@launchsecure/launch-kit 0.0.36 → 0.0.38

package/dist/server/deck-serve.js

@@ -39,8 +39,8 @@ __export(deck_serve_exports, {
 });
 module.exports = __toCommonJS(deck_serve_exports);
 var import_node_http = __toESM(require("node:http"));
-var import_node_fs3 = __toESM(require("node:fs"));
-var import_node_path3 = __toESM(require("node:path"));
+var import_node_fs4 = __toESM(require("node:fs"));
+var import_node_path4 = __toESM(require("node:path"));
 var import_ws = require("ws");
 
 // src/server/launch-kit-paths.ts
@@ -704,9 +704,9 @@ function generateBlastRadiusReport(manifest) {
 `;
     for (const n of nodes) {
       const ln = layerMap[n.layer] || n.layer;
-      const path2 = (n.path || "-").replace(/\|/g, "/");
+      const path3 = (n.path || "-").replace(/\|/g, "/");
       const reason = (n.reason || "-").replace(/\|/g, "/");
-      md += `| ${n.name} | ${ln} | ${n.type || "-"} | ${path2} | ${reason} |
+      md += `| ${n.name} | ${ln} | ${n.type || "-"} | ${path3} | ${reason} |
 `;
     }
     md += `
@@ -1174,6 +1174,216 @@ function slugify(label) {
   return label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "block";
 }
 
+// src/server/mcp-client.ts
+var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
+
+// src/server/cred-shape.ts
+var fs = __toESM(require("node:fs"));
+var path = __toESM(require("node:path"));
+var CONFIG_FILENAME2 = ".launch-secure.cred.config";
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path.join(repoRoot, CONFIG_FILENAME2);
+  if (!fs.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse ${CONFIG_FILENAME2}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+// src/server/mcp-client.ts
+var _config = null;
+var _requestId = 0;
+var _sessionId = null;
+function mcpConfigFromCourse(projectRoot) {
+  let cred;
+  try {
+    cred = readCredFile(projectRoot);
+  } catch {
+    return null;
+  }
+  if (!cred) return null;
+  const nested = toNested(cred);
+  if (!nested) return null;
+  const profile = nested.profiles[nested.active];
+  if (!profile?.pat || !profile.serverUrl || !profile.orgSlug || !profile.projectSlug) {
+    return null;
+  }
+  return {
+    url: new URL("/api/mcp/project", profile.serverUrl).toString(),
+    headers: {
+      Authorization: `Bearer ${profile.pat}`,
+      "X-Org-Slug": profile.orgSlug,
+      "X-Project-Slug": profile.projectSlug
+    }
+  };
+}
+function loadMcpConfig(projectRoot) {
+  if (_config) return _config;
+  const fromCourse = mcpConfigFromCourse(projectRoot);
+  if (fromCourse) {
+    _config = fromCourse;
+    return _config;
+  }
+  const mcpPath = (0, import_node_path3.join)(projectRoot, ".mcp.json");
+  if (!(0, import_node_fs3.existsSync)(mcpPath)) {
+    throw new Error(
+      `No active course in ${CONFIG_FILENAME2} and no .mcp.json at ${mcpPath}. Run \`launch-course\` or bootstrap with \`launch-kit init\`.`
+    );
+  }
+  const raw = JSON.parse((0, import_node_fs3.readFileSync)(mcpPath, "utf-8"));
+  const entry = raw.mcpServers["launch-secure"];
+  if (!entry?.url) {
+    throw new Error(
+      `No active course in ${CONFIG_FILENAME2} and no "launch-secure" entry with url in .mcp.json`
+    );
+  }
+  _config = {
+    url: entry.url,
+    headers: entry.headers ?? {}
+  };
+  return _config;
+}
+function parseSSE(text) {
+  const lines = text.split("\n");
+  for (const line of lines) {
+    if (line.startsWith("data: ")) {
+      const data = line.slice(6);
+      try {
+        return JSON.parse(data);
+      } catch {
+      }
+    }
+  }
+  return JSON.parse(text);
+}
+async function mcpRequest(method, params) {
+  const config = _config;
+  if (!config) throw new Error("MCP config not loaded \u2014 call loadMcpConfig first");
+  const id = ++_requestId;
+  const headers = {
+    ...config.headers,
+    "Content-Type": "application/json",
+    "Accept": "application/json, text/event-stream"
+  };
+  if (_sessionId) {
+    headers["Mcp-Session-Id"] = _sessionId;
+  }
+  const response = await fetch(config.url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ jsonrpc: "2.0", id, method, params })
+  });
+  const sid = response.headers.get("mcp-session-id");
+  if (sid) _sessionId = sid;
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`MCP ${method} failed (${response.status}): ${text}`);
+  }
+  const contentType = response.headers.get("content-type") ?? "";
+  const body = await response.text();
+  if (contentType.includes("text/event-stream")) {
+    return parseSSE(body);
+  }
+  return JSON.parse(body);
+}
+async function ensureInitialized() {
+  if (_sessionId) return;
+  await mcpRequest("initialize", {
+    protocolVersion: "2024-11-05",
+    capabilities: {},
+    clientInfo: { name: "launch-council", version: "0.0.1" }
+  });
+  const config = _config;
+  const headers = {
+    ...config.headers,
+    "Content-Type": "application/json",
+    "Accept": "application/json, text/event-stream"
+  };
+  if (_sessionId) headers["Mcp-Session-Id"] = _sessionId;
+  await fetch(config.url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })
+  });
+}
+async function callTool(toolName, args) {
+  await ensureInitialized();
+  const result = await mcpRequest("tools/call", {
+    name: toolName,
+    arguments: args
+  });
+  if (result.error) {
+    throw new Error(`MCP tool error: ${result.error.message}`);
+  }
+  const textContent = result.result?.content?.[0]?.text;
+  if (!textContent) return null;
+  return JSON.parse(textContent);
+}
+async function writeDeck(input) {
+  const result = await callTool("communication_write", {
+    title: input.title,
+    body: input.body,
+    resource_type: "deck",
+    fields: {
+      deckHtml: input.html,
+      sessionId: input.sessionId,
+      blockCount: input.blockCount,
+      sharedFrom: "launch-deck"
+    }
+  });
+  return { id: result.created.id };
+}
+async function updateDeck(commentId, input) {
+  await callTool("communication_update", {
+    comment_id: commentId,
+    title: input.title,
+    body: input.body,
+    fields: {
+      deckHtml: input.html,
+      sessionId: input.sessionId,
+      blockCount: input.blockCount,
+      sharedFrom: "launch-deck"
+    }
+  });
+  return { id: commentId };
+}
+async function deleteDeck(commentId) {
+  await callTool("communication_delete", { comment_id: commentId });
+}
+
 // src/server/deck-serve.ts
 var DEFAULT_PORT = 52829;
 var MAX_PORT_SCAN = 3;
@@ -1189,14 +1399,14 @@ var MIME_TYPES = {
   ".woff2": "font/woff2"
 };
 function sessionDir(cwd, session) {
-  return import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", session);
+  return import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", session);
 }
 function sessionJsonPath(cwd, session) {
-  return import_node_path3.default.join(sessionDir(cwd, session), "session.json");
+  return import_node_path4.default.join(sessionDir(cwd, session), "session.json");
 }
 function readPersistedSession(cwd, session) {
   try {
-    const raw = import_node_fs3.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
+    const raw = import_node_fs4.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -1204,7 +1414,7 @@ function readPersistedSession(cwd, session) {
 }
 function writePersistedSession(cwd, session, payload) {
   const dir = sessionDir(cwd, session);
-  import_node_fs3.default.mkdirSync(dir, { recursive: true });
+  import_node_fs4.default.mkdirSync(dir, { recursive: true });
   const existing = readPersistedSession(cwd, session);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const next = {
@@ -1216,13 +1426,13 @@ function writePersistedSession(cwd, session, payload) {
     createdAt: existing?.createdAt ?? now,
     updatedAt: now
   };
-  import_node_fs3.default.writeFileSync(sessionJsonPath(cwd, session), JSON.stringify(next, null, 2));
+  import_node_fs4.default.writeFileSync(sessionJsonPath(cwd, session), JSON.stringify(next, null, 2));
   return next;
 }
 function listPersistedSessions(cwd) {
-  const base = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
-  if (!import_node_fs3.default.existsSync(base)) return [];
-  const entries = import_node_fs3.default.readdirSync(base, { withFileTypes: true });
+  const base = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
+  if (!import_node_fs4.default.existsSync(base)) return [];
+  const entries = import_node_fs4.default.readdirSync(base, { withFileTypes: true });
   const sessions = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
@@ -1234,20 +1444,106 @@ function listPersistedSessions(cwd) {
       blockCount: Array.isArray(persisted.blocks) ? persisted.blocks.length : 0,
       version: persisted.version,
       createdAt: persisted.createdAt,
-      updatedAt: persisted.updatedAt
+      updatedAt: persisted.updatedAt,
+      shared: Boolean(readSyncRecord(cwd, persisted.id))
     });
   }
   sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return sessions;
 }
 function deletePersistedSession(cwd, session) {
-  const base = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
+  const base = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
   if (session === "all") {
-    if (import_node_fs3.default.existsSync(base)) import_node_fs3.default.rmSync(base, { recursive: true, force: true });
+    if (import_node_fs4.default.existsSync(base)) import_node_fs4.default.rmSync(base, { recursive: true, force: true });
     return;
   }
   const dir = sessionDir(cwd, session);
-  if (import_node_fs3.default.existsSync(dir)) import_node_fs3.default.rmSync(dir, { recursive: true, force: true });
+  if (import_node_fs4.default.existsSync(dir)) import_node_fs4.default.rmSync(dir, { recursive: true, force: true });
+}
+function syncJsonPath(cwd, session) {
+  return import_node_path4.default.join(sessionDir(cwd, session), ".sync.json");
+}
+function readSyncRecord(cwd, session) {
+  try {
+    return JSON.parse(import_node_fs4.default.readFileSync(syncJsonPath(cwd, session), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeSyncRecord(cwd, session, rec) {
+  import_node_fs4.default.writeFileSync(syncJsonPath(cwd, session), JSON.stringify(rec, null, 2));
+}
+function escHtml2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function escAttr(s) {
+  return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+}
+function readIframeArtifact(cwd, src) {
+  if (typeof src !== "string" || !src.startsWith("/deck-files/")) return null;
+  const rel = decodeURIComponent(src.slice("/deck-files/".length));
+  if (rel.includes("..")) return null;
+  try {
+    return import_node_fs4.default.readFileSync(import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", rel), "utf-8");
+  } catch {
+    return null;
+  }
+}
+function renderShareSection(cwd, block) {
+  const label = block?.label ? `<h2 class="db-title">${escHtml2(String(block.label))}</h2>` : "";
+  switch (block?.type) {
+    case "iframe": {
+      const doc = readIframeArtifact(cwd, block.src) ?? "<p>(missing artifact)</p>";
+      return `<section class="db">${label}<iframe class="db-frame" sandbox="allow-scripts allow-popups" srcdoc="${escAttr(doc)}"></iframe></section>`;
+    }
+    case "rich-html":
+    case "html":
+      return `<section class="db">${label}<div class="db-html">${typeof block.content === "string" ? block.content : ""}</div></section>`;
+    case "markdown":
+      return `<section class="db">${label}<div class="db-md" data-md="${escAttr(typeof block.content === "string" ? block.content : "")}"></div></section>`;
+    case "mermaid":
+      return `<section class="db">${label}<pre class="mermaid">${escHtml2(typeof block.content === "string" ? block.content : "")}</pre></section>`;
+    case "options": {
+      const opts = Array.isArray(block.options) ? block.options : [];
+      const lis = opts.map(
+        (o) => `<li><strong>${escHtml2(String(o?.label ?? o?.id ?? ""))}</strong>${o?.description ? ` \u2014 ${escHtml2(String(o.description))}` : ""}</li>`
+      ).join("");
+      return `<section class="db">${label}<ul>${lis}</ul></section>`;
+    }
+    default:
+      return `<section class="db">${label}</section>`;
+  }
+}
+function buildShareHtml(cwd, session, blocks) {
+  if (blocks.length === 1) {
+    const only = blocks[0];
+    if (only?.type === "iframe") {
+      const doc = readIframeArtifact(cwd, only.src);
+      if (doc) return doc;
+    }
+  }
+  const list = blocks;
+  const sections = list.map((b) => renderShareSection(cwd, b)).join("\n");
+  const hasMd = list.some((b) => b?.type === "markdown");
+  const hasMermaid = list.some((b) => b?.type === "mermaid");
+  return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escHtml2(session)}</title>
+<style>
+  body { margin:0; font-family: ui-sans-serif, system-ui, sans-serif; background:#0b0e14; color:#e6e9ef; }
+  .db { padding:20px 24px; border-bottom:1px solid #1e2433; }
+  .db-title { font-size:13px; font-weight:600; margin:0 0 12px; color:#9aa4b2; text-transform:uppercase; letter-spacing:.05em; }
+  .db-frame { width:100%; height:70vh; border:0; border-radius:8px; background:#fff; }
+  .db-html { background:#fff; color:#111; border-radius:8px; padding:16px; overflow:auto; }
+  ul { line-height:1.7; }
+  .mermaid { background:#fff; border-radius:8px; padding:16px; }
+</style></head>
+<body>
+${sections}
+${hasMd ? `<script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+<script>document.querySelectorAll('.db-md').forEach(function(el){try{el.innerHTML=marked.parse(el.dataset.md||'')}catch(e){el.textContent=el.dataset.md||''}});</script>` : ""}
+${hasMermaid ? `<script type="module">import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.esm.min.mjs';mermaid.initialize({startOnLoad:true,theme:'dark'});</script>` : ""}
+</body></html>`;
 }
 var pendingFeedback = /* @__PURE__ */ new Map();
 var lastRenderError = null;
@@ -1288,23 +1584,23 @@ function broadcastToClients(message) {
   }
 }
 function serveStatic(res, filePath) {
-  if (!import_node_fs3.default.existsSync(filePath) || !import_node_fs3.default.statSync(filePath).isFile()) return false;
-  const ext = import_node_path3.default.extname(filePath).toLowerCase();
+  if (!import_node_fs4.default.existsSync(filePath) || !import_node_fs4.default.statSync(filePath).isFile()) return false;
+  const ext = import_node_path4.default.extname(filePath).toLowerCase();
   const mime = MIME_TYPES[ext] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": mime, "Cache-Control": "no-cache" });
-  import_node_fs3.default.createReadStream(filePath).pipe(res);
+  import_node_fs4.default.createReadStream(filePath).pipe(res);
   return true;
 }
 function resolveClientDir() {
-  const sibling = import_node_path3.default.join(__dirname, "..", "deck-client");
-  if (import_node_fs3.default.existsSync(import_node_path3.default.join(sibling, "assets"))) return sibling;
-  const devDist = import_node_path3.default.join(__dirname, "..", "..", "dist", "deck-client");
-  if (import_node_fs3.default.existsSync(import_node_path3.default.join(devDist, "assets"))) return devDist;
+  const sibling = import_node_path4.default.join(__dirname, "..", "deck-client");
+  if (import_node_fs4.default.existsSync(import_node_path4.default.join(sibling, "assets"))) return sibling;
+  const devDist = import_node_path4.default.join(__dirname, "..", "..", "dist", "deck-client");
+  if (import_node_fs4.default.existsSync(import_node_path4.default.join(devDist, "assets"))) return devDist;
   return sibling;
 }
 function serveIndex(res, clientDir) {
-  const indexPath = import_node_path3.default.join(clientDir, "index.html");
-  if (!import_node_fs3.default.existsSync(indexPath)) {
+  const indexPath = import_node_path4.default.join(clientDir, "index.html");
+  if (!import_node_fs4.default.existsSync(indexPath)) {
     res.writeHead(500, { "Content-Type": "text/plain" });
     res.end(`LaunchDeck client bundle not found at ${clientDir}. Run 'npm run build:client'.`);
     return;
@@ -1408,15 +1704,15 @@ async function startDeckServer(opts = {}) {
               const baseUrl = `/deck-files/${sessionEncoded}`;
               const html = generateBlastRadiusHtml(block.manifest, baseUrl);
               const report = generateBlastRadiusReport(block.manifest);
-              const dir = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
-              import_node_fs3.default.mkdirSync(dir, { recursive: true });
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "blast-radius.html"), html);
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "blast-radius-report.md"), report);
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
+              const dir = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
+              import_node_fs4.default.mkdirSync(dir, { recursive: true });
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius.html"), html);
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius-report.md"), report);
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
               const contractData = generateContract(block.manifest);
               const contractMd = contractToMarkdown(contractData);
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "contract.json"), JSON.stringify(contractData, null, 2));
-              import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, "contract.md"), contractMd);
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "contract.json"), JSON.stringify(contractData, null, 2));
+              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "contract.md"), contractMd);
               block.type = "iframe";
               block.src = `${baseUrl}/blast-radius.html`;
               delete block.manifest;
@@ -1443,9 +1739,9 @@ async function startDeckServer(opts = {}) {
                 const sessionEncoded = encodeURIComponent(body.session);
                 const baseUrl = `/deck-files/${sessionEncoded}`;
                 const filename = `${slugify(block.label)}.html`;
-                const dir = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
-                import_node_fs3.default.mkdirSync(dir, { recursive: true });
-                import_node_fs3.default.writeFileSync(import_node_path3.default.join(dir, filename), html);
+                const dir = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
+                import_node_fs4.default.mkdirSync(dir, { recursive: true });
+                import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, filename), html);
                 block.type = "iframe";
                 block.src = `${baseUrl}/${filename}`;
                 delete block.content;
@@ -1477,6 +1773,79 @@ async function startDeckServer(opts = {}) {
         jsonResponse(res, 200, { sessions: listPersistedSessions(cwd) });
         return;
       }
+      const shareMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)\/share$/);
+      if (shareMatch && req.method === "POST") {
+        const id = decodeURIComponent(shareMatch[1]);
+        const persisted = readPersistedSession(cwd, id);
+        if (!persisted) {
+          jsonResponse(res, 404, { ok: false, error: "session not found" });
+          return;
+        }
+        try {
+          loadMcpConfig(cwd);
+        } catch (err) {
+          jsonResponse(res, 400, {
+            ok: false,
+            error: `Cloud sharing needs an active LaunchSecure course (.launch-secure.cred.config) or a "launch-secure" entry in .mcp.json: ${String(err)}`
+          });
+          return;
+        }
+        try {
+          const blocks = Array.isArray(persisted.blocks) ? persisted.blocks : [];
+          const html = buildShareHtml(cwd, id, blocks);
+          const types = blocks.map((b) => b?.type).filter(Boolean);
+          const body = `Shared deck "${id}" \u2014 ${blocks.length} block${blocks.length === 1 ? "" : "s"}${types.length ? ` (${types.join(", ")})` : ""}. Open the Decks tab in the Communication Center to view.`;
+          const input = { title: id, body, html, sessionId: id, blockCount: blocks.length };
+          const existing2 = readSyncRecord(cwd, id);
+          let resourceId;
+          let updated = false;
+          if (existing2?.resourceId) {
+            try {
+              ({ id: resourceId } = await updateDeck(existing2.resourceId, input));
+              updated = true;
+            } catch {
+              ({ id: resourceId } = await writeDeck(input));
+            }
+          } else {
+            ({ id: resourceId } = await writeDeck(input));
+          }
+          writeSyncRecord(cwd, id, {
+            resourceId,
+            sharedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            version: persisted.version
+          });
+          jsonResponse(res, 200, { ok: true, resourceId, updated });
+        } catch (err) {
+          jsonResponse(res, 500, { ok: false, error: String(err) });
+        }
+        return;
+      }
+      const remoteDelMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)\/remote$/);
+      if (remoteDelMatch && req.method === "DELETE") {
+        const id = decodeURIComponent(remoteDelMatch[1]);
+        const sync = readSyncRecord(cwd, id);
+        if (!sync?.resourceId) {
+          jsonResponse(res, 200, { ok: true, deleted: false, reason: "not shared" });
+          return;
+        }
+        try {
+          loadMcpConfig(cwd);
+        } catch (err) {
+          jsonResponse(res, 400, { ok: false, error: `Cloud delete needs an active LaunchSecure course (.launch-secure.cred.config) or a "launch-secure" entry in .mcp.json: ${String(err)}` });
+          return;
+        }
+        try {
+          await deleteDeck(sync.resourceId);
+          try {
+            import_node_fs4.default.rmSync(syncJsonPath(cwd, id), { force: true });
+          } catch {
+          }
+          jsonResponse(res, 200, { ok: true, deleted: true });
+        } catch (err) {
+          jsonResponse(res, 500, { ok: false, error: String(err) });
+        }
+        return;
+      }
       const sessionMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)$/);
       if (sessionMatch) {
         const id = decodeURIComponent(sessionMatch[1]);
@@ -1579,7 +1948,7 @@ async function startDeckServer(opts = {}) {
           res.end("Forbidden");
           return;
         }
-        const filePath = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
+        const filePath = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
         if (serveStatic(res, filePath)) return;
         res.writeHead(404);
         res.end("Not found");
@@ -1592,25 +1961,25 @@ async function startDeckServer(opts = {}) {
           res.end("Forbidden");
           return;
         }
-        const filePath = import_node_path3.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
-        if (!import_node_fs3.default.existsSync(filePath) || !import_node_fs3.default.statSync(filePath).isFile()) {
+        const filePath = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
+        if (!import_node_fs4.default.existsSync(filePath) || !import_node_fs4.default.statSync(filePath).isFile()) {
           res.writeHead(404);
           res.end("Not found");
           return;
         }
-        const ext = import_node_path3.default.extname(filePath).toLowerCase();
+        const ext = import_node_path4.default.extname(filePath).toLowerCase();
         const mime = MIME_TYPES[ext] ?? "application/octet-stream";
-        const filename = import_node_path3.default.basename(filePath);
+        const filename = import_node_path4.default.basename(filePath);
         res.writeHead(200, {
           "Content-Type": mime,
           "Content-Disposition": `attachment; filename="${filename}"`,
           "Cache-Control": "no-cache"
         });
-        import_node_fs3.default.createReadStream(filePath).pipe(res);
+        import_node_fs4.default.createReadStream(filePath).pipe(res);
         return;
       }
       if (url2.pathname !== "/") {
-        const staticPath = import_node_path3.default.join(clientDir, url2.pathname);
+        const staticPath = import_node_path4.default.join(clientDir, url2.pathname);
         if (serveStatic(res, staticPath)) return;
       }
       serveIndex(res, clientDir);