@latellu/atlas-mcp 1.0.3 → 1.0.5

package/README.md

@@ -172,7 +172,7 @@ AI: → Calls upload_media with file_path='/Users/you/Pictures/tokyo.png'
 
 ### Best Practices
 
-1. **Scope API keys**: Use minimal scopes required
+1. **Scope API keys**: For management keys, grant only the scopes each tool needs — `content:write` for create/update/delete/reorder, `content:publish` for publish/unpublish/archive/schedule, `media:write` for uploads/deletes. Leave unused scopes off.
 2. **Restrict upload paths**: Only allow necessary directories
 3. **Rotate keys**: Regularly rotate API keys
 4. **Monitor usage**: Review MCP tool calls for suspicious activity

package/dist/index.js

@@ -5,13 +5,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __commonJS = (cb, mod) => function __require2() {
+var __commonJS = (cb, mod) => function __require() {
   try {
     return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
   } catch (e) {
@@ -3231,8 +3225,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path) {
-      let input = path;
+    function removeDotSegments(path2) {
+      let input = path2;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3484,8 +3478,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path && path !== "/" ? path : void 0;
+        const [path2, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -12536,6 +12530,30 @@ var StdioServerTransport = class {
 import { z as z2 } from "zod";
 
 // src/client.ts
+function detectMimeType(fileName) {
+  const ext = fileName.slice(fileName.lastIndexOf(".")).toLowerCase();
+  switch (ext) {
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".png":
+      return "image/png";
+    case ".gif":
+      return "image/gif";
+    case ".webp":
+      return "image/webp";
+    case ".mp4":
+      return "video/mp4";
+    case ".webm":
+      return "video/webm";
+    case ".mov":
+      return "video/quicktime";
+    case ".pdf":
+      return "application/pdf";
+    default:
+      return "application/octet-stream";
+  }
+}
 var AtlasClient = class {
   baseUrl;
   apiKey;
@@ -12543,8 +12561,8 @@ var AtlasClient = class {
     this.baseUrl = baseUrl;
     this.apiKey = apiKey;
   }
-  async request(path, options) {
-    const url = `${this.baseUrl}${path}`;
+  async request(path2, options) {
+    const url = `${this.baseUrl}${path2}`;
     const response = await fetch(url, {
       ...options,
       headers: {
@@ -12553,6 +12571,20 @@ var AtlasClient = class {
         ...options?.headers
       }
     });
+    return this.handleResponse(response);
+  }
+  // Write requests to /api/v1/manage/* carry an Idempotency-Key so that
+  // AI-agent-driven retries don't risk double-create/double-publish.
+  async writeRequest(path2, options) {
+    return this.request(path2, {
+      ...options,
+      headers: {
+        "Idempotency-Key": crypto.randomUUID(),
+        ...options.headers
+      }
+    });
+  }
+  async handleResponse(response) {
     if (!response.ok) {
       const error = await response.json().catch(() => ({}));
       throw new Error(
@@ -12591,39 +12623,39 @@ var AtlasClient = class {
     return this.request(`/api/v1/public/entries/${slug}`);
   }
   async createEntry(contentType, data, slug) {
-    return this.request(`/api/v1/manage/content-types/${contentType}/entries`, {
+    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries`, {
       method: "POST",
       body: JSON.stringify({ slug, data })
     });
   }
   async updateEntry(contentType, slug, data) {
-    return this.request(`/api/v1/manage/content-types/${contentType}/entries/${slug}`, {
+    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}`, {
       method: "PUT",
       body: JSON.stringify({ data })
     });
   }
   async deleteEntry(contentType, slug) {
-    return this.request(`/api/v1/manage/content-types/${contentType}/entries/${slug}`, {
+    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}`, {
       method: "DELETE"
     });
   }
   async publishEntry(contentType, slug) {
-    return this.request(`/api/v1/manage/content-types/${contentType}/entries/${slug}/publish`, {
+    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/publish`, {
       method: "PATCH"
     });
   }
   async unpublishEntry(contentType, slug) {
-    return this.request(`/api/v1/manage/content-types/${contentType}/entries/${slug}/unpublish`, {
+    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/unpublish`, {
       method: "PATCH"
     });
   }
   async archiveEntry(contentType, slug) {
-    return this.request(`/api/v1/manage/content-types/${contentType}/entries/${slug}/archive`, {
+    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/archive`, {
       method: "PATCH"
     });
   }
   async duplicateEntry(contentType, slug) {
-    return this.request(`/api/v1/manage/content-types/${contentType}/entries/${slug}/duplicate`, {
+    return this.writeRequest(`/api/v1/manage/content-types/${contentType}/entries/${slug}/duplicate`, {
       method: "POST"
     });
   }
@@ -12638,24 +12670,24 @@ var AtlasClient = class {
     return this.request(`/api/v1/public/pages/${slug}`);
   }
   async createPage(data) {
-    return this.request("/api/v1/manage/pages", {
+    return this.writeRequest("/api/v1/manage/pages", {
       method: "POST",
       body: JSON.stringify(data)
     });
   }
   async updatePage(slug, data) {
-    return this.request(`/api/v1/manage/pages/${slug}`, {
+    return this.writeRequest(`/api/v1/manage/pages/${slug}`, {
       method: "PUT",
       body: JSON.stringify(data)
     });
   }
   async deletePage(slug) {
-    return this.request(`/api/v1/manage/pages/${slug}`, {
+    return this.writeRequest(`/api/v1/manage/pages/${slug}`, {
       method: "DELETE"
     });
   }
   async publishPage(slug) {
-    return this.request(`/api/v1/manage/pages/${slug}/publish`, {
+    return this.writeRequest(`/api/v1/manage/pages/${slug}/publish`, {
       method: "PATCH"
     });
   }
@@ -12665,38 +12697,35 @@ var AtlasClient = class {
   }
   async uploadMedia(filePath, folder, altText) {
     const fs = await import("fs");
-    const path = await import("path");
+    const path2 = await import("path");
     if (!fs.existsSync(filePath)) {
       throw new Error(`File not found: ${filePath}`);
     }
-    const fileName = path.basename(filePath);
+    const fileName = path2.basename(filePath);
     const fileBuffer = fs.readFileSync(filePath);
+    const mimeType = detectMimeType(fileName);
     const formData = new FormData();
-    formData.append("file", new Blob([fileBuffer]), fileName);
+    formData.append("file", new Blob([fileBuffer], { type: mimeType }), fileName);
     if (folder) formData.append("folder", folder);
     if (altText) formData.append("alt_text", altText);
     const response = await fetch(`${this.baseUrl}/api/v1/manage/media/upload`, {
       method: "POST",
       headers: {
-        "X-API-Key": this.apiKey
+        "X-API-Key": this.apiKey,
+        "Idempotency-Key": crypto.randomUUID()
       },
       body: formData
     });
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({}));
-      throw new Error(`Upload failed: ${response.status} - ${error.message || response.statusText}`);
-    }
-    const data = await response.json();
-    return data.data || data;
+    return this.handleResponse(response);
   }
 };
 
 // src/security.ts
+import path from "node:path";
 function validateFilePath(filePath, allowedPaths) {
   if (allowedPaths.length === 0) {
     return;
   }
-  const path = __require("path");
   const absPath = path.resolve(filePath);
   const isAllowed = allowedPaths.some((allowed) => {
     const absAllowed = path.resolve(allowed);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@latellu/atlas-mcp",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "publishConfig": {
     "access": "public"
   },