form overview and key stats. Not present for an anonymous caller."),
           responses: external_exports.string().optional().describe("Responses tab - individual submissions. Not present for an anonymous caller."),
@@ -17081,7 +17132,7 @@ function registerUpdateFormTool(server) {
         if (!result.ok) {
           return isAnonymousAccountRequired(result) ? errorResult(
             result.error,
-            authChallengeMeta("invalid_token", result.apiMessage ?? result.error)
+            authChallengeMeta("insufficient_scope", result.apiMessage ?? result.error)
           ) : errorResult(result.error);
         }
       }
@@ -17093,7 +17144,7 @@ function registerUpdateFormTool(server) {
         if (!tagResult.ok) {
           return isAnonymousAccountRequired(tagResult) ? errorResult(
             tagResult.error,
-            authChallengeMeta("invalid_token", tagResult.apiMessage ?? tagResult.error)
+            authChallengeMeta("insufficient_scope", tagResult.apiMessage ?? tagResult.error)
           ) : errorResult(tagResult.error);
         }
       }
@@ -17179,23 +17230,42 @@ ${anonNotice}`;
 
 // src/lib/confirm.ts
 var CONFIRM_FIELD_DESCRIPTION = "Set to true ONLY after the user has explicitly confirmed this destructive action. Leave unset otherwise - hosts that support confirmation dialogs will prompt the user automatically.";
-async function confirmDestructive(server, opts) {
+var CONFIRM_RESPONSE_SCHEMA = external_exports.object({ confirm: external_exports.boolean() });
+var CANCELLED = "Cancelled - nothing was changed.";
+async function confirmDestructive(server, ctx, opts) {
   if (opts.alreadyConfirmed === true) return { proceed: true };
+  const mcpReq = ctx?.mcpReq;
+  const responses = mcpReq?.inputResponses;
+  if (responses && responses.confirm !== void 0) {
+    const answer = acceptedContent(responses, "confirm", CONFIRM_RESPONSE_SCHEMA);
+    if (answer?.confirm === true) return { proceed: true };
+    return { proceed: false, message: CANCELLED };
+  }
+  const requestedSchema = {
+    type: "object",
+    properties: {
+      confirm: { type: "boolean", title: "Confirm", description: opts.message }
+    },
+    required: ["confirm"]
+  };
+  const envelope = mcpReq?.envelope;
+  if (envelope) {
+    if (envelope["io.modelcontextprotocol/clientCapabilities"]?.elicitation) {
+      return {
+        proceed: false,
+        result: inputRequired({
+          inputRequests: { confirm: inputRequired.elicit({ message: opts.message, requestedSchema }) }
+        })
+      };
+    }
+    return { proceed: false, message: opts.relay };
+  }
   const lowLevel = server.server;
   const caps = lowLevel?.getClientCapabilities?.();
   if (caps?.elicitation) {
-    const r = await lowLevel.elicitInput({
-      message: opts.message,
-      requestedSchema: {
-        type: "object",
-        properties: {
-          confirm: { type: "boolean", title: "Confirm", description: opts.message }
-        },
-        required: ["confirm"]
-      }
-    });
+    const r = await lowLevel.elicitInput({ message: opts.message, requestedSchema });
     if (r.action === "accept" && r.content?.confirm === true) return { proceed: true };
-    return { proceed: false, message: "Cancelled - nothing was changed." };
+    return { proceed: false, message: CANCELLED };
   }
   return { proceed: false, message: opts.relay };
 }
@@ -17223,14 +17293,14 @@ function registerDeleteFormTool(server) {
         openWorldHint: true
       }
     },
-    async ({ form_id, confirm }) => {
-      const decision = await confirmDestructive(server, {
+    async ({ form_id, confirm }, ctx) => {
+      const decision = await confirmDestructive(server, ctx, {
         alreadyConfirmed: confirm,
         message: `Move form ${form_id} to the trash? It stops accepting responses immediately and can be restored later.`,
         relay: `Confirmation required: moving form ${form_id} to the trash stops it accepting responses immediately. It can be restored later. Ask the user to confirm, then call clipform_delete_form again with confirm: true.`
       });
       if (!decision.proceed) {
-        return textResult(decision.message);
+        return decision.result ?? textResult(decision.message);
       }
       const result = await callApi(`/forms/${form_id}`, {
         method: "DELETE"
@@ -17797,14 +17867,14 @@ function registerDeleteNodeTool(server) {
         openWorldHint: false
       }
     },
-    async ({ form_id, node_id, confirm }) => {
-      const decision = await confirmDestructive(server, {
+    async ({ form_id, node_id, confirm }, ctx) => {
+      const decision = await confirmDestructive(server, ctx, {
         alreadyConfirmed: confirm,
         message: `Delete node ${node_id} from this form? This cannot be undone.`,
         relay: `Confirmation required: deleting node ${node_id} cannot be undone. Ask the user to confirm, then call clipform_delete_node again with confirm: true.`
       });
       if (!decision.proceed) {
-        return textResult(decision.message);
+        return decision.result ?? textResult(decision.message);
       }
       const result = await callApi(
         `/forms/${form_id}/nodes/${node_id}`,
@@ -18290,14 +18360,14 @@ function registerDeleteNodeMediaTool(server) {
         openWorldHint: true
       }
     },
-    async ({ form_id, node_id, confirm }) => {
-      const decision = await confirmDestructive(server, {
+    async ({ form_id, node_id, confirm }, ctx) => {
+      const decision = await confirmDestructive(server, ctx, {
         alreadyConfirmed: confirm,
         message: `Remove the media attached to node ${node_id}? This deletes the underlying video/file and cannot be undone.`,
         relay: `Confirmation required: removing media from node ${node_id} deletes the underlying video/file and cannot be undone. Ask the user to confirm, then call clipform_delete_node_media again with confirm: true.`
       });
       if (!decision.proceed) {
-        return textResult(decision.message);
+        return decision.result ?? textResult(decision.message);
       }
       const result = await callApi(
         `/forms/${form_id}/nodes/${node_id}/media`,
@@ -20097,4 +20167,4 @@ export {
   * MIT Licensed
   *)
 */
-//# sourceMappingURL=chunk-YKJV5LZQ.js.map
+//# sourceMappingURL=chunk-XOV5ILOJ.js.map