@link.me/eve 0.4.0

package/dist/extension/_manifest.json

@@ -0,0 +1,13 @@
+{
+  "kind": "eve-extension",
+  "formatVersion": 1,
+  "builtWithEve": "0.29.2",
+  "requires": {
+    "extension": 1,
+    "tool": 3,
+    "connection": 2,
+    "skill": 1,
+    "instructions": 1,
+    "config": 1
+  }
+}

package/dist/extension/connections/platform.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("eve/connections").McpClientConnectionDefinition;
+export default _default;

package/dist/extension/connections/platform.mjs

@@ -0,0 +1,19 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import extension_default from "../extension.mjs";
+import { linkmeConnectionApproval } from "../lib/approval.mjs";
+import { linkmeAuth } from "../lib/auth.mjs";
+import { defineMcpClientConnection } from "eve/connections";
+const toolFilter = extension_default.config.allowedTools ? { tools: { allow: extension_default.config.allowedTools } } : {};
+var platform_default = defineMcpClientConnection({
+	url: extension_default.config.mcpUrl,
+	description: "Linkme platform for the signed-in user: profile, links, publishing, analytics, contacts, commerce, email, and other remote-safe workflows. Remote tools cannot read eve /workspace paths; use the extension prepare_media tool for AP videos first.",
+	auth: linkmeAuth,
+	approval: linkmeConnectionApproval,
+	...toolFilter
+});
+export { platform_default as default };

package/dist/extension/extension.d.ts

@@ -0,0 +1,10 @@
+import { z } from "zod";
+declare const _default: import("eve/extension").ExtensionHandle<z.ZodObject<{
+    connector: z.ZodDefault<z.ZodString>;
+    mcpUrl: z.ZodDefault<z.ZodString>;
+    apApiUrl: z.ZodDefault<z.ZodString>;
+    mountNamespace: z.ZodDefault<z.ZodString>;
+    allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    maxVideoBytes: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>>;
+export default _default;

package/dist/extension/extension.mjs

@@ -0,0 +1,25 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import { defineExtension } from "eve/extension";
+import { z } from "zod";
+const serviceUrl = z.string().url().refine((value) => {
+	const url = new URL(value);
+	return (url.protocol === "https:" || [
+		"localhost",
+		"127.0.0.1",
+		"::1"
+	].includes(url.hostname)) && url.username === "" && url.password === "" && url.search === "" && url.hash === "";
+}, "Use a credential-free HTTPS URL without query or fragment, except for an explicit loopback development URL.");
+var extension_default = defineExtension({ config: z.object({
+	connector: z.string().trim().min(1).default("REPLACE_WITH_VERCEL_CONNECTOR_UID"),
+	mcpUrl: serviceUrl.default("https://mcp.link.me/mcp"),
+	apApiUrl: serviceUrl.default("https://ap-api.link.me"),
+	mountNamespace: z.string().regex(/^[a-z][a-z0-9_-]*$/).default("linkme"),
+	allowedTools: z.array(z.string().trim().min(1)).min(1).optional(),
+	maxVideoBytes: z.number().int().positive().max(5368709120).default(2147483648)
+}) });
+export { extension_default as default };

package/dist/extension/instructions.md

@@ -0,0 +1,3 @@
+Use Linkme only for the authenticated user attached to the current session. Discover remote tools through the `platform` connection; never ask the user to paste a token.
+
+Treat approval gates as authoritative. Re-read affected state after every write. A remote MCP tool cannot access eve's `/workspace`; use `prepare_media` for an AP video and pass its returned key as `videoReference`.

package/dist/extension/lib/approval.d.ts

@@ -0,0 +1,3 @@
+import type { ApprovalContext, ApprovalStatus } from "eve/tools";
+export declare function linkmeConnectionApproval(ctx: ApprovalContext): ApprovalStatus;
+export declare function linkmeMediaApproval(ctx: ApprovalContext): ApprovalStatus;

package/dist/extension/lib/approval.mjs

@@ -0,0 +1,25 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import extension_default from "../extension.mjs";
+import { decideLinkmeApproval, hasPinnedUserPrincipal } from "./policy-core.mjs";
+function linkmeConnectionApproval(ctx) {
+	return decideLinkmeApproval({
+		toolName: ctx.toolName,
+		approvedTools: ctx.approvedTools,
+		current: ctx.session.auth.current,
+		initiator: ctx.session.auth.initiator,
+		namespace: extension_default.config.mountNamespace
+	});
+}
+function linkmeMediaApproval(ctx) {
+	if (!hasPinnedUserPrincipal(ctx.session.auth.current, ctx.session.auth.initiator)) return {
+		type: "denied",
+		reason: "Linkme media transfer requires one authenticated user pinned to the session."
+	};
+	return "user-approval";
+}
+export { linkmeConnectionApproval, linkmeMediaApproval };

package/dist/extension/lib/auth.d.ts

@@ -0,0 +1,5 @@
+/**
+ * User-scoped by design. Do not change this to `principalType: "app"` unless
+ * the consuming product intentionally operates one shared Linkme account.
+ */
+export declare const linkmeAuth: import("@vercel/connect/eve").EveConnectAuthorizationDefinition<import("eve/connections").InteractiveAuthorizationDefinition<import("eve/connections").JsonValue>>;

package/dist/extension/lib/auth.mjs

@@ -0,0 +1,10 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import extension_default from "../extension.mjs";
+import { connect } from "@vercel/connect/eve";
+const linkmeAuth = connect(extension_default.config.connector);
+export { linkmeAuth };

package/dist/extension/lib/media.d.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+export declare const VIDEO_CONTENT_TYPES: readonly ["video/mp4", "video/quicktime", "video/webm", "video/x-m4v", "video/x-matroska", "video/x-msvideo", "video/mpeg"];
+declare const finalizeUploadSchema: z.ZodObject<{
+    assetId: z.ZodNumber;
+    status: z.ZodEnum<{
+        failed: "failed";
+        processing: "processing";
+        processing_failed: "processing_failed";
+        ready: "ready";
+        uploaded: "uploaded";
+    }>;
+}, z.core.$strip>;
+export declare class LinkmeUnauthorizedError extends Error {
+    constructor();
+}
+export declare function normalizeSandboxPath(input: string): string;
+export declare function shellQuote(value: string): string;
+export declare function sandboxStatCommand(sandboxPath: string): string;
+export declare function parseSandboxStat(stdout: string): {
+    path: string;
+    size: number;
+};
+export declare function validateVideoDescriptor(input: {
+    readonly path: string;
+    readonly contentType: (typeof VIDEO_CONTENT_TYPES)[number];
+    readonly size: number;
+    readonly maxBytes: number;
+}): {
+    filename: string;
+    contentType: (typeof VIDEO_CONTENT_TYPES)[number];
+    size: number;
+};
+export declare function exactSizeStream(source: ReadableStream<Uint8Array>, expectedBytes: number): ReadableStream<Uint8Array>;
+type DirectIngestInput = {
+    readonly apiBaseUrl: string;
+    readonly bearerToken: string;
+    readonly contentType: (typeof VIDEO_CONTENT_TYPES)[number];
+    readonly filename: string;
+    readonly finalizeIdempotencyKey: string;
+    readonly prepareIdempotencyKey: string;
+    readonly signal?: AbortSignal;
+    readonly size: number;
+    readonly stream: ReadableStream<Uint8Array>;
+};
+type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export declare function directIngestVideo(input: DirectIngestInput, fetchImpl?: FetchLike): Promise<{
+    key: string;
+    assetId: number;
+    status: z.infer<typeof finalizeUploadSchema>["status"];
+}>;
+export {};

package/dist/extension/lib/media.mjs

@@ -0,0 +1,188 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import { z } from "zod";
+import { basename, extname, posix } from "node:path";
+const VIDEO_CONTENT_TYPES = [
+	"video/mp4",
+	"video/quicktime",
+	"video/webm",
+	"video/x-m4v",
+	"video/x-matroska",
+	"video/x-msvideo",
+	"video/mpeg"
+];
+const EXTENSIONS_BY_CONTENT_TYPE = {
+	"video/mp4": [".mp4"],
+	"video/quicktime": [".mov"],
+	"video/webm": [".webm"],
+	"video/x-m4v": [".m4v"],
+	"video/x-matroska": [".mkv"],
+	"video/x-msvideo": [".avi"],
+	"video/mpeg": [".mpeg", ".mpg"]
+};
+const prepareUploadSchema = z.object({
+	key: z.string().min(1),
+	mode: z.enum(["s3", "proxy"]),
+	upload: z.object({
+		method: z.literal("PUT"),
+		url: z.string().url(),
+		headers: z.record(z.string(), z.string())
+	})
+});
+const finalizeUploadSchema = z.object({
+	assetId: z.number().int(),
+	status: z.enum([
+		"uploaded",
+		"processing",
+		"ready",
+		"failed",
+		"processing_failed"
+	])
+});
+var LinkmeUnauthorizedError = class extends Error {
+	constructor() {
+		super("Linkme authorization expired.");
+		this.name = "LinkmeUnauthorizedError";
+	}
+};
+function normalizeSandboxPath(input) {
+	if (/[\u0000-\u001f\u007f]/.test(input)) throw new Error("Sandbox path cannot contain control characters.");
+	const trimmed = input.trim();
+	if (!trimmed) throw new Error("Sandbox path is required.");
+	const absolute = trimmed.startsWith("/") ? posix.normalize(trimmed) : posix.join("/workspace", trimmed);
+	if (absolute !== "/workspace" && !absolute.startsWith("/workspace/")) throw new Error("Media must be a file inside /workspace.");
+	return absolute;
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function sandboxStatCommand(sandboxPath) {
+	return [
+		"set -eu",
+		`target=$(realpath -e -- ${shellQuote(normalizeSandboxPath(sandboxPath))})`,
+		"case \"$target\" in /workspace/*) ;; *) exit 42 ;; esac",
+		"test -f \"$target\"",
+		"printf \"%s\\n\" \"$target\"",
+		"stat -c \"%s\" -- \"$target\""
+	].join("\n");
+}
+function parseSandboxStat(stdout) {
+	const lines = stdout.trimEnd().split("\n");
+	if (lines.length !== 2) throw new Error("Could not inspect the sandbox media file.");
+	const [path, rawSize] = lines;
+	if (!path || !rawSize) throw new Error("Could not inspect the sandbox media file.");
+	const size = Number(rawSize);
+	if (!Number.isSafeInteger(size) || size <= 0) throw new Error("Sandbox media file must be non-empty and have a safe byte size.");
+	return {
+		path: normalizeSandboxPath(path),
+		size
+	};
+}
+function validateVideoDescriptor(input) {
+	if (!Number.isSafeInteger(input.size) || input.size <= 0) throw new Error("Video must be non-empty.");
+	if (input.size > input.maxBytes) throw new Error(`Video exceeds the configured ${input.maxBytes}-byte limit.`);
+	const filename = basename(input.path);
+	const extension = extname(filename).toLowerCase();
+	if (!EXTENSIONS_BY_CONTENT_TYPE[input.contentType].includes(extension)) throw new Error(`File extension ${extension || "(none)"} does not match ${input.contentType}.`);
+	return {
+		filename,
+		contentType: input.contentType,
+		size: input.size
+	};
+}
+function exactSizeStream(source, expectedBytes) {
+	const reader = source.getReader();
+	let seen = 0;
+	return new ReadableStream({
+		async pull(controller) {
+			const next = await reader.read();
+			if (next.done) {
+				if (seen !== expectedBytes) {
+					controller.error(new Error(`Sandbox file changed during upload (expected ${expectedBytes} bytes, read ${seen}).`));
+					return;
+				}
+				controller.close();
+				return;
+			}
+			seen += next.value.byteLength;
+			if (seen > expectedBytes) {
+				await reader.cancel("Sandbox file grew during upload.");
+				controller.error(new Error(`Sandbox file changed during upload (expected ${expectedBytes} bytes).`));
+				return;
+			}
+			controller.enqueue(next.value);
+		},
+		async cancel(reason) {
+			await reader.cancel(reason);
+		}
+	});
+}
+async function directIngestVideo(input, fetchImpl = fetch) {
+	const apiHeaders = {
+		accept: "application/json",
+		authorization: `Bearer ${input.bearerToken}`,
+		"content-type": "application/json"
+	};
+	const prepareUrl = new URL("/api/uploads/prepare", input.apiBaseUrl);
+	prepareUrl.searchParams.set("mode", "s3");
+	const prepareResponse = await fetchImpl(prepareUrl, {
+		method: "POST",
+		headers: {
+			...apiHeaders,
+			"idempotency-key": input.prepareIdempotencyKey
+		},
+		body: JSON.stringify({
+			contentType: input.contentType,
+			filename: input.filename,
+			size: input.size
+		}),
+		signal: input.signal
+	});
+	await requireApiSuccess(prepareResponse);
+	const prepared = prepareUploadSchema.parse(await prepareResponse.json());
+	const uploadUrl = new URL(prepared.upload.url);
+	if (uploadUrl.protocol !== "https:") throw new Error("Linkme returned a non-HTTPS upload target.");
+	const uploadHeaders = new Headers(prepared.upload.headers);
+	for (const sensitiveHeader of [
+		"authorization",
+		"cookie",
+		"host",
+		"proxy-authorization"
+	]) uploadHeaders.delete(sensitiveHeader);
+	uploadHeaders.set("content-length", String(input.size));
+	if (!uploadHeaders.has("content-type")) uploadHeaders.set("content-type", input.contentType);
+	const uploadResponse = await fetchImpl(uploadUrl, {
+		method: "PUT",
+		headers: uploadHeaders,
+		body: exactSizeStream(input.stream, input.size),
+		redirect: "error",
+		signal: input.signal,
+		duplex: "half"
+	});
+	if (!uploadResponse.ok) throw new Error(`Linkme media upload failed with status ${uploadResponse.status}.`);
+	const finalizeResponse = await fetchImpl(new URL("/api/uploads/finalize", input.apiBaseUrl), {
+		method: "POST",
+		headers: {
+			...apiHeaders,
+			"idempotency-key": input.finalizeIdempotencyKey
+		},
+		body: JSON.stringify({ key: prepared.key }),
+		signal: input.signal
+	});
+	await requireApiSuccess(finalizeResponse);
+	const finalized = finalizeUploadSchema.parse(await finalizeResponse.json());
+	return {
+		key: prepared.key,
+		assetId: finalized.assetId,
+		status: finalized.status
+	};
+}
+async function requireApiSuccess(response) {
+	if (response.status === 401) throw new LinkmeUnauthorizedError();
+	if (!response.ok) throw new Error(`Linkme media API failed with status ${response.status}.`);
+}
+export { LinkmeUnauthorizedError, VIDEO_CONTENT_TYPES, directIngestVideo, exactSizeStream, normalizeSandboxPath, parseSandboxStat, sandboxStatCommand, shellQuote, validateVideoDescriptor };

package/dist/extension/lib/policy-core.d.ts

@@ -0,0 +1,20 @@
+export type Principal = {
+    readonly issuer?: string;
+    readonly principalId: string;
+    readonly principalType: string;
+};
+export type LinkmeApprovalDecision = "not-applicable" | "user-approval" | {
+    readonly type: "denied";
+    readonly reason: string;
+};
+export type LinkmeToolEffect = "read" | "session-write" | "always-confirm";
+export declare function bareLinkmeToolName(qualifiedToolName: string): string;
+export declare function classifyLinkmeTool(qualifiedToolName: string): LinkmeToolEffect;
+export declare function hasPinnedUserPrincipal(current: Principal | null | undefined, initiator: Principal | null | undefined): boolean;
+export declare function decideLinkmeApproval(input: {
+    readonly toolName: string;
+    readonly approvedTools: ReadonlySet<string>;
+    readonly current: Principal | null | undefined;
+    readonly initiator: Principal | null | undefined;
+    readonly namespace?: string;
+}): LinkmeApprovalDecision;

package/dist/extension/lib/policy-core.mjs

@@ -0,0 +1,168 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+const READ_EXACT = new Set([
+	"agency_invitations",
+	"agency_list",
+	"agency_users",
+	"analytics_geo",
+	"analytics_links",
+	"analytics_overview",
+	"analytics_realtime",
+	"analytics_visits",
+	"linkme_capabilities",
+	"ap_accounts",
+	"ap_analytics_accounts",
+	"ap_analytics_post",
+	"ap_limits",
+	"ap_post_calendar",
+	"ap_post_comments",
+	"ap_post_insights",
+	"ap_post_list",
+	"ap_post_status",
+	"api_get",
+	"auth_sessions_list",
+	"automations_analytics",
+	"automations_config",
+	"automations_connection",
+	"automations_dashboard-link-analytics",
+	"automations_dashboard-stats",
+	"automations_get",
+	"automations_list",
+	"automations_metrics",
+	"automations_posts",
+	"commerce_merch_list",
+	"commerce_products_list",
+	"commerce_products_orders",
+	"contacts_list",
+	"contacts_stats",
+	"courses_get",
+	"courses_list",
+	"email_detail",
+	"email_domains_list",
+	"email_history",
+	"email_recipients",
+	"email_templates_get",
+	"email_templates_list",
+	"featured_headers_list",
+	"featured_list",
+	"featured_multilinks_list",
+	"feeds_list",
+	"feeds_videos",
+	"gallery_list",
+	"links_list",
+	"links_platform_list",
+	"links_schedule_list",
+	"profile_bands-in-town_events",
+	"profile_bands-in-town_show",
+	"profile_contact_list",
+	"profile_events_list",
+	"profile_forms_export",
+	"profile_forms_list",
+	"profile_forms_submissions",
+	"profile_sections_list",
+	"profile_video_show",
+	"profile_view",
+	"reviews_list",
+	"reviews_show",
+	"search",
+	"shop_categories_list",
+	"shop_products_list",
+	"skill_list",
+	"skill_show",
+	"username_check",
+	"waitlist_status",
+	"whoami"
+]);
+const ALWAYS_CONFIRM_EXACT = new Set([
+	"ap_post_create",
+	"auth_sessions_revoke",
+	"email_campaigns_send"
+]);
+const READ_ACTIONS = new Set([
+	"accounts",
+	"availability",
+	"check",
+	"endpoints",
+	"geo",
+	"get",
+	"limits",
+	"list",
+	"lookup",
+	"overview",
+	"realtime",
+	"search",
+	"show",
+	"stats",
+	"status",
+	"validate",
+	"view",
+	"visits",
+	"whoami"
+]);
+const ALWAYS_CONFIRM_ACTIONS = new Set([
+	"cancel",
+	"delete",
+	"disconnect",
+	"logout",
+	"publish",
+	"purge",
+	"remove",
+	"revoke",
+	"send",
+	"upload"
+]);
+const SESSION_WRITE_ACTIONS = new Set([
+	"add",
+	"archive",
+	"create",
+	"disable",
+	"edit",
+	"enable",
+	"join",
+	"leave",
+	"reorder",
+	"restore",
+	"set",
+	"unset",
+	"update"
+]);
+function bareLinkmeToolName(qualifiedToolName) {
+	return qualifiedToolName.split("__").at(-1) ?? qualifiedToolName;
+}
+function classifyLinkmeTool(qualifiedToolName) {
+	const bareName = bareLinkmeToolName(qualifiedToolName);
+	if (READ_EXACT.has(bareName) || bareName.startsWith("analytics_") || bareName.includes("_analytics_")) return "read";
+	if (ALWAYS_CONFIRM_EXACT.has(bareName) || bareName.endsWith("_post_create")) return "always-confirm";
+	const words = bareName.split("_");
+	if (words.some((word) => ALWAYS_CONFIRM_ACTIONS.has(word))) return "always-confirm";
+	if (words.some((word) => SESSION_WRITE_ACTIONS.has(word))) return "session-write";
+	if (words.some((word) => READ_ACTIONS.has(word))) return "read";
+	return "always-confirm";
+}
+function hasPinnedUserPrincipal(current, initiator) {
+	if (!current || !initiator) return false;
+	if (current.principalType !== "user" || initiator.principalType !== "user") return false;
+	if (!current.principalId || !initiator.principalId || !current.issuer || !initiator.issuer) return false;
+	return current.principalId === initiator.principalId && current.issuer === initiator.issuer;
+}
+function decideLinkmeApproval(input) {
+	const namespace = input.namespace ?? "linkme";
+	if (!input.toolName.startsWith(`${namespace}__`)) return {
+		type: "denied",
+		reason: `Tool is outside the ${namespace} extension namespace.`
+	};
+	if (!hasPinnedUserPrincipal(input.current, input.initiator)) return {
+		type: "denied",
+		reason: "Linkme requires one authenticated user pinned to the entire session."
+	};
+	switch (classifyLinkmeTool(input.toolName)) {
+		case "read": return "not-applicable";
+		case "session-write": return input.approvedTools.has(input.toolName) ? "not-applicable" : "user-approval";
+		case "always-confirm": return "user-approval";
+	}
+}
+export { bareLinkmeToolName, classifyLinkmeTool, decideLinkmeApproval, hasPinnedUserPrincipal };

package/dist/extension/skills/analyze-performance/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: analyze-performance
+description: Analyze Linkme profile, link, audience, geographic, realtime, post, or provider performance and explain actionable trends over a defined time range.
+---
+
+# Analyze Linkme performance
+
+1. Confirm the metric question, date range, comparison period, and timezone. Default to the user's locale only when it is known.
+2. Discover and call the smallest set of read-only analytics tools needed.
+3. Keep counts, rates, and provider-native metrics distinct. Do not add incompatible metrics.
+4. Compare like-for-like periods and label partial or delayed provider data.
+5. State the strongest findings, supporting values, uncertainty, and one or two actionable follow-ups.
+
+Do not mutate profile or publishing state during an analytics request. Ask before turning an insight into an edit or campaign.

package/dist/extension/skills/manage-commerce/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: manage-commerce
+description: Inspect or manage Linkme digital products, pay-to-unlock content, orders, print-on-demand merch templates, shop items, pricing, or catalog presentation.
+---
+
+# Manage Linkme commerce
+
+1. Determine whether the request concerns digital commerce, merch templates, or public shop products; these are separate surfaces.
+2. Read the catalog item and relevant order or category state before editing.
+3. Resolve currency, price units, fulfillment type, files, visibility, and tax or policy implications explicitly.
+4. Present the exact price and customer-visible change before the approval-gated write.
+5. Execute once with an application idempotency key when supported.
+6. Re-read the item and verify price, availability, and presentation.
+
+Never fabricate revenue, payout, tax, inventory, or fulfillment status. Unknown financial or destructive tools require per-call approval.

package/dist/extension/skills/manage-profile/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: manage-profile
+description: Inspect or update a Linkme profile, theme, links, featured content, gallery, sections, contact settings, events, forms, pixels, or public-page presentation.
+---
+
+# Manage a Linkme profile
+
+1. Discover the relevant `platform` tools and read current state first.
+2. Separate content changes from ordering and presentation changes.
+3. Preserve IDs from read results; never guess a link, section, gallery, or featured item ID.
+4. For several edits, present one compact change set and expected public-page effect.
+5. Execute approval-gated writes in dependency order: create or edit items, then reorder, then enable or publish presentation changes.
+6. Read the changed resources again and report the resulting public state.
+
+Do not infer destructive intent from “clean up.” Ask which items may be deleted. Treat public URLs, visibility, tracking pixels, and contact exposure as consequential settings.

package/dist/extension/skills/prepare-media/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: prepare-media
+description: Prepare video, image, or document inputs for Linkme agent workflows, especially when a file is attached to an eve session or stored under /workspace.
+---
+
+# Prepare Linkme media
+
+First identify the source:
+
+- Eve sandbox path: remote MCP cannot read it. For AP video, call `prepare_media`, then use the returned durable key.
+- Hosted file object or HTTPS URL: pass it only to a remote tool that explicitly declares that bounded file input.
+- Existing Linkme object key: pass it as the tool's reference field; do not download and re-upload it.
+
+For `prepare_media`:
+
+1. Ensure the path is inside `/workspace`.
+2. Supply the real video MIME type matching the extension.
+3. Respect the human approval: this transfers user bytes to Linkme.
+4. Keep the returned `key`, `assetId`, and status together.
+5. Wait for or inspect processing state when a downstream operation requires ready media.
+
+The native bridge currently supports AP video only. Do not claim it uploads profile/gallery images or documents. Never proxy a large video through the hosted MCP process.

package/dist/extension/skills/publish-content/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: publish-content
+description: Plan, preflight, schedule, publish, inspect, or cancel Linkme multi-platform short-form video posts. Use for YouTube Shorts, Instagram Reels or Stories, TikTok, and other AP publishing workflows.
+---
+
+# Publish Linkme content
+
+1. Discover the `platform` connection's account, limit, post, and capability tools.
+2. Read connected accounts and limits before preparing a post. Report missing or reconnect-required providers.
+3. If the video is in `/workspace`, load the media skill and call `prepare_media`. Use its returned key as `videoReference`; never send the sandbox path to MCP.
+4. Resolve caption, platforms, provider account IDs, timezone, schedule, privacy, and commercial-content settings. Ask only for consequential missing choices.
+5. Summarize the exact publish plan before the approval-gated create call.
+6. Create once. Preserve the returned post ID and do not retry an ambiguous timeout without first listing or getting the post.
+7. Read the post and per-target state after creation. Surface partial failures per provider rather than calling the whole post successful.
+
+Never bypass the approval request for create, publish, cancel, disconnect, or delete operations.

package/dist/extension/skills/recover-access/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: recover-access
+description: Diagnose Linkme sign-in, expired authorization, account reconnect, provider OAuth, session, or permission failures encountered by an eve agent.
+---
+
+# Recover Linkme access
+
+1. Never request a password, access token, refresh token, cookie, or OAuth code in chat.
+2. If the `platform` connection requests authorization, surface its Vercel Connect URL and wait for the same user to finish.
+3. On a provider reconnect issue, read account state, identify the affected provider/account, and start only the official reconnect flow.
+4. On a permission error, distinguish Linkme account authorization from an external provider scope or policy restriction.
+5. After authorization, retry one read operation before retrying a write.
+
+Remote Linkme intentionally omits CLI-local login, logout, config, and agency-context mutation tools. Do not work around that boundary with a pasted bearer token or alternate API URL.

package/dist/extension/tools/prepare_media.d.ts

@@ -0,0 +1,14 @@
+declare const _default: import("eve/tools").ToolDefinition<{
+    sandboxPath: string;
+    contentType: "video/mp4" | "video/mpeg" | "video/quicktime" | "video/webm" | "video/x-m4v" | "video/x-matroska" | "video/x-msvideo";
+}, {
+    kind: "video";
+    key: string;
+    assetId: number;
+    status: "failed" | "processing" | "processing_failed" | "ready" | "uploaded";
+    filename: string;
+    contentType: "video/mp4" | "video/mpeg" | "video/quicktime" | "video/webm" | "video/x-m4v" | "video/x-matroska" | "video/x-msvideo";
+    sizeBytes: number;
+    source: "linkme-direct-ingest";
+}>;
+export default _default;

package/dist/extension/tools/prepare_media.mjs

@@ -0,0 +1,83 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import extension_default from "../extension.mjs";
+import { linkmeMediaApproval } from "../lib/approval.mjs";
+import { linkmeAuth } from "../lib/auth.mjs";
+import { LinkmeUnauthorizedError, VIDEO_CONTENT_TYPES, directIngestVideo, parseSandboxStat, sandboxStatCommand, validateVideoDescriptor } from "../lib/media.mjs";
+import { z } from "zod";
+import { defineTool } from "eve/tools";
+const outputSchema = z.object({
+	kind: z.literal("video"),
+	key: z.string(),
+	assetId: z.number().int(),
+	status: z.enum([
+		"uploaded",
+		"processing",
+		"ready",
+		"failed",
+		"processing_failed"
+	]),
+	filename: z.string(),
+	contentType: z.enum(VIDEO_CONTENT_TYPES),
+	sizeBytes: z.number().int().positive(),
+	source: z.literal("linkme-direct-ingest")
+});
+var prepare_media_default = defineTool({
+	description: "Prepare an AP video already stored in this eve session's /workspace for Linkme publishing. Streams directly to Linkme and returns a durable key; never pass sandbox paths to remote MCP tools.",
+	inputSchema: z.object({
+		sandboxPath: z.string().min(1).describe("Relative path or absolute /workspace path for an existing sandbox video"),
+		contentType: z.enum(VIDEO_CONTENT_TYPES)
+	}),
+	outputSchema,
+	approval: linkmeMediaApproval,
+	async execute({ sandboxPath, contentType }, ctx) {
+		const sandbox = await ctx.getSandbox();
+		const inspected = await sandbox.run({ command: sandboxStatCommand(sandboxPath) });
+		if (inspected.exitCode !== 0) throw new Error("Media must resolve to one regular file inside /workspace.");
+		const stat = parseSandboxStat(inspected.stdout);
+		const video = validateVideoDescriptor({
+			path: stat.path,
+			contentType,
+			size: stat.size,
+			maxBytes: extension_default.config.maxVideoBytes
+		});
+		const stream = await sandbox.readFile({ path: stat.path });
+		if (!stream) throw new Error("Sandbox media file disappeared before upload.");
+		const { token } = await ctx.getToken(linkmeAuth, {
+			displayName: "Linkme",
+			authKey: "linkme"
+		});
+		try {
+			const operationId = `${ctx.session.id}:${ctx.session.turn.id}:${ctx.callId}`;
+			return {
+				kind: "video",
+				...await directIngestVideo({
+					apiBaseUrl: extension_default.config.apApiUrl,
+					bearerToken: token,
+					contentType: video.contentType,
+					filename: video.filename,
+					finalizeIdempotencyKey: `${operationId}:finalize`,
+					prepareIdempotencyKey: `${operationId}:prepare`,
+					signal: ctx.abortSignal,
+					size: video.size,
+					stream
+				}),
+				filename: video.filename,
+				contentType: video.contentType,
+				sizeBytes: video.size,
+				source: "linkme-direct-ingest"
+			};
+		} catch (error) {
+			if (error instanceof LinkmeUnauthorizedError) ctx.requireAuth(linkmeAuth, {
+				displayName: "Linkme",
+				authKey: "linkme"
+			});
+			throw error;
+		}
+	}
+});
+export { prepare_media_default as default };

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+// Generated by eve. Do not edit by hand.
+
+export { default } from "./extension/extension.js";
+export { default as eve } from "./extension/extension.js";

package/dist/index.mjs

@@ -0,0 +1,8 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import extension_default from "./extension/extension.mjs";
+export { extension_default as default, extension_default as eve };

package/dist/tools/index.d.ts

@@ -0,0 +1,3 @@
+// Generated by eve. Do not edit by hand.
+
+export { default as prepare_media } from "../extension/tools/prepare_media.js";

package/dist/tools/index.mjs

@@ -0,0 +1,8 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import prepare_media_default from "../extension/tools/prepare_media.mjs";
+export { prepare_media_default as prepare_media };

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@link.me/eve",
+  "version": "0.4.0",
+  "description": "Linkme MCP connection, media bridge, and agent skills for eve",
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.mjs"
+    },
+    "./tools": {
+      "types": "./dist/tools/index.d.ts",
+      "default": "./dist/tools/index.mjs"
+    }
+  },
+  "dependencies": {
+    "@vercel/connect": "0.4.3",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "eve": "0.29.2",
+    "typescript": "7.0.2"
+  },
+  "peerDependencies": {
+    "eve": "*"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "eve": {
+    "extension": {
+      "source": "./extension",
+      "dist": "./dist/extension"
+    }
+  },
+  "scripts": {
+    "build": "eve extension build",
+    "test": "node --test test/*.test.ts",
+    "typecheck": "tsc && tsc --project tsconfig.test.json"
+  }
+}