@homespunapps/mcp 1.4.3 → 1.5.0

package/dist/tools.js

@@ -348,13 +348,21 @@ const membersShape = {
 };
 const ingestShape = {
     action: z
-        .enum(["list", "rotate"])
-        .describe("list: the app's inbound catch-hooks, each with its full secret URL, current rule (collection/mode/wake/handshake), and per-status delivery counts (app_id). rotate: mint a fresh secret for one hook and return its new URL once, invalidating the old URL immediately (app_id+name)."),
+        .enum(["list", "rotate", "set_signing_secret", "clear_signing_secret"])
+        .describe("list: the app's inbound catch-hooks, each with its full secret URL, current rule (collection/mode/wake/handshake), and per-status delivery counts (app_id). rotate: mint a fresh URL secret for one hook and return its new URL once, invalidating the old URL immediately (app_id+name). set_signing_secret: provision or rotate a hook's OPT-IN signing secret, distinct from the URL secret (it is what a provider HMACs the body with); omit `secret` to mint one (returned ONCE) or pass `secret` to store a provider-generated value verbatim (never echoed) (app_id+name). clear_signing_secret: remove a hook's signing secret (app_id+name)."),
     app_id: z.string().min(1).describe("The app id."),
     name: z
         .string()
         .optional()
-        .describe("rotate only. The manifest ingest hook name to rotate (an x-homespun-manifest.ingest[].name). See list's `name` field."),
+        .describe("rotate / set_signing_secret / clear_signing_secret. The manifest ingest hook name (an x-homespun-manifest.ingest[].name). See list's `name` field."),
+    secret: z
+        .string()
+        .optional()
+        .describe("set_signing_secret only. A provider-generated signing secret to store verbatim (the Stripe path). Omit to have the relay mint one (the GitHub path), returned ONCE in the response."),
+    grace_seconds: z
+        .number()
+        .optional()
+        .describe("set_signing_secret only. On a rotation, how long the previous secret stays valid so deliveries verify while you update the provider (default 3600, max 86400)."),
 };
 // ===========================================================================
 // Consolidated management tools
@@ -1219,7 +1227,7 @@ export const TOOLS = [
     // ----- consolidated management tools --------------------------------------
     {
         name: "ingest",
-        description: "Manage a v2 app's inbound catch-hooks (inbound-webhooks). A catch-hook lets an EXTERNAL system (Stripe, Zapier, Make, Home Assistant, an email router) POST JSON to a secret URL that writes into a declared collection, so the app receives data even with no agent online. Hooks are DECLARED IN THE MANIFEST (x-homespun-manifest.ingest) and materialized at deploy, so this tool has no create/delete: use it to READ BACK the URL and rotate a leaked one. ONE tool with an `action` enum: list (the app's hooks, each with its full secret URL, current rule collection/mode/wake/handshake, and per-status delivery counts) | rotate (mint a fresh secret for one hook by name and return its NEW url once; the old url stops working immediately, no redeploy needed). After deploying a manifest that declares a hook, run list and tell the owner the exact url to paste into the external system.",
+        description: "Manage a v2 app's inbound catch-hooks (inbound-webhooks). A catch-hook lets an EXTERNAL system (Stripe, Zapier, Make, Home Assistant, an email router) POST JSON to a secret URL that writes into a declared collection, so the app receives data even with no agent online. Hooks are DECLARED IN THE MANIFEST (x-homespun-manifest.ingest) and materialized at deploy, so this tool has no create/delete: use it to READ BACK the URL, rotate a leaked one, and manage the opt-in signing secret. ONE tool with an `action` enum: list (the app's hooks, each with its full secret URL, current rule collection/mode/wake/handshake, per-status delivery counts, and signing-secret state) | rotate (mint a fresh URL secret for one hook by name and return its NEW url once; the old url stops working immediately, no redeploy needed) | set_signing_secret (provision/rotate a hook's signing secret, a DIFFERENT secret from the URL: what a provider HMACs the body with; omit `secret` to mint one returned ONCE, or pass `secret` to store a provider value verbatim, never echoed) | clear_signing_secret (remove it). Signature verification ships DARK for now: nothing verifies a signature yet. After deploying a manifest that declares a hook, run list and tell the owner the exact url to paste into the external system.",
         inputSchema: ingestShape,
         // Consolidated tool: read action (list) + a mutating one (rotate). Marked
         // destructive (not read-only) because rotate invalidates the old URL, which
@@ -1248,6 +1256,23 @@ export const TOOLS = [
                         }
                         return jsonResult(await client.rotateIngestHook(appId, String(args["name"])));
                     }
+                    case "set_signing_secret": {
+                        if (str(args, "name") === undefined) {
+                            return invalidArgs("set_signing_secret requires `name`");
+                        }
+                        const secret = str(args, "secret");
+                        const grace = args["grace_seconds"];
+                        return jsonResult(await client.setIngestSigningSecret(appId, String(args["name"]), {
+                            ...(secret !== undefined ? { secret } : {}),
+                            ...(typeof grace === "number" ? { graceSeconds: grace } : {}),
+                        }));
+                    }
+                    case "clear_signing_secret": {
+                        if (str(args, "name") === undefined) {
+                            return invalidArgs("clear_signing_secret requires `name`");
+                        }
+                        return jsonResult(await client.clearIngestSigningSecret(appId, String(args["name"])));
+                    }
                     default:
                         return invalidArgs(`unknown ingest action '${action}'`);
                 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.4.3";
+export declare const VERSION = "1.5.0";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Single source of the package version, reported in the MCP server's
 // serverInfo. Kept in sync with package.json by the release tooling.
-export const VERSION = "1.4.3";
+export const VERSION = "1.5.0";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@homespunapps/mcp",
   "mcpName": "dev.homespun/homespun",
-  "version": "1.4.3",
+  "version": "1.5.0",
   "description": "Model Context Protocol (stdio) server for Homespun: lets any MCP client (Claude Desktop, Cursor, …) hand a human a rich interactive UI by URL and get structured data back.",
   "license": "MIT",
   "type": "module",
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.20.0",
-    "@homespunapps/core": "^1.4.3",
+    "@homespunapps/core": "^1.5.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/server.json

@@ -3,14 +3,14 @@
   "name": "dev.homespun/homespun",
   "title": "Homespun",
   "description": "Hand a human a rich interactive UI by URL and get structured data back, from any MCP client.",
-  "version": "1.4.3",
+  "version": "1.5.0",
   "websiteUrl": "https://docs.homespun.dev",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@homespunapps/mcp",
-      "version": "1.4.3",
+      "version": "1.5.0",
       "transport": {
         "type": "stdio"
       },