@honest-pitches/pitch-sdk 0.4.6 → 0.5.2

package/dist/index.mjs

@@ -1,3 +1,5 @@
+import { createRequire as topLevelCreateRequire } from "node:module";
+const require = topLevelCreateRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -30,168 +32,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// vendor/platform-libs/pitcher-api-key-core/dist/index.cjs
-var require_dist = __commonJS({
-  "vendor/platform-libs/pitcher-api-key-core/dist/index.cjs"(exports, module) {
-    "use strict";
-    var __defProp2 = Object.defineProperty;
-    var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
-    var __getOwnPropNames2 = Object.getOwnPropertyNames;
-    var __hasOwnProp2 = Object.prototype.hasOwnProperty;
-    var __export = (target, all) => {
-      for (var name in all)
-        __defProp2(target, name, { get: all[name], enumerable: true });
-    };
-    var __copyProps2 = (to, from, except, desc) => {
-      if (from && typeof from === "object" || typeof from === "function") {
-        for (let key of __getOwnPropNames2(from))
-          if (!__hasOwnProp2.call(to, key) && key !== except)
-            __defProp2(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc2(from, key)) || desc.enumerable });
-      }
-      return to;
-    };
-    var __toCommonJS = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
-    var index_exports = {};
-    __export(index_exports, {
-      ALL_API_KEY_SCOPES: () => ALL_API_KEY_SCOPES,
-      API_KEY_PREFIX: () => API_KEY_PREFIX,
-      API_KEY_PREFIX_LEN: () => API_KEY_PREFIX_LEN,
-      API_KEY_RANDOM_LEN: () => API_KEY_RANDOM_LEN,
-      HASH_ALGO: () => HASH_ALGO,
-      extractKeyPrefix: () => extractKeyPrefix2,
-      generateApiKeyRandomSegment: () => generateApiKeyRandomSegment,
-      hashApiKey: () => hashApiKey,
-      isApiKeyScope: () => isApiKeyScope,
-      isApiKeyUsable: () => isApiKeyUsable2,
-      isWellFormedApiKey: () => isWellFormedApiKey2,
-      mintApiKey: () => mintApiKey,
-      parseApiKeyScopes: () => parseApiKeyScopes,
-      parseBearerHeader: () => parseBearerHeader,
-      verifyApiKey: () => verifyApiKey2
-    });
-    module.exports = __toCommonJS(index_exports);
-    var import_node_crypto = __require("crypto");
-    var API_KEY_PREFIX = "hp_pk_";
-    var API_KEY_PREFIX_LEN = 8;
-    var API_KEY_RANDOM_LEN = 48;
-    var HASH_ALGO = "sha256";
-    var BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-    function generateApiKeyRandomSegment(len) {
-      if (!Number.isInteger(len) || len <= 0) {
-        throw new Error("len must be a positive integer");
-      }
-      const out = [];
-      while (out.length < len) {
-        const buf = (0, import_node_crypto.randomBytes)(len + 4);
-        for (let i = 0; i < buf.length && out.length < len; i++) {
-          const byte = buf[i];
-          if (byte < 248) {
-            out.push(BASE62[byte % 62]);
-          }
-        }
-      }
-      return out.join("");
-    }
-    function hashApiKey(rawToken) {
-      if (typeof rawToken !== "string" || rawToken.length === 0) {
-        throw new Error("hashApiKey: rawToken must be a non-empty string");
-      }
-      return (0, import_node_crypto.createHash)(HASH_ALGO).update(rawToken, "utf8").digest("hex");
-    }
-    function isWellFormedApiKey2(rawToken) {
-      if (typeof rawToken !== "string") return false;
-      if (!rawToken.startsWith(API_KEY_PREFIX)) return false;
-      const rest = rawToken.slice(API_KEY_PREFIX.length);
-      if (rest.length !== API_KEY_RANDOM_LEN) return false;
-      for (let i = 0; i < rest.length; i++) {
-        const code = rest.charCodeAt(i);
-        const isDigit = code >= 48 && code <= 57;
-        const isUpper = code >= 65 && code <= 90;
-        const isLower = code >= 97 && code <= 122;
-        if (!isDigit && !isUpper && !isLower) return false;
-      }
-      return true;
-    }
-    function extractKeyPrefix2(rawToken) {
-      if (!isWellFormedApiKey2(rawToken)) return null;
-      return rawToken.slice(API_KEY_PREFIX.length, API_KEY_PREFIX.length + API_KEY_PREFIX_LEN);
-    }
-    var ALL_API_KEY_SCOPES = ["mcp", "sdk"];
-    function isApiKeyScope(value) {
-      return value === "mcp" || value === "sdk";
-    }
-    function parseApiKeyScopes(input) {
-      if (!Array.isArray(input)) {
-        throw new Error("scopes must be an array of strings");
-      }
-      const seen = /* @__PURE__ */ new Set();
-      for (const raw of input) {
-        if (!isApiKeyScope(raw)) {
-          throw new Error(
-            `unknown scope: ${JSON.stringify(raw)}. Valid scopes: ${ALL_API_KEY_SCOPES.join(", ")}`
-          );
-        }
-        seen.add(raw);
-      }
-      return Array.from(seen);
-    }
-    function mintApiKey(input) {
-      if (typeof input.label !== "string" || input.label.length === 0) {
-        throw new Error("mintApiKey: label must be a non-empty string");
-      }
-      if (input.label.length > 128) {
-        throw new Error("mintApiKey: label must be <= 128 chars");
-      }
-      if (!Array.isArray(input.scopes) || input.scopes.length === 0) {
-        throw new Error("mintApiKey: scopes must be a non-empty array");
-      }
-      if (input.expiresAt != null && typeof input.expiresAt !== "number") {
-        throw new Error("mintApiKey: expiresAt must be a number (epoch ms) or null");
-      }
-      const randomSegment = generateApiKeyRandomSegment(API_KEY_RANDOM_LEN);
-      const rawToken = `${API_KEY_PREFIX}${randomSegment}`;
-      const keyHash = hashApiKey(rawToken);
-      const keyPrefix = extractKeyPrefix2(rawToken);
-      if (keyPrefix === null) {
-        throw new Error("mintApiKey: generated key is not well-formed");
-      }
-      return { rawToken, keyHash, keyPrefix };
-    }
-    function constantTimeEqualHex(a, b) {
-      if (a.length !== b.length) return false;
-      let diff = 0;
-      for (let i = 0; i < a.length; i++) {
-        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-      }
-      return diff === 0;
-    }
-    function verifyApiKey2(presented, storedHash) {
-      if (typeof presented !== "string" || typeof storedHash !== "string") return false;
-      if (presented.length === 0 || storedHash.length === 0) return false;
-      let presentedHash;
-      try {
-        presentedHash = hashApiKey(presented);
-      } catch {
-        return false;
-      }
-      return constantTimeEqualHex(presentedHash, storedHash);
-    }
-    function isApiKeyUsable2(row, now = Date.now()) {
-      if (row.revokedAt != null) return false;
-      if (row.expiresAt != null && row.expiresAt <= now) return false;
-      return true;
-    }
-    function parseBearerHeader(header) {
-      if (!header || typeof header !== "string") return null;
-      const match = /^Bearer\s+(\S+)\s*$/i.exec(header.trim());
-      if (!match) return null;
-      return { token: match[1] };
-    }
-  }
-});
-
 // vendor/platform-libs/hp-codes/dist/index.cjs
-var require_dist2 = __commonJS({
+var require_dist = __commonJS({
   "vendor/platform-libs/hp-codes/dist/index.cjs"(exports, module) {
     "use strict";
     var __defProp2 = Object.defineProperty;
@@ -332,7 +174,7 @@ var require_dist2 = __commonJS({
 });
 
 // vendor/platform-libs/pitch-core/dist/index.cjs
-var require_dist3 = __commonJS({
+var require_dist2 = __commonJS({
   "vendor/platform-libs/pitch-core/dist/index.cjs"(exports, module) {
     "use strict";
     var __create2 = Object.create;
@@ -12341,7 +12183,7 @@ and ensure you are accounting for this risk.
       TEST_CONCLUSIONS: () => TEST_CONCLUSIONS,
       TEST_PRIMARY_METRICS: () => TEST_PRIMARY_METRICS,
       TEST_STATUSES: () => TEST_STATUSES,
-      assertFrameworkSwitchable: () => assertFrameworkSwitchable2,
+      assertFrameworkSwitchable: () => assertFrameworkSwitchable,
       assertSameTestBase: () => assertSameTestBase,
       baseKey: () => baseKey,
       buildPitchVariantIndexes: () => buildPitchVariantIndexes,
@@ -12373,13 +12215,13 @@ and ensure you are accounting for this risk.
       lifecycleFromRow: () => lifecycleFromRow2,
       loadFrameworkGuidance: () => loadFrameworkGuidance,
       loadFrameworks: () => loadFrameworks3,
-      loadPitchSections: () => loadPitchSections2,
+      loadPitchSections: () => loadPitchSections,
       loadSegments: () => loadSegments2,
       mergeSectionsForFramework: () => mergeSectionsForFramework,
       mismatchedSectionKinds: () => mismatchedSectionKinds,
       normalizeClips: () => normalizeClips,
       normalizeCreatePitchInput: () => normalizeCreatePitchInput,
-      normalizePitchContent: () => normalizePitchContent2,
+      normalizePitchContent: () => normalizePitchContent,
       normalizePitchLayout: () => normalizePitchLayout,
       parseClipsJson: () => parseClipsJson,
       parsePitchSectionsColumn: () => parsePitchSectionsColumn,
@@ -14247,7 +14089,7 @@ Please report this to https://github.com/markedjs/marked.`, e) {
     function sectionsFromDescription(description) {
       return [{ kind: "problem", body: description, mediaIds: [] }];
     }
-    function normalizePitchContent2(row) {
+    function normalizePitchContent(row) {
       const frameworkRaw = String(row.framework ?? "pas");
       const framework = isFrameworkId3(frameworkRaw) ? frameworkRaw : "pas";
       const parsed = parseSectionsJson2(
@@ -15597,7 +15439,7 @@ ${raw.slice(0, 200)}`
       }
       return { ok: true };
     }
-    var import_hp_codes = require_dist2();
+    var import_hp_codes = require_dist();
     function baseKey(pitch) {
       const result = (0, import_hp_codes.validateCode)(pitch.hpCode);
       if (!result.valid || !result.payload || !result.checkDigit) {
@@ -15797,7 +15639,7 @@ ${raw.slice(0, 200)}`
       "expired",
       "archived"
     ];
-    function assertFrameworkSwitchable2(input) {
+    function assertFrameworkSwitchable(input) {
       if (input.status === "draft") return { ok: true };
       if (input.status === "live" || input.status === "expired" || input.status === "archived") {
         return { ok: false, reason: "immutable" };
@@ -15809,7 +15651,7 @@ ${raw.slice(0, 200)}`
       if (from === "draft" && to !== "draft") {
         return { ok: false, reason: "locked" };
       }
-      return assertFrameworkSwitchable2({ status: from });
+      return assertFrameworkSwitchable({ status: from });
     }
     function isPitchLifecycleState(value) {
       return PITCH_LIFECYCLE_STATES.includes(value);
@@ -16644,7 +16486,7 @@ ${raw.slice(0, 200)}`
         };
       });
     }
-    function loadPitchSections2({
+    function loadPitchSections({
       pitchId,
       doc,
       rows,
@@ -16731,9 +16573,6 @@ ${raw.slice(0, 200)}`
   }
 });
 
-// src/config.ts
-import { Client } from "node-appwrite";
-
 // src/errors.ts
 var PitcherSdkError = class extends Error {
   code;
@@ -16773,71 +16612,50 @@ var HpCodeImmutableError = class extends PitcherSdkError {
     this.name = "HpCodeImmutableError";
   }
 };
-var AppwriteRequestError = class extends PitcherSdkError {
+var PitcherRequestError = class extends PitcherSdkError {
   status;
-  constructor(status, message) {
-    super("APPWRITE_REQUEST", message);
-    this.name = "AppwriteRequestError";
+  constructor(status, code, message) {
+    super(code || "PITCHER_REQUEST", message);
+    this.name = "PitcherRequestError";
     this.status = status;
   }
 };
 
 // src/config.ts
+var DEFAULT_PITCHER_BASE_URL = "https://mcp.honestpitches.com";
 function resolvePitcherConfig(input) {
-  if (input.initialJwt && input.apiKey) {
+  if (input.jwt && input.apiKey) {
     throw new PitcherSdkError(
       "PITCHER_AUTH_AMBIGUOUS",
-      "Set either initialJwt or apiKey, not both \u2014 the SDK can only act as one principal per client"
+      "Set either jwt or apiKey, not both \u2014 the SDK can only act as one principal per client"
     );
   }
-  const endpoint = input.endpoint?.replace(/\/$/, "");
-  if (!endpoint || !input.projectId) {
-    throw new Error("PitcherClientConfig requires endpoint and projectId");
-  }
-  const client = input.client ?? (() => {
-    const c = new Client().setEndpoint(endpoint).setProject(input.projectId);
-    return c;
-  })();
-  if (input.initialJwt) {
-    try {
-      client.setJWT(input.initialJwt);
-    } catch {
-    }
-  }
-  let jwt = input.initialJwt ?? null;
-  let jwtExpiresAt = input.initialJwtExpiresAt ?? null;
+  const baseUrl = (input.baseUrl ?? DEFAULT_PITCHER_BASE_URL).replace(/\/$/, "");
+  const state = {
+    jwt: input.jwt ?? null,
+    jwtExpiresAt: input.jwtExpiresAt ?? null
+  };
   const apiKey = input.apiKey ?? null;
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (!fetchImpl) {
+    throw new PitcherSdkError(
+      "PITCHER_NO_FETCH",
+      "PitcherClient requires a fetch implementation \u2014 Node 20+ provides globalThis.fetch; older runtimes must pass { fetchImpl }"
+    );
+  }
   return {
-    endpoint,
-    projectId: input.projectId,
-    databaseId: input.databaseId ?? "honest-pitches",
-    pitchesTableId: input.pitchesTableId ?? "pitches",
-    creatorsTableId: input.creatorsTableId ?? "creators",
-    pitchSectionsTableId: input.pitchSectionsTableId ?? "pitch_sections",
-    pitchCreateFunctionId: input.pitchCreateFunctionId ?? "pitch-write",
-    pitchAssetUploadFunctionId: input.pitchAssetUploadFunctionId ?? "pitch-asset-upload",
-    pitcherApiKeysTableId: input.pitcherApiKeysTableId ?? "pitcher_api_keys",
-    client,
-    getJwt: () => jwt,
-    getJwtExpiresAt: () => jwtExpiresAt,
+    baseUrl,
+    getJwt: () => state.jwt,
+    getJwtExpiresAt: () => state.jwtExpiresAt,
     setJwt: (next, expiresAt) => {
-      jwt = next;
-      jwtExpiresAt = expiresAt ?? null;
-      if (!apiKey) {
-        try {
-          client.setJWT(next);
-        } catch {
-        }
-      }
+      state.jwt = next;
+      state.jwtExpiresAt = expiresAt ?? null;
     },
-    getApiKey: () => apiKey
+    getApiKey: () => apiKey,
+    fetchImpl
   };
 }
 
-// src/creators.ts
-var import_pitcher_api_key_core = __toESM(require_dist(), 1);
-import { Query } from "node-appwrite";
-
 // src/jwt.ts
 function decodeJwtSub(jwt) {
   const parts = jwt.split(".");
@@ -16860,214 +16678,92 @@ function isJwtExpired(expiresAt) {
   return Date.now() >= expiresAt;
 }
 
-// src/http.ts
-import { Functions, TablesDB, AppwriteException } from "node-appwrite";
-
-// src/resolve-consolidated-route.ts
-var PUBLIC_API_FUNCTION_ID = "honest-pitches-public-api";
-var STRIPE_API_FUNCTION_ID = "stripe-api";
-var STUDIO_API_FUNCTION_ID = "honest-pitches-studio-api";
-var MEDIA_API_FUNCTION_ID = "honest-pitches-media";
-var FUNCTION_BUNDLE_MAP = {
-  "pitch-write": STUDIO_API_FUNCTION_ID,
-  "pitch-transition": STUDIO_API_FUNCTION_ID,
-  "pitch-asset-upload": MEDIA_API_FUNCTION_ID,
-  "agent-magic-link-issue": STUDIO_API_FUNCTION_ID
-};
-function resolveConsolidatedRoute(functionId, path) {
-  const bundle = FUNCTION_BUNDLE_MAP[functionId];
-  if (!bundle) return { functionId, path };
-  const sub = path.startsWith("/") ? path : `/${path}`;
-  const prefixed = sub === "/" ? `/${functionId}` : `/${functionId}${sub}`;
-  return { functionId: bundle, path: prefixed };
-}
-
-// src/http.ts
-function requireJwt(config) {
+// src/fetch-pitcher.ts
+function requireAuthHeader(config) {
+  const apiKey = config.getApiKey();
+  if (apiKey) return `Bearer ${apiKey}`;
   const jwt = config.getJwt();
   if (!jwt) {
-    throw new PitcherNotAuthenticatedError();
+    throw new PitcherNotAuthenticatedError(
+      "PitcherClient requires { apiKey: 'hp_pk_\u2026' } or { jwt: '<jwt>' }"
+    );
   }
   if (isJwtExpired(config.getJwtExpiresAt())) {
-    throw new PitcherNotAuthenticatedError("JWT expired \u2014 refresh via pitcher-mcp OAuth");
+    throw new PitcherNotAuthenticatedError(
+      "JWT expired \u2014 refresh via pitcher-mcp OAuth"
+    );
   }
-  return jwt;
+  return `Bearer ${jwt}`;
 }
-function mapAppwriteException(err, fallbackMessage) {
-  if (err instanceof AppwriteRequestError) {
-    throw err;
-  }
-  if (err instanceof AppwriteException) {
-    const status = typeof err.code === "number" && err.code > 0 ? err.code : 500;
-    if (status === 401) {
-      throw new PitcherNotAuthenticatedError(err.message || "Unauthorized");
-    }
-    throw new AppwriteRequestError(status, err.message || fallbackMessage);
-  }
-  if (typeof err === "object" && err !== null && err.name === "AppwriteException") {
-    const code = err.code;
-    const message = err.message;
-    const status = typeof code === "number" && code > 0 ? code : 500;
-    if (status === 401) {
-      throw new PitcherNotAuthenticatedError(message || "Unauthorized");
-    }
-    throw new AppwriteRequestError(status, message || fallbackMessage);
+async function fetchPitches(config, opts) {
+  const auth = requireAuthHeader(config);
+  const url = `${config.baseUrl}/pitcher${opts.path.startsWith("/") ? opts.path : `/${opts.path}`}`;
+  const headers = {
+    Authorization: auth,
+    Accept: "application/json",
+    "User-Agent": "@honest-pitches/pitch-sdk/0.5.0"
+  };
+  let body;
+  if (opts.body !== void 0 && (opts.method === "POST" || opts.method === "PATCH")) {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify(opts.body);
   }
-  throw new AppwriteRequestError(
-    500,
-    err instanceof Error ? err.message : fallbackMessage
-  );
-}
-function tablesDB(config) {
-  return new TablesDB(config.client);
-}
-function functions(config) {
-  return new Functions(config.client);
-}
-function applyApiKeyHeader(config) {
-  const apiKey = config.getApiKey();
-  if (!apiKey) return;
-  config.client.addHeader("Authorization", `Bearer ${apiKey}`);
-}
-async function executePitchFunction(config, opts) {
-  if (!config.getApiKey()) requireJwt(config);
-  applyApiKeyHeader(config);
-  const fn = functions(config);
-  const legacyFn = opts.functionId ?? config.pitchCreateFunctionId;
-  const route = resolveConsolidatedRoute(legacyFn, opts.path ?? "/");
+  let res;
   try {
-    const execution = await fn.createExecution({
-      functionId: route.functionId,
-      body: JSON.stringify(opts.body),
-      async: false,
+    res = await config.fetchImpl(url, {
       method: opts.method,
-      xpath: route.path
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      headers,
+      ...body !== void 0 ? { body } : {},
+      ...opts.signal ? { signal: opts.signal } : {}
     });
-    const status = execution.responseStatusCode ?? 201;
-    const responseBody = execution.responseBody ?? "";
-    if (status >= 400) {
-      let message = responseBody;
-      try {
-        const parsed = JSON.parse(responseBody);
-        message = parsed.error ?? responseBody;
-      } catch {
-      }
-      throw new AppwriteRequestError(status, message);
-    }
-    if (!responseBody) {
-      throw new AppwriteRequestError(status, "Empty response from pitch-write");
-    }
-    return JSON.parse(responseBody);
-  } catch (err) {
-    if (err instanceof AppwriteRequestError) throw err;
-    if (err instanceof PitcherNotAuthenticatedError) throw err;
-    mapAppwriteException(err, "pitch-write execution failed");
-  }
-}
-async function tablesListRows(config, tableId, queries) {
-  if (!config.getApiKey()) requireJwt(config);
-  applyApiKeyHeader(config);
-  try {
-    const result = await tablesDB(config).listRows({
-      databaseId: config.databaseId,
-      tableId,
-      queries
-    });
-    const total = result.total ?? 0;
-    const rows = result.rows ?? [];
-    return { total, documents: rows };
   } catch (err) {
-    mapAppwriteException(err, `listRows(${tableId}) failed`);
+    const message = err instanceof Error ? err.message : String(err);
+    throw new PitcherRequestError(0, "PITCHER_NETWORK", `fetchPitches failed: ${message}`);
   }
-}
-async function tablesGetRow(config, tableId, rowId) {
-  if (!config.getApiKey()) requireJwt(config);
-  applyApiKeyHeader(config);
+  const text = await res.text();
+  let envelope = null;
   try {
-    const row = await tablesDB(config).getRow({
-      databaseId: config.databaseId,
-      tableId,
-      rowId
-    });
-    return row;
-  } catch (err) {
-    mapAppwriteException(err, `getRow(${tableId}/${rowId}) failed`);
-  }
-}
-
-// src/creators.ts
-async function findCreatorIdForJwtUser(config) {
-  const jwt = config.getJwt();
-  if (!jwt) throw new PitcherNotAuthenticatedError();
-  const userId = decodeJwtSub(jwt);
-  if (!userId) {
-    throw new PitcherNotAuthenticatedError(
-      "JWT missing userId/sub \u2014 use account.createJWT().jwt from studio"
+    envelope = JSON.parse(text);
+  } catch {
+    throw new PitcherRequestError(
+      res.status,
+      "PITCHER_NON_JSON",
+      `MCP server returned non-JSON body (status ${res.status}): ${text.slice(0, 256)}`
     );
   }
-  const json = await tablesListRows(
-    config,
-    config.creatorsTableId,
-    [Query.equal("userId", userId), Query.limit(1)]
-  );
-  const doc = json.documents?.[0];
-  return doc?.$id ? String(doc.$id) : null;
-}
-async function findCreatorIdForApiKey(config) {
-  const apiKey = config.getApiKey();
-  if (!apiKey) {
-    throw new PitcherNotAuthenticatedError(
-      "findCreatorIdForApiKey requires the SDK to be configured with { apiKey: 'hp_pk_\u2026' }; for JWT auth use findCreatorIdForJwtUser instead"
-    );
+  if (envelope && envelope.ok === true) {
+    return envelope.data;
   }
-  if (!(0, import_pitcher_api_key_core.isWellFormedApiKey)(apiKey)) {
-    return null;
-  }
-  const keyPrefix = (0, import_pitcher_api_key_core.extractKeyPrefix)(apiKey);
-  if (!keyPrefix) {
-    return null;
+  if (envelope && envelope.ok === false) {
+    throw new PitcherRequestError(
+      res.status,
+      envelope.error.code,
+      envelope.error.message
+    );
   }
-  const apiKeyRows = await tablesListRows(
-    config,
-    config.pitcherApiKeysTableId,
-    [Query.equal("keyPrefix", keyPrefix), Query.limit(1)]
+  throw new PitcherRequestError(
+    res.status,
+    "PITCHER_MALFORMED",
+    `MCP server returned malformed envelope: ${text.slice(0, 256)}`
   );
-  const keyDoc = apiKeyRows.documents?.[0];
-  if (!keyDoc) return null;
-  const keyHash = String(keyDoc["keyHash"] ?? "");
-  if (!(0, import_pitcher_api_key_core.verifyApiKey)(apiKey, keyHash)) return null;
-  const rowShape = {
-    revokedAt: typeof keyDoc["revokedAt"] === "string" ? Date.parse(String(keyDoc["revokedAt"])) : null,
-    expiresAt: typeof keyDoc["expiresAt"] === "string" ? Date.parse(String(keyDoc["expiresAt"])) : null
-  };
-  if (!(0, import_pitcher_api_key_core.isApiKeyUsable)(rowShape)) return null;
-  const userId = String(keyDoc["userId"] ?? "");
-  if (!userId) return null;
-  const creatorRows = await tablesListRows(
-    config,
-    config.creatorsTableId,
-    [Query.equal("userId", userId), Query.limit(1)]
-  );
-  const creatorDoc = creatorRows.documents?.[0];
-  return creatorDoc?.$id ? String(creatorDoc.$id) : null;
 }
 
-// src/pitches.ts
-var import_pitch_core = __toESM(require_dist3(), 1);
-
-// src/query.ts
-import { Query as Query2 } from "node-appwrite";
-function appwriteQueryEqual(attribute, value) {
-  return Query2.equal(attribute, value);
+// src/creators.ts
+async function findCreatorIdForJwtUser(config) {
+  const result = await fetchPitches(config, {
+    method: "GET",
+    path: "/creators/me"
+  });
+  return result.creatorId;
 }
-function appwriteQueryLimit(limit) {
-  return Query2.limit(limit);
+async function findCreatorIdForApiKey(config) {
+  return findCreatorIdForJwtUser(config);
 }
 
 // src/pitches.ts
-function rowToPitch(doc, precomputedSections) {
-  const sections = precomputedSections ?? (0, import_pitch_core.normalizePitchContent)(doc).sections;
+var import_pitch_core = __toESM(require_dist2(), 1);
+function rowToPitch(doc) {
+  const sections = Array.isArray(doc.sections) ? doc.sections : [];
   const lifecycle = (0, import_pitch_core.lifecycleFromRow)({
     status: String(doc.status ?? "draft"),
     previewToken: doc.previewToken
@@ -17079,14 +16775,6 @@ function rowToPitch(doc, precomputedSections) {
     status: String(doc.status ?? "draft")
   };
 }
-async function loadPitchSectionsFor(config, pitchId) {
-  const json = await tablesListRows(
-    config,
-    config.pitchSectionsTableId,
-    [appwriteQueryEqual("pitchId", pitchId)]
-  );
-  return json.documents ?? [];
-}
 function validatePitchContent(framework, sections) {
   if (!(0, import_pitch_core.isFrameworkId)(framework)) {
     throw new InvalidSectionKindError(`Unknown framework: ${framework}`);
@@ -17099,7 +16787,9 @@ function validatePitchContent(framework, sections) {
   }
 }
 async function assertCreatorOwnedByAuthContext(config, creatorId) {
-  if (!config.getJwt()) throw new PitcherNotAuthenticatedError();
+  if (!config.getJwt() && !config.getApiKey()) {
+    throw new PitcherNotAuthenticatedError();
+  }
   const owningCreatorId = await findCreatorIdForJwtUser(config);
   if (!owningCreatorId) {
     throw new PitcherNotAuthenticatedError(
@@ -17116,10 +16806,8 @@ var PitchesApi = class {
   }
   config;
   async create(input) {
-    await assertCreatorOwnedByAuthContext(this.config, input.creatorId);
     validatePitchContent(input.framework, input.sections);
-    const switchCheck = (0, import_pitch_core.assertFrameworkSwitchable)({ status: "draft" });
-    if (!switchCheck.ok) throw new FrameworkLockedError();
+    await assertCreatorOwnedByAuthContext(this.config, input.creatorId);
     const payload = {
       creatorId: input.creatorId,
       slug: input.slug,
@@ -17134,151 +16822,198 @@ var PitchesApi = class {
       ctaLabel: input.ctaLabel ?? "Get it now",
       intendedAudience: input.intendedAudience ?? "",
       visibility: input.visibility ?? "private"
-      // 2026-06-21: `listingMode` removed (clean-break).
     };
+    if (input.honestyDisclosure != null && input.honestyDisclosure !== "") {
+      payload.honestyDisclosure = String(input.honestyDisclosure).slice(0, 2e3);
+    }
     if (input.categorySlug != null) payload.categorySlug = input.categorySlug;
     if (input.priceNote != null && input.priceNote !== "") {
       payload.priceNote = String(input.priceNote).slice(0, 64);
     }
-    const doc = await executePitchFunction(this.config, {
+    if (input.videoSource != null && input.videoSource !== "") {
+      payload.videoSource = input.videoSource;
+    }
+    if (input.videoExternalId != null && input.videoExternalId !== "") {
+      payload.videoExternalId = String(input.videoExternalId);
+    }
+    if (input.videoExternalUrl != null && input.videoExternalUrl !== "") {
+      payload.videoExternalUrl = String(input.videoExternalUrl);
+    }
+    if (input.bunnyVideoId != null && input.bunnyVideoId !== "") {
+      payload.bunnyVideoId = String(input.bunnyVideoId);
+    }
+    if (input.primaryVideo != null && input.primaryVideo !== "") {
+      payload.primaryVideo = String(input.primaryVideo);
+    }
+    if (input.primaryVideoId != null && input.primaryVideoId !== "") {
+      payload.primaryVideoId = String(input.primaryVideoId);
+    }
+    if (input.honestyDisclosure != null && input.honestyDisclosure !== "") {
+      payload.honestyDisclosure = String(input.honestyDisclosure).slice(0, 2e3);
+    }
+    const doc = await fetchPitches(this.config, {
       method: "POST",
-      path: "/",
+      path: "/pitches",
       body: payload
     });
     return rowToPitch(doc);
   }
   async get(id) {
-    const doc = await tablesGetRow(
-      this.config,
-      this.config.pitchesTableId,
-      id
-    );
-    const rows = await loadPitchSectionsFor(this.config, id);
-    const resolved = (0, import_pitch_core.loadPitchSections)({
-      pitchId: id,
-      doc,
-      rows,
-      // The SDK is silent on the self-heal path; the build log
-      // catches disagreement via its own `loadPitchSections`
-      // invocation. Keeping the SDK quiet preserves the
-      // "read-only" contract of `pitches.get`.
-      log: () => {
-      }
+    const doc = await fetchPitches(this.config, {
+      method: "GET",
+      path: `/pitches/${encodeURIComponent(id)}`
     });
-    return rowToPitch(doc, resolved.sections);
+    return rowToPitch(doc);
   }
   async find(opts = {}) {
-    const queries = [appwriteQueryLimit(opts.limit ?? 25)];
-    if (opts.status) {
-      queries.push(appwriteQueryEqual("status", opts.status));
-    }
-    const json = await tablesListRows(
-      this.config,
-      this.config.pitchesTableId,
-      queries
-    );
-    const docs = json.documents ?? [];
-    if (docs.length === 0) return [];
-    const pitchIds = docs.map((d) => String(d["$id"] ?? ""));
-    const sectionRowsByPitch = /* @__PURE__ */ new Map();
-    for (const pitchId of pitchIds) {
-      if (!pitchId) continue;
-      if (sectionRowsByPitch.has(pitchId)) continue;
-      const rows = await loadPitchSectionsFor(this.config, pitchId);
-      sectionRowsByPitch.set(pitchId, rows);
-    }
-    return docs.map((doc) => {
-      const pitchId = String(doc["$id"] ?? "");
-      const rows = sectionRowsByPitch.get(pitchId) ?? [];
-      const resolved = (0, import_pitch_core.loadPitchSections)({
-        pitchId,
-        doc,
-        rows,
-        log: () => {
-        }
-      });
-      return rowToPitch(doc, resolved.sections);
+    const params = new URLSearchParams();
+    if (opts.status) params.set("status", opts.status);
+    if (opts.creatorId) params.set("creatorId", opts.creatorId);
+    if (typeof opts.limit === "number") params.set("limit", String(opts.limit));
+    if (opts.cursor) params.set("cursor", opts.cursor);
+    const qs = params.toString();
+    const docs = await fetchPitches(this.config, {
+      method: "GET",
+      path: `/pitches${qs ? `?${qs}` : ""}`
     });
+    return docs.map((d) => rowToPitch(d));
+  }
+  /**
+   * Public alias for {@link PitchesApi.find}. Stable on the public
+   * npm registry since `@honest-pitches/pitch-sdk@0.5.2` (2026-07-28).
+   * If you see "client.pitches.list is not a function" you are on
+   * an older SDK — bump to `>=0.5.2`. (The 0.5.1 tarball on npmjs
+   * never shipped this alias even though the source landed under
+   * that version number locally; 0.5.2 is the first published cut.)
+   *
+   * (Added 2026-07-27; published 2026-07-28 after the agent bug
+   * report against CLI 0.5.1 / hosted MCP `list_pitches`.)
+   */
+  async list(opts = {}) {
+    return this.find(opts);
   }
   async update(id, input) {
-    const existing = await this.get(id);
-    await assertCreatorOwnedByAuthContext(this.config, String(existing.creatorId));
-    const nextFramework = input.framework ?? existing.framework;
-    const nextSections = input.sections ?? (0, import_pitch_core.parseSectionsJson)(existing.sections);
-    if (input.framework != null && input.framework !== existing.framework) {
-      const from = existing.lifecycle;
-      const check = (0, import_pitch_core.canChangeFramework)(from, from);
-      if (!check.ok) throw new FrameworkLockedError(check.reason);
-    }
-    validatePitchContent(nextFramework, nextSections);
-    const body = { ...input };
-    const doc = await executePitchFunction(this.config, {
+    const doc = await fetchPitches(this.config, {
       method: "PATCH",
-      path: `/${id}`,
-      body
+      path: `/pitches/${encodeURIComponent(id)}`,
+      body: { ...input }
     });
     return rowToPitch(doc);
   }
+  /**
+   * Move a pitch through its lifecycle. The returned row carries BOTH
+   * `status` (row-level persisted) and `lifecycle` (computed from
+   * `status + previewToken` server-side).
+   *
+   * Status vs lifecycle (2026-07-28 FlexTape retest doc bundle):
+   *   `lifecycle` is the canonical, computed view of where the row sits
+   *   (`draft | preview | live | expired | archived`). It is derived
+   *   from `status + previewToken` server-side in
+   *   `honest-pitches-studio-api/legacy/pitch-write/src/handler.ts`.
+   *   Branch on `lifecycle` for terminal-state checks.
+   *
+   *   The mapping is:
+   *     - `lifecycle: "draft"`    ⟷ `status: "draft"`   (no previewToken)
+   *     - `lifecycle: "preview"`  ⟷ `status: "draft"`   (previewToken set)
+   *     - `lifecycle: "live"`     ⟷ `status: "live"`
+   *     - `lifecycle: "expired"`  ⟷ `status: "expired"`
+   *     - `lifecycle: "archived"` ⟷ `status: "removed"` (intentional vocab split)
+   *
+   * Token gate (Finding #17, FlexTape retest):
+   *   `to: "preview"` requires a `previewToken` that matches the row's
+   *   stored token. The server returns
+   *   `400 previewToken is required to transition to preview`
+   *   when the token is missing or wrong.
+   *
+   *   `to: "draft"` from an `archived` row ALSO requires the same
+   *   `previewToken` (the token is the only proof the caller owns the
+   *   unarchive). There is NO `archived → preview` single-step path —
+   *   the supported path is `archived → draft` (token required) and
+   *   then `draft → preview` (which may issue a NEW token).
+   *
+   * Visibility on archive (Finding #17, FlexTape retest):
+   *   `to: "archived"` does NOT touch `visibility` — the row keeps
+   *   whatever visibility it had at the time of the archive (usually
+   *   `"public"`, but `"unlisted"` is preserved too). Only `to: "live"`
+   *   assigns `visibility: "public"`.
+   */
   async transition(id, input) {
-    const existing = await this.get(id);
-    await assertCreatorOwnedByAuthContext(this.config, String(existing.creatorId));
-    const doc = await executePitchFunction(this.config, {
+    const doc = await fetchPitches(this.config, {
       method: "POST",
-      path: `/${id}/transition`,
-      body: {
-        to: input.to,
-        previewToken: input.previewToken
-      }
+      path: `/pitches/${encodeURIComponent(id)}/transition`,
+      body: { to: input.to, previewToken: input.previewToken }
     });
     return rowToPitch(doc);
   }
   /**
    * Upload a media file (thumbnail, og-image, video-poster, etc.)
-   * to Bunny Storage via the `pitch-asset-upload` Appwrite Function
-   * and wire the resulting `pitch_assets` row onto the draft pitch.
-   *
-   * Added 2026-06-23 to address Finding #4 of
-   * `docs-new/hp-cli-cycle-finds-2026-06-23.md`. The CLI's
-   * `hp pitches media upload` command calls this method.
-   *
-   * The `kind` must be one of the `AssetKind` values exported by
-   * `@honest-pitches/pitch-asset-core`. The server reads the bytes
-   * from `bytesBase64` (the base64 of `bytes`), uploads them to
-   * Bunny Storage, and writes a `pitch_assets` row. The returned
-   * record carries the wired `bunnyPath` and `cdnUrl`.
+   * via the MCP server's `POST /pitcher/pitches/:id/media` route.
+   * The MCP server handles the Bunny Storage upload + the
+   * `pitch_assets` row insert.
    */
   async uploadMedia(input) {
-    const doc = await executePitchFunction(this.config, {
-      functionId: this.config.pitchAssetUploadFunctionId,
+    const doc = await fetchPitches(this.config, {
       method: "POST",
-      path: "/",
+      path: `/pitches/${encodeURIComponent(input.pitchId)}/media`,
       body: {
-        pitchId: input.pitchId,
         kind: input.kind,
         mimeType: input.mimeType,
-        sizeBytes: input.bytes.byteLength,
-        isPublic: input.isPublic ?? true,
-        // Buffer.from(Uint8Array) is the canonical Node 22 path to
-        // get the raw bytes. In browsers this is also covered by the
-        // same Buffer.from(uint8) shim, but the SDK is Node-only
-        // today so we don't need a cross-runtime polyfill.
-        bytesBase64: Buffer.from(input.bytes).toString("base64")
+        bytesBase64: Buffer.from(input.bytes).toString("base64"),
+        isPublic: input.isPublic ?? true
       }
     });
     return doc;
   }
   /**
-   * Restore an archived pitch to `draft` so the operator can edit
-   * and re-publish. Routes through the standard `transition` path
-   * with `to: "draft"` + a `previewToken` (required by the
-   * `pitch-write` server handler's "to=preview" pre-condition;
-   * the unarchive path reuses the same token so subsequent
-   * `draft → preview` moves don't require a re-mint).
+   * List every media asset for a pitch, joining two server-side sources:
    *
-   * Added 2026-06-23 to address Finding #5 of
-   * `docs-new/hp-cli-cycle-finds-2026-06-23.md`. The CLI's
-   * `hp pitches transition <id> --to draft` command routes through
-   * this method when the current lifecycle is `archived`.
+   *  - `pitch_assets` rows with `pitchId === id` (the explicit
+   *    uploads via `POST /pitcher/pitches/:id/media`).
+   *  - The auto-generated `thumbnailFileId` and `ogImageFileId` fields
+   *    on the pitch row itself (synthesised by `pitch-write`'s
+   *    `to=live` path; they live on the row, NOT in `pitch_assets`).
+   *
+   * Each result carries a `source: "pitch_assets" | "pitch_row"`
+   * discriminator so consumers can tell the two apart. The server
+   * may synthesise `pitch_row` rows with `sizeBytes: 0` (the auto
+   * images don't carry an upload byte count — the `cdnUrl` is the
+   * canonical handle).
+   *
+   * Added 2026-07-28 to address Bug #12 of the FlexTape retest brief
+   * (`testing-feedback/2026-07-27-flextape-rerun-3surface-retest.md`).
+   * Prior to this, `hp pitches media list <id>` returned `[]` for
+   * every pitch whose only assets were auto-generated.
+   */
+  async listMedia(id) {
+    return fetchPitches(this.config, {
+      method: "GET",
+      path: `/pitches/${encodeURIComponent(id)}/media`
+    });
+  }
+  /**
+   * Restore an archived pitch to `draft`. Same as `transition(id, {
+   * to: "draft", previewToken })` but with a placeholder previewToken
+   * if the caller didn't pass one. The server's "to=draft" path
+   * mirrors the existing "to=preview" pre-condition.
+   *
+   * Status vs lifecycle (2026-07-28 FlexTape retest doc bundle):
+   *   `pitches.lifecycle` is the canonical, computed view of where
+   *   the row sits (`draft, preview, live, expired, archived`). It is
+   *   derived from `status + previewToken` server-side
+   *   (`honest-pitches-studio-api/legacy/pitch-write/src/handler.ts`).
+   *   Branch on `lifecycle` for terminal-state checks.
+   *
+   *   The mapping is:
+   *     - `lifecycle: "preview"` ⟷ `status: "draft"` (previewToken set)
+   *     - `lifecycle: "live"`    ⟷ `status: "live"`
+   *     - `lifecycle: "archived"` ⟷ `status: "removed"` (intentional vocab split)
+   *
+   *   There is NO direct `archived → preview` path — the server only
+   *   exposes `archived → draft`. To resume preview after a draft,
+   *   transition twice (`archived → draft` then `draft → preview` with
+   *   a new preview token), or use `transition(id, { to: "preview",
+   *   previewToken })` directly if your `lifecycle` is `draft` (NOT
+   *   `archived`).
    */
   async unarchive(id, opts = {}) {
     return this.transition(id, {
@@ -17295,25 +17030,16 @@ function createPitcherClient(config) {
     pitches: new PitchesApi(resolved),
     setJwt: (jwt, expiresAt) => resolved.setJwt(jwt, expiresAt),
     getJwt: () => resolved.getJwt(),
-    resolveCreatorId: async () => {
-      const id = await findCreatorIdForJwtUser(resolved);
-      if (!id) {
-        throw new Error(
-          "No creators row for this user \u2014 sign in via studio once so user-onboard runs"
-        );
-      }
-      return id;
-    },
     findCreatorIdForJwtUser: () => findCreatorIdForJwtUser(resolved),
     findCreatorIdForApiKey: () => findCreatorIdForApiKey(resolved)
   };
 }
 
 // src/index.ts
-var import_pitch_core3 = __toESM(require_dist3(), 1);
+var import_pitch_core3 = __toESM(require_dist2(), 1);
 
 // src/scaffold.ts
-var import_pitch_core2 = __toESM(require_dist3(), 1);
+var import_pitch_core2 = __toESM(require_dist2(), 1);
 function scaffoldPitchFromFramework(input) {
   if (!(0, import_pitch_core2.isFrameworkId)(input.framework)) {
     throw new Error(`Unknown framework id: ${input.framework}`);
@@ -17334,25 +17060,37 @@ function scaffoldPitchFromFramework(input) {
     ctaLabel: input.ctaLabel
   };
 }
+
+// src/resolve-consolidated-route.ts
+var STUDIO_API_FUNCTION_ID = "honest-pitches-studio-api";
+var MEDIA_API_FUNCTION_ID = "honest-pitches-media";
+var FUNCTION_BUNDLE_MAP = {
+  "pitch-write": STUDIO_API_FUNCTION_ID,
+  "pitch-transition": STUDIO_API_FUNCTION_ID,
+  "pitch-asset-upload": MEDIA_API_FUNCTION_ID,
+  "agent-magic-link-issue": STUDIO_API_FUNCTION_ID
+};
+function resolveConsolidatedRoute(functionId, path) {
+  const bundle = FUNCTION_BUNDLE_MAP[functionId];
+  if (!bundle) return { functionId, path };
+  const sub = path.startsWith("/") ? path : `/${path}`;
+  const prefixed = sub === "/" ? `/${functionId}` : `/${functionId}${sub}`;
+  return { functionId: bundle, path: prefixed };
+}
 var export_getSegmentDefinition = import_pitch_core3.getSegmentDefinition;
 var export_loadFrameworks = import_pitch_core3.loadFrameworks;
 var export_loadSegments = import_pitch_core3.loadSegments;
 var export_suggestedSectionsForFramework = import_pitch_core3.suggestedSectionsForFramework;
 export {
-  AppwriteRequestError,
+  DEFAULT_PITCHER_BASE_URL,
   FrameworkLockedError,
   HpCodeImmutableError,
   InvalidSectionKindError,
-  MEDIA_API_FUNCTION_ID,
-  PUBLIC_API_FUNCTION_ID,
   PitcherNotAuthenticatedError,
   PitcherNotOwnedCreatorError,
+  PitcherRequestError,
   PitcherSdkError,
   PitchesApi,
-  STRIPE_API_FUNCTION_ID,
-  STUDIO_API_FUNCTION_ID,
-  appwriteQueryEqual,
-  appwriteQueryLimit,
   createPitcherClient,
   decodeJwtSub,
   findCreatorIdForApiKey,