@jclvsh/dropspace 2.23.0 → 2.24.1

package/README.md

@@ -13,6 +13,8 @@ This installs two binaries:
 - `dropspace` — CLI for terminal use
 - `dropspace-mcp` — MCP server for AI agents
 
+Imported as a library, the package resolves only through its `exports` map (`.`, `./hosted`, `./tool-policy`, `./policy`, `./package.json`); deep imports of `dist/*` are not supported.
+
 ## CLI
 
 ```bash
@@ -107,6 +109,21 @@ Add to your `.cursor/mcp.json`:
 }
 ```
 
+## Hosted Endpoint
+
+Clients that connect to a remote MCP server over HTTPS can skip the install and use:
+
+```
+https://api.dropspace.dev/mcp
+```
+
+- Transport: MCP streamable HTTP, `POST` only, stateless, JSON responses.
+- Auth: `Authorization: Bearer ds_live_...` (the same API key; its scopes apply).
+- Tools: a subset of this package. API key, webhook, boost, credit, and reddit engagement tools are only available through the npm package.
+- Every tool is annotated by class: `read` (`readOnlyHint: true`), `write`, or `sensitive` (`destructiveHint: true`: it publishes, schedules, or deletes on a connected platform, or deletes a launch or persona with no restore). The class of each hosted tool is listed at https://www.dropspace.dev/docs#mcp-hosted, and the source of truth is `src/tool-policy.ts`.
+- `create_launch` sends a content-derived `Idempotency-Key`, so a retry after a timeout returns the launch already created instead of creating a second one (the result says so).
+- Each MCP request counts once against the key's rate limit, and each tool call counts once more when it reaches the REST API.
+
 ## Available Tools
 
 ### Launches

package/dist/client.d.ts

@@ -1,12 +1,32 @@
+export interface DropspaceClientOptions {
+    /** API key to send. Defaults to the DROPSPACE_API_KEY environment variable. */
+    apiKey?: string;
+    /** REST base URL. Defaults to DROPSPACE_API_URL, then https://api.dropspace.dev. */
+    baseUrl?: string;
+}
 export declare class DropspaceClient {
     private apiKey;
     private baseUrl;
-    constructor();
+    /** True when the base URL was injected; the network-error hint then names no URL or env var. */
+    private hasInjectedBaseUrl;
+    constructor(options?: DropspaceClientOptions);
     get<T>(path: string, params?: Record<string, string>): Promise<T>;
     post<T>(path: string, body?: unknown): Promise<T>;
     put<T>(path: string, body: unknown): Promise<T>;
     patch<T>(path: string, body: unknown): Promise<T>;
     delete(path: string): Promise<void>;
+    /**
+     * POST with an Idempotency-Key. The API answers a repeat of the same key within 24 hours
+     * with the original response and `Idempotent-Replayed: true`; `replayed` surfaces that so
+     * the caller can say "nothing new was created".
+     */
+    postIdempotent<T>(path: string, body: unknown, idempotencyKey: string): Promise<{
+        result: T;
+        replayed: boolean;
+    }>;
     private request;
+    /** Read a JSON body; a timeout while the body streams gets the same message as one during fetch. */
+    private readJson;
+    private send;
     private handleError;
 }

package/dist/client.js

@@ -2,16 +2,21 @@ const REQUEST_TIMEOUT_MS = 30_000;
 export class DropspaceClient {
     apiKey;
     baseUrl;
-    constructor() {
-        const apiKey = process.env.DROPSPACE_API_KEY;
+    /** True when the base URL was injected; the network-error hint then names no URL or env var. */
+    hasInjectedBaseUrl;
+    constructor(options = {}) {
+        const apiKey = options.apiKey ?? process.env.DROPSPACE_API_KEY;
         if (!apiKey) {
             throw new Error("DROPSPACE_API_KEY environment variable is required");
         }
         if (!apiKey.startsWith("ds_live_")) {
-            throw new Error("DROPSPACE_API_KEY must start with 'ds_live_'. Get one at https://www.dropspace.dev/settings");
+            // An injected key came from a hosted caller, who never set the env var.
+            const subject = options.apiKey !== undefined ? "api key" : "DROPSPACE_API_KEY";
+            throw new Error(`${subject} must start with 'ds_live_'. Get one at https://www.dropspace.dev/settings`);
         }
         this.apiKey = apiKey;
-        this.baseUrl = (process.env.DROPSPACE_API_URL || "https://api.dropspace.dev").replace(/\/$/, "");
+        this.hasInjectedBaseUrl = Boolean(options.baseUrl);
+        this.baseUrl = (options.baseUrl || process.env.DROPSPACE_API_URL || "https://api.dropspace.dev").replace(/\/$/, "");
     }
     async get(path, params) {
         const url = new URL(`${this.baseUrl}${path}`);
@@ -63,7 +68,39 @@ export class DropspaceClient {
             throw error;
         }
     }
+    /**
+     * POST with an Idempotency-Key. The API answers a repeat of the same key within 24 hours
+     * with the original response and `Idempotent-Replayed: true`; `replayed` surfaces that so
+     * the caller can say "nothing new was created".
+     */
+    async postIdempotent(path, body, idempotencyKey) {
+        const response = await this.send(`${this.baseUrl}${path}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "Idempotency-Key": idempotencyKey },
+            body: JSON.stringify(body),
+        });
+        return {
+            result: await this.readJson(response),
+            replayed: response.headers.get("Idempotent-Replayed") === "true",
+        };
+    }
     async request(url, init) {
+        const response = await this.send(url, init);
+        return this.readJson(response);
+    }
+    /** Read a JSON body; a timeout while the body streams gets the same message as one during fetch. */
+    async readJson(response) {
+        try {
+            return (await response.json());
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === "TimeoutError") {
+                throw new Error("request timed out after 30s");
+            }
+            throw error;
+        }
+    }
+    async send(url, init) {
         let response;
         try {
             response = await fetch(url, {
@@ -80,14 +117,16 @@ export class DropspaceClient {
                 throw new Error("request timed out after 30s");
             }
             if (error instanceof TypeError) {
-                throw new Error(`network error: ${error.message}. check DROPSPACE_API_URL and your connection`);
+                throw new Error(this.hasInjectedBaseUrl
+                    ? `network error reaching the api: ${error.message}`
+                    : `network error: ${error.message}. check DROPSPACE_API_URL and your connection`);
             }
             throw error;
         }
         if (!response.ok) {
             await this.handleError(response);
         }
-        return (await response.json());
+        return response;
     }
     async handleError(response) {
         let errorMessage;

package/dist/hosted-transport.d.ts

@@ -0,0 +1,10 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Serve one MCP request over HTTP. LOCKSTEP across every apps/<app>/packages/mcp.
+ *
+ * Stateless: a fresh transport per request, no sessions, JSON responses - so it runs on
+ * serverless functions where consecutive requests from one client can land on different
+ * instances. Only POST is meaningful; the host must not route GET here (a stateless GET
+ * opens an event stream that never ends).
+ */
+export declare function serveStatelessMcp(server: McpServer, request: Request): Promise<Response>;

package/dist/hosted-transport.js

@@ -0,0 +1,17 @@
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+/**
+ * Serve one MCP request over HTTP. LOCKSTEP across every apps/<app>/packages/mcp.
+ *
+ * Stateless: a fresh transport per request, no sessions, JSON responses - so it runs on
+ * serverless functions where consecutive requests from one client can land on different
+ * instances. Only POST is meaningful; the host must not route GET here (a stateless GET
+ * opens an event stream that never ends).
+ */
+export async function serveStatelessMcp(server, request) {
+    const transport = new WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+        enableJsonResponse: true,
+    });
+    await server.connect(transport);
+    return transport.handleRequest(request);
+}

package/dist/hosted.d.ts

@@ -0,0 +1,10 @@
+export interface HostedMcpOptions {
+    /** The caller's dropspace API key. The host authenticates it before calling in. */
+    apiKey: string;
+    /** REST base URL the tools call, e.g. https://api.dropspace.dev */
+    baseUrl: string;
+    /** Reported as serverInfo.version */
+    version: string;
+}
+/** One hosted MCP request: a per-request client and server over the stateless transport. */
+export declare function handleHostedMcpRequest(request: Request, options: HostedMcpOptions): Promise<Response>;

package/dist/hosted.js

@@ -0,0 +1,9 @@
+import { DropspaceClient } from "./client.js";
+import { serveStatelessMcp } from "./hosted-transport.js";
+import { createDropspaceServer } from "./server.js";
+/** One hosted MCP request: a per-request client and server over the stateless transport. */
+export function handleHostedMcpRequest(request, options) {
+    const client = new DropspaceClient({ apiKey: options.apiKey, baseUrl: options.baseUrl });
+    const server = createDropspaceServer({ client, version: options.version, profile: "hosted" });
+    return serveStatelessMcp(server, request);
+}

package/dist/idempotency.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A content-derived Idempotency-Key for create calls.
+ *
+ * The REST API dedupes a request that repeats a key within 24 hours (per key + endpoint)
+ * and answers with the original response plus `Idempotent-Replayed: true`. Deriving the
+ * key from the arguments means a retry after a timeout - by an agent, or by a person
+ * pressing "try again" in an MCP client - returns the record that was already created
+ * instead of creating a second one.
+ */
+export declare function contentIdempotencyKey(args: unknown): Promise<string>;

package/dist/idempotency.js

@@ -0,0 +1,28 @@
+/**
+ * A content-derived Idempotency-Key for create calls.
+ *
+ * The REST API dedupes a request that repeats a key within 24 hours (per key + endpoint)
+ * and answers with the original response plus `Idempotent-Replayed: true`. Deriving the
+ * key from the arguments means a retry after a timeout - by an agent, or by a person
+ * pressing "try again" in an MCP client - returns the record that was already created
+ * instead of creating a second one.
+ */
+function stable(value) {
+    if (Array.isArray(value))
+        return value.map(stable);
+    if (value !== null && typeof value === "object") {
+        const source = value;
+        const sorted = {};
+        for (const key of Object.keys(source).sort()) {
+            if (source[key] !== undefined)
+                sorted[key] = stable(source[key]);
+        }
+        return sorted;
+    }
+    return value;
+}
+export async function contentIdempotencyKey(args) {
+    const bytes = new TextEncoder().encode(JSON.stringify(stable(args)));
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/index.js

@@ -1,42 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { DropspaceClient } from "./client.js";
-import { registerLaunchTools } from "./tools/launches.js";
-import { registerPersonaTools } from "./tools/personas.js";
-import { registerConnectionTools } from "./tools/connections.js";
-import { registerKeyTools } from "./tools/keys.js";
-import { registerWebhookTools } from "./tools/webhooks.js";
-import { registerDropspaceTools } from "./tools/dropspace.js";
-import { registerUsageTools } from "./tools/usage.js";
-import { registerCreditTools } from "./tools/credits.js";
-import { registerMediaTools } from "./tools/media.js";
-import { registerBoostTools } from "./tools/boosts.js";
-import { registerAutopilotTools } from "./tools/autopilot.js";
-import { registerRecommendationTools } from "./tools/recommendations.js";
-import { registerRedditTools } from "./tools/reddit.js";
-import { registerAudienceTools } from "./tools/audience.js";
+import { createDropspaceServer } from "./server.js";
 const requireFromHere = createRequire(import.meta.url);
 const pkg = requireFromHere("../package.json");
-const server = new McpServer({
-    name: "dropspace",
-    version: pkg.version,
-});
-const client = new DropspaceClient();
-registerLaunchTools(server, client);
-registerPersonaTools(server, client);
-registerConnectionTools(server, client);
-registerKeyTools(server, client);
-registerWebhookTools(server, client);
-registerDropspaceTools(server, client);
-registerUsageTools(server, client);
-registerCreditTools(server, client);
-registerMediaTools(server, client);
-registerBoostTools(server, client);
-registerAutopilotTools(server, client);
-registerRecommendationTools(server, client);
-registerRedditTools(server, client);
-registerAudienceTools(server, client);
+const server = createDropspaceServer({ client: new DropspaceClient(), version: pkg.version, profile: "full" });
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/dist/policy.d.ts

@@ -0,0 +1,36 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Generic tool-policy machinery. LOCKSTEP across every apps/<app>/packages/mcp
+ * (byte-identical; scripts/check-lockstep-identity.sh enforces it). The per-app
+ * table lives in tool-policy.ts next to this file.
+ *
+ * class:
+ *   read      - retrieves information; changes nothing.
+ *   write     - changes the app's own data, reversibly; nothing leaves the app.
+ *   sensitive - publishes, sends, or deletes on an external platform, deletes a record
+ *               with no user-facing restore, spends money, handles credentials, or
+ *               switches on automatic sending or posting.
+ * hosted: whether the app's hosted endpoint (api.<brand>/mcp) serves the tool.
+ * category: the documentation grouping every docs count is computed from.
+ */
+export type ToolClass = "read" | "write" | "sensitive";
+export type ToolProfile = "full" | "hosted";
+export interface ToolPolicy<Category extends string = string> {
+    class: ToolClass;
+    hosted: boolean;
+    category: Category;
+}
+export type PolicyTable<Category extends string = string> = Record<string, ToolPolicy<Category>>;
+export declare function toolPolicyFor<C extends string>(table: PolicyTable<C>, name: string): ToolPolicy<C>;
+export declare function isToolEnabledIn<C extends string>(table: PolicyTable<C>, name: string, profile: ToolProfile): boolean;
+export declare function toolAnnotationsFor<C extends string>(table: PolicyTable<C>, name: string): {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+};
+/** Tool names in a category, in table order. */
+export declare function toolsInCategoryOf<C extends string>(table: PolicyTable<C>, category: C): string[];
+/**
+ * A stand-in for McpServer that every register*Tools(server, client) function can be
+ * handed. It is the one place a tool is filtered by profile and given its annotations.
+ */
+export declare function createPolicyRegistrar<C extends string>(server: McpServer, table: PolicyTable<C>, profile: ToolProfile): McpServer;

package/dist/policy.js

@@ -0,0 +1,33 @@
+export function toolPolicyFor(table, name) {
+    const policy = table[name];
+    if (!policy) {
+        throw new Error(`tool "${name}" has no entry in tool-policy.ts - classify it before registering`);
+    }
+    return policy;
+}
+export function isToolEnabledIn(table, name, profile) {
+    const { hosted } = toolPolicyFor(table, name);
+    return profile === "full" || hosted;
+}
+export function toolAnnotationsFor(table, name) {
+    const toolClass = toolPolicyFor(table, name).class;
+    return { readOnlyHint: toolClass === "read", destructiveHint: toolClass === "sensitive" };
+}
+/** Tool names in a category, in table order. */
+export function toolsInCategoryOf(table, category) {
+    return Object.keys(table).filter((name) => table[name].category === category);
+}
+/**
+ * A stand-in for McpServer that every register*Tools(server, client) function can be
+ * handed. It is the one place a tool is filtered by profile and given its annotations.
+ */
+export function createPolicyRegistrar(server, table, profile) {
+    const registerAnnotated = server.tool.bind(server);
+    return {
+        tool(name, description, schema, handler) {
+            if (!isToolEnabledIn(table, name, profile))
+                return;
+            registerAnnotated(name, description, schema, toolAnnotationsFor(table, name), handler);
+        },
+    };
+}

package/dist/server.d.ts

@@ -0,0 +1,10 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DropspaceClient } from "./client.js";
+import { type ToolProfile } from "./policy.js";
+export interface CreateDropspaceServerOptions {
+    client: DropspaceClient;
+    version: string;
+    /** "full" serves every tool (stdio). "hosted" serves the tools marked hosted in tool-policy.ts. */
+    profile: ToolProfile;
+}
+export declare function createDropspaceServer({ client, version, profile }: CreateDropspaceServerOptions): McpServer;

package/dist/server.js

@@ -0,0 +1,36 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { createPolicyRegistrar } from "./policy.js";
+import { TOOL_POLICY } from "./tool-policy.js";
+import { registerLaunchTools } from "./tools/launches.js";
+import { registerPersonaTools } from "./tools/personas.js";
+import { registerConnectionTools } from "./tools/connections.js";
+import { registerKeyTools } from "./tools/keys.js";
+import { registerWebhookTools } from "./tools/webhooks.js";
+import { registerDropspaceTools } from "./tools/dropspace.js";
+import { registerUsageTools } from "./tools/usage.js";
+import { registerCreditTools } from "./tools/credits.js";
+import { registerMediaTools } from "./tools/media.js";
+import { registerBoostTools } from "./tools/boosts.js";
+import { registerAutopilotTools } from "./tools/autopilot.js";
+import { registerRecommendationTools } from "./tools/recommendations.js";
+import { registerRedditTools } from "./tools/reddit.js";
+import { registerAudienceTools } from "./tools/audience.js";
+export function createDropspaceServer({ client, version, profile }) {
+    const server = new McpServer({ name: "dropspace", version });
+    const registrar = createPolicyRegistrar(server, TOOL_POLICY, profile);
+    registerLaunchTools(registrar, client);
+    registerPersonaTools(registrar, client);
+    registerConnectionTools(registrar, client);
+    registerKeyTools(registrar, client);
+    registerWebhookTools(registrar, client);
+    registerDropspaceTools(registrar, client);
+    registerUsageTools(registrar, client);
+    registerCreditTools(registrar, client);
+    registerMediaTools(registrar, client);
+    registerBoostTools(registrar, client);
+    registerAutopilotTools(registrar, client);
+    registerRecommendationTools(registrar, client);
+    registerRedditTools(registrar, client);
+    registerAudienceTools(registrar, client);
+    return server;
+}

package/dist/tool-policy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The one place a tool is classified.
+ *
+ * classes are defined in policy.ts; this file only assigns them.
+ *
+ * hosted: whether the hosted endpoint (https://api.dropspace.dev/mcp) serves the tool.
+ * The stdio server serves every tool. Left off hosted: credits and boosts (payments and
+ * ad spend), API keys and webhooks (developer plumbing and credentials), and reddit
+ * engagement.
+ *
+ * category: the documentation grouping. Every tool count and category list in the docs
+ * page, llms.txt, and llms-full.txt is computed from this table.
+ *
+ * Registering a tool with no entry here throws, and __tests__/server.test.ts fails on
+ * any mismatch between this table and what the package registers.
+ */
+import { type PolicyTable, type ToolClass, type ToolPolicy, type ToolProfile } from "./policy.js";
+export type { ToolClass, ToolPolicy, ToolProfile };
+export declare const TOOL_CATEGORIES: readonly ["launches", "posts", "personas", "media", "connections", "boosts", "credits", "API keys", "webhooks", "dropspace", "usage", "autopilot", "recommendations", "reddit engagement", "audience"];
+export type ToolCategory = (typeof TOOL_CATEGORIES)[number];
+export declare const TOOL_POLICY: PolicyTable<ToolCategory>;
+export declare const toolPolicy: (name: string) => ToolPolicy<"launches" | "personas" | "connections" | "webhooks" | "usage" | "credits" | "media" | "boosts" | "autopilot" | "recommendations" | "audience" | "dropspace" | "posts" | "API keys" | "reddit engagement">;
+export declare const isToolEnabled: (name: string, profile: ToolProfile) => boolean;
+export declare const toolAnnotations: (name: string) => {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+};
+export declare const toolsInCategory: (category: ToolCategory) => string[];

package/dist/tool-policy.js

@@ -0,0 +1,143 @@
+/**
+ * The one place a tool is classified.
+ *
+ * classes are defined in policy.ts; this file only assigns them.
+ *
+ * hosted: whether the hosted endpoint (https://api.dropspace.dev/mcp) serves the tool.
+ * The stdio server serves every tool. Left off hosted: credits and boosts (payments and
+ * ad spend), API keys and webhooks (developer plumbing and credentials), and reddit
+ * engagement.
+ *
+ * category: the documentation grouping. Every tool count and category list in the docs
+ * page, llms.txt, and llms-full.txt is computed from this table.
+ *
+ * Registering a tool with no entry here throws, and __tests__/server.test.ts fails on
+ * any mismatch between this table and what the package registers.
+ */
+import { isToolEnabledIn, toolAnnotationsFor, toolPolicyFor, toolsInCategoryOf, } from "./policy.js";
+export const TOOL_CATEGORIES = [
+    "launches",
+    "posts",
+    "personas",
+    "media",
+    "connections",
+    "boosts",
+    "credits",
+    "API keys",
+    "webhooks",
+    "dropspace",
+    "usage",
+    "autopilot",
+    "recommendations",
+    "reddit engagement",
+    "audience",
+];
+const hosted = (category, toolClass) => ({
+    class: toolClass,
+    hosted: true,
+    category,
+});
+const localOnly = (category, toolClass) => ({
+    class: toolClass,
+    hosted: false,
+    category,
+});
+export const TOOL_POLICY = {
+    // launches
+    list_launches: hosted("launches", "read"),
+    get_launch: hosted("launches", "read"),
+    get_launch_status: hosted("launches", "read"),
+    get_launch_analytics: hosted("launches", "read"),
+    get_batch_launch_analytics: hosted("launches", "read"),
+    // create and update accept `publish` / `scheduled_date`, so either can put a post out
+    create_launch: hosted("launches", "sensitive"),
+    update_launch: hosted("launches", "sensitive"),
+    // a soft delete with no user-facing restore
+    delete_launch: hosted("launches", "sensitive"),
+    generate_content: hosted("launches", "write"),
+    retry_launch_content: hosted("launches", "write"),
+    publish_launch: hosted("launches", "sensitive"),
+    retry_launch: hosted("launches", "sensitive"),
+    // posts
+    delete_post: hosted("posts", "sensitive"),
+    delete_all_posts: hosted("posts", "sensitive"),
+    // personas
+    list_personas: hosted("personas", "read"),
+    get_persona: hosted("personas", "read"),
+    create_persona: hosted("personas", "write"),
+    update_persona: hosted("personas", "write"),
+    // a soft delete with no user-facing restore
+    delete_persona: hosted("personas", "sensitive"),
+    analyze_persona: hosted("personas", "write"),
+    finalize_persona: hosted("personas", "write"),
+    discard_persona_analysis: hosted("personas", "write"),
+    // media
+    generate_media: hosted("media", "write"),
+    get_media_job: hosted("media", "read"),
+    // connections
+    list_connections: hosted("connections", "read"),
+    // edits the profile ON the platform (youtube channel description)
+    update_connection_profile: hosted("connections", "sensitive"),
+    // autopilot
+    get_autopilot: hosted("autopilot", "read"),
+    list_autopilot_review: hosted("autopilot", "read"),
+    list_autopilot_runs: hosted("autopilot", "read"),
+    // deletes the draft launch with no restore
+    reject_autopilot_draft: hosted("autopilot", "sensitive"),
+    // enabling autopilot leads to posts with no further per-post step
+    configure_autopilot: hosted("autopilot", "sensitive"),
+    approve_autopilot_draft: hosted("autopilot", "sensitive"),
+    run_autopilot_now: hosted("autopilot", "sensitive"),
+    // recommendations
+    list_recommendations: hosted("recommendations", "read"),
+    // creates a DRAFT launch or a PAUSED boost; nothing publishes or spends
+    apply_recommendation: hosted("recommendations", "write"),
+    dismiss_recommendation: hosted("recommendations", "write"),
+    // audience, usage, status
+    get_audience: hosted("audience", "read"),
+    get_usage: hosted("usage", "read"),
+    get_changelog: hosted("usage", "read"),
+    get_dropspace_status: hosted("dropspace", "read"),
+    // reddit engagement
+    suggest_subreddits: localOnly("reddit engagement", "read"),
+    get_engagement_config: localOnly("reddit engagement", "read"),
+    get_engagement_standing: localOnly("reddit engagement", "read"),
+    list_engagement_comments: localOnly("reddit engagement", "read"),
+    update_engagement_config: localOnly("reddit engagement", "write"),
+    discover_engagement: localOnly("reddit engagement", "write"),
+    reject_engagement_comment: localOnly("reddit engagement", "write"),
+    activate_engagement_subreddit: localOnly("reddit engagement", "write"),
+    deactivate_engagement_subreddit: localOnly("reddit engagement", "write"),
+    approve_engagement_comment: localOnly("reddit engagement", "sensitive"),
+    // credits
+    get_credit_balance: localOnly("credits", "read"),
+    purchase_credit_pack: localOnly("credits", "sensitive"),
+    // boosts
+    list_boosts: localOnly("boosts", "read"),
+    get_boost: localOnly("boosts", "read"),
+    get_boost_performance: localOnly("boosts", "read"),
+    create_boost: localOnly("boosts", "write"),
+    activate_boost: localOnly("boosts", "sensitive"),
+    cancel_boost: localOnly("boosts", "sensitive"),
+    // api keys
+    get_current_api_key: localOnly("API keys", "read"),
+    list_api_keys: localOnly("API keys", "read"),
+    rename_api_key: localOnly("API keys", "write"),
+    create_api_key: localOnly("API keys", "sensitive"),
+    revoke_api_key: localOnly("API keys", "sensitive"),
+    rotate_api_key: localOnly("API keys", "sensitive"),
+    // webhooks
+    list_webhooks: localOnly("webhooks", "read"),
+    get_webhook: localOnly("webhooks", "read"),
+    list_webhook_deliveries: localOnly("webhooks", "read"),
+    create_webhook: localOnly("webhooks", "write"),
+    update_webhook: localOnly("webhooks", "write"),
+    // a hard delete with no restore
+    delete_webhook: localOnly("webhooks", "sensitive"),
+    test_webhook: localOnly("webhooks", "write"),
+    rotate_webhook_secret: localOnly("webhooks", "sensitive"),
+};
+export const toolPolicy = (name) => toolPolicyFor(TOOL_POLICY, name);
+export const isToolEnabled = (name, profile) => isToolEnabledIn(TOOL_POLICY, name, profile);
+export const toolAnnotations = (name) => toolAnnotationsFor(TOOL_POLICY, name);
+export const toolsInCategory = (category) => toolsInCategoryOf(TOOL_POLICY, category);

package/dist/tools/launches.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { contentIdempotencyKey } from "../idempotency.js";
 // 11 enum values but only 10 distinct platforms — linkedin-community is a LinkedIn variant, not a separate platform.
 // auto-post (7): facebook, linkedin, twitter, reddit, instagram, tiktok, youtube
 // guided  (3): substack, producthunt, hackernews
@@ -161,9 +162,20 @@ export function registerLaunchTools(server, client) {
             };
         }
         try {
-            const result = await client.post("/launches", args);
+            // A retry after a timeout (by an agent, or a person pressing "try again") must not
+            // create a second launch: the key is derived from the arguments, so the API replays
+            // the launch it already created for them.
+            const { result, replayed } = await client.postIdempotent("/launches", args, await contentIdempotencyKey(args));
+            const text = JSON.stringify(result, null, 2);
             return {
-                content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+                content: [
+                    {
+                        type: "text",
+                        text: replayed
+                            ? `note: an identical launch was created within the last 24 hours, so dropspace returned it - no new launch was created.\n${text}`
+                            : text,
+                    },
+                ],
             };
         }
         catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jclvsh/dropspace",
-	"version": "2.23.0",
+	"version": "2.24.1",
 	"description": "MCP server and CLI for the Dropspace API",
 	"repository": {
 		"type": "git",
@@ -10,6 +10,25 @@
 	"type": "module",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		},
+		"./hosted": {
+			"types": "./dist/hosted.d.ts",
+			"default": "./dist/hosted.js"
+		},
+		"./policy": {
+			"types": "./dist/policy.d.ts",
+			"default": "./dist/policy.js"
+		},
+		"./tool-policy": {
+			"types": "./dist/tool-policy.d.ts",
+			"default": "./dist/tool-policy.js"
+		},
+		"./package.json": "./package.json"
+	},
 	"bin": {
 		"dropspace-mcp": "dist/index.js",
 		"dropspace": "dist/cli.js"
@@ -20,17 +39,21 @@
 	],
 	"scripts": {
 		"build": "tsc",
+		"prepare": "tsc",
 		"prepublishOnly": "npm run build",
-		"start": "node dist/index.js"
+		"start": "node dist/index.js",
+		"typecheck": "tsc -p tsconfig.test.json",
+		"test": "vitest run"
 	},
 	"dependencies": {
-		"@modelcontextprotocol/sdk": "^1.11.0",
+		"@modelcontextprotocol/sdk": "^1.26.0",
 		"commander": "^14.0.3",
 		"zod": "^3.24.0"
 	},
 	"devDependencies": {
 		"@types/node": "^22.0.0",
-		"typescript": "^5.7.0"
+		"typescript": "^5.7.0",
+		"vitest": "^4.0.18"
 	},
 	"engines": {
 		"node": ">=18"