@drop2run/mcp 0.6.0 → 0.7.0

package/README.md

@@ -67,6 +67,7 @@ lose it.
 | `publish_files` | Publishes files Claude wrote — a page, a markdown note, several files together |
 | `publish_dir` | Publishes a folder, given its absolute path |
 | `list_sites` | Lists the sites on the account |
+| `list_folders` | Lists the account's folders, each with the path `folder` accepts |
 | `delete_site` | Deletes a site permanently, subdomain included — requires the subdomain repeated as `confirm` |
 
 Both publish tools take an optional `site` — a subdomain or site id to publish over. Leave it out and a
@@ -78,6 +79,11 @@ afterwards, and a site made under a guessed one has to be deleted by hand. `site
 opposites — one publishes over a site that exists, the other creates one that does not — so passing both
 is refused rather than resolved.
 
+And both take an optional `folder`, which files the new site in one of the account's dashboard folders —
+by path such as `Clients/Acme`, or by the id `list_folders` shows. Like `subdomain` it only describes a new
+site, so it cannot be combined with `site`. It never creates a folder: one that does not exist is refused
+with the list of those that do, and nothing is published.
+
 Both sign-in tools answer "not approved yet" rather than failing while they wait, and calling them
 again keeps waiting on the same sign-in. Neither replaces a token that is already stored unless asked
 to with `replace`.

package/dist/index.js

@@ -8,59 +8,6 @@ import { createServer as createServer$1 } from "node:http";
 import { realpath, readdir, stat, readFile } from "node:fs/promises";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-async function call(credentials, path, init = {}) {
-  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
-    ...init,
-    headers: {
-      ...init.headers,
-      Authorization: `Bearer ${credentials.token}`,
-      ...init.body === void 0 ? {} : { "Content-Type": "application/json" }
-    }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-  return await response.json();
-}
-async function findSite(credentials, site) {
-  const wanted = site.trim().toLowerCase();
-  const found = (await listSites(credentials)).find(
-    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
-  );
-  if (found === void 0) {
-    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
-  }
-  return found;
-}
-async function deleteSite(credentials, siteId) {
-  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
-    method: "DELETE",
-    headers: { Authorization: `Bearer ${credentials.token}` }
-  });
-  if (!response.ok) {
-    const problem = await response.json().catch(() => null);
-    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
-  }
-}
-async function listSites(credentials) {
-  const body = await call(credentials, "sites");
-  return body.sites;
-}
-async function createSite(credentials, subdomain) {
-  const created = await call(
-    credentials,
-    "sites",
-    {
-      method: "POST",
-      // An absent field rather than a null one, because the API reads null, empty and missing the
-      // same way and a body carrying only what was asked for is the one that reads correctly in a
-      // log.
-      body: JSON.stringify(subdomain === void 0 ? {} : { subdomain })
-    }
-  );
-  return { ...created, name: null };
-}
 const TOKEN_VARIABLE = "DROP2RUN_TOKEN";
 function configPath() {
   return join(homedir(), ".config", "drop2run", "config.json");
@@ -137,6 +84,131 @@ function missingCredentialsMessage(surface = "cli") {
     "The token is shown once when it is created and cannot be recovered afterwards."
   ].join("\n");
 }
+async function call(credentials, path, init = {}) {
+  const response = await fetch(`${credentials.apiBaseUrl}/${path}`, {
+    ...init,
+    headers: {
+      ...init.headers,
+      Authorization: `Bearer ${credentials.token}`,
+      ...init.body === void 0 ? {} : { "Content-Type": "application/json" }
+    }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  return await response.json();
+}
+async function findSite(credentials, site) {
+  const found = await lookUpSite(credentials, site);
+  if (found === void 0) {
+    throw new Error(`No site of yours is called "${site}". \`drop2run ls\` shows what exists.`);
+  }
+  return found;
+}
+const SITE_ID_SHAPE = /^[0-9a-z]{26}$/i;
+async function lookUpSite(credentials, site) {
+  const wanted = site.trim().toLowerCase();
+  if (wanted === "") return void 0;
+  const { sites } = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}&q=${encodeURIComponent(wanted)}`
+  );
+  const bySubdomain = sites.find((candidate) => candidate.subdomain.toLowerCase() === wanted);
+  if (bySubdomain !== void 0) return bySubdomain;
+  if (!SITE_ID_SHAPE.test(wanted)) return void 0;
+  const response = await fetch(
+    `${credentials.apiBaseUrl}/sites/${encodeURIComponent(wanted.toUpperCase())}`,
+    { headers: { Authorization: `Bearer ${credentials.token}` } }
+  );
+  if (response.status === 404) return void 0;
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+  const detail = await response.json();
+  return { siteId: detail.siteId, subdomain: detail.subdomain, url: detail.url, name: detail.name };
+}
+async function deleteSite(credentials, siteId) {
+  const response = await fetch(`${credentials.apiBaseUrl}/sites/${encodeURIComponent(siteId)}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${credentials.token}` }
+  });
+  if (!response.ok) {
+    const problem = await response.json().catch(() => null);
+    throw new Error(problem?.detail ?? `The API answered ${response.status}.`);
+  }
+}
+const SITES_PER_REQUEST = 100;
+async function listSites(credentials) {
+  const body = await call(
+    credentials,
+    `sites?pageSize=${SITES_PER_REQUEST}`
+  );
+  return { sites: body.sites, total: body.total };
+}
+async function createSite(credentials, subdomain, folderId) {
+  const created = await call(
+    credentials,
+    "sites",
+    {
+      method: "POST",
+      // Absent fields rather than null ones, because the API reads null, empty and missing the same
+      // way and a body carrying only what was asked for is the one that reads correctly in a log.
+      body: JSON.stringify({
+        ...subdomain === void 0 ? {} : { subdomain },
+        ...folderId === void 0 ? {} : { folderId }
+      })
+    }
+  );
+  return { ...created, name: null };
+}
+async function listFolders(credentials) {
+  const body = await call(credentials, "site-folders");
+  const byId = new Map(body.folders.map((folder) => [folder.folderId, folder]));
+  const pathOf = (folderId) => {
+    const names = [];
+    let cursor = byId.get(folderId);
+    while (cursor !== void 0 && names.length <= byId.size) {
+      names.unshift(cursor.name);
+      cursor = cursor.parentId === null ? void 0 : byId.get(cursor.parentId);
+    }
+    return names.join("/");
+  };
+  return body.folders.map((folder) => ({ folderId: folder.folderId, path: pathOf(folder.folderId) })).sort((a, b) => a.path.localeCompare(b.path));
+}
+function comparablePath(path) {
+  return path.split("/").map((name) => name.trim()).filter((name) => name !== "").join("/").toLowerCase();
+}
+const FOLDERS_LISTED_ON_MISS = 20;
+async function resolveFolder(credentials, folder) {
+  const wanted = comparablePath(folder);
+  if (wanted === "") {
+    throw new Error(
+      `"${folder}" does not name a folder. Leave the folder out to put the site at the top level.`
+    );
+  }
+  const folders = await listFolders(credentials);
+  const byId = folders.find((candidate) => candidate.folderId.toLowerCase() === wanted);
+  if (byId !== void 0) return byId.folderId;
+  const matches = folders.filter((candidate) => comparablePath(candidate.path) === wanted);
+  if (matches.length === 1 && matches[0] !== void 0) return matches[0].folderId;
+  if (matches.length > 1) {
+    throw new Error(
+      `More than one folder is at "${folder}", because a folder name can contain "/". Name it by id instead: ${matches.map((match) => match.folderId).join(", ")}.`
+    );
+  }
+  if (folders.length === 0) {
+    throw new Error(
+      `No folder of yours is called "${folder}" — this account has no folders yet. Make one in the dashboard at ${dashboardUrlFor(credentials.apiBaseUrl)}, or leave the folder out.`
+    );
+  }
+  const listed = folders.slice(0, FOLDERS_LISTED_ON_MISS).map((candidate) => candidate.path);
+  const more = folders.length - listed.length;
+  throw new Error(
+    `No folder of yours is called "${folder}". Your folders: ${listed.join(", ")}${more > 0 ? `, and ${more} more` : ""}.`
+  );
+}
 function newAttempt() {
   const verifier = randomBytes(32).toString("base64url");
   return {
@@ -1269,20 +1341,23 @@ function escapesRoot(root, candidate) {
   const inside = relative(root, candidate);
   return inside === "" || inside.startsWith("..");
 }
-async function resolveSite(credentials, site, subdomain) {
-  if (subdomain !== void 0) {
-    if (site !== void 0) {
-      throw new Error(
-        "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
-      );
-    }
-    return await createSite(credentials, subdomain);
+async function resolveSite(credentials, site, newSite) {
+  const { subdomain, folder } = newSite;
+  if (site !== void 0 && subdomain !== void 0) {
+    throw new Error(
+      "Give either an existing site or a subdomain for a new one, not both: publishing over a site and creating one are different requests."
+    );
   }
-  if (site === void 0) return await createSite(credentials);
-  const wanted = site.trim().toLowerCase();
-  const found = (await listSites(credentials)).find(
-    (candidate) => candidate.siteId.toLowerCase() === wanted || candidate.subdomain.toLowerCase() === wanted
-  );
+  if (site !== void 0 && folder !== void 0) {
+    throw new Error(
+      "A folder only says where a new site goes, so it cannot be given with an existing site. Leave the site out to create one in that folder, or move the existing site from the dashboard."
+    );
+  }
+  if (site === void 0) {
+    const folderId = folder === void 0 ? void 0 : await resolveFolder(credentials, folder);
+    return await createSite(credentials, subdomain, folderId);
+  }
+  const found = await lookUpSite(credentials, site);
   if (found === void 0) {
     throw new Error(
       `No site of yours is called "${site}". Leave the site out to publish to a new one, or list your sites to see what exists.`
@@ -1290,8 +1365,8 @@ async function resolveSite(credentials, site, subdomain) {
   }
   return found;
 }
-async function publish(credentials, source, site, onProgress, subdomain) {
-  const target = await resolveSite(credentials, site, subdomain);
+async function publish(credentials, source, site, onProgress, newSite = {}) {
+  const target = await resolveSite(credentials, site, newSite);
   let files = 0;
   let url = target.url;
   let unchanged = false;
@@ -1321,11 +1396,11 @@ async function publish(credentials, source, site, onProgress, subdomain) {
   });
   return { url, siteId: target.siteId, subdomain: target.subdomain, files, unchanged };
 }
-async function publishDirectory(credentials, directory, site, onProgress, subdomain) {
+async function publishDirectory(credentials, directory, site, onProgress, newSite = {}) {
   const found = await stat(directory).catch(() => null);
   if (found === null) throw new Error(`There is no folder at ${directory}.`);
   if (!found.isDirectory()) throw new Error(`${directory} is a file, not a folder to publish.`);
-  return await publish(credentials, directorySource(directory), site, onProgress, subdomain);
+  return await publish(credentials, directorySource(directory), site, onProgress, newSite);
 }
 function cleanPath(path) {
   const cleaned = path.trim().replaceAll("\\", "/").replace(/^\.?\//, "");
@@ -1339,7 +1414,7 @@ function cleanPath(path) {
   }
   return cleaned;
 }
-async function publishFiles(credentials, files, site, subdomain) {
+async function publishFiles(credentials, files, site, newSite = {}) {
   const encoder = new TextEncoder();
   const collected = files.map((file) => ({
     path: cleanPath(file.path),
@@ -1350,7 +1425,7 @@ async function publishFiles(credentials, files, site, subdomain) {
     if (seen.has(file.path)) throw new Error(`Two files were given the same path: ${file.path}`);
     seen.add(file.path);
   }
-  return publish(credentials, async () => collected, site, void 0, subdomain);
+  return publish(credentials, async () => collected, site, void 0, newSite);
 }
 const DEFAULT_WAIT_SECONDS = 120;
 const MAX_WAIT_SECONDS = 240;
@@ -1528,7 +1603,7 @@ async function signInWithCode(waitSeconds, replace = false) {
     "Call this tool again to keep waiting. Nothing has been changed yet."
   ].join("\n");
 }
-const SERVER_VERSION = "0.6.0";
+const SERVER_VERSION = "0.7.0";
 const CREDENTIAL_WRITE = {
   readOnlyHint: false,
   destructiveHint: false,
@@ -1566,6 +1641,15 @@ const SITE_OUTPUT = z.object({
   url: z.string().describe("Its live URL."),
   name: z.string().nullable().describe("What it is called, or null when it has no name.")
 });
+const FOLDER_OUTPUT = z.object({
+  folderId: z.string().describe("Identifier of the folder, which `folder` accepts."),
+  path: z.string().describe(
+    "Every name from the top level down to it, joined with /, which `folder` accepts too."
+  )
+});
+const FOLDER_INPUT = z.string().optional().describe(
+  "Folder to file the new site in, when the person asked for one: its path of names such as Clients/Acme, or its id from list_folders. Only for a new site — do not pass it together with `site`; moving an existing site is done in the dashboard. It never creates a folder: a folder that does not exist is refused with the list of those that do, and nothing is published."
+);
 function say(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
@@ -1613,6 +1697,10 @@ function createServer() {
         "be deleted by hand. `site` and `subdomain` are opposites: one publishes over a site that",
         "exists, the other creates one that does not. Never pass both.",
         "",
+        "A new site goes at the top level of the dashboard unless `folder` files it somewhere. Pass",
+        "it when the person named a folder, as its path (Clients/Acme) or its id; list_folders shows",
+        "what exists. Like `subdomain`, it only describes a new site, so never pass it with `site`.",
+        "",
         "A site needs an index.html at its top level, or at least one document (.md, .markdown,",
         ".pdf, .docx, .xlsx or .epub), which publishes as a documents site and is read through a",
         "viewer. So one page goes at index.html, and a single note is a whole publish that needs",
@@ -1674,13 +1762,14 @@ function createServer() {
         site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site."),
         subdomain: z.string().optional().describe(
           "Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, it cannot be changed afterwards, and an unused site made under a guessed name has to be deleted by hand."
-        )
+        ),
+        folder: FOLDER_INPUT
       },
       outputSchema: PUBLISH_OUTPUT,
       annotations: REPLACES_A_SITE
     },
-    ({ files, site, subdomain }) => withCredentials(async (credentials) => {
-      const result = await publishFiles(credentials, files, site, subdomain);
+    ({ files, site, subdomain, folder }) => withCredentials(async (credentials) => {
+      const result = await publishFiles(credentials, files, site, { subdomain, folder });
       return report(describe(result), { ...result });
     })
   );
@@ -1694,13 +1783,17 @@ function createServer() {
         site: z.string().optional().describe("Subdomain or site id to publish over. Omit to create a new site."),
         subdomain: z.string().optional().describe(
           "Subdomain to create the new site under, when the person asked for a particular address. Only for a new site: leave it out to publish over an existing one, and do not pass it together with `site`. Ask rather than inventing one — the name is the URL somebody will be given, it cannot be changed afterwards, and an unused site made under a guessed name has to be deleted by hand."
-        )
+        ),
+        folder: FOLDER_INPUT
       },
       outputSchema: PUBLISH_OUTPUT,
       annotations: REPLACES_A_SITE
     },
-    ({ path, site, subdomain }) => withCredentials(async (credentials) => {
-      const result = await publishDirectory(credentials, path, site, void 0, subdomain);
+    ({ path, site, subdomain, folder }) => withCredentials(async (credentials) => {
+      const result = await publishDirectory(credentials, path, site, void 0, {
+        subdomain,
+        folder
+      });
       return report(describe(result), { ...result });
     })
   );
@@ -1741,15 +1834,36 @@ function createServer() {
       title: "List sites",
       description: "Lists the sites on this account, so a publish can go to one of them.",
       inputSchema: {},
-      outputSchema: { sites: z.array(SITE_OUTPUT).describe("Every site on this account.") },
+      outputSchema: {
+        sites: z.array(SITE_OUTPUT).describe("The account's sites, newest first — every one unless `total` is larger."),
+        total: z.number().int().describe("How many sites the account holds. Larger than `sites` only past 100.")
+      },
       annotations: READS_ONLY
     },
     () => withCredentials(async (credentials) => {
-      const sites = await listSites(credentials);
+      const { sites, total } = await listSites(credentials);
       const text = sites.length === 0 ? "No sites on this account yet. Publishing without a `site` creates one." : sites.map(
         (site) => `${site.subdomain} — ${site.url}${site.name ? ` — ${site.name}` : ""}`
-      ).join("\n");
-      return report(text, { sites: sites.map((site) => ({ ...site })) });
+      ).join("\n") + (total > sites.length ? `
+… and ${total - sites.length} more; these are the newest ${sites.length} of ${total}.` : "");
+      return report(text, { sites: sites.map((site) => ({ ...site })), total });
+    })
+  );
+  server.registerTool(
+    "list_folders",
+    {
+      title: "List folders",
+      description: "Lists the folders on this account, each with the path a publish's `folder` accepts. Folders are made and rearranged in the dashboard; no tool here creates one.",
+      inputSchema: {},
+      outputSchema: {
+        folders: z.array(FOLDER_OUTPUT).describe("Every folder on this account, ordered by path.")
+      },
+      annotations: READS_ONLY
+    },
+    () => withCredentials(async (credentials) => {
+      const folders = await listFolders(credentials);
+      const text = folders.length === 0 ? "No folders on this account. A new site goes at the top level; folders are made in the dashboard." : folders.map((folder) => `${folder.path} — ${folder.folderId}`).join("\n");
+      return report(text, { folders: folders.map((folder) => ({ ...folder })) });
     })
   );
   return server;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@drop2run/mcp",
-	"version": "0.6.0",
+	"version": "0.7.0",
 	"description": "MCP server that publishes what an AI made — a page, a document or a whole site — to Drop2Run and returns a live URL.",
 	"mcpName": "run.dropto/drop2run",
 	"license": "MIT",