@drop2run/mcp 0.13.0 → 1.0.0

package/README.md

@@ -1,11 +1,32 @@
 # @drop2run/mcp
 
-An MCP server that lets any MCP client — Claude, Cursor, VS Code, Codex, Gemini CLI — publish what it made to
+An MCP server that lets any MCP client — Claude, ChatGPT, Cursor, VS Code, Codex, Gemini CLI — publish what it made to
 [Drop2Run](https://dropto.run): an HTML page, a markdown note, a folder of documents or a built site. It
 returns a live HTTPS URL.
 
 Full documentation at [dropto.run/docs/mcp](https://dropto.run/docs/mcp).
 
+## In a chat on the web — no package at all
+
+Claude on the web and on a phone, ChatGPT and other hosted chats cannot run this package, so the same
+tools are hosted at a URL:
+
+```
+https://mcp.dropto.run/mcp
+```
+
+**Claude** — connect it from
+[Claude's connector directory](https://claude.ai/directory/connectors/drop2run) and sign in to Drop2Run
+when asked. To add it by URL instead, open
+[this link](https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName=Drop2Run&connectorUrl=https%3A%2F%2Fmcp.dropto.run%2Fmcp)
+or *Settings → Connectors → Add custom connector* and paste the URL.
+**Claude Code** — `claude mcp add --transport http drop2run https://mcp.dropto.run/mcp`. **ChatGPT** — add
+it as a custom connector, where your plan offers developer mode.
+
+The hosted server has no `login` / `login_code` (the chat signs in for it) and no `publish_dir` (there is
+no disk), and `publish_files` takes text files only. For a folder on disk, a PDF or an image, run the
+package below.
+
 ## Setup
 
 **Claude Desktop** — download [`drop2run.mcpb`](https://dropto.run/drop2run.mcpb) and open it. Claude
@@ -87,6 +108,7 @@ lose it.
 | `list_sites` | Lists the sites on the account |
 | `list_folders` | Lists the account's folders, each with the path `folder` accepts |
 | `delete_site` | Deletes a site permanently, subdomain included — requires the subdomain repeated as `confirm` |
+| `change_subdomain` | Moves a site to a new subdomain; the old one keeps redirecting — requires the current subdomain as `confirm` |
 | `get_site` | Reads a site's settings, whether it is paused, and its versions with the live one marked |
 | `update_site` | Changes a site's name, serving mode, password, invite-only, comments, forms, scheduled takedown or folder |
 | `list_people` | Lists who a site is shared with, what each may do, and whether only they can open it |
@@ -104,8 +126,8 @@ Both publish tools take an optional `site` — a subdomain or site id to publish
 new site is created.
 
 Both also take an optional `subdomain`, which names the new site instead of letting the server generate
-one. It is for a person who asked for a particular address: the name becomes the URL, cannot be changed
-afterwards, and a site made under a guessed one has to be deleted by hand. `site` and `subdomain` are
+one. It is for a person who asked for a particular address: the name becomes the URL, and a site made
+under a guessed one has to be deleted, or moved with `change_subdomain`, by hand. `site` and `subdomain` are
 opposites — one publishes over a site that exists, the other creates one that does not — so passing both
 is refused rather than resolved.
 
@@ -114,6 +136,11 @@ by path such as `Clients/Acme`, or by the id `list_folders` shows. Like `subdoma
 site, so it cannot be combined with `site`. It never creates a folder: one that does not exist is refused
 with the list of those that do, and nothing is published.
 
+`change_subdomain` moves a site to a new address. The old one keeps working by redirecting to the new
+one, and nobody else can take it. Each site gets two changes, and a change back to an old name counts
+too, so it asks for the current subdomain as `confirm`. Visitors who signed in to the site or typed its
+password are asked again on the new address. `get_site` shows the changes left and the former names.
+
 `update_site` changes only the settings it is given. An empty `name`, `password` or `expiresAt` clears
 that setting, and `folder: "root"` moves the site back to the top level. A takedown pauses the site by
 default; `expiryAction: "delete"` removes it instead, and asks for the subdomain as `confirm` the way

package/dist/index.js

@@ -88,10 +88,18 @@ function missingCredentialsMessage(surface = "cli") {
   ].join("\n");
 }
 function sizeOf(content) {
-  return ArrayBuffer.isView(content) ? content.byteLength : content.size;
+  if (ArrayBuffer.isView(content)) return content.byteLength;
+  if (isArrayBuffer(content)) return content.byteLength;
+  if (typeof content.size === "number") return content.size;
+  throw new TypeError("File contents must be a Uint8Array, an ArrayBuffer or a Blob.");
+}
+function isArrayBuffer(value) {
+  return Object.prototype.toString.call(value) === "[object ArrayBuffer]";
 }
 async function bytesOf(content) {
-  return ArrayBuffer.isView(content) ? content : new Uint8Array(await content.arrayBuffer());
+  if (ArrayBuffer.isView(content)) return content;
+  if (isArrayBuffer(content)) return new Uint8Array(content);
+  return new Uint8Array(await content.arrayBuffer());
 }
 class DeployError extends Error {
   /**
@@ -1654,6 +1662,7 @@ async function findSite(credentials, site) {
   return found;
 }
 const SITE_ID_SHAPE = /^[0-9a-z]{26}$/i;
+const FORMER_NAME_CANDIDATES = 3;
 async function lookUpSite(credentials, site) {
   const wanted = site.trim().toLowerCase();
   if (wanted === "") return void 0;
@@ -1663,6 +1672,13 @@ async function lookUpSite(credentials, site) {
   );
   const bySubdomain = sites.find((candidate) => candidate.subdomain.toLowerCase() === wanted);
   if (bySubdomain !== void 0) return bySubdomain;
+  for (const candidate of sites.slice(0, FORMER_NAME_CANDIDATES)) {
+    const detail2 = await call(
+      credentials,
+      `sites/${encodeURIComponent(candidate.siteId)}`
+    );
+    if (detail2.formerSubdomains?.some((former) => former.subdomain === wanted)) return candidate;
+  }
   if (!SITE_ID_SHAPE.test(wanted)) return void 0;
   const response = await fetch(
     `${credentials.apiBaseUrl}/sites/${encodeURIComponent(wanted.toUpperCase())}`,
@@ -1746,7 +1762,19 @@ async function getSite(credentials, siteId) {
       createdAt: deploy2.createdAt,
       completedAt: deploy2.completedAt,
       filesKept: deploy2.filesKept
-    }))
+    })),
+    subdomainChangesLeft: site.subdomainChangesLeft ?? null,
+    formerSubdomains: (site.formerSubdomains ?? []).map((former) => former.subdomain)
+  };
+}
+async function changeSubdomain(credentials, siteId, subdomain) {
+  const changed = await call(credentials, `sites/${encodeURIComponent(siteId)}/subdomain`, {
+    method: "POST",
+    body: JSON.stringify({ subdomain })
+  });
+  return {
+    ...changed,
+    formerSubdomains: changed.formerSubdomains.map((former) => former.subdomain)
   };
 }
 async function updateSiteSettings(credentials, siteId, change) {
@@ -1938,6 +1966,10 @@ function describeMode(result) {
   if (result.mode === "spa") return "Served as a single-page app.";
   return "Served as a static site.";
 }
+async function ownSiteAt(credentials, subdomain) {
+  const found = await lookUpSite(credentials, subdomain);
+  return found?.subdomain.toLowerCase() === subdomain.trim().toLowerCase() ? found : void 0;
+}
 async function resolveSite(credentials, site, newSite) {
   const { subdomain, folder } = newSite;
   if (site !== void 0 && subdomain !== void 0) {
@@ -1952,6 +1984,13 @@ async function resolveSite(credentials, site, newSite) {
   }
   if (site === void 0) {
     const folderId = folder === void 0 ? void 0 : await resolveFolder(credentials, folder);
+    const held = subdomain === void 0 ? void 0 : await ownSiteAt(credentials, subdomain);
+    if (held !== void 0) {
+      if (held.liveDeployId === null) return held;
+      throw new Error(
+        `You already have a site at ${held.subdomain}, and it is live. To replace what it serves, publish to it as an existing site (the \`site\` argument, or \`--site\` on the command line); to make a new site, choose another subdomain.`
+      );
+    }
     return await createSite(credentials, subdomain, folderId);
   }
   const found = await lookUpSite(credentials, site);
@@ -2234,6 +2273,12 @@ function accessOf(site) {
   if (site.invitedOnly === false) return "public";
   return "no password (whether it is invite-only could not be read)";
 }
+function addressLines(site) {
+  return [
+    ...site.formerSubdomains.length > 0 ? [`  formerly ${site.formerSubdomains.join(", ")} (redirect here)`] : [],
+    ...site.subdomainChangesLeft === null ? [] : [`  address   ${site.subdomainChangesLeft} change(s) left`]
+  ];
+}
 function describeSite(site, folderPath) {
   const unavailable = (available) => available ? "" : " (not on this plan)";
   const versions = site.deploys.slice(0, VERSIONS_LISTED).map((deploy2) => {
@@ -2253,6 +2298,7 @@ function describeSite(site, folderPath) {
     `  comments  ${site.comments ?? "unknown"}${unavailable(site.commentsAvailable)}`,
     `  takedown  ${site.expiresAt === null ? "none" : `${site.expiresAt} (${site.expiryAction})`}${unavailable(site.scheduledExpiryAvailable)}`,
     `  folder    ${site.folderId === null ? "(top level)" : folderPath ?? site.folderId}`,
+    ...addressLines(site),
     "",
     site.deploys.length === 0 ? "No versions yet." : "Versions, newest first:",
     ...versions,
@@ -2435,7 +2481,7 @@ async function signInWithCode(waitSeconds, replace = false) {
     "Call this tool again to keep waiting. Nothing has been changed yet."
   ].join("\n");
 }
-const SERVER_VERSION = "0.13.0";
+const SERVER_VERSION = "1.0.0";
 const REPLACES_A_SITE = {
   readOnlyHint: false,
   destructiveHint: true,
@@ -2461,6 +2507,12 @@ const REMOVES_A_SITE = {
   idempotentHint: false,
   openWorldHint: true
 };
+const MOVES_AN_ADDRESS = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: true,
+  openWorldHint: true
+};
 const CHANGES_A_SITE = {
   readOnlyHint: false,
   destructiveHint: true,
@@ -2621,7 +2673,9 @@ function structuredSite(site) {
       createdAt: deploy2.createdAt,
       filesKept: deploy2.filesKept,
       live: deploy2.deployId === site.liveDeployId
-    }))
+    })),
+    subdomainChangesLeft: site.subdomainChangesLeft,
+    formerSubdomains: [...site.formerSubdomains]
   };
 }
 const SITE_OUTPUT = z.object({
@@ -2689,9 +2743,10 @@ function instructionsFor(surface) {
     "",
     "A new site gets a generated name unless `subdomain` asks for one. Pass it when the person",
     "named the address they want, and otherwise leave it out — a name is what somebody will be",
-    "given as a URL, it cannot be changed later, and a site created under a guessed one has to",
-    "be deleted by hand. `site` and `subdomain` are opposites: one publishes over a site that",
-    "exists, the other creates one that does not. Never pass both.",
+    "given as a URL, changing it later spends one of the two changes a site gets, and a site",
+    "created under a guessed one has to be renamed or deleted by hand. `site` and `subdomain` are",
+    "opposites: one publishes over a site that exists, the other creates one that does not. Never",
+    "pass both.",
     "",
     "A new site goes at the top level of the dashboard unless `folder` files it somewhere. Pass",
     "it when the person named a folder, as its path (Clients/Acme) or its id; list_folders shows",
@@ -2711,9 +2766,14 @@ function instructionsFor(surface) {
     "Publishing over an existing site replaces what it serves, so ask before doing that to a",
     "site the person did not name.",
     "",
-    "delete_site is permanent and frees the subdomain for anybody to claim. Ask the person for",
-    "the subdomain and pass what they say as `confirm` — do not fill it in from what you already",
-    "know, because being told it is the point of the step.",
+    "delete_site is permanent, and the subdomain stays reserved: nobody, the person included, can",
+    "use it again. Ask the person for the subdomain and pass what they say as `confirm` — do not",
+    "fill it in from what you already know, because being told it is the point of the step.",
+    "",
+    "change_subdomain moves a site to a new address. The old one keeps redirecting and nobody else",
+    "can take it, but each site gets only a couple of changes, a change back to an old name",
+    "included. Use it only when the person named the new address, and pass the site's current",
+    "subdomain, as they say it, as `confirm`.",
     "",
     "An existing site's settings are read with get_site and changed with update_site: its name,",
     "serving mode (static, spa, docs), a password, whether forms accept submissions, a scheduled",
@@ -2738,8 +2798,10 @@ function instructionsFor(surface) {
   ].join("\n");
 }
 function publishFilesDescription(surface) {
-  return surface === "local" ? "Publishes one or more files written here — markdown, HTML, CSS, JSON, source code, any text — as a site, and returns its URL. A single page goes at index.html; a single .md, .markdown or .pdf file is a site on its own, served through the documents viewer. Text only: a PDF or an image has to be published from disk with publish_dir." : "Publishes one or more files written here — markdown, HTML, CSS, JSON, source code, any text — as a site, and returns its URL. A single page goes at index.html; a single .md or .markdown file is a site on its own, served through the documents viewer. Text only: this connector cannot publish a PDF, an image or an Office file.";
+  const body = surface === "local" ? "Publishes one or more files written here — markdown, HTML, CSS, JSON, source code, any text — as a site, and returns its URL. A single page goes at index.html; a single .md, .markdown or .pdf file is a site on its own, served through the documents viewer. Text only: a PDF or an image has to be published from disk with publish_dir." : "Publishes one or more files written here — markdown, HTML, CSS, JSON, source code, any text — as a site, and returns its URL. A single page goes at index.html; a single .md or .markdown file is a site on its own, served through the documents viewer. Text only: this connector cannot publish a PDF, an image or an Office file.";
+  return `${body} ${RESERVE_FIRST}`;
 }
+const RESERVE_FIRST = "To hold an address before the content exists — the person asks for the site first and the files later — publish a placeholder index.html with `subdomain`, then publish the real files over it with `site`. There is no way to create an empty site.";
 function registerPublishFiles(server, context) {
   server.registerTool(
     "publish_files",
@@ -2755,7 +2817,7 @@ function registerPublishFiles(server, context) {
         ).min(1).describe("The files to publish."),
         site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site."),
         subdomain: z.string().optional().describe(
-          "Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, it cannot be changed afterwards, and an unused site made under a guessed name has to be deleted by hand."
+          "Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, changing it later spends one of the few changes a site gets, and an unused site made under a guessed name has to be deleted by hand."
         ),
         folder: FOLDER_INPUT
       },
@@ -2772,7 +2834,7 @@ function registerSiteTools(server, context) {
     "delete_site",
     {
       ...titled("Delete a site", REMOVES_A_SITE),
-      description: "Takes a site down permanently — its files, its history and its subdomain. Nothing here undoes it, and the subdomain becomes available for anybody to claim. Requires `confirm` to repeat the site's own subdomain exactly; ask the person for it rather than filling it in from what you already know, because that is the step this asks for.",
+      description: "Takes a site down permanently — its files, its history and its subdomain. Nothing here undoes it, and the subdomain stays reserved — nobody can use it again. Requires `confirm` to repeat the site's own subdomain exactly; ask the person for it rather than filling it in from what you already know, because that is the step this asks for.",
       inputSchema: {
         site: z.string().min(1).describe("Subdomain or site id to delete."),
         confirm: z.string().min(1).describe(
@@ -2793,11 +2855,46 @@ function registerSiteTools(server, context) {
       }
       await deleteSite(credentials, found.siteId);
       return report(
-        `Deleted ${found.subdomain}. Its files and history are gone, and the subdomain is free for anybody to claim.`,
+        `Deleted ${found.subdomain}. Its files and history are gone; the subdomain stays reserved and cannot be used again.`,
         { siteId: found.siteId, subdomain: found.subdomain }
       );
     })
   );
+  server.registerTool(
+    "change_subdomain",
+    {
+      ...titled("Change a site's address", MOVES_AN_ADDRESS),
+      description: "Moves a site to a new subdomain. The old one keeps working by redirecting to the new one, and nobody else can take it. Each site gets only a couple of changes, and a change back to an old name counts too, so use this only when the person named the new address. Requires `confirm` to repeat the site's current subdomain exactly; ask the person rather than filling it in. Visitors who signed in to the site or typed its password are asked again.",
+      inputSchema: {
+        site: SITE_INPUT,
+        subdomain: z.string().min(1).describe("The new subdomain, as the person gave it."),
+        confirm: z.string().min(1).describe(
+          "The site's current subdomain, repeated exactly. A mismatch refuses the call rather than guessing which site was meant."
+        )
+      },
+      outputSchema: {
+        siteId: z.string().describe("Identifier of the site."),
+        subdomain: z.string().describe("The subdomain it answers on now."),
+        url: z.string().describe("Its address now."),
+        subdomainChangesLeft: z.number().int().nullable().describe("How many more changes its plan allows, or null when it allows any number."),
+        formerSubdomains: z.array(z.string()).describe("The subdomains it used to answer on, newest first; each redirects here.")
+      }
+    },
+    ({ site, subdomain, confirm }) => withCredentials(context, async (credentials) => {
+      const found = await findSite(credentials, site);
+      if (confirm.trim().toLowerCase() !== found.subdomain.toLowerCase()) {
+        throw new Error(
+          `Refusing to move ${found.subdomain}: \`confirm\` said "${confirm}". Repeat the current subdomain exactly to go ahead.`
+        );
+      }
+      const changed = await changeSubdomain(credentials, found.siteId, subdomain);
+      const left = changed.subdomainChangesLeft === null ? "" : ` ${changed.subdomainChangesLeft} address change(s) left.`;
+      return report(
+        `${found.subdomain} is now ${changed.url}. The old address redirects there.${left}`,
+        { ...changed, formerSubdomains: [...changed.formerSubdomains] }
+      );
+    })
+  );
   server.registerTool(
     "list_sites",
     {
@@ -2851,7 +2948,11 @@ function registerSiteTools(server, context) {
           scheduledTakedown: z.boolean(),
           comments: z.boolean()
         }).describe("Which settings the account's plan includes."),
-        versions: z.array(VERSION_OUTPUT).describe("Its versions, newest first.")
+        versions: z.array(VERSION_OUTPUT).describe("Its versions, newest first."),
+        subdomainChangesLeft: z.number().int().nullable().describe(
+          "How many more times change_subdomain may move it, or null when there is no limit."
+        ),
+        formerSubdomains: z.array(z.string()).describe("The subdomains it used to answer on, newest first; each redirects to it.")
       }
     },
     ({ site }) => withCredentials(context, async (credentials) => {
@@ -3261,7 +3362,7 @@ function createServer() {
         path: z.string().min(1).describe("Absolute path of the folder to publish."),
         site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site."),
         subdomain: z.string().optional().describe(
-          "Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, it cannot be changed afterwards, and an unused site made under a guessed name has to be deleted by hand."
+          "Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, changing it later spends one of the few changes a site gets, and an unused site made under a guessed name has to be deleted by hand."
         ),
         folder: FOLDER_INPUT
       },

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@drop2run/mcp",
-	"version": "0.13.0",
+	"version": "1.0.0",
 	"description": "MCP server that publishes what an AI made — a page, a document or a whole site — to Drop2Run and returns a live URL.",
 	"mcpName": "run.dropto/drop2run",
 	"license": "MIT",