@homespunapps/mcp 1.6.67 → 1.6.69

package/dist/tools.js

@@ -422,12 +422,15 @@ const appsShape = {
         "update",
         "share_link_rotate",
         "delete",
+        "list_deleted",
+        "restore",
+        "purge",
         "wake",
         "domain_set",
         "domain_status",
         "domain_remove",
     ])
-        .describe("list: the caller's owning human's apps. show/update/delete/wake: act on one app (app_id). audit: read-only security review of every app the caller owns. share_link_rotate: rotate a 'link' app's share token, returning a new share_url (the old link stops working); also generates one if the app has none yet. domain_set/domain_status/domain_remove: manage the app's custom domains (app_id; domain_set also needs domain)."),
+        .describe("list: the caller's owning human's apps. show/update/delete/wake: act on one app (app_id). audit: read-only security review of every app the caller owns. share_link_rotate: rotate a 'link' app's share token, returning a new share_url (the old link stops working); also generates one if the app has none yet. list_deleted: the apps in the trash, each with when it is purged for good. restore: bring a deleted app back with all its data (app_id). purge: destroy a deleted app forever, now (app_id). domain_set/domain_status/domain_remove: manage the app's custom domains (app_id; domain_set also needs domain)."),
     severity: z
         .enum(["high", "medium", "low"])
         .optional()
@@ -435,11 +438,11 @@ const appsShape = {
     app_id: z
         .string()
         .optional()
-        .describe("Required for show/update/share_link_rotate/delete/wake/domain_set/domain_status/domain_remove."),
+        .describe("Required for show/update/share_link_rotate/delete/restore/purge/wake/domain_set/domain_status/domain_remove."),
     status: z
-        .enum(["active", "dormant", "archived", "all"])
+        .enum(["active", "dormant", "archived", "suspended", "all"])
         .optional()
-        .describe("list only. Default: active."),
+        .describe("list only. Default: active. 'all' means every live status; deleted apps are never in this list, use action list_deleted for those."),
     limit: z
         .number()
         .int()
@@ -1342,14 +1345,17 @@ export const TOOLS = [
     },
     {
         name: "apps",
-        description: "The v2 app lifecycle apart from creation and redeploy, which deploy_app covers. Actions: list returns the owning human's apps; show returns full detail including manifest, timezone and has_share_token; audit is a read-only security review of every app the caller owns, computed from each app's stored manifest, which is what makes it see apps that were deployed once and never redeployed (a deploy-time warning never reaches those). It reports collections whose declared permissions expose them, worst first: severity 'high' means an anonymous visitor can exploit it today, typically a collection that admits \"anyone\" to write with no separate 'update' list, so any visitor can overwrite rows other people created rather than only adding their own. It changes nothing; the fix is a redeploy declaring the missing list, and the right list differs per app, so read the app before proposing one. update changes visibility and timezone, the slug being immutable, and switching to 'link' returns a share_url once; share_link_rotate issues a new share token for a 'link' app, returning a new share_url and revoking the old link, and generates one if the app has none; delete is an idempotent soft-delete; wake wakes a dormant app and is otherwise a no-op that reports the actual status; domain_set binds a custom domain and returns the DNS records the domain owner must publish, where the first domain bound serves the app and every later one redirects to it, which is how apex plus www is configured; domain_status returns the serving domain and its `aliases`, live-refreshed against Cloudflare when that is enabled, with last_error carrying the reason a domain is not activating; domain_remove unbinds one domain, or all of them when no `domain` is given, and is idempotent.",
+        description: "The v2 app lifecycle apart from creation and redeploy, which deploy_app covers. Actions: list returns the owning human's apps; show returns full detail including manifest, timezone and has_share_token; audit is a read-only security review of every app the caller owns, computed from each app's stored manifest, which is what makes it see apps that were deployed once and never redeployed (a deploy-time warning never reaches those). It reports collections whose declared permissions expose them, worst first: severity 'high' means an anonymous visitor can exploit it today, typically a collection that admits \"anyone\" to write with no separate 'update' list, so any visitor can overwrite rows other people created rather than only adding their own. It changes nothing; the fix is a redeploy declaring the missing list, and the right list differs per app, so read the app before proposing one. update changes visibility and timezone, the slug being immutable, and switching to 'link' returns a share_url once; share_link_rotate issues a new share token for a 'link' app, returning a new share_url and revoking the old link, and generates one if the app has none; delete is an idempotent soft-delete, and it is recoverable: the app stops serving at once but keeps every version, collection, row, attachment, member and grant, and restore brings all of it back until the retention window elapses (list_deleted shows what is in the trash and each app's purges_at deadline, which is null when the account is never purged). restore is idempotent on a live app, and refuses with 409 when the account is at its app limit, when the app was an expired trial, or when the owning account is itself deleted; an app an operator suspended comes back suspended, not active. purge destroys a deleted app and all its data immediately and forever, with no restore afterwards, and requires the app to already be deleted, so no single call takes a serving app to unrecoverable; wake wakes a dormant app and is otherwise a no-op that reports the actual status; domain_set binds a custom domain and returns the DNS records the domain owner must publish, where the first domain bound serves the app and every later one redirects to it, which is how apex plus www is configured; domain_status returns the serving domain and its `aliases`, live-refreshed against Cloudflare when that is enabled, with last_error carrying the reason a domain is not activating; domain_remove unbinds one domain, or all of them when no `domain` is given, and is idempotent.",
         inputSchema: appsShape,
-        // Consolidated tool: read actions (list/show) + mutating ones (update/
-        // delete/wake). Hint reflects delete, the most-privileged action.
+        // Consolidated tool: read actions (list/show/list_deleted) + mutating ones
+        // (update/delete/restore/purge/wake). Hint reflects purge, the most-
+        // privileged action.
         annotations: {
             title: "Manage Apps",
             readOnlyHint: false,
-            // Destructive: `delete` removes an app.
+            // Destructive: `purge` destroys an app and all its data irreversibly.
+            // `delete` is only soft, but the hint is a per-TOOL boolean and has to
+            // describe the worst action reachable through it.
             destructiveHint: true,
             // NOT idempotent: `share_link_rotate` issues a new share token and
             // revokes the old link on every call, so a retried call invalidates a
@@ -1410,7 +1416,34 @@ export const TOOLS = [
                             return invalidArgs("delete requires `app_id`");
                         }
                         await client.deleteApp(String(args["app_id"]));
-                        return jsonResult({ app_id: args["app_id"], deleted: true });
+                        // `restorable` so a caller reading only this result knows the app
+                        // is recoverable, without having to have read the tool description.
+                        return jsonResult({
+                            app_id: args["app_id"],
+                            deleted: true,
+                            restorable: true,
+                        });
+                    case "list_deleted":
+                        return jsonResult(await client.listApps({
+                            status: "deleted",
+                            ...(args["limit"] !== undefined
+                                ? { limit: Number(args["limit"]) }
+                                : {}),
+                            ...(str(args, "cursor") !== undefined
+                                ? { cursor: String(args["cursor"]) }
+                                : {}),
+                        }));
+                    case "restore":
+                        if (str(args, "app_id") === undefined) {
+                            return invalidArgs("restore requires `app_id`");
+                        }
+                        return jsonResult(await client.restoreApp(String(args["app_id"])));
+                    case "purge":
+                        if (str(args, "app_id") === undefined) {
+                            return invalidArgs("purge requires `app_id`");
+                        }
+                        await client.purgeApp(String(args["app_id"]));
+                        return jsonResult({ app_id: args["app_id"], purged: true });
                     case "share_link_rotate":
                         if (str(args, "app_id") === undefined) {
                             return invalidArgs("share_link_rotate requires `app_id`");

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.6.67";
+export declare const VERSION = "1.6.69";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Single source of the package version, reported in the MCP server's
 // serverInfo. Kept in sync with package.json by the release tooling.
-export const VERSION = "1.6.67";
+export const VERSION = "1.6.69";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@homespunapps/mcp",
   "mcpName": "dev.homespun/homespun",
-  "version": "1.6.67",
+  "version": "1.6.69",
   "description": "Model Context Protocol (stdio) server for Homespun: lets any MCP client (Claude Desktop, Cursor, …) deploy a multi-user web app with hosting, auth, a shared database and permissions included.",
   "license": "MIT",
   "type": "module",
@@ -46,13 +46,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@homespunapps/core": "^1.6.67",
+    "@homespunapps/core": "^1.6.69",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "repository": {
     "type": "git",

package/server.json

@@ -3,14 +3,14 @@
   "name": "dev.homespun/homespun",
   "title": "Homespun",
   "description": "Deploy a multi-user web app from your agent: hosting, auth, database, and permissions.",
-  "version": "1.6.67",
+  "version": "1.6.69",
   "websiteUrl": "https://homespun.dev",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@homespunapps/mcp",
-      "version": "1.6.67",
+      "version": "1.6.69",
       "transport": {
         "type": "stdio"
       },