@clipform/mcp-server 4.2.1 → 4.2.2

package/dist/{chunk-BKTCQ5HS.js → chunk-XOV5ILOJ.js}

@@ -29,7 +29,7 @@ import {
   union,
   unknown,
   url
-} from "./chunk-QG354AVT.js";
+} from "./chunk-APCG2RRD.js";
 import {
   GUIDE_TYPES,
   QUIZ_VARIANTS,
@@ -38,13 +38,18 @@ import {
   getGuideUri,
   guideFallbackText,
   registerResources
-} from "./chunk-RKMGVU57.js";
+} from "./chunk-5AAKB4S5.js";
 import {
+  ANON_PREVIEW_LINK_LABEL,
   ANON_PREVIEW_NOTICE,
+  ANON_PREVIEW_ONLY_NOTICE,
+  CLAIM_URL_DESCRIPTION,
   FULL_CAPS,
+  PREVIEW_URL_DESCRIPTION,
   anonPreviewNotice,
-  capsFromToolsets
-} from "./chunk-O4LOUBGW.js";
+  capsFromToolsets,
+  isPreviewViewerUrl
+} from "./chunk-FGTU764J.js";
 import {
   ACTIVE_NODE_TYPES,
   CONTACT_FIELDS,
@@ -66,7 +71,7 @@ import {
   resolveFormType,
   structuredResult,
   textResult
-} from "./chunk-GZZGKW5A.js";
+} from "./chunk-KZNBYHHR.js";
 import {
   getMcpAuth,
   runWithMcpAuth,
@@ -16314,7 +16319,7 @@ function registerCreateFormTool(server) {
     "clipform_create_form",
     {
       title: "Create Clipform",
-      description: `Create a new Clipform (interactive video-style form). Returns a viewer URL and form ID. When connected via an authenticated MCP client (e.g. claude.ai), the form lands directly in the user's workspace. Anonymous sessions build into a temporary account of their own: forms stay drafts with a private preview link. Some results also include a one-time claim URL that signs the user into that account; relay it when present.
+      description: `Create a new Clipform (interactive video-style form). Returns a viewer URL and form ID (an anonymous build's link is a private preview where answers are not saved). When connected via an authenticated MCP client (e.g. claude.ai), the form lands directly in the user's workspace. Anonymous sessions build into a temporary account of their own: forms stay drafts with a private preview link. Some results also include a one-time claim URL that signs the user into that account; relay it when present.
 
 ${ONBOARDING_OFFER_TOOL_CUE}
 
@@ -16344,12 +16349,20 @@ Example: A form that asks a question, collects contact info, then finishes:
       }),
       outputSchema: external_exports.object({
         form_id: external_exports.string().describe("Form UUID - pass to follow-up tools"),
-        // #3330: an anonymous session's viewer_url is a scoped preview link
-        // (only the caller can open it) until the account is claimed and the
-        // form is published - only an authenticated/claimed workspace's
-        // create returns a genuinely live URL here.
-        viewer_url: external_exports.string().describe("Form URL for respondents - a live public URL once authenticated/published, or a scoped preview-only link for an anonymous session"),
-        dashboard_url: external_exports.string().optional().describe("Builder URL (sign in to edit)"),
+        // #4845 expand/contract. The deployed ChatGPT schema is
+        // additionalProperties:false, so emitting a field it does not declare
+        // is invalid until the Rescan approves a schema that declares it.
+        // Order: (a) deploy the schema declaring preview_url / claim_url /
+        // is_preview as optional, emitting NOTHING new (this step);
+        // (b) Rescan; (c) once approved, emit them; (d) a later Rescan-approved
+        // CONTRACT step drops the anonymous viewer_url / dashboard_url
+        // duplicates. See SUBMISSION.md. Until (c), structuredContent stays
+        // key-for-key what origin/main emitted (approved-schema.test.ts).
+        viewer_url: external_exports.string().describe("Form URL for respondents - the live public URL. For an anonymous build this is a private preview link: answers are not saved, do not share it with respondents."),
+        dashboard_url: external_exports.string().optional().describe("Builder URL (sign in to edit). For an anonymous build this is a one-time claim link, not an editor."),
+        is_preview: external_exports.boolean().optional().describe("True when this is an anonymous preview build (answers are not saved), false otherwise."),
+        preview_url: external_exports.string().optional().describe(`Anonymous builds only. ${PREVIEW_URL_DESCRIPTION}`),
+        claim_url: external_exports.string().optional().describe(`Anonymous builds only. ${CLAIM_URL_DESCRIPTION}`),
         nodes: external_exports.array(external_exports.object({ id: external_exports.string(), type: external_exports.string(), prompt: external_exports.string() })).describe("Created nodes in order - IDs for attach_node_media / update_node"),
         plan: external_exports.object({ name: external_exports.string(), auth_mode: external_exports.string() }).optional().describe("Plan and auth context for this session"),
         workspace_name: external_exports.string().optional().describe("Name of the workspace the form was created in")
@@ -16442,7 +16455,7 @@ Example: A form that asks a question, collects contact info, then finishes:
       });
       if (!createResult.ok) {
         const message = `Form NOT created (nothing was saved): ${createResult.error}`;
-        return isAnonymousAccountRequired(createResult) ? errorResult(message, authChallengeMeta("invalid_token", createResult.apiMessage ?? message)) : errorResult(message);
+        return isAnonymousAccountRequired(createResult) ? errorResult(message, authChallengeMeta("insufficient_scope", createResult.apiMessage ?? message)) : errorResult(message);
       }
       const { data } = createResult;
       const formId = data.form_id;
@@ -16464,6 +16477,8 @@ Example: A form that asks a question, collects contact info, then finishes:
       const truncate2 = (s, n = 60) => s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
       const lines = [
         isPreview ? `Form created as a preview draft.` : `Form created and live.`,
+        // #4845: lead with the in-chat path (wording defined once in lib/anon-notice.ts).
+        ...isPreview ? [``, ANON_PREVIEW_ONLY_NOTICE] : [],
         ``,
         `Title: ${title}`,
         ...planContext?.is_authenticated && planContext.workspace_name ? [`Workspace: ${planContext.workspace_name}`] : [],
@@ -16472,18 +16487,18 @@ Example: A form that asks a question, collects contact info, then finishes:
         `Node IDs (use directly with attach_node_media / update_node - no get_form round-trip needed):`,
         ...createdNodes.map((n) => `- [${n.type}] "${truncate2(n.prompt)}": ${n.id}`),
         ``,
-        isPreview ? `PREVIEW URL (draft - only you can open this, not yet visible to respondents): ${data.viewer_url}` : `FORM URL (live - share this with respondents): ${data.viewer_url}`
+        isPreview ? `PREVIEW URL (draft - answers are not saved, only you can open this, not for respondents): ${data.viewer_url}` : `FORM URL (live - share this with respondents): ${data.viewer_url}`
       ];
       if (formUrl) {
         lines.push(
-          isPreview ? `CLAIM URL (one-time - sign up to claim and publish): ${formUrl}` : `DASHBOARD URL (sign in to edit and manage): ${formUrl}`
+          isPreview ? `CLAIM URL (fallback - or open this one-time link to sign up in the browser): ${formUrl}` : `DASHBOARD URL (sign in to edit and manage): ${formUrl}`
         );
       }
       const firstUrlLabel = isPreview ? "PREVIEW" : "FORM";
       const secondUrlLabel = isPreview ? "CLAIM" : "DASHBOARD";
       lines.push(
         ``,
-        isPreview ? `This form is a preview - claim and publish to start collecting responses.${formUrl ? " Open the CLAIM URL to sign up and claim the account this form already belongs to, then republish" : " Sign up to claim the account this form already belongs to and republish"} with clipform_update_form (is_live: true). The PREVIEW URL never becomes public on its own.` : `The form is live and accessible at the FORM URL above. Edits and media attached AFTER this point are NOT visible to respondents until you re-send is_live: true via clipform_update_form - republishing is the expected final step of a build, never skip it after attaching media/narration.`,
+        isPreview ? `This form is a preview, not live. When the user says "publish it", call clipform_update_form (is_live: true); it prompts them to sign in. The PREVIEW URL never becomes public on its own.` : `The form is live and accessible at the FORM URL above. Edits and media attached AFTER this point are NOT visible to respondents until you re-send is_live: true via clipform_update_form - republishing is the expected final step of a build, never skip it after attaching media/narration.`,
         formUrl ? `The URLs above are exact values; constructed or guessed URLs return 404. Use the ${firstUrlLabel} URL and ${secondUrlLabel} URL as shown.` : `The ${firstUrlLabel} URL above is an exact value; constructed or guessed URLs return 404.`,
         `Pass form_id on follow-up tools (get_form, add_node, attach_node_media, etc.).`
       );
@@ -16954,7 +16969,11 @@ function formatFormState(data) {
   const urls = projectUrls(data);
   if (urls) {
     lines.push(``, `Links (exact values - constructed or guessed URLs return 404):`);
-    if (urls.viewer) lines.push(`  Viewer (respondent view): ${urls.viewer}`);
+    if (urls.viewer) {
+      lines.push(
+        isPreviewViewerUrl(urls.viewer) ? `  ${ANON_PREVIEW_LINK_LABEL}: ${urls.viewer}` : `  Viewer (respondent view): ${urls.viewer}`
+      );
+    }
     if (urls.builder) lines.push(`  Builder: ${urls.builder}`);
     if (urls.summary) lines.push(`  Summary: ${urls.summary}`);
     if (urls.responses) lines.push(`  Responses: ${urls.responses}`);
@@ -16963,6 +16982,7 @@ function formatFormState(data) {
     if (urls.embed) lines.push(`  Embed: ${urls.embed}`);
     if (urls.dynamic_link) lines.push(`  Dynamic link: ${urls.dynamic_link}`);
   }
+  if (isPreviewViewerUrl(urls?.viewer)) lines.push(``, ANON_PREVIEW_ONLY_NOTICE);
   lines.push(``, `Nodes (in order):`);
   for (let i = 0; i < nodes.length; i++) {
     const q = nodes[i];
@@ -17003,7 +17023,7 @@ function registerGetFormTool(server) {
         is_live: external_exports.boolean().describe("Whether the form is published"),
         has_unpublished_changes: external_exports.boolean().describe("Live form has edits not yet republished"),
         urls: external_exports.object({
-          viewer: external_exports.string().optional().describe("Live respondent link, or a scoped preview link for an anonymous caller's draft. Omitted for a non-anonymous caller's unpublished draft."),
+          viewer: external_exports.string().optional().describe("Live respondent link, or - for an anonymous caller's draft - a private preview link where answers are not saved (do not share it with respondents). Omitted for a non-anonymous caller's unpublished draft."),
           builder: external_exports.string().optional().describe("Build tab - the node/canvas editor. Not present for an anonymous caller."),
           summary: external_exports.string().optional().describe("Summary tab - form overview and key stats. Not present for an anonymous caller."),
           responses: external_exports.string().optional().describe("Responses tab - individual submissions. Not present for an anonymous caller."),
@@ -17112,7 +17132,7 @@ function registerUpdateFormTool(server) {
         if (!result.ok) {
           return isAnonymousAccountRequired(result) ? errorResult(
             result.error,
-            authChallengeMeta("invalid_token", result.apiMessage ?? result.error)
+            authChallengeMeta("insufficient_scope", result.apiMessage ?? result.error)
           ) : errorResult(result.error);
         }
       }
@@ -17124,7 +17144,7 @@ function registerUpdateFormTool(server) {
         if (!tagResult.ok) {
           return isAnonymousAccountRequired(tagResult) ? errorResult(
             tagResult.error,
-            authChallengeMeta("invalid_token", tagResult.apiMessage ?? tagResult.error)
+            authChallengeMeta("insufficient_scope", tagResult.apiMessage ?? tagResult.error)
           ) : errorResult(tagResult.error);
         }
       }
@@ -20147,4 +20167,4 @@ export {
   * MIT Licensed
   *)
 */
-//# sourceMappingURL=chunk-BKTCQ5HS.js.map
+//# sourceMappingURL=chunk-XOV5ILOJ.js.map