@micropage-sh/mcp 0.1.0

package/dist/client/posts.js

@@ -0,0 +1,187 @@
+import { createHash } from "node:crypto";
+import { MicropageError } from "./errors.js";
+import { eq, gt, inList, is } from "./http.js";
+/** Same rule as supabase/functions/_shared/slug.ts and the CLI's slugify. */
+export function slugify(s) {
+    return s
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
+/** Columns for the list view (cli posts list, plus form_id to name the list). */
+export const POST_LIST_COLUMNS = "id,slug,title,web_visibility,email_enabled,form_id,status,published_at,created_at,recipient_count";
+/** Everything posts pull reads, plus the email fields upsert_post writes. */
+export const POST_FULL_COLUMNS = "id,slug,title,description,body_markdown,web_visibility,email_enabled,form_id,hero_image,subject,preheader," +
+    "status,published_at,created_at,recipient_count,sent_count";
+export async function listPosts(http, projectId) {
+    return http.select("posts", {
+        select: POST_LIST_COLUMNS,
+        filters: { project_id: eq(projectId) },
+        order: "created_at.desc",
+    });
+}
+export async function getPostBySlug(http, projectId, slug) {
+    return http.selectOne("posts", {
+        select: POST_FULL_COLUMNS,
+        filters: { project_id: eq(projectId), slug: eq(slug) },
+    });
+}
+export function postNotFound(slug) {
+    return new MicropageError("POST_NOT_FOUND", `No post with slug "${slug}" in this project. Call list_posts to see the project's posts, or upsert_post to create it.`);
+}
+/** publish-post's condition for sending (supabase/functions/publish-post/index.ts). */
+export function postWillEmail(post) {
+    return post.email_enabled === true && post.form_id != null;
+}
+/**
+ * `list: <form name>` -> form_id, as cli/src/commands/posts.js resolveFormId:
+ * case-insensitive exact name among the project's newsletter forms.
+ */
+export async function resolveListFormId(http, projectId, listName) {
+    const name = listName.trim();
+    const forms = await http.select("forms", {
+        select: "id,form_name,is_newsletter",
+        filters: { project_id: eq(projectId), is_newsletter: eq(true) },
+    });
+    const matches = forms.filter((f) => (f.form_name ?? "").toLowerCase() === name.toLowerCase());
+    if (matches.length === 0) {
+        const known = forms.map((f) => f.form_name).filter((n) => !!n);
+        throw new MicropageError("LIST_NOT_FOUND", `No newsletter form named "${name}" in this project.` +
+            (known.length > 0
+                ? ` Newsletter forms here: ${known.map((n) => `"${n}"`).join(", ")}.`
+                : " The project has no newsletter forms; one is created by publishing a page with a newsletter form.") +
+            " Nothing was saved.");
+    }
+    if (matches.length > 1) {
+        throw new MicropageError("LIST_AMBIGUOUS", `More than one newsletter form is named "${name}". Ask the user to rename one in the editor. Nothing was saved.`);
+    }
+    return matches[0].id;
+}
+export async function formNamesById(http, ids) {
+    const unique = [...new Set(ids)];
+    if (unique.length === 0)
+        return new Map();
+    const rows = await http.select("forms", {
+        select: "id,form_name",
+        filters: { id: inList(unique) },
+    });
+    return new Map(rows.map((r) => [r.id, r.form_name]));
+}
+/**
+ * Active subscribers on a list, with the filter publish-post sends to
+ * (form_id, unsubscribed_at is null). The owner can read the table under RLS
+ * ("Users can select newsletter_subscribers for own projects").
+ */
+export async function countActiveSubscribers(http, formId) {
+    return http.count("newsletter_subscribers", { form_id: eq(formId), unsubscribed_at: is("null") });
+}
+export function isAbsoluteUrl(s) {
+    return /^https?:\/\//i.test(s.trim());
+}
+/**
+ * The hero as cli/src/posts-assets.js resolveHeroImage resolves it, minus the
+ * local-file upload branch: an absolute URL passes through, anything else must
+ * be the filename of an asset already uploaded to the project.
+ */
+export async function resolveHeroUrl(http, projectId, hero) {
+    const value = hero?.trim() ?? "";
+    if (!value)
+        return null;
+    if (isAbsoluteUrl(value))
+        return value;
+    const data = await http.invokeGet("list-files", { project_id: String(projectId) });
+    const files = data?.files ?? [];
+    const base = value.split(/[\\/]/).pop() ?? value;
+    const file = files.find((f) => f.filename === value) ?? files.find((f) => f.filename === base);
+    if (!file) {
+        throw new MicropageError("HERO_NOT_FOUND", `hero "${value}" is not an https URL and no uploaded asset in this project has that filename. ` +
+            "Upload the image with upload_asset first and pass the filename it returns (list_files shows existing ones). Nothing was saved.");
+    }
+    const urlData = await http.invokeGet("get-file-url", { file_id: file.id });
+    if (!urlData?.url) {
+        throw new MicropageError("HTTP", `get-file-url returned no URL for "${file.filename}". Retry shortly. Nothing was saved.`);
+    }
+    return urlData.url;
+}
+// Same pattern as posts-assets.js: ![alt](path "title").
+const MD_IMAGE_RE = /!\[([^\]]*)\]\(\s*([^)\s]+)(?:\s+"[^"]*")?\s*\)/g;
+/** Body image refs that are not hosted URLs; they would 404 on the live page. */
+export function unhostedBodyImages(markdown) {
+    const out = [];
+    for (const match of markdown.matchAll(MD_IMAGE_RE)) {
+        const ref = match[2];
+        if (isAbsoluteUrl(ref) || ref.startsWith("/") || ref.startsWith("#") || ref.startsWith("data:"))
+            continue;
+        if (!out.includes(ref))
+            out.push(ref);
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Fingerprint for preview tokens
+// ---------------------------------------------------------------------------
+/**
+ * posts has no updated_at, so a preview is bound to a hash of every field a
+ * save can change. Fixed field order keeps it stable without key sorting.
+ */
+export function postContentFingerprint(post) {
+    const fields = [
+        post.title,
+        post.slug,
+        post.subject,
+        post.preheader,
+        post.description,
+        post.body_markdown,
+        post.hero_image,
+        post.web_visibility,
+    ];
+    return createHash("sha256").update(JSON.stringify(fields)).digest("base64url");
+}
+export async function upsertPost(http, payload) {
+    try {
+        return await http.invoke("upsert-post", payload);
+    }
+    catch (err) {
+        if (err instanceof MicropageError && err.status === 409) {
+            throw new MicropageError("SLUG_CONFLICT", `The slug "${payload.slug}" is already used by another post in this project. Pass a different \`slug\`, ` +
+                "or call list_posts to find the existing post and edit that one. Nothing was saved.", { status: 409, data: err.data, cause: err });
+        }
+        throw err;
+    }
+}
+export async function publishPost(http, projectId, slug) {
+    try {
+        return await http.invoke("publish-post", { project_id: projectId, slug });
+    }
+    catch (err) {
+        if (err instanceof MicropageError && err.status === 402) {
+            throw new MicropageError("PLAN_LIMIT", `micropage refused to send this post: ${serverMessage(err) ?? "the plan does not allow it"}. ` +
+                "Newsletter sends need a Pro plan and count against a monthly recipient limit; " +
+                "tell the user (upgrade at https://micropage.sh/pricing). No email went out and the site was not rebuilt, " +
+                "but the post may now be marked published; check with list_posts.", { status: 402, data: err.data, cause: err });
+        }
+        if (err instanceof MicropageError && err.status === 404)
+            throw postNotFound(slug);
+        throw err;
+    }
+}
+export async function unpublishPost(http, projectId, slug) {
+    try {
+        return await http.invoke("unpublish-post", { project_id: projectId, slug });
+    }
+    catch (err) {
+        if (err instanceof MicropageError && err.status === 404)
+            throw postNotFound(slug);
+        throw err;
+    }
+}
+export async function deletePost(http, projectId, slug) {
+    return http.invoke("delete-post", { project_id: projectId, slug });
+}
+function serverMessage(err) {
+    const data = err.data;
+    const msg = data?.error ?? data?.message;
+    return typeof msg === "string" && msg ? msg : null;
+}
+//# sourceMappingURL=posts.js.map

package/dist/client/posts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posts.js","sourceRoot":"","sources":["../../src/client/posts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAa,MAAM,WAAW,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC;SACL,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAID,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,mGAAmG,CAAC;AAEtG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4GAA4G;IAC5G,2DAA2D,CAAC;AAwB9D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,SAAiB;IAC3D,OAAO,IAAI,CAAC,MAAM,CAAc,OAAO,EAAE;QACvC,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE;QACtC,KAAK,EAAE,iBAAiB;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,SAAiB,EAAE,IAAY;IAC7E,OAAO,IAAI,CAAC,SAAS,CAAU,OAAO,EAAE;QACtC,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE;KACvD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,cAAc,CACvB,gBAAgB,EAChB,sBAAsB,IAAI,6FAA6F,CACxH,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,IAAgD;IAC5E,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;AAC7D,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,SAAiB,EAAE,QAAgB;IACrF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAA2C,OAAO,EAAE;QACjF,MAAM,EAAE,4BAA4B;QACpC,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE;KAChE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,cAAc,CACtB,gBAAgB,EAChB,6BAA6B,IAAI,oBAAoB;YACnD,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBACf,CAAC,CAAC,2BAA2B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACrE,CAAC,CAAC,mGAAmG,CAAC;YACxG,qBAAqB,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CACtB,gBAAgB,EAChB,2CAA2C,IAAI,iEAAiE,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,GAA0B;IACxE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAc,OAAO,EAAE;QACnD,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;KAChC,CAAC,CAAC;IACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAU,EAAE,MAAc;IACrE,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACpG,CAAC;AAWD,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE,SAAiB,EAAE,IAAwB;IAC1F,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAkC,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpH,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,cAAc,CACtB,gBAAgB,EAChB,SAAS,KAAK,iFAAiF;YAC7F,gIAAgI,CACnI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAA0B,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,qCAAqC,IAAI,CAAC,QAAQ,sCAAsC,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED,yDAAyD;AACzD,MAAM,WAAW,GAAG,kDAAkD,CAAC;AAEvE,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAC1G,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,MAAM,MAAM,GAAG;QACb,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,cAAc;KACpB,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACjF,CAAC;AAmCD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,OAA0B;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAqB,aAAa,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxD,MAAM,IAAI,cAAc,CACtB,eAAe,EACf,aAAa,OAAO,CAAC,IAAI,gFAAgF;gBACvG,oFAAoF,EACtF,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAC5C,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,SAAiB,EAAE,IAAY;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAsB,cAAc,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxD,MAAM,IAAI,cAAc,CACtB,YAAY,EACZ,wCAAwC,aAAa,CAAC,GAAG,CAAC,IAAI,4BAA4B,IAAI;gBAC5F,gFAAgF;gBAChF,2GAA2G;gBAC3G,kEAAkE,EACpE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAC5C,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,SAAiB,EAAE,IAAY;IAC7E,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,SAAiB,EAAE,IAAY;IAC1E,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAiE,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,OAAO,CAAC;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC"}

package/dist/client/project-ref.d.ts

@@ -0,0 +1,68 @@
+import * as z from "zod";
+import type { AuthProvider } from "./auth-provider.js";
+import { type MicropageConfig } from "./config.js";
+import { type Http } from "./http.js";
+export declare function isProjectUuid(s: string): boolean;
+export declare function isNumericProjectId(s: string): boolean;
+/** The `project` input every project-scoped tool takes. */
+export declare const ProjectRef: z.ZodString;
+/** Columns read for every resolved project. */
+export declare const PROJECT_COLUMNS = "id,uuid,name,domain,custom_domain,active_build_id,status,created_at";
+export interface ProjectRow {
+    id: number;
+    uuid: string;
+    name: string | null;
+    domain: string | null;
+    custom_domain: string | null;
+    active_build_id: number | null;
+    status: string | null;
+    created_at: string | null;
+}
+export interface Project extends ProjectRow {
+    /** Public URL: the custom domain when set, else https://<domain>.<baseDomain>. */
+    live_url: string | null;
+    /** The project in the web editor. */
+    editor_url: string;
+}
+/** What resolveProject needs; ToolContext satisfies it. */
+export interface ProjectRefDeps {
+    http: Http;
+    auth: Pick<AuthProvider, "mode" | "pinnedProjectUuid">;
+    config: Pick<MicropageConfig, "baseDomain" | "appUrl">;
+}
+export declare function toProject(row: ProjectRow, config: ProjectRefDeps["config"]): Project;
+export type ParsedProjectRef = {
+    kind: "uuid";
+    value: string;
+} | {
+    kind: "id";
+    value: number;
+}
+/** `{slug}.<baseDomain>` or a bare slug: matches projects.domain. */
+ | {
+    kind: "slug";
+    value: string;
+}
+/** Any other hostname: a custom domain (or, as the CLI allows, a domain stored verbatim). */
+ | {
+    kind: "host";
+    value: string;
+};
+/**
+ * Classifies a user-supplied ref the way cli/src/project-ref.js does, plus
+ * URL/hostname handling. Throws PROJECT_NOT_FOUND for something that cannot
+ * be any of them.
+ */
+export declare function parseProjectRef(ref: string, baseDomain: string): ParsedProjectRef;
+/**
+ * The pin a deploy token carries. The minted JWT can reach every project the
+ * owner has, so this check is what keeps a deploy-token session on one project.
+ */
+export declare function assertPinnedProject(auth: ProjectRefDeps["auth"], projectUuid: string): void;
+/**
+ * Loads one of the user's projects from a uuid, numeric id, micropage
+ * hostname or custom domain. In deploy-token mode an omitted ref means the
+ * pinned project and any other project is refused. Throws PROJECT_NOT_FOUND
+ * (RLS hides other users' projects, so "not yours" reads the same).
+ */
+export declare function resolveProject(deps: ProjectRefDeps, ref: string | undefined): Promise<Project>;

package/dist/client/project-ref.js

@@ -0,0 +1,118 @@
+import * as z from "zod";
+import { projectUrl } from "./config.js";
+import { MicropageError } from "./errors.js";
+import { eq } from "./http.js";
+const PROJECT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function isProjectUuid(s) {
+    return PROJECT_UUID_RE.test(s.trim());
+}
+export function isNumericProjectId(s) {
+    return /^\d+$/.test(s.trim());
+}
+/** The `project` input every project-scoped tool takes. */
+export const ProjectRef = z
+    .string()
+    .trim()
+    .min(1)
+    .max(300)
+    .describe('Which project: its uuid, its numeric id, its micropage hostname ("acme" or "acme.micropage.sh") or its ' +
+    "custom domain (\"www.acme.com\"). A full URL also works. Get valid values from list_projects.");
+/** Columns read for every resolved project. */
+export const PROJECT_COLUMNS = "id,uuid,name,domain,custom_domain,active_build_id,status,created_at";
+export function toProject(row, config) {
+    return {
+        ...row,
+        live_url: projectUrl(config, row.domain, row.custom_domain),
+        editor_url: `${config.appUrl.replace(/\/+$/, "")}/editor/${row.id}`,
+    };
+}
+/**
+ * Classifies a user-supplied ref the way cli/src/project-ref.js does, plus
+ * URL/hostname handling. Throws PROJECT_NOT_FOUND for something that cannot
+ * be any of them.
+ */
+export function parseProjectRef(ref, baseDomain) {
+    const raw = ref.trim();
+    if (isProjectUuid(raw))
+        return { kind: "uuid", value: raw.toLowerCase() };
+    if (isNumericProjectId(raw))
+        return { kind: "id", value: Number(raw) };
+    const host = raw
+        .replace(/^[a-z][a-z0-9+.-]*:\/\//i, "")
+        .replace(/[/?#].*$/, "")
+        .replace(/:\d+$/, "")
+        .replace(/\.$/, "")
+        .toLowerCase();
+    // Also keeps the value safe to splice into the PostgREST `or=(...)` filter below.
+    if (!/^[a-z0-9-]+(\.[a-z0-9-]+)*$/.test(host)) {
+        throw new MicropageError("PROJECT_NOT_FOUND", `"${ref}" is not a project uuid, numeric id or hostname. Call list_projects to see valid projects.`);
+    }
+    const base = baseDomain.toLowerCase();
+    if (host.endsWith(`.${base}`)) {
+        const slug = host.slice(0, -(base.length + 1));
+        if (slug && !slug.includes("."))
+            return { kind: "slug", value: slug };
+    }
+    if (!host.includes("."))
+        return { kind: "slug", value: host };
+    return { kind: "host", value: host };
+}
+function filtersFor(parsed) {
+    switch (parsed.kind) {
+        case "uuid":
+            return { uuid: eq(parsed.value) };
+        case "id":
+            return { id: eq(parsed.value) };
+        case "slug":
+            return { domain: eq(parsed.value) };
+        case "host":
+            return { or: `(custom_domain.eq.${parsed.value},domain.eq.${parsed.value})` };
+    }
+}
+/**
+ * The pin a deploy token carries. The minted JWT can reach every project the
+ * owner has, so this check is what keeps a deploy-token session on one project.
+ */
+export function assertPinnedProject(auth, projectUuid) {
+    if (auth.mode !== "deploy_token")
+        return;
+    if (projectUuid.toLowerCase() === auth.pinnedProjectUuid?.toLowerCase())
+        return;
+    throw new MicropageError("NOT_ALLOWED_IN_DEPLOY_TOKEN_MODE", `This deploy token is pinned to project ${auth.pinnedProjectUuid ?? "(unset)"}; ` +
+        `it cannot act on ${projectUuid}. Omit the project or pass the pinned one.`);
+}
+/**
+ * Loads one of the user's projects from a uuid, numeric id, micropage
+ * hostname or custom domain. In deploy-token mode an omitted ref means the
+ * pinned project and any other project is refused. Throws PROJECT_NOT_FOUND
+ * (RLS hides other users' projects, so "not yours" reads the same).
+ */
+export async function resolveProject(deps, ref) {
+    const pinned = deps.auth.mode === "deploy_token" ? deps.auth.pinnedProjectUuid : undefined;
+    const given = ref?.trim() ?? "";
+    if (!given) {
+        if (!pinned) {
+            throw new MicropageError("PROJECT_REQUIRED", "Pass `project` (a uuid, numeric id or domain). Call list_projects to see the user's projects.");
+        }
+    }
+    const parsed = given
+        ? parseProjectRef(given, deps.config.baseDomain)
+        : { kind: "uuid", value: pinned };
+    // Refuse a foreign uuid before any network call.
+    if (parsed.kind === "uuid")
+        assertPinnedProject(deps.auth, parsed.value);
+    const rows = await deps.http.select("projects", {
+        select: PROJECT_COLUMNS,
+        filters: filtersFor(parsed),
+        order: "id.asc",
+        limit: 2,
+    });
+    // A host can match one project's custom_domain and another's domain; the custom domain wins.
+    const row = parsed.kind === "host" ? (rows.find((r) => r.custom_domain?.toLowerCase() === parsed.value) ?? rows[0]) : rows[0];
+    if (!row) {
+        throw new MicropageError("PROJECT_NOT_FOUND", `No project matching "${given || pinned}" in this micropage account. Call list_projects to see valid projects.`);
+    }
+    assertPinnedProject(deps.auth, row.uuid);
+    return toProject(row, deps.config);
+}
+//# sourceMappingURL=project-ref.js.map

package/dist/client/project-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-ref.js","sourceRoot":"","sources":["../../src/client/project-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,EAAE,EAA2B,MAAM,WAAW,CAAC;AAExD,MAAM,eAAe,GAAG,iEAAiE,CAAC;AAE1F,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,QAAQ,CACP,yGAAyG;IACvG,+FAA+F,CAClG,CAAC;AAEJ,+CAA+C;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,qEAAqE,CAAC;AA2BrG,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,MAAgC;IACzE,OAAO;QACL,GAAG,GAAG;QACN,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC;QAC3D,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,GAAG,CAAC,EAAE,EAAE;KACpE,CAAC;AACJ,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,UAAkB;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;IAC1E,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAEvE,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,WAAW,EAAE,CAAC;IACjB,kFAAkF;IAClF,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,cAAc,CACtB,mBAAmB,EACnB,IAAI,GAAG,4FAA4F,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,UAAU,CAAC,MAAwB;IAC1C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,IAAI;YACP,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM;YACT,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,KAAK,MAAM;YACT,OAAO,EAAE,EAAE,EAAE,qBAAqB,MAAM,CAAC,KAAK,cAAc,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA4B,EAAE,WAAmB;IACnF,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO;IACzC,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,iBAAiB,EAAE,WAAW,EAAE;QAAE,OAAO;IAChF,MAAM,IAAI,cAAc,CACtB,kCAAkC,EAClC,0CAA0C,IAAI,CAAC,iBAAiB,IAAI,SAAS,IAAI;QAC/E,oBAAoB,WAAW,4CAA4C,CAC9E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAoB,EAAE,GAAuB;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,+FAA+F,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAqB,KAAK;QACpC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAChD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAO,EAAE,CAAC;IACrC,iDAAiD;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAEzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAa,UAAU,EAAE;QAC1D,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;QAC3B,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IACH,6FAA6F;IAC7F,MAAM,GAAG,GACP,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,cAAc,CACtB,mBAAmB,EACnB,wBAAwB,KAAK,IAAI,MAAM,wEAAwE,CAChH,CAAC;IACJ,CAAC;IACD,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/dist/client/session-store.d.ts

@@ -0,0 +1,81 @@
+import type { AuthProvider } from "./auth-provider.js";
+import type { MicropageConfig } from "./config.js";
+import type { FetchLike } from "./http.js";
+import { type LockOptions } from "./lock.js";
+export declare const LOGIN_HINT = "Run `micropage login` in a terminal, then retry.";
+/** Same location as the CLI (cli/src/auth.js), plus a MICROPAGE_CONFIG_DIR override. */
+export declare function configDir(env?: NodeJS.ProcessEnv): string;
+export declare function sessionFilePath(env?: NodeJS.ProcessEnv): string;
+export interface StoredSession {
+    access_token: string;
+    refresh_token: string;
+    user: unknown;
+}
+/**
+ * The CLI's ~/.micropage/config.json. Reads tolerate the CLI's non-atomic
+ * writes; our writes are atomic and only ever replace the token keys, so the
+ * session is never cleared from here.
+ */
+export declare class SessionStore {
+    readonly path: string;
+    constructor(path: string);
+    get lockPath(): string;
+    /** The whole config object, or null when there is no file. */
+    readConfig(): Promise<Record<string, unknown> | null>;
+    readSession(): Promise<StoredSession | null>;
+    /**
+     * Replaces the token keys (and user, when given), keeping every other key.
+     * Re-reads the file first and writes nothing when it no longer holds a
+     * session: the user logged out while a refresh was in flight, and writing
+     * the tokens back would undo that. Returns whether it wrote.
+     */
+    writeTokens(tokens: {
+        access_token: string;
+        refresh_token: string;
+        user?: unknown;
+    }): Promise<boolean>;
+}
+export interface SessionAuthOptions {
+    config: Pick<MicropageConfig, "supabaseUrl" | "supabaseAnonKey">;
+    /** Path of the CLI config file (see sessionFilePath()). */
+    path: string;
+    fetch?: FetchLike;
+    now?: () => number;
+    lock?: LockOptions;
+    timeoutMs?: number;
+    /** Where the one-time "could not save the session" notice goes; stderr by default (stdout is the MCP stream). */
+    log?: (message: string) => void;
+}
+/**
+ * Access tokens from the CLI's login session. Refreshes proactively within
+ * 60 s of expiry; refreshes are single-flight in-process and serialised across
+ * MCP processes by a lockfile next to the config. The CLI does not take that
+ * lock, so a failed refresh re-reads the file and retries once if the CLI
+ * rotated the refresh token meanwhile.
+ */
+export declare class SessionAuthProvider implements AuthProvider {
+    readonly mode: "session";
+    readonly store: SessionStore;
+    private readonly config;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly lockOptions;
+    private readonly timeoutMs;
+    private inflight;
+    private lastIssued;
+    private memory;
+    private warnedWriteFailure;
+    private readonly log;
+    constructor(options: SessionAuthOptions);
+    get path(): string;
+    hasSession(): Promise<boolean>;
+    /** The file's session, or the in-memory one while the file still holds the refresh token it replaced. */
+    private currentSession;
+    getAccessToken(options?: {
+        forceRefresh?: boolean;
+    }): Promise<string>;
+    private issue;
+    private requireSession;
+    private refreshUnderLock;
+    private exchange;
+}