@clipform/mcp-server 4.5.0 → 4.7.0

package/dist/{chunk-WTYIKGXQ.js → chunk-VSSV3IOU.js}

@@ -1,16 +1,16 @@
 import {
   FULL_CAPS,
   getSessionContext
-} from "./chunk-RN5ORN7O.js";
+} from "./chunk-EFPJA3JE.js";
 import {
   ALL_VARIANTS,
   FORM_TYPES,
   FORM_TYPE_KEYS,
   callApi
-} from "./chunk-Q6OG6RXP.js";
+} from "./chunk-XC3YMWCN.js";
 import {
   getMcpAuth
-} from "./chunk-BV3KA6HC.js";
+} from "./chunk-ENVV65JX.js";
 
 // src/lib/guides.ts
 var guidesPromise = null;
@@ -155,4 +155,4 @@ export {
   getGuideUri,
   registerResources
 };
-//# sourceMappingURL=chunk-WTYIKGXQ.js.map
+//# sourceMappingURL=chunk-VSSV3IOU.js.map

package/dist/{chunk-Q6OG6RXP.js → chunk-XC3YMWCN.js}

@@ -5,7 +5,7 @@ import {
   MCP_SESSION_ID_HEADER,
   MCP_SESSION_PROOF_HEADER,
   getMcpAuth
-} from "./chunk-BV3KA6HC.js";
+} from "./chunk-ENVV65JX.js";
 import {
   isAuthFault,
   isServerFault,
@@ -239,13 +239,13 @@ var FEATURES = {
   node_draw: {
     name: "Drawing",
     description: "Drawing canvas; respondents draw and it is saved as a PNG image",
-    // Went GA 2026-06-27 (#1012), pulled back behind the allowlist 2026-07-20
-    // (#2289) while pen options / match-to-shape mature. Prod usage at
-    // pull-back verified = Clipform Public only, zero external customers.
-    // Existing nodes still render (creation-gated only, camera precedent).
-    enabled: false,
-    status: "beta",
-    wentLiveAt: "2026-06-27",
+    // First GA 2026-06-27 (#1012), pulled back behind the allowlist 2026-07-20
+    // (#2289), back to GA 2026-10-26 (#5052). The NODE_COMPANY_ALLOWLIST.node_draw
+    // entry below stays as a safety valve: flip enabled back to false to pull it
+    // behind the allowlist again (creation-gated only - existing nodes render).
+    enabled: true,
+    status: "live",
+    wentLiveAt: "2026-10-26",
     category: "node-types"
   },
   node_camera: {
@@ -838,6 +838,7 @@ var HELP_TOPICS = {
   node_choice: { path: "/help/node-types", anchor: "choice" },
   node_open: { path: "/help/node-types", anchor: "open-ended" },
   node_camera: { path: "/help/node-types", anchor: "camera" },
+  node_draw: { path: "/help/node-types", anchor: "drawing" },
   node_details: { path: "/help/node-types", anchor: "details" },
   node_button: { path: "/help/node-types", anchor: "button" },
   node_end_screen: { path: "/help/node-types", anchor: "end-screen" },
@@ -853,6 +854,19 @@ function buildHelpLinks(docsBaseUrl) {
   return links;
 }
 
+// ../config/draw-presets.js
+var DRAW_PRESETS = [
+  { id: "body-front", label: "Body diagram - front", shortLabel: "Front", file: "body-front.png", group: "body" },
+  { id: "body-back", label: "Body diagram - back", shortLabel: "Back", file: "body-back.png", group: "body" },
+  { id: "hands-palms", label: "Hands diagram - palms", shortLabel: "Palms", file: "hands-palms.png", group: "body" },
+  { id: "hands-backs", label: "Hands diagram - backs", shortLabel: "Backs of hands", file: "hands-backs.png", group: "body" },
+  { id: "feet-soles", label: "Feet diagram - soles", shortLabel: "Soles", file: "feet-soles.png", group: "body" },
+  { id: "face-profile", label: "Face diagram - profile", shortLabel: "Face", file: "face-profile.png", group: "body" },
+  { id: "vehicle-sides", label: "Vehicle diagram - sides", shortLabel: "Sides", file: "vehicle-sides.png", group: "vehicle" },
+  { id: "vehicle-top", label: "Vehicle diagram - top and ends", shortLabel: "Top and ends", file: "vehicle-top.png", group: "vehicle" }
+];
+var DRAW_PRESET_IDS = DRAW_PRESETS.map((p) => p.id);
+
 // ../config/node-types.js
 var RESPONSE_FORMATS = ["text", "audio", "video"];
 var CONSENT_TYPES = ["consent", "opt_in"];
@@ -1349,8 +1363,11 @@ var NODE_TYPES = {
               type: { type: "string", enum: CONSENT_TYPES },
               // Optional attached agreement document (PDF only in v1, #2760). Served
               // from the public node-media bucket; `version` bumps on file replace.
+              // anon_locked_file: an outside file on a guest live form (#4847), stripped from the
+              // payload so the item renders as a plain consent checkbox.
               document: {
                 type: "object",
+                anon_locked_file: true,
                 properties: {
                   storage_path: { type: "string" },
                   filename: { type: "string" },
@@ -1629,7 +1646,8 @@ var NODE_TYPES = {
           default: [3, 6, 12],
           description: "Stroke widths (px) the respondent can choose. The middle entry is the default selection; a single entry locks the pen to that width and hides the picker."
         },
-        // The reference image itself is the node's attached media (media_id,
+        // The reference image is EITHER a built-in outline (`preset`, below: a static image
+        // referenced by name, #5263) OR the node's attached media (media_id,
         // via the same media_asset/create-media.ts pipeline every other
         // supports_media node uses) - not a config field, to avoid a
         // duplicated asset ref. This only tunes its display/bake.
@@ -1638,9 +1656,11 @@ var NODE_TYPES = {
           label: "Diagram",
           description: "Display settings for the optional diagram the respondent draws on (a body, vehicle or your own image)",
           properties: {
-            // Fit + position live on the node_media placement (fit_media / position_x), shared with every media node.
+            // Fit + position (uploaded image only) live on the node_media placement (fit_media / position_x), shared with every media node.
             opacity: { type: "number", minimum: 0, maximum: 1, default: 1, label: "Opacity", description: "Diagram opacity, from 0 (invisible) to 1 (fully opaque)" },
-            scale: { type: "number", minimum: 0.5, maximum: 1, default: 1, label: "Size", description: "Diagram size as a fraction of its fitted size. Applies only when the diagram is fitted (fit_media true)." }
+            scale: { type: "number", minimum: 0.5, maximum: 1, default: 1, label: "Size", description: "Diagram size as a fraction of its fitted size. Applies only when the diagram is fitted (fit_media true)." },
+            // A built-in outline (#5263): a static image served by the viewer, referenced by name. Not a media asset - no placement. Wins over an attached image; always shown whole and centred.
+            preset: { type: "string", enum: DRAW_PRESETS.map((p) => p.id), label: "Built-in diagram", description: "Use a ready-made outline instead of an uploaded image: " + DRAW_PRESETS.map((p) => `${p.id} (${p.label})`).join(", ") + ". Shown whole and centred, so fit/position do not apply. Shown instead of any attached image while set; unset it to use the attached image of the node." }
           }
         },
         // Optional match-to-shape game (#2148). Absent entirely by default
@@ -1893,7 +1913,25 @@ var NODE_TYPES = {
               storage_path: { type: "string", description: "Bucket-prefixed storage path: respondent-captures/workspace_id/form_id/session_id/uuid.ext" },
               width: { type: "number", description: "Displayed pixel width, when the browser could read it (#5125)" },
               height: { type: "number", description: "Displayed pixel height, when the browser could read it (#5125)" },
-              duration: { type: "number", description: "Video duration in seconds, when readable (#5125)" }
+              duration: { type: "number", description: "Video duration in seconds, when readable (#5125)" },
+              // Viewer-written for a video recorded without the on-device 9:16 crop (#5253); the camera
+              // video processor validates it and crops the playback copy server-side.
+              preview_crop: {
+                type: "object",
+                description: "What the viewfinder showed (stream and preview box sizes); untrusted, validated server-side",
+                properties: {
+                  stream_width: { type: "number" },
+                  stream_height: { type: "number" },
+                  preview_width: { type: "number" },
+                  preview_height: { type: "number" }
+                }
+              },
+              // Server-written by the camera video processor (#5114); stripped from client input.
+              thumbnail_storage_path: { type: "string", description: "Poster frame (webp) of a video, bucket-prefixed" },
+              playback_storage_path: { type: "string", description: "Browser-safe H.264/AAC mp4 copy of a video, when the original is not one" },
+              processed_at: { type: "string", description: "When the video was processed" },
+              processing_attempts: { type: "integer", description: "Failed processing attempts so far" },
+              processing_failed_at: { type: "string", description: "Set once processing gave up" }
             }
           },
           minItems: 1,
@@ -2006,8 +2044,8 @@ var NODE_TYPES = {
         currency: { enum: ["usd", "eur", "gbp", "cad", "aud"], type: "string", label: "Currency", default: "usd", required: true, description: "Three-letter ISO currency code" },
         provider: { enum: ["stripe", "paddle"], type: "string", label: "Payment Provider", default: "stripe", required: true, description: "Payment provider to use" },
         workspace_integration_id: { type: "string", label: "Workspace Integration ID", description: "UUID of the workspace_integrations record for the connected payment account" },
-        title: { type: "string", label: "Heading", description: "Heading shown above the order summary" },
-        description: { type: "string", label: "Description", description: "Body text shown below the heading in the order summary" }
+        title: { type: "string", label: "Heading", description: "Heading shown above the order summary", anon_locked_keep: true },
+        description: { type: "string", label: "Description", description: "Body text shown below the heading in the order summary", anon_locked_keep: true }
       },
       description: "Payment configuration with provider-agnostic flat structure"
     },
@@ -2257,7 +2295,7 @@ var NODE_TYPES = {
     config_schema: {
       type: "object",
       properties: {
-        url: { type: "string", label: "Redirect URL", placeholder: "https://example.com" },
+        url: { type: "string", label: "Redirect URL", placeholder: "https://example.com", outbound_link: true },
         auto_redirect: { type: "boolean", label: "Auto-redirect", default: true, description: "Automatically redirect to the URL instead of showing a button" }
       }
     },
@@ -2300,7 +2338,7 @@ var NODE_TYPES = {
             required: ["id", "url"],
             properties: {
               id: { type: "string" },
-              url: { type: "string", label: "URL", placeholder: "https://example.com" },
+              url: { type: "string", label: "URL", placeholder: "https://example.com", outbound_link: true },
               title: { type: "string", label: "Heading" },
               description: { type: "string", label: "Description" },
               order: { type: "number", label: "Sort order" }
@@ -2361,7 +2399,7 @@ var NODE_TYPES = {
           label: "Downloadable files"
         },
         button_text: { type: "string", label: "Continue button text", default: "Continue" },
-        description: { type: "string", label: "Description text" }
+        description: { type: "string", label: "Description text", anon_locked_keep: true }
       }
     },
     response_schema: {
@@ -2630,6 +2668,52 @@ var ANON_MCP_OUTBOUND_LINK_RULES = (() => {
   for (const [type, def] of Object.entries(NODE_TYPES)) walk(type, def.config_schema, []);
   return rules;
 })();
+var ANON_MCP_STRIPPED_FIELD_RULES = (() => {
+  const rules = ANON_MCP_OUTBOUND_LINK_RULES.filter((r) => r.kind === "non_empty" && !ANON_MCP_BLOCKED_NODE_TYPES.includes(r.type)).map(({ type, path }) => ({ type, path }));
+  const walk = (type, schema, path) => {
+    if (!schema || typeof schema !== "object") return;
+    for (const [key, prop] of Object.entries(schema.properties ?? {})) {
+      const next = [...path, key];
+      if (prop.anon_locked_file === true) rules.push({ type, path: next });
+      walk(type, prop, next);
+      if (prop.items) walk(type, prop.items, [...next, "[]"]);
+    }
+    for (const branch of [...schema.oneOf ?? [], ...schema.anyOf ?? []]) walk(type, branch, path);
+  };
+  for (const [type, def] of Object.entries(NODE_TYPES)) {
+    if (!ANON_MCP_BLOCKED_NODE_TYPES.includes(type)) walk(type, def.config_schema, []);
+  }
+  return rules;
+})();
+var ANON_MCP_KEPT_TEXT_KEYS = (() => {
+  const out = {};
+  for (const type of ANON_MCP_BLOCKED_NODE_TYPES) {
+    const props = NODE_TYPES[type]?.config_schema?.properties ?? {};
+    const keys = Object.entries(props).filter(([, p]) => p && p.anon_locked_keep === true && p.type === "string").map(([k]) => k);
+    if (keys.length > 0) out[type] = keys;
+  }
+  return out;
+})();
+function anonValuesAtPath(value, path) {
+  if (path.length === 0) return [value];
+  const [head, ...rest] = path;
+  if (head === "[]") return Array.isArray(value) ? value.flatMap((v) => anonValuesAtPath(v, rest)) : [];
+  if (value && typeof value === "object") return anonValuesAtPath(value[head], rest);
+  return [];
+}
+function isAnonMcpLockedNode(node) {
+  if (!node || typeof node.type !== "string") return false;
+  if (ANON_MCP_BLOCKED_NODE_TYPES.includes(node.type)) return true;
+  const isSet = (v) => typeof v === "string" ? v.trim() !== "" : v != null && v !== false;
+  const outbound = ANON_MCP_OUTBOUND_LINK_RULES.some((rule) => {
+    if (rule.type !== node.type) return false;
+    return anonValuesAtPath(node.config, rule.path).some((v) => rule.kind === "equals" ? v === rule.value : isSet(v));
+  });
+  if (outbound) return true;
+  return ANON_MCP_STRIPPED_FIELD_RULES.some(
+    (rule) => rule.type === node.type && anonValuesAtPath(node.config, rule.path).some(isSet)
+  );
+}
 
 // ../config/form-types.js
 var FORM_TYPES = {
@@ -2893,6 +2977,12 @@ function isInactiveOptionEdge(node, action) {
   return isOptionEdge(action) && !isBranchingActive(node);
 }
 
+// ../config/anon-mcp-limits.js
+var ANON_MCP_RESPONSE_CAP = 3;
+var ANON_MCP_STARTED_SESSION_MULTIPLE = 5;
+var ANON_MCP_STARTED_SESSION_CAP = ANON_MCP_RESPONSE_CAP * ANON_MCP_STARTED_SESSION_MULTIPLE;
+var ANON_MCP_LIVE_TTL_DAYS = 7;
+
 // ../config/logic-chain.js
 function outgoingTargets(actions, node) {
   const out = [];
@@ -3015,6 +3105,7 @@ var BUSINESS = {
 };
 var MEDIA_DIRECT_MAX_BYTES = 20 * 1024 * 1024;
 var MEDIA_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+var DRAW_DIAGRAM_SPEC = `PNG with simple dark outlines on a light or transparent background (no shading or text), portrait, at least 1000px wide. Up to ${Math.round(MEDIA_IMAGE_MAX_BYTES / (1024 * 1024))}MB.`;
 var MEDIA_DOCUMENT_MAX_BYTES = 20 * 1024 * 1024;
 var SUPABASE_STORAGE_MAX_BYTES = 200 * 1024 * 1024;
 var VIDEO_COMPRESS_FLOOR_BYTES = 1 * 1024 * 1024;
@@ -3335,10 +3426,6 @@ var MCP_TOOL_SECURITY = Object.freeze(
     ])
   )
 );
-var MCP_ANON_PUBLISH_GATE = Object.freeze({
-  tool: "clipform_update_form",
-  argument: "is_live"
-});
 
 // src/lib/api-client.ts
 function getApiBaseUrl() {
@@ -3518,6 +3605,8 @@ export {
   stripGatedConfigKeys,
   ACTIVE_NODE_TYPES,
   NON_COUNTABLE_TYPES,
+  ANON_MCP_BLOCKED_NODE_TYPES,
+  isAnonMcpLockedNode,
   FORM_TYPES,
   FORM_TYPES_LIST,
   FORM_TYPE_KEYS,
@@ -3526,6 +3615,8 @@ export {
   ALL_VARIANTS,
   resolveFormType,
   getDiscoveryParams,
+  ANON_MCP_RESPONSE_CAP,
+  ANON_MCP_LIVE_TTL_DAYS,
   defaultTarget,
   bfsOrder,
   PLAN_LIMITS,
@@ -3535,7 +3626,6 @@ export {
   MCP_TOOL_TIERS,
   MCP_TOOL_TOOLSETS,
   MCP_TOOL_SECURITY,
-  MCP_ANON_PUBLISH_GATE,
   callApi,
   recoveryHint,
   errorResult,
@@ -3544,4 +3634,4 @@ export {
   textResult,
   structuredResult
 };
-//# sourceMappingURL=chunk-Q6OG6RXP.js.map
+//# sourceMappingURL=chunk-XC3YMWCN.js.map