@launchsecure/launch-kit 0.0.36 → 0.0.37

package/dist/server/deck-mcp-entry.js

@@ -712,9 +712,9 @@ function generateBlastRadiusReport(manifest) {
 `;
     for (const n of nodes) {
       const ln = layerMap[n.layer] || n.layer;
-      const path2 = (n.path || "-").replace(/\|/g, "/");
+      const path3 = (n.path || "-").replace(/\|/g, "/");
       const reason = (n.reason || "-").replace(/\|/g, "/");
-      md += `| ${n.name} | ${ln} | ${n.type || "-"} | ${path2} | ${reason} |
+      md += `| ${n.name} | ${ln} | ${n.type || "-"} | ${path3} | ${reason} |
 `;
     }
     md += `
@@ -1198,6 +1198,227 @@ var init_rich_html_render = __esm({
   }
 });
 
+// src/server/cred-shape.ts
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path.join(repoRoot, CONFIG_FILENAME2);
+  if (!fs.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse ${CONFIG_FILENAME2}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+var fs, path, CONFIG_FILENAME2;
+var init_cred_shape = __esm({
+  "src/server/cred-shape.ts"() {
+    "use strict";
+    fs = __toESM(require("node:fs"));
+    path = __toESM(require("node:path"));
+    CONFIG_FILENAME2 = ".launch-secure.cred.config";
+  }
+});
+
+// src/server/mcp-client.ts
+function mcpConfigFromCourse(projectRoot) {
+  let cred;
+  try {
+    cred = readCredFile(projectRoot);
+  } catch {
+    return null;
+  }
+  if (!cred) return null;
+  const nested = toNested(cred);
+  if (!nested) return null;
+  const profile = nested.profiles[nested.active];
+  if (!profile?.pat || !profile.serverUrl || !profile.orgSlug || !profile.projectSlug) {
+    return null;
+  }
+  return {
+    url: new URL("/api/mcp/project", profile.serverUrl).toString(),
+    headers: {
+      Authorization: `Bearer ${profile.pat}`,
+      "X-Org-Slug": profile.orgSlug,
+      "X-Project-Slug": profile.projectSlug
+    }
+  };
+}
+function loadMcpConfig(projectRoot) {
+  if (_config) return _config;
+  const fromCourse = mcpConfigFromCourse(projectRoot);
+  if (fromCourse) {
+    _config = fromCourse;
+    return _config;
+  }
+  const mcpPath = (0, import_node_path3.join)(projectRoot, ".mcp.json");
+  if (!(0, import_node_fs3.existsSync)(mcpPath)) {
+    throw new Error(
+      `No active course in ${CONFIG_FILENAME2} and no .mcp.json at ${mcpPath}. Run \`launch-course\` or bootstrap with \`launch-kit init\`.`
+    );
+  }
+  const raw = JSON.parse((0, import_node_fs3.readFileSync)(mcpPath, "utf-8"));
+  const entry = raw.mcpServers["launch-secure"];
+  if (!entry?.url) {
+    throw new Error(
+      `No active course in ${CONFIG_FILENAME2} and no "launch-secure" entry with url in .mcp.json`
+    );
+  }
+  _config = {
+    url: entry.url,
+    headers: entry.headers ?? {}
+  };
+  return _config;
+}
+function parseSSE(text2) {
+  const lines = text2.split("\n");
+  for (const line of lines) {
+    if (line.startsWith("data: ")) {
+      const data = line.slice(6);
+      try {
+        return JSON.parse(data);
+      } catch {
+      }
+    }
+  }
+  return JSON.parse(text2);
+}
+async function mcpRequest(method, params) {
+  const config = _config;
+  if (!config) throw new Error("MCP config not loaded \u2014 call loadMcpConfig first");
+  const id = ++_requestId;
+  const headers = {
+    ...config.headers,
+    "Content-Type": "application/json",
+    "Accept": "application/json, text/event-stream"
+  };
+  if (_sessionId) {
+    headers["Mcp-Session-Id"] = _sessionId;
+  }
+  const response = await fetch(config.url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ jsonrpc: "2.0", id, method, params })
+  });
+  const sid = response.headers.get("mcp-session-id");
+  if (sid) _sessionId = sid;
+  if (!response.ok) {
+    const text2 = await response.text();
+    throw new Error(`MCP ${method} failed (${response.status}): ${text2}`);
+  }
+  const contentType = response.headers.get("content-type") ?? "";
+  const body = await response.text();
+  if (contentType.includes("text/event-stream")) {
+    return parseSSE(body);
+  }
+  return JSON.parse(body);
+}
+async function ensureInitialized() {
+  if (_sessionId) return;
+  await mcpRequest("initialize", {
+    protocolVersion: "2024-11-05",
+    capabilities: {},
+    clientInfo: { name: "launch-council", version: "0.0.1" }
+  });
+  const config = _config;
+  const headers = {
+    ...config.headers,
+    "Content-Type": "application/json",
+    "Accept": "application/json, text/event-stream"
+  };
+  if (_sessionId) headers["Mcp-Session-Id"] = _sessionId;
+  await fetch(config.url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })
+  });
+}
+async function callTool(toolName, args) {
+  await ensureInitialized();
+  const result = await mcpRequest("tools/call", {
+    name: toolName,
+    arguments: args
+  });
+  if (result.error) {
+    throw new Error(`MCP tool error: ${result.error.message}`);
+  }
+  const textContent = result.result?.content?.[0]?.text;
+  if (!textContent) return null;
+  return JSON.parse(textContent);
+}
+async function writeDeck(input) {
+  const result = await callTool("communication_write", {
+    title: input.title,
+    body: input.body,
+    resource_type: "deck",
+    fields: {
+      deckHtml: input.html,
+      sessionId: input.sessionId,
+      blockCount: input.blockCount,
+      sharedFrom: "launch-deck"
+    }
+  });
+  return { id: result.created.id };
+}
+async function updateDeck(commentId, input) {
+  await callTool("communication_update", {
+    comment_id: commentId,
+    title: input.title,
+    body: input.body,
+    fields: {
+      deckHtml: input.html,
+      sessionId: input.sessionId,
+      blockCount: input.blockCount,
+      sharedFrom: "launch-deck"
+    }
+  });
+  return { id: commentId };
+}
+async function deleteDeck(commentId) {
+  await callTool("communication_delete", { comment_id: commentId });
+}
+var import_node_fs3, import_node_path3, _config, _requestId, _sessionId;
+var init_mcp_client = __esm({
+  "src/server/mcp-client.ts"() {
+    "use strict";
+    import_node_fs3 = require("node:fs");
+    import_node_path3 = require("node:path");
+    init_cred_shape();
+    _config = null;
+    _requestId = 0;
+    _sessionId = null;
+  }
+});
+
 // src/server/deck-serve.ts
 var deck_serve_exports = {};
 __export(deck_serve_exports, {
@@ -1209,14 +1430,14 @@ __export(deck_serve_exports, {
   startDeckServer: () => startDeckServer
 });
 function sessionDir(cwd, session) {
-  return import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", session);
+  return import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", session);
 }
 function sessionJsonPath(cwd, session) {
-  return import_node_path3.default.join(sessionDir(cwd, session), "session.json");
+  return import_node_path4.default.join(sessionDir(cwd, session), "session.json");
 }
 function readPersistedSession(cwd, session) {
   try {
-    const raw = import_node_fs3.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
+    const raw = import_node_fs4.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -1224,7 +1445,7 @@ function readPersistedSession(cwd, session) {
 }
 function writePersistedSession(cwd, session, payload) {
   const dir = sessionDir(cwd, session);
-  import_node_fs3.default.mkdirSync(dir, { recursive: true });
+  import_node_fs4.default.mkdirSync(dir, { recursive: true });
   const existing = readPersistedSession(cwd, session);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const next = {
@@ -1236,13 +1457,13 @@ function writePersistedSession(cwd, session, payload) {
     createdAt: existing?.createdAt ?? now,
     updatedAt: now
   };
-  import_node_fs3.default.writeFileSync(sessionJsonPath(cwd, session), JSON.stringify(next, null, 2));
+  import_node_fs4.default.writeFileSync(sessionJsonPath(cwd, session), JSON.stringify(next, null, 2));
   return next;
 }
 function listPersistedSessions(cwd) {
-  const base = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
-  if (!import_node_fs3.default.existsSync(base)) return [];
-  const entries = import_node_fs3.default.readdirSync(base, { withFileTypes: true });
+  const base = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
+  if (!import_node_fs4.default.existsSync(base)) return [];
+  const entries = import_node_fs4.default.readdirSync(base, { withFileTypes: true });
   const sessions = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
@@ -1254,20 +1475,106 @@ function listPersistedSessions(cwd) {
       blockCount: Array.isArray(persisted.blocks) ? persisted.blocks.length : 0,
       version: persisted.version,
       createdAt: persisted.createdAt,
-      updatedAt: persisted.updatedAt
+      updatedAt: persisted.updatedAt,
+      shared: Boolean(readSyncRecord(cwd, persisted.id))
     });
   }
   sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return sessions;
 }
 function deletePersistedSession(cwd, session) {
-  const base = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
+  const base = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
   if (session === "all") {
-    if (import_node_fs3.default.existsSync(base)) import_node_fs3.default.rmSync(base, { recursive: true, force: true });
+    if (import_node_fs4.default.existsSync(base)) import_node_fs4.default.rmSync(base, { recursive: true, force: true });
     return;
   }
   const dir = sessionDir(cwd, session);
-  if (import_node_fs3.default.existsSync(dir)) import_node_fs3.default.rmSync(dir, { recursive: true, force: true });
+  if (import_node_fs4.default.existsSync(dir)) import_node_fs4.default.rmSync(dir, { recursive: true, force: true });
+}
+function syncJsonPath(cwd, session) {
+  return import_node_path4.default.join(sessionDir(cwd, session), ".sync.json");
+}
+function readSyncRecord(cwd, session) {
+  try {
+    return JSON.parse(import_node_fs4.default.readFileSync(syncJsonPath(cwd, session), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeSyncRecord(cwd, session, rec) {
+  import_node_fs4.default.writeFileSync(syncJsonPath(cwd, session), JSON.stringify(rec, null, 2));
+}
+function escHtml2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function escAttr(s) {
+  return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+}
+function readIframeArtifact(cwd, src) {
+  if (typeof src !== "string" || !src.startsWith("/deck-files/")) return null;
+  const rel = decodeURIComponent(src.slice("/deck-files/".length));
+  if (rel.includes("..")) return null;
+  try {
+    return import_node_fs4.default.readFileSync(import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", rel), "utf-8");
+  } catch {
+    return null;
+  }
+}
+function renderShareSection(cwd, block) {
+  const label = block?.label ? `<h2 class="db-title">${escHtml2(String(block.label))}</h2>` : "";
+  switch (block?.type) {
+    case "iframe": {
+      const doc = readIframeArtifact(cwd, block.src) ?? "<p>(missing artifact)</p>";
+      return `<section class="db">${label}<iframe class="db-frame" sandbox="allow-scripts allow-popups" srcdoc="${escAttr(doc)}"></iframe></section>`;
+    }
+    case "rich-html":
+    case "html":
+      return `<section class="db">${label}<div class="db-html">${typeof block.content === "string" ? block.content : ""}</div></section>`;
+    case "markdown":
+      return `<section class="db">${label}<div class="db-md" data-md="${escAttr(typeof block.content === "string" ? block.content : "")}"></div></section>`;
+    case "mermaid":
+      return `<section class="db">${label}<pre class="mermaid">${escHtml2(typeof block.content === "string" ? block.content : "")}</pre></section>`;
+    case "options": {
+      const opts = Array.isArray(block.options) ? block.options : [];
+      const lis = opts.map(
+        (o) => `<li><strong>${escHtml2(String(o?.label ?? o?.id ?? ""))}</strong>${o?.description ? ` \u2014 ${escHtml2(String(o.description))}` : ""}</li>`
+      ).join("");
+      return `<section class="db">${label}<ul>${lis}</ul></section>`;
+    }
+    default:
+      return `<section class="db">${label}</section>`;
+  }
+}
+function buildShareHtml(cwd, session, blocks) {
+  if (blocks.length === 1) {
+    const only = blocks[0];
+    if (only?.type === "iframe") {
+      const doc = readIframeArtifact(cwd, only.src);
+      if (doc) return doc;
+    }
+  }
+  const list = blocks;
+  const sections = list.map((b) => renderShareSection(cwd, b)).join("\n");
+  const hasMd = list.some((b) => b?.type === "markdown");
+  const hasMermaid = list.some((b) => b?.type === "mermaid");
+  return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escHtml2(session)}</title>
+<style>
+  body { margin:0; font-family: ui-sans-serif, system-ui, sans-serif; background:#0b0e14; color:#e6e9ef; }
+  .db { padding:20px 24px; border-bottom:1px solid #1e2433; }
+  .db-title { font-size:13px; font-weight:600; margin:0 0 12px; color:#9aa4b2; text-transform:uppercase; letter-spacing:.05em; }
+  .db-frame { width:100%; height:70vh; border:0; border-radius:8px; background:#fff; }
+  .db-html { background:#fff; color:#111; border-radius:8px; padding:16px; overflow:auto; }
+  ul { line-height:1.7; }
+  .mermaid { background:#fff; border-radius:8px; padding:16px; }
+</style></head>
+<body>
+${sections}
+${hasMd ? `<script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+<script>document.querySelectorAll('.db-md').forEach(function(el){try{el.innerHTML=marked.parse(el.dataset.md||'')}catch(e){el.textContent=el.dataset.md||''}});</script>` : ""}
+${hasMermaid ? `<script type="module">import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.esm.min.mjs';mermaid.initialize({startOnLoad:true,theme:'dark'});</script>` : ""}
+</body></html>`;
 }
 function consumeRenderError() {
   const err = lastRenderError;
@@ -1305,23 +1612,23 @@ function broadcastToClients(message) {
   }
 }
 function serveStatic(res, filePath) {
-  if (!import_node_fs3.default.existsSync(filePath) || !import_node_fs3.default.statSync(filePath).isFile()) return false;
-  const ext = import_node_path3.default.extname(filePath).toLowerCase();
+  if (!import_node_fs4.default.existsSync(filePath) || !import_node_fs4.default.statSync(filePath).isFile()) return false;
+  const ext = import_node_path4.default.extname(filePath).toLowerCase();
   const mime = MIME_TYPES[ext] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": mime, "Cache-Control": "no-cache" });
-  import_node_fs3.default.createReadStream(filePath).pipe(res);
+  import_node_fs4.default.createReadStream(filePath).pipe(res);
   return true;
 }
 function resolveClientDir() {
-  const sibling = import_node_path3.default.join(__dirname, "..", "deck-client");
-  if (import_node_fs3.default.existsSync(import_node_path3.default.join(sibling, "assets"))) return sibling;
-  const devDist = import_node_path3.default.join(__dirname, "..", "..", "dist", "deck-client");
-  if (import_node_fs3.default.existsSync(import_node_path3.default.join(devDist, "assets"))) return devDist;
+  const sibling = import_node_path4.default.join(__dirname, "..", "deck-client");
+  if (import_node_fs4.default.existsSync(import_node_path4.default.join(sibling, "assets"))) return sibling;
+  const devDist = import_node_path4.default.join(__dirname, "..", "..", "dist", "deck-client");
+  if (import_node_fs4.default.existsSync(import_node_path4.default.join(devDist, "assets"))) return devDist;
   return sibling;
 }
 function serveIndex(res, clientDir) {
-  const indexPath = import_node_path3.default.join(clientDir, "index.html");
-  if (!import_node_fs3.default.existsSync(indexPath)) {
+  const indexPath = import_node_path4.default.join(clientDir, "index.html");
+  if (!import_node_fs4.default.existsSync(indexPath)) {
     res.writeHead(500, { "Content-Type": "text/plain" });
     res.end(`LaunchDeck client bundle not found at ${clientDir}. Run 'npm run build:client'.`);
     return;
@@ -1425,15 +1732,15 @@ async function startDeckServer(opts = {}) {
               const baseUrl = `/deck-files/${sessionEncoded}`;
               const html = generateBlastRadiusHtml(block.manifest, baseUrl);
               const report = generateBlastRadiusReport(block.manifest);
-              const dir = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
-              import_node_fs3.default.mkdirSync(dir, { recursive: true });
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "blast-radius.html"), html);
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "blast-radius-report.md"), report);
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
+              const dir = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
+              import_node_fs4.default.mkdirSync(dir, { recursive: true });
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius.html"), html);
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius-report.md"), report);
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
               const contractData = generateContract(block.manifest);
               const contractMd = contractToMarkdown(contractData);
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "contract.json"), JSON.stringify(contractData, null, 2));
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "contract.md"), contractMd);
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "contract.json"), JSON.stringify(contractData, null, 2));
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "contract.md"), contractMd);
               block.type = "iframe";
               block.src = `${baseUrl}/blast-radius.html`;
               delete block.manifest;
@@ -1460,9 +1767,9 @@ async function startDeckServer(opts = {}) {
                 const sessionEncoded = encodeURIComponent(body.session);
                 const baseUrl = `/deck-files/${sessionEncoded}`;
                 const filename = `${slugify(block.label)}.html`;
-                const dir = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
-                import_node_fs3.default.mkdirSync(dir, { recursive: true });
-                import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, filename), html);
+                const dir = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
+                import_node_fs4.default.mkdirSync(dir, { recursive: true });
+                import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, filename), html);
                 block.type = "iframe";
                 block.src = `${baseUrl}/${filename}`;
                 delete block.content;
@@ -1494,6 +1801,79 @@ async function startDeckServer(opts = {}) {
         jsonResponse(res, 200, { sessions: listPersistedSessions(cwd) });
         return;
       }
+      const shareMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)\/share$/);
+      if (shareMatch && req.method === "POST") {
+        const id = decodeURIComponent(shareMatch[1]);
+        const persisted = readPersistedSession(cwd, id);
+        if (!persisted) {
+          jsonResponse(res, 404, { ok: false, error: "session not found" });
+          return;
+        }
+        try {
+          loadMcpConfig(cwd);
+        } catch (err) {
+          jsonResponse(res, 400, {
+            ok: false,
+            error: `Cloud sharing needs an active LaunchSecure course (.launch-secure.cred.config) or a "launch-secure" entry in .mcp.json: ${String(err)}`
+          });
+          return;
+        }
+        try {
+          const blocks = Array.isArray(persisted.blocks) ? persisted.blocks : [];
+          const html = buildShareHtml(cwd, id, blocks);
+          const types = blocks.map((b) => b?.type).filter(Boolean);
+          const body = `Shared deck "${id}" \u2014 ${blocks.length} block${blocks.length === 1 ? "" : "s"}${types.length ? ` (${types.join(", ")})` : ""}. Open the Decks tab in the Communication Center to view.`;
+          const input = { title: id, body, html, sessionId: id, blockCount: blocks.length };
+          const existing2 = readSyncRecord(cwd, id);
+          let resourceId;
+          let updated = false;
+          if (existing2?.resourceId) {
+            try {
+              ({ id: resourceId } = await updateDeck(existing2.resourceId, input));
+              updated = true;
+            } catch {
+              ({ id: resourceId } = await writeDeck(input));
+            }
+          } else {
+            ({ id: resourceId } = await writeDeck(input));
+          }
+          writeSyncRecord(cwd, id, {
+            resourceId,
+            sharedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            version: persisted.version
+          });
+          jsonResponse(res, 200, { ok: true, resourceId, updated });
+        } catch (err) {
+          jsonResponse(res, 500, { ok: false, error: String(err) });
+        }
+        return;
+      }
+      const remoteDelMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)\/remote$/);
+      if (remoteDelMatch && req.method === "DELETE") {
+        const id = decodeURIComponent(remoteDelMatch[1]);
+        const sync = readSyncRecord(cwd, id);
+        if (!sync?.resourceId) {
+          jsonResponse(res, 200, { ok: true, deleted: false, reason: "not shared" });
+          return;
+        }
+        try {
+          loadMcpConfig(cwd);
+        } catch (err) {
+          jsonResponse(res, 400, { ok: false, error: `Cloud delete needs an active LaunchSecure course (.launch-secure.cred.config) or a "launch-secure" entry in .mcp.json: ${String(err)}` });
+          return;
+        }
+        try {
+          await deleteDeck(sync.resourceId);
+          try {
+            import_node_fs4.default.rmSync(syncJsonPath(cwd, id), { force: true });
+          } catch {
+          }
+          jsonResponse(res, 200, { ok: true, deleted: true });
+        } catch (err) {
+          jsonResponse(res, 500, { ok: false, error: String(err) });
+        }
+        return;
+      }
       const sessionMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)$/);
       if (sessionMatch) {
         const id = decodeURIComponent(sessionMatch[1]);
@@ -1596,7 +1976,7 @@ async function startDeckServer(opts = {}) {
           res.end("Forbidden");
           return;
         }
-        const filePath = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
+        const filePath = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
         if (serveStatic(res, filePath)) return;
         res.writeHead(404);
         res.end("Not found");
@@ -1609,25 +1989,25 @@ async function startDeckServer(opts = {}) {
           res.end("Forbidden");
           return;
         }
-        const filePath = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
-        if (!import_node_fs3.default.existsSync(filePath) || !import_node_fs3.default.statSync(filePath).isFile()) {
+        const filePath = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
+        if (!import_node_fs4.default.existsSync(filePath) || !import_node_fs4.default.statSync(filePath).isFile()) {
           res.writeHead(404);
           res.end("Not found");
           return;
         }
-        const ext = import_node_path3.default.extname(filePath).toLowerCase();
+        const ext = import_node_path4.default.extname(filePath).toLowerCase();
         const mime = MIME_TYPES[ext] ?? "application/octet-stream";
-        const filename = import_node_path3.default.basename(filePath);
+        const filename = import_node_path4.default.basename(filePath);
         res.writeHead(200, {
           "Content-Type": mime,
           "Content-Disposition": `attachment; filename="${filename}"`,
           "Cache-Control": "no-cache"
         });
-        import_node_fs3.default.createReadStream(filePath).pipe(res);
+        import_node_fs4.default.createReadStream(filePath).pipe(res);
         return;
       }
       if (url2.pathname !== "/") {
-        const staticPath = import_node_path3.default.join(clientDir, url2.pathname);
+        const staticPath = import_node_path4.default.join(clientDir, url2.pathname);
         if (serveStatic(res, staticPath)) return;
       }
       serveIndex(res, clientDir);
@@ -1726,13 +2106,13 @@ function runServeCli(argv) {
     process.exit(1);
   });
 }
-var import_node_http, import_node_fs3, import_node_path3, import_ws, DEFAULT_PORT, MAX_PORT_SCAN, MIME_TYPES, pendingFeedback, lastRenderError, wss;
+var import_node_http, import_node_fs4, import_node_path4, import_ws, DEFAULT_PORT, MAX_PORT_SCAN, MIME_TYPES, pendingFeedback, lastRenderError, wss;
 var init_deck_serve = __esm({
   "src/server/deck-serve.ts"() {
     "use strict";
     import_node_http = __toESM(require("node:http"));
-    import_node_fs3 = __toESM(require("node:fs"));
-    import_node_path3 = __toESM(require("node:path"));
+    import_node_fs4 = __toESM(require("node:fs"));
+    import_node_path4 = __toESM(require("node:path"));
     import_ws = require("ws");
     init_launch_kit_paths();
     init_deck_lockfile();
@@ -1740,6 +2120,7 @@ var init_deck_serve = __esm({
     init_blast_radius_render();
     init_contract_generator();
     init_rich_html_render();
+    init_mcp_client();
     DEFAULT_PORT = 52829;
     MAX_PORT_SCAN = 3;
     MIME_TYPES = {
@@ -1825,15 +2206,15 @@ async function handleTool(name, args) {
             const baseUrl = `/deck-files/${sessionEncoded}`;
             const html = generateBlastRadiusHtml(block.manifest, baseUrl);
             const report = generateBlastRadiusReport(block.manifest);
-            const dir = (0, import_node_path4.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
-            import_node_fs4.default.mkdirSync(dir, { recursive: true });
-            import_node_fs4.default.writeFileSync((0, import_node_path4.join)(dir, "blast-radius.html"), html);
-            import_node_fs4.default.writeFileSync((0, import_node_path4.join)(dir, "blast-radius-report.md"), report);
-            import_node_fs4.default.writeFileSync((0, import_node_path4.join)(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
+            const dir = (0, import_node_path5.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
+            import_node_fs5.default.mkdirSync(dir, { recursive: true });
+            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "blast-radius.html"), html);
+            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "blast-radius-report.md"), report);
+            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
             const contractData = generateContract(block.manifest);
             const contractMd = contractToMarkdown(contractData);
-            import_node_fs4.default.writeFileSync((0, import_node_path4.join)(dir, "contract.json"), JSON.stringify(contractData, null, 2));
-            import_node_fs4.default.writeFileSync((0, import_node_path4.join)(dir, "contract.md"), contractMd);
+            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "contract.json"), JSON.stringify(contractData, null, 2));
+            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "contract.md"), contractMd);
             block.type = "iframe";
             block.src = `${baseUrl}/blast-radius.html`;
             delete block.manifest;
@@ -1860,9 +2241,9 @@ async function handleTool(name, args) {
               const sessionEncoded = encodeURIComponent(session);
               const baseUrl = `/deck-files/${sessionEncoded}`;
               const filename = `${slugify(block.label)}.html`;
-              const dir = (0, import_node_path4.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
-              import_node_fs4.default.mkdirSync(dir, { recursive: true });
-              import_node_fs4.default.writeFileSync((0, import_node_path4.join)(dir, filename), html);
+              const dir = (0, import_node_path5.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
+              import_node_fs5.default.mkdirSync(dir, { recursive: true });
+              import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, filename), html);
               block.type = "iframe";
               block.src = `${baseUrl}/${filename}`;
               delete block.content;
@@ -1956,11 +2337,11 @@ async function handleTool(name, args) {
         }));
       }
       try {
-        const logDir = (0, import_node_path4.join)((0, import_node_os2.homedir)(), LAUNCHSECURE_DIR);
-        (0, import_node_fs5.mkdirSync)(logDir, { recursive: true });
-        const logPath = (0, import_node_path4.join)(logDir, "launch-deck.log");
-        const out = (0, import_node_fs5.openSync)(logPath, "a");
-        const err = (0, import_node_fs5.openSync)(logPath, "a");
+        const logDir = (0, import_node_path5.join)((0, import_node_os2.homedir)(), LAUNCHSECURE_DIR);
+        (0, import_node_fs6.mkdirSync)(logDir, { recursive: true });
+        const logPath = (0, import_node_path5.join)(logDir, "launch-deck.log");
+        const out = (0, import_node_fs6.openSync)(logPath, "a");
+        const err = (0, import_node_fs6.openSync)(logPath, "a");
         const entryPath = process.argv[1];
         const config = loadDeckConfig(projectRoot);
         const resolvedPort = args.port ?? config.port;
@@ -2016,21 +2397,21 @@ async function handleTool(name, args) {
     }
     case "generate_contract": {
       const session = args.session;
-      const dir = (0, import_node_path4.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
-      const manifestPath = (0, import_node_path4.join)(dir, "blast-radius-manifest.json");
-      if (!import_node_fs4.default.existsSync(manifestPath)) {
+      const dir = (0, import_node_path5.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
+      const manifestPath = (0, import_node_path5.join)(dir, "blast-radius-manifest.json");
+      if (!import_node_fs5.default.existsSync(manifestPath)) {
         return text(JSON.stringify({
           error: `No blast radius manifest found for session "${session}". Push a blast-radius block first.`,
           hint: "Use the deck tool with a blast-radius block type to create a session."
         }));
       }
       try {
-        const raw = import_node_fs4.default.readFileSync(manifestPath, "utf-8");
+        const raw = import_node_fs5.default.readFileSync(manifestPath, "utf-8");
         const manifest = JSON.parse(raw);
         const contract = generateContract(manifest);
         const markdown = contractToMarkdown(contract);
-        import_node_fs4.default.writeFileSync((0, import_node_path4.join)(dir, "contract.json"), JSON.stringify(contract, null, 2));
-        import_node_fs4.default.writeFileSync((0, import_node_path4.join)(dir, "contract.md"), markdown);
+        import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "contract.json"), JSON.stringify(contract, null, 2));
+        import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "contract.md"), markdown);
         return text(JSON.stringify(contract));
       } catch (err) {
         return text(JSON.stringify({ error: `Failed to generate contract: ${err}` }));
@@ -2121,15 +2502,15 @@ function startDeckMcpServer() {
     process.exit(0);
   });
 }
-var import_node_http2, import_node_fs4, import_node_path4, import_node_child_process2, import_node_fs5, import_node_os2, SERVER_INFO, TOOLS;
+var import_node_http2, import_node_fs5, import_node_path5, import_node_child_process2, import_node_fs6, import_node_os2, SERVER_INFO, TOOLS;
 var init_deck_mcp = __esm({
   "src/server/deck-mcp.ts"() {
     "use strict";
     import_node_http2 = __toESM(require("node:http"));
-    import_node_fs4 = __toESM(require("node:fs"));
-    import_node_path4 = require("node:path");
+    import_node_fs5 = __toESM(require("node:fs"));
+    import_node_path5 = require("node:path");
     import_node_child_process2 = require("node:child_process");
-    import_node_fs5 = require("node:fs");
+    import_node_fs6 = require("node:fs");
     import_node_os2 = require("node:os");
     init_launch_kit_paths();
     init_deck_lockfile();