@labelgrid/mcp 0.2.2 → 0.3.1

package/dist/tools/releases.js

@@ -0,0 +1,177 @@
+/**
+ * Releases toolset: release-level reads (review results, the delivery queue,
+ * the smart-link landing config, track licenses) plus the safe-write release
+ * checks, landing-page management and review-issue notes.
+ *
+ * The two [proj] reads (`get_release_review`, `get_delivery_queue`) default to
+ * concise-mode projection; `response_format: 'detailed'` returns the verbatim
+ * API response.
+ */
+import { z } from 'zod';
+import { applyProjection } from '../projection.js';
+const releaseId = z.number().int().positive().describe('The release id.');
+const responseFormat = z
+    .enum(['concise', 'detailed'])
+    .optional()
+    .describe("'concise' (default) keeps only the high-signal fields (ids always kept); 'detailed' returns the verbatim API response.");
+const getReleaseReview = {
+    name: 'get_release_review',
+    toolset: 'releases',
+    gate: 'read',
+    title: 'Get release review results',
+    description: "Read a release's automated quality-check results. Pick ONE view with `view`: " +
+        '`issues` lists the review issues raised against the release — each carries a code (see list_reference_data type issue_definitions), severity, and whether it blocks distribution; use it to see what must be fixed before the release can go out. ' +
+        '`quality_report` retrieves the Preflight QC quality report — the customer-facing issues found by the automated checks, to review before confirming the release into distribution; Preflight QC is an optional add-on — without it the API returns a 403, surfaced verbatim. ' +
+        "response_format:'detailed' returns the verbatim API response.",
+    inputShape: {
+        release_id: releaseId,
+        view: z.enum(['issues', 'quality_report']).describe('Which review read.'),
+        response_format: responseFormat,
+    },
+    annotations: { readOnlyHint: true },
+    handler: async (args, { client }) => {
+        const result = args.view === 'quality_report'
+            ? await client.get(`/releases/${args.release_id}/quality-report`)
+            : await client.get('/review-issues', { release_id: args.release_id });
+        return applyProjection(result, 'get_release_review', args.response_format);
+    },
+};
+const getDeliveryQueue = {
+    name: 'get_delivery_queue',
+    toolset: 'releases',
+    gate: 'read',
+    title: 'Get the distribution queue',
+    description: 'List the distribution queue entries for your account, paginated — one entry per (release, outlet) delivery with its current status (e.g. pending review, processing, scheduled, complete, error) — where a release is in the delivery pipeline to each store. Filter by `release_id`, `outlet_id`, or `status`. ' +
+        "response_format:'detailed' returns the verbatim API response.",
+    inputShape: {
+        release_id: z.number().int().positive().optional().describe('Filter to one release.'),
+        outlet_id: z.number().int().positive().optional().describe('Filter to one outlet/store.'),
+        status: z.string().optional().describe('Filter by delivery status.'),
+        page: z.number().int().positive().optional(),
+        per_page: z.number().int().positive().optional(),
+        response_format: responseFormat,
+    },
+    annotations: { readOnlyHint: true },
+    handler: async (args, { client }) => {
+        const result = await client.get('/queues/distro', {
+            page: args.page,
+            per_page: args.per_page,
+            filter: {
+                release_id: args.release_id,
+                outlet_id: args.outlet_id,
+                status: args.status,
+            },
+        });
+        return applyProjection(result, 'get_delivery_queue', args.response_format);
+    },
+};
+const getLandingConfig = {
+    name: 'get_landing_config',
+    toolset: 'releases',
+    gate: 'read',
+    title: 'Get a release landing-page config',
+    description: 'Retrieve the smart-link landing-page configuration for a release: whether the links page is enabled, its style/mode, custom copy, the action list and any pre-order links. Pair with manage_release_links (action update_landing_config) to change it.',
+    inputShape: { release_id: releaseId },
+    annotations: { readOnlyHint: true },
+    handler: (args, { client }) => client.get(`/releases/${args.release_id}/landing-config`),
+};
+const listTrackLicenses = {
+    name: 'list_track_licenses',
+    toolset: 'releases',
+    gate: 'read',
+    title: 'List track licenses',
+    description: 'List the licenses attached to a track (e.g. cover/mechanical or sample clearances), paginated. Pass `license_id` to retrieve one license by its id instead.',
+    inputShape: {
+        track_id: z.number().int().positive().describe('The track id.'),
+        license_id: z
+            .number()
+            .int()
+            .positive()
+            .optional()
+            .describe('Retrieve one license by id instead of listing.'),
+        page: z.number().int().positive().optional(),
+        per_page: z.number().int().positive().optional(),
+    },
+    annotations: { readOnlyHint: true },
+    handler: (args, { client }) => {
+        if (args.license_id !== undefined) {
+            return client.get(`/tracks/${args.track_id}/licenses/${args.license_id}`);
+        }
+        return client.get(`/tracks/${args.track_id}/licenses`, {
+            page: args.page,
+            per_page: args.per_page,
+        });
+    },
+};
+const runReleaseChecks = {
+    name: 'run_release_checks',
+    toolset: 'releases',
+    gate: 'safe_write',
+    title: 'Run release checks',
+    description: 'Run an automated check on a release. Pick ONE with `check`: ' +
+        '`validate` returns any problems that would block distribution, as a human-readable `errors` list and a machine-readable `errors_structured` list — it changes nothing and is safe to repeat; run it before distributing. ' +
+        '`refresh_quality_report` re-runs the Preflight QC checks and refreshes the quality report (read it with get_release_review view quality_report); the server applies an hourly refresh budget, so frequent calls may be rate-limited. Preflight QC is an optional add-on.',
+    inputShape: {
+        release_id: releaseId,
+        check: z.enum(['validate', 'refresh_quality_report']).describe('Which check to run.'),
+    },
+    annotations: { idempotentHint: true },
+    handler: (args, { client }) => args.check === 'refresh_quality_report'
+        ? client.post(`/releases/${args.release_id}/quality-report/refresh`)
+        : client.post(`/releases/${args.release_id}/validate`),
+};
+const manageReleaseLinks = {
+    name: 'manage_release_links',
+    toolset: 'releases',
+    gate: 'safe_write',
+    title: 'Manage a release smart link',
+    description: "Manage a release's smart-link landing page. Pick ONE action with `action`: " +
+        '`update_landing_config` replaces the landing-page configuration with `config` (required for this action) — `config.actions` uses the current (v2) action-list contract (one entry per call-to-action); other keys: links_page_enabled, config_mode, page_style, custom_cta_text, custom_description, pre_order_links. ' +
+        "`create_short_url` creates (or returns the existing) short URL for the release's smart-link landing page — safe to repeat.",
+    inputShape: {
+        release_id: releaseId,
+        action: z.enum(['update_landing_config', 'create_short_url']).describe('Which action.'),
+        config: z
+            .record(z.string(), z.unknown())
+            .optional()
+            .describe('The landing-page configuration to set (required for update_landing_config).'),
+    },
+    annotations: {},
+    handler: (args, { client }) => {
+        if (args.action === 'create_short_url') {
+            return client.post('/releases/short-url', { release_id: args.release_id });
+        }
+        if (args.config === undefined) {
+            return Promise.resolve({
+                error: {
+                    code: 'INVALID_SELECTOR',
+                    message: "action 'update_landing_config' requires `config` — the landing-page configuration to set.",
+                    status: 0,
+                },
+            });
+        }
+        return client.put(`/releases/${args.release_id}/landing-config`, args.config);
+    },
+};
+const addReviewIssueNote = {
+    name: 'add_review_issue_note',
+    toolset: 'releases',
+    gate: 'safe_write',
+    title: 'Add a note to a review issue',
+    description: 'Add a note to a release review issue — to explain a fix or add reviewer context. `review_issue_id` comes from get_release_review view issues.',
+    inputShape: {
+        review_issue_id: z.number().int().positive(),
+        note: z.string().describe('The note text to attach to the issue.'),
+    },
+    annotations: {},
+    handler: (args, { client }) => client.post(`/review-issues/${args.review_issue_id}/notes`, { note: args.note }),
+};
+export const releaseTools = [
+    getReleaseReview,
+    getDeliveryQueue,
+    getLandingConfig,
+    listTrackLicenses,
+    runReleaseChecks,
+    manageReleaseLinks,
+    addReviewIssueNote,
+];

package/dist/tools/setup.js

@@ -39,7 +39,7 @@ const SETUP_GUIDE = {
     optional_settings: [
         'LABELGRID_ENABLE_WRITES — safe draft-stage writes; on by default, set false for read-only (see the README Safety section).',
         'LABELGRID_ENABLE_FULL_WRITES (plus LABELGRID_FULL_WRITES_ACK) — arm consequential distribution actions; off by default (see the README Safety section).',
-        'LABELGRID_TOOLSETS — expose only a comma-separated subset of toolsets (see the README Safety section).',
+        'LABELGRID_TOOLSETS — expose only a comma-separated subset of toolsets: account, reference, catalog, releases, insights, finance, webhooks, distribution (pre-0.3.0 names are still accepted as aliases). The webhooks toolset is off by default — name it explicitly here to enable it (see the README Configuration section).',
         'LABELGRID_READ_ONLY — force reads only, overriding the write flags (see the README Safety section).',
     ],
 };

package/dist/tools/types.d.ts

@@ -7,8 +7,8 @@
  * into a registered MCP tool. This keeps every tool a thin wrapper: one HTTP
  * call, no client-side business logic.
  */
+import type { ApiResult, LabelGridClient } from '@labelgrid/core';
 import type { z } from 'zod';
-import type { ApiResult, LabelGridClient } from '../api/http.js';
 import type { Config } from '../config.js';
 import type { Gate } from '../gating.js';
 export type ToolAnnotations = {

package/dist/tools/webhooks.d.ts

@@ -1,7 +1,7 @@
 /**
- * Webhooks toolset: read your webhook subscriptions and delivery logs, and
- * manage them (create/update/delete/test/rotate-secret). Reads are always on;
- * the mutations are safe writes.
+ * Webhooks toolset: read your webhook subscriptions and delivery logs
+ * (list_webhooks) and manage them (manage_webhook: create/update/delete/test/
+ * rotate_secret). The read is always on; the mutations are safe writes.
  */
 import type { ToolDef } from './types.js';
 export declare const webhookTools: ToolDef[];

package/dist/tools/webhooks.js

@@ -1,124 +1,92 @@
 /**
- * Webhooks toolset: read your webhook subscriptions and delivery logs, and
- * manage them (create/update/delete/test/rotate-secret). Reads are always on;
- * the mutations are safe writes.
+ * Webhooks toolset: read your webhook subscriptions and delivery logs
+ * (list_webhooks) and manage them (manage_webhook: create/update/delete/test/
+ * rotate_secret). The read is always on; the mutations are safe writes.
  */
 import { z } from 'zod';
-const webhookId = z.number().int().positive().describe('The webhook id.');
-const eventsShape = z
-    .record(z.string(), z.unknown())
-    .describe('The event subscription object selecting which event types this webhook receives. Call list_webhook_event_types for the available types and each payload shape.');
+const webhookId = z.number().int().positive().optional().describe('The webhook id.');
 const listWebhooks = {
     name: 'list_webhooks',
     toolset: 'webhooks',
     gate: 'read',
     title: 'List webhooks',
-    description: 'List the webhook subscriptions configured on your account, each with its URL, subscribed events and active state.',
-    inputShape: {},
-    annotations: { readOnlyHint: true },
-    handler: (_args, { client }) => client.get('/webhooks'),
-};
-const getWebhook = {
-    name: 'get_webhook',
-    toolset: 'webhooks',
-    gate: 'read',
-    title: 'Get a webhook',
-    description: 'Retrieve one webhook subscription by id.',
-    inputShape: { webhook_id: webhookId },
-    annotations: { readOnlyHint: true },
-    handler: (args, { client }) => client.get(`/webhooks/${args.webhook_id}`),
-};
-const getWebhookLogs = {
-    name: 'get_webhook_logs',
-    toolset: 'webhooks',
-    gate: 'read',
-    title: 'Get webhook delivery logs',
-    description: 'Retrieve the recent delivery log for a webhook — the attempts, response codes and outcomes — to debug why events did or did not reach your endpoint.',
-    inputShape: { webhook_id: webhookId },
-    annotations: { readOnlyHint: true },
-    handler: (args, { client }) => client.get(`/webhooks/${args.webhook_id}/logs`),
-};
-const listWebhookEventTypes = {
-    name: 'list_webhook_event_types',
-    toolset: 'webhooks',
-    gate: 'read',
-    title: 'List webhook event types',
-    description: 'List every available webhook event type, each with the schema of the payload it delivers. Use it to decide which events to subscribe a webhook to.',
-    inputShape: {},
-    annotations: { readOnlyHint: true },
-    handler: (_args, { client }) => client.get('/webhooks/event-types'),
-};
-const createWebhook = {
-    name: 'create_webhook',
-    toolset: 'webhooks',
-    gate: 'safe_write',
-    title: 'Create a webhook',
-    description: 'Create a webhook subscription. `name` and `url` (the HTTPS endpoint that will receive events) are required, along with `events` selecting which event types to deliver. The API returns a signing secret once on creation — store it to verify incoming payloads.',
+    description: "Read your webhook subscriptions. `view: 'config'` (the default) lists the webhook subscriptions configured on your account — each with its URL, subscribed events and active state — or retrieves one subscription when `webhook_id` is given. " +
+        "`view: 'logs'` retrieves the recent delivery log for a webhook (`webhook_id` required) — attempts, response codes and outcomes — to debug why events did or did not reach your endpoint.",
     inputShape: {
-        name: z.string().describe('A label for this webhook.'),
-        url: z.string().describe('The HTTPS endpoint that will receive event deliveries.'),
-        events: eventsShape,
+        webhook_id: webhookId,
+        view: z
+            .enum(['config', 'logs'])
+            .optional()
+            .describe('config (default) reads subscriptions; logs reads a webhook’s delivery log.'),
+    },
+    annotations: { readOnlyHint: true },
+    handler: (args, { client }) => {
+        const view = args.view ?? 'config';
+        if (view === 'logs') {
+            if (args.webhook_id === undefined) {
+                return Promise.resolve({
+                    error: {
+                        code: 'INVALID_SELECTOR',
+                        message: "view 'logs' requires `webhook_id` — the webhook whose delivery log to read.",
+                        status: 0,
+                    },
+                });
+            }
+            return client.get(`/webhooks/${args.webhook_id}/logs`);
+        }
+        if (args.webhook_id !== undefined) {
+            return client.get(`/webhooks/${args.webhook_id}`);
+        }
+        return client.get('/webhooks');
     },
-    annotations: {},
-    handler: (args, { client }) => client.post('/webhooks', { name: args.name, url: args.url, events: args.events }),
 };
-const updateWebhook = {
-    name: 'update_webhook',
+const manageWebhook = {
+    name: 'manage_webhook',
     toolset: 'webhooks',
     gate: 'safe_write',
-    title: 'Update a webhook',
-    description: 'Update a webhook subscription. Supply only the fields you want to change: `name`, `url`, `events`, or `is_active` (set false to pause deliveries).',
+    title: 'Manage a webhook',
+    description: 'Manage a webhook subscription. Pick ONE action with `action`: ' +
+        '`create` — pass `fields` with `name`, `url` (the HTTPS endpoint receiving deliveries) and `events` (the event subscription object — see list_reference_data type webhook_event_types); the API returns a signing secret ONCE on creation — store it to verify incoming payloads. ' +
+        '`update` — supply only the fields to change in `fields`: name, url, events, or is_active (false pauses deliveries). ' +
+        '`delete` — permanently removes the subscription; it stops receiving events. ' +
+        '`test` — sends a test event to confirm reachability and signature verification; safe to repeat. ' +
+        '`rotate_secret` — generates and returns a new signing secret — WARNING: the old secret stops working immediately; update your endpoint right away or deliveries will fail verification. ' +
+        '`webhook_id` is required for every action except create.',
     inputShape: {
+        action: z
+            .enum(['create', 'update', 'delete', 'test', 'rotate_secret'])
+            .describe('Which action.'),
         webhook_id: webhookId,
-        name: z.string().optional(),
-        url: z.string().optional(),
-        events: eventsShape.optional(),
-        is_active: z.boolean().optional().describe('Set false to pause deliveries.'),
+        fields: z
+            .record(z.string(), z.unknown())
+            .optional()
+            .describe('The webhook attributes (create: name, url, events; update: any of those plus is_active), forwarded verbatim.'),
     },
-    annotations: {},
+    annotations: { destructiveHint: true },
     handler: (args, { client }) => {
-        const { webhook_id, ...body } = args;
-        return client.patch(`/webhooks/${webhook_id}`, body);
+        const action = args.action;
+        if (action === 'create') {
+            return client.post('/webhooks', args.fields);
+        }
+        if (args.webhook_id === undefined) {
+            return Promise.resolve({
+                error: {
+                    code: 'INVALID_SELECTOR',
+                    message: `action '${action}' requires \`webhook_id\` — the webhook to act on. Only action 'create' works without one.`,
+                    status: 0,
+                },
+            });
+        }
+        switch (action) {
+            case 'update':
+                return client.patch(`/webhooks/${args.webhook_id}`, args.fields);
+            case 'delete':
+                return client.delete(`/webhooks/${args.webhook_id}`);
+            case 'test':
+                return client.post(`/webhooks/${args.webhook_id}/test`);
+            default: // rotate_secret
+                return client.post(`/webhooks/${args.webhook_id}/regenerate-secret`);
+        }
     },
 };
-const deleteWebhook = {
-    name: 'delete_webhook',
-    toolset: 'webhooks',
-    gate: 'safe_write',
-    title: 'Delete a webhook',
-    description: 'Delete a webhook subscription permanently. It will stop receiving events.',
-    inputShape: { webhook_id: webhookId },
-    annotations: { destructiveHint: true },
-    handler: (args, { client }) => client.delete(`/webhooks/${args.webhook_id}`),
-};
-const testWebhook = {
-    name: 'test_webhook',
-    toolset: 'webhooks',
-    gate: 'safe_write',
-    title: 'Send a test webhook event',
-    description: 'Send a test event to a webhook’s endpoint so you can confirm it is reachable and your signature verification works. Safe to repeat.',
-    inputShape: { webhook_id: webhookId },
-    annotations: { idempotentHint: true },
-    handler: (args, { client }) => client.post(`/webhooks/${args.webhook_id}/test`),
-};
-const rotateWebhookSecret = {
-    name: 'rotate_webhook_secret',
-    toolset: 'webhooks',
-    gate: 'safe_write',
-    title: 'Rotate a webhook signing secret',
-    description: 'Generate a new signing secret for a webhook and return it. WARNING: the old secret stops working immediately — update your endpoint’s signature verification with the new secret right away or deliveries will fail verification.',
-    inputShape: { webhook_id: webhookId },
-    annotations: { destructiveHint: true },
-    handler: (args, { client }) => client.post(`/webhooks/${args.webhook_id}/regenerate-secret`),
-};
-export const webhookTools = [
-    listWebhooks,
-    getWebhook,
-    getWebhookLogs,
-    listWebhookEventTypes,
-    createWebhook,
-    updateWebhook,
-    deleteWebhook,
-    testWebhook,
-    rotateWebhookSecret,
-];
+export const webhookTools = [listWebhooks, manageWebhook];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@labelgrid/mcp",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "mcpName": "io.github.labelgrid/labelgrid-mcp",
   "description": "Official LabelGrid MCP server — connect your AI client to your LabelGrid account",
   "type": "module",
@@ -12,32 +12,23 @@
   "files": ["dist", "README.md", "CHANGELOG.md", "LICENSE", "server.json"],
   "scripts": {
     "build": "tsc",
-    "build:mcpb": "npm run build && node scripts/build-mcpb.mjs",
     "start": "node dist/index.js",
     "dev": "tsc --watch",
     "test": "vitest run --exclude 'test/contract/**'",
-    "test:contract": "vitest run test/contract",
-    "lint": "biome check .",
-    "leak-guard": "node scripts/leak-guard.mjs",
-    "check-coverage": "node scripts/check-api-coverage.mjs",
-    "gen-docs": "node scripts/gen-tool-docs.mjs"
+    "test:contract": "vitest run test/contract"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/labelgrid/labelgrid-mcp.git"
+    "url": "git+https://github.com/labelgrid/labelgrid-mcp.git",
+    "directory": "packages/mcp"
   },
   "license": "MIT",
   "engines": {
     "node": ">=20"
   },
   "dependencies": {
+    "@labelgrid/core": "0.1.0",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
-  },
-  "devDependencies": {
-    "@biomejs/biome": "^1.9.0",
-    "@types/node": "^22.0.0",
-    "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
   }
 }

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.labelgrid/labelgrid-mcp",
   "description": "Official LabelGrid MCP server — manage your music catalog, releases, analytics and distribution.",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "websiteUrl": "https://labelgrid.com",
   "repository": {
     "url": "https://github.com/labelgrid/labelgrid-mcp",
@@ -12,7 +12,7 @@
     {
       "registryType": "npm",
       "identifier": "@labelgrid/mcp",
-      "version": "0.2.2",
+      "version": "0.3.1",
       "transport": {
         "type": "stdio"
       },
@@ -50,7 +50,7 @@
         },
         {
           "name": "LABELGRID_TOOLSETS",
-          "description": "Comma-separated subset of toolsets to expose (identity, reference, catalog, releases, review, analytics, accounting, delivery, webhooks, distribution). Defaults to all.",
+          "description": "Comma-separated subset of toolsets to expose (account, reference, catalog, releases, insights, finance, webhooks, distribution; pre-0.3.0 names are accepted as aliases). Defaults to all except webhooks, which must be named explicitly to enable.",
           "isRequired": false,
           "format": "string"
         },

package/dist/api/content-types.d.ts

@@ -1,33 +0,0 @@
-/**
- * Shared file content-type inference and the upload extension allow-list guard.
- *
- * CONTENT_TYPES (moved here from upload.ts) infers a best-effort MIME type from
- * a file extension — used for the presigned PUT and the multipart Blob.
- * assertAllowedExtension is the per-tool guard: each file-accepting tool
- * declares exactly which extensions it accepts, and the guard rejects anything
- * else BEFORE the file is read or any HTTP call is made, so an upload tool can
- * never be pointed at an arbitrary local file.
- */
-import type { ApiError } from './http.js';
-/** Best-effort Content-Type inferred from a file extension. */
-export declare const CONTENT_TYPES: Record<string, string>;
-/** Best-effort Content-Type for a file path (default application/octet-stream). */
-export declare function contentType(filePath: string): string;
-/**
- * Rejects a file whose extension is not in `allowed` (case-insensitive), before
- * any read or HTTP call, and resolves the path to its real target. The supplied
- * path's extension is checked first (the fast path); then the path is resolved
- * with realpathSync and the REAL target's extension is checked too, so a symlink
- * named `cover.jpg` that points at an arbitrary local file cannot slip past the
- * guard. On success it returns `{ realPath }` — the resolved canonical path,
- * which the caller MUST use as the path it reads/uploads (never the original
- * argument), so a symlink retargeted after validation cannot redirect the read
- * (the resolved target is what gets uploaded). On failure it returns `{ error }`
- * — a structured FILE_TYPE_NOT_ALLOWED, or FILE_NOT_FOUND if the path does not
- * resolve.
- */
-export declare function assertAllowedExtension(filePath: string, allowed: string[]): {
-    error: ApiError;
-} | {
-    realPath: string;
-};

package/dist/api/content-types.js

@@ -1,87 +0,0 @@
-/**
- * Shared file content-type inference and the upload extension allow-list guard.
- *
- * CONTENT_TYPES (moved here from upload.ts) infers a best-effort MIME type from
- * a file extension — used for the presigned PUT and the multipart Blob.
- * assertAllowedExtension is the per-tool guard: each file-accepting tool
- * declares exactly which extensions it accepts, and the guard rejects anything
- * else BEFORE the file is read or any HTTP call is made, so an upload tool can
- * never be pointed at an arbitrary local file.
- */
-import { realpathSync } from 'node:fs';
-import { extname } from 'node:path';
-/** Best-effort Content-Type inferred from a file extension. */
-export const CONTENT_TYPES = {
-    '.wav': 'audio/wav',
-    '.flac': 'audio/flac',
-    '.aif': 'audio/aiff',
-    '.aiff': 'audio/aiff',
-    '.mp3': 'audio/mpeg',
-    '.lrc': 'text/plain',
-    '.txt': 'text/plain',
-    '.jpg': 'image/jpeg',
-    '.jpeg': 'image/jpeg',
-    '.png': 'image/png',
-    '.webp': 'image/webp',
-    '.tif': 'image/tiff',
-    '.tiff': 'image/tiff',
-    '.pdf': 'application/pdf',
-    '.mp4': 'video/mp4',
-    '.mov': 'video/quicktime',
-};
-/** Best-effort Content-Type for a file path (default application/octet-stream). */
-export function contentType(filePath) {
-    return CONTENT_TYPES[extname(filePath).toLowerCase()] ?? 'application/octet-stream';
-}
-/**
- * Rejects a file whose extension is not in `allowed` (case-insensitive), before
- * any read or HTTP call, and resolves the path to its real target. The supplied
- * path's extension is checked first (the fast path); then the path is resolved
- * with realpathSync and the REAL target's extension is checked too, so a symlink
- * named `cover.jpg` that points at an arbitrary local file cannot slip past the
- * guard. On success it returns `{ realPath }` — the resolved canonical path,
- * which the caller MUST use as the path it reads/uploads (never the original
- * argument), so a symlink retargeted after validation cannot redirect the read
- * (the resolved target is what gets uploaded). On failure it returns `{ error }`
- * — a structured FILE_TYPE_NOT_ALLOWED, or FILE_NOT_FOUND if the path does not
- * resolve.
- */
-export function assertAllowedExtension(filePath, allowed) {
-    const isAllowed = (candidate) => allowed.some((a) => a.toLowerCase() === candidate);
-    const ext = extname(filePath).toLowerCase();
-    // Fast path: reject a plainly-disallowed extension before touching the disk.
-    if (!isAllowed(ext)) {
-        return {
-            error: {
-                code: 'FILE_TYPE_NOT_ALLOWED',
-                message: `This tool only accepts ${allowed.join(', ')} files (got "${ext || 'no extension'}").`,
-                status: 0,
-            },
-        };
-    }
-    // The supplied name is allowed; resolve symlinks and re-check the real target.
-    let realPath;
-    try {
-        realPath = realpathSync(filePath);
-    }
-    catch {
-        return {
-            error: {
-                code: 'FILE_NOT_FOUND',
-                message: `No readable file at ${filePath}.`,
-                status: 0,
-            },
-        };
-    }
-    const realExt = extname(realPath).toLowerCase();
-    if (!isAllowed(realExt)) {
-        return {
-            error: {
-                code: 'FILE_TYPE_NOT_ALLOWED',
-                message: `The file resolves to a "${realExt || 'no extension'}" file; this tool only accepts ${allowed.join(', ')}.`,
-                status: 0,
-            },
-        };
-    }
-    return { realPath };
-}