@micropage-sh/mcp 0.1.1 → 0.1.3

package/dist/client/tier.js

@@ -1,7 +1,7 @@
-import { MicropageError } from "./errors.js";
+import { currentUserId } from "./auth-provider.js";
+import { MicropageError, PRICING_URL } from "./errors.js";
 import { eq } from "./http.js";
-import { decodeJwtClaims } from "./jwt.js";
-export const PRICING_URL = "https://micropage.sh/pricing";
+export { PRICING_URL };
 /** Same wording as the CLI (cli/src/plan.js), addressed to the model. */
 export const UPGRADE_MESSAGE = "The micropage MCP server, like the micropage CLI, is available on paid plans only. " +
     `This account is on the free plan. Tell the user they can upgrade at ${PRICING_URL}, then retry.`;
@@ -9,6 +9,43 @@ export const PLAN_CACHE_TTL_MS = 5 * 60 * 1000;
 export function isPaidTier(tier) {
     return tier === "pro" || tier === "pro_plus";
 }
+/** Bound on cached users; past it, expired entries are dropped before adding one. */
+export const PLAN_CACHE_MAX_USERS = 1000;
+/**
+ * Tier lookups keyed by user id. A PlanGate owns one by default; the remote
+ * server builds a gate per request and passes one long-lived cache to all of
+ * them, so the cache outlives the request without sharing anything else.
+ */
+export class PlanTierCache {
+    entries = new Map();
+    inflight = new Map();
+    get(userId, now, ttlMs) {
+        const hit = this.entries.get(userId);
+        return hit && now - hit.at < ttlMs ? hit.tier : null;
+    }
+    set(userId, tier, now, ttlMs) {
+        if (this.entries.size >= PLAN_CACHE_MAX_USERS && !this.entries.has(userId)) {
+            for (const [id, entry] of this.entries) {
+                if (now - entry.at >= ttlMs)
+                    this.entries.delete(id);
+            }
+            // Still full of live entries: drop the oldest insertion.
+            if (this.entries.size >= PLAN_CACHE_MAX_USERS) {
+                const oldest = this.entries.keys().next();
+                if (!oldest.done)
+                    this.entries.delete(oldest.value);
+            }
+        }
+        this.entries.delete(userId);
+        this.entries.set(userId, { tier, at: now });
+    }
+    get size() {
+        return this.entries.size;
+    }
+    clear() {
+        this.entries.clear();
+    }
+}
 /**
  * The CLI's client-side Pro gate: reads customers.plan_tier under RLS and
  * caches it for 5 minutes per user. A product gate, not a security boundary;
@@ -19,21 +56,19 @@ export class PlanGate {
     auth;
     now;
     ttlMs;
-    cache = null;
-    inflight = null;
+    cache;
+    hints;
     constructor(options) {
         this.http = options.http;
         this.auth = options.auth;
         this.now = options.now ?? Date.now;
         this.ttlMs = options.ttlMs ?? PLAN_CACHE_TTL_MS;
+        this.cache = options.cache ?? new PlanTierCache();
+        this.hints = options.hints;
     }
     /** The signed-in user's id, read from the access token's `sub`. */
-    async currentUserId() {
-        const sub = decodeJwtClaims(await this.auth.getAccessToken())?.sub;
-        if (typeof sub !== "string" || !sub) {
-            throw new MicropageError("SESSION_EXPIRED", "The micropage access token has no user id. Run `micropage login` in a terminal, then retry.");
-        }
-        return sub;
+    currentUserId() {
+        return currentUserId(this.auth, this.hints);
     }
     /**
      * Missing customer row means free, as in the CLI. A failed lookup is not
@@ -41,26 +76,32 @@ export class PlanGate {
      */
     async getPlanTier() {
         const userId = await this.currentUserId();
-        const hit = this.cache;
-        if (hit && hit.userId === userId && this.now() - hit.at < this.ttlMs)
-            return hit.tier;
-        this.inflight ??= (async () => {
+        const hit = this.cache.get(userId, this.now(), this.ttlMs);
+        if (hit)
+            return hit;
+        const pending = this.cache.inflight.get(userId);
+        if (pending)
+            return pending;
+        const lookup = (async () => {
             const row = await this.http.selectOne("customers", {
                 select: "plan_tier",
                 filters: { user_id: eq(userId) },
             });
             const tier = isPaidTier(row?.plan_tier) ? row.plan_tier : "free";
-            this.cache = { userId, tier, at: this.now() };
+            this.cache.set(userId, tier, this.now(), this.ttlMs);
             return tier;
         })().finally(() => {
-            this.inflight = null;
+            this.cache.inflight.delete(userId);
         });
-        return this.inflight;
+        this.cache.inflight.set(userId, lookup);
+        return lookup;
     }
     /**
      * Throws PLAN_REQUIRED unless the account is pro or pro_plus. Deploy-token
-     * mode skips the lookup: deploy tokens can only be created on Pro+
-     * (create-deploy-token), so holding one already implies a paid plan.
+     * mode skips the lookup: exchange-deploy-token refuses the exchange with
+     * `plan_required` unless the token owner is Pro+ at that moment, so a
+     * working deploy-token session already implies a paid plan (and a downgrade
+     * takes effect at the next exchange).
      */
     async requirePaidPlan() {
         if (this.auth.mode === "deploy_token")
@@ -70,7 +111,7 @@ export class PlanGate {
             throw new MicropageError("PLAN_REQUIRED", UPGRADE_MESSAGE);
     }
     clearCache() {
-        this.cache = null;
+        this.cache.clear();
     }
 }
 //# sourceMappingURL=tier.js.map

package/dist/client/tier.js.map

@@ -1 +1 @@
-{"version":3,"file":"tier.js","sourceRoot":"","sources":["../../src/client/tier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAa,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAI3C,MAAM,CAAC,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAE1D,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAC1B,qFAAqF;IACrF,uEAAuE,WAAW,eAAe,CAAC;AAEpG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,MAAM,UAAU,UAAU,CAAC,IAA+B;IACxD,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,CAAC;AAC/C,CAAC;AASD;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IACF,IAAI,CAAO;IACX,IAAI,CAAe;IACnB,GAAG,CAAe;IAClB,KAAK,CAAS;IACvB,KAAK,GAA0D,IAAI,CAAC;IACpE,QAAQ,GAA6B,IAAI,CAAC;IAElD,YAAY,OAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IAClD,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,GAAG,CAAC;QACnE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,6FAA6F,CAAC,CAAC;QAC7I,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAEtF,IAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAA+B,WAAW,EAAE;gBAC/E,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE;aACjC,CAAC,CAAC;YACH,MAAM,IAAI,GAAa,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3E,IAAI,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACpF,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"tier.js","sourceRoot":"","sources":["../../src/client/tier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAa,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,CAAC;AAIvB,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAC1B,qFAAqF;IACrF,uEAAuE,WAAW,eAAe,CAAC;AAEpG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,MAAM,UAAU,UAAU,CAAC,IAA+B;IACxD,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,CAAC;AAC/C,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;IACpE,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEzD,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,KAAa;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,GAAW,EAAE,KAAa;QAC5D,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,oBAAoB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvC,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,yDAAyD;YACzD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,oBAAoB,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAaD;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IACF,IAAI,CAAO;IACX,IAAI,CAAe;IACnB,GAAG,CAAe;IAClB,KAAK,CAAS;IACd,KAAK,CAAgB;IACrB,KAAK,CAA6C;IAEnE,YAAY,OAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,aAAa,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,mEAAmE;IACnE,aAAa;QACX,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAA+B,WAAW,EAAE;gBAC/E,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE;aACjC,CAAC,CAAC;YACH,MAAM,IAAI,GAAa,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACpF,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/context.d.ts

@@ -1,28 +1,64 @@
 import type { ClientCapabilities, ProtocolEra, ServerContext } from "@modelcontextprotocol/server";
+import type { HostDenylist, HostLookup, PathLoader } from "./client/assets.js";
 import type { AuthProvider } from "./client/auth-provider.js";
 import type { MicropageConfig } from "./client/config.js";
-import type { Http } from "./client/http.js";
+import type { FetchLike, Http } from "./client/http.js";
 import type { PlanGate } from "./client/tier.js";
-/** User-set switches. Each defaults off; only the user's MCP config can turn them on. */
-export interface EnvFlags {
+import type { ConfirmationTokens } from "./guards.js";
+import type { ModeHints } from "./hints.js";
+/**
+ * What the user allowed this connection to do. Each defaults off. Stdio reads
+ * them from env switches the user sets in their MCP config; the remote server
+ * reads the per-connection row the user set on the consent page.
+ */
+export interface Permissions {
     /** MICROPAGE_MCP_ALLOW_SEND: publish_post may email the subscriber list. */
     allowSend: boolean;
     /** MICROPAGE_MCP_ALLOW_DELETE: delete_project is registered at all. */
     allowDelete: boolean;
     /** MICROPAGE_MCP_SUBMISSIONS: form submission (PII) tools are registered. */
-    submissions: boolean;
+    allowSubmissions: boolean;
 }
-/** Process-wide dependencies, built once and shared by every server instance. */
+/** Where upload_asset may read bytes from; differs between a local and a hosted server. */
+export interface UploadDeps {
+    /** Reads `{path}` sources. Absent on a hosted server, which then does not offer `{path}` at all. */
+    pathLoader?: PathLoader;
+    /**
+     * Resolves `{url}` hostnames so private addresses are refused before the
+     * fetch. Null only where the runtime's fetch cannot reach private networks
+     * anyway; IP-literal hosts and the denylist are checked either way.
+     */
+    lookupHost: HostLookup | null;
+    /** Hostnames `{url}` must never fetch (our own infrastructure on a hosted server). */
+    deniedHosts?: HostDenylist;
+    /** fetch for `{url}` sources; never the micropage-authenticated client. Defaults to global fetch. */
+    fetchExternal?: FetchLike;
+    /** Largest asset upload_asset accepts, in bytes; also what its description states. Defaults to MAX_ASSET_BYTES. */
+    maxBytes?: number;
+}
+/**
+ * Dependencies for serving one user. Stdio builds them once per process;
+ * the remote server builds them per request (with long-lived pieces such as
+ * the plan-tier cache and the token key passed in).
+ */
 export interface ServerDeps {
     config: MicropageConfig;
     auth: AuthProvider;
     http: Http;
-    /** Paid-plan gate with its 5-minute plan_tier cache; call through gateTool() in tools. */
+    /** Paid-plan gate with its 5-minute per-user plan_tier cache; call through gateTool() in tools. */
     tier: PlanGate;
-    flags: EnvFlags;
+    permissions: Permissions;
+    /** Signs preview_post_send tokens; its key decides which servers accept them. */
+    confirmationTokens: ConfirmationTokens;
+    uploads: UploadDeps;
+    /** Wording that names how the user changes a setting or fixes a login. Defaults to the stdio wording. */
+    hints?: ModeHints;
+    /** Called with each error a tool handler throws, before the SDK turns it into an isError result (logging). */
+    onToolError?: (tool: string, error: unknown) => void;
 }
 /** What every register* function receives: the deps plus per-instance protocol facts. */
 export interface ToolContext extends ServerDeps {
+    hints: ModeHints;
     /** Protocol era this server instance serves (fixed per instance by the factory). */
     era: ProtocolEra;
     /** The calling client's declared capabilities for this request, era-correct. */

package/dist/guards.d.ts

@@ -1,7 +1,8 @@
 import { type ClientCapabilities, type InputRequiredResult, type ServerContext } from "@modelcontextprotocol/server";
 import type { AuthProvider } from "./client/auth-provider.js";
-import type { EnvFlags } from "./context.js";
-export declare function readEnvFlags(env?: NodeJS.ProcessEnv): EnvFlags;
+import type { Permissions } from "./context.js";
+export declare function envPermissions(env?: Readonly<Record<string, string | undefined>>): Permissions;
+export declare const NO_PERMISSIONS: Readonly<Permissions>;
 export declare function requireConfirm(args: {
     confirm?: boolean | undefined;
 }, action: string): void;
@@ -15,20 +16,20 @@ export type TokenCheck = {
     reason: "malformed" | "expired" | "mismatch";
 };
 export declare const DEFAULT_TOKEN_TTL_MS: number;
+/** HMAC key: random bytes per stdio process, a Worker secret remotely. */
+export type TokenKey = Uint8Array | string;
 export declare class ConfirmationTokens {
     private readonly key;
     private readonly now;
-    constructor(options?: {
-        key?: Buffer;
+    constructor(options: {
+        key: TokenKey;
         now?: () => number;
     });
-    mint(payload: TokenPayload, ttlMs?: number): string;
-    verify(token: string, payload: TokenPayload): TokenCheck;
+    mint(sub: string, payload: TokenPayload, ttlMs?: number): string;
+    verify(token: string, sub: string, payload: TokenPayload): TokenCheck;
     private sign;
 }
-/** Per-process instance; restarting the server invalidates every outstanding token. */
-export declare const confirmationTokens: ConfirmationTokens;
-export declare function requireConfirmationToken(tokens: ConfirmationTokens, token: string | undefined, payload: TokenPayload, previewTool: string): void;
+export declare function requireConfirmationToken(tokens: ConfirmationTokens, token: string | undefined, sub: string, payload: TokenPayload, previewTool: string): void;
 /** Stable JSON: object keys sorted at every depth, so equal payloads sign equally. */
 export declare function canonicalJson(value: unknown): string;
 export type ElicitOutcome = {
@@ -52,4 +53,4 @@ export interface ConfirmElicitation {
 export declare function supportsFormElicitation(caps: ClientCapabilities | undefined): boolean;
 export declare function elicitConfirmation(handlerCtx: ServerContext, caps: ClientCapabilities | undefined, request: ConfirmElicitation): ElicitOutcome;
 export declare const DEPLOY_TOKEN_TOOLS: ReadonlySet<string>;
-export declare function assertDeployTokenAllows(auth: Pick<AuthProvider, "mode" | "pinnedProjectUuid">, tool: string, projectUuid?: string): void;
+export declare function assertDeployTokenAllows(auth: Pick<AuthProvider, "mode" | "pinnedProjectUuid">, tool: string, projectUuid?: string, elsewhere?: string): void;

package/dist/guards.js

@@ -1,17 +1,19 @@
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual } from "node:crypto";
 import { inputRequired, inputResponse, } from "@modelcontextprotocol/server";
 import { MicropageError } from "./client/errors.js";
+import { STDIO_HINTS } from "./hints.js";
 // ---------------------------------------------------------------------------
-// Env switches
+// Env switches (stdio's source of Permissions)
 // ---------------------------------------------------------------------------
 const truthy = (v) => /^(1|true|yes|on)$/i.test(v?.trim() ?? "");
-export function readEnvFlags(env = process.env) {
+export function envPermissions(env = process.env) {
     return {
         allowSend: truthy(env.MICROPAGE_MCP_ALLOW_SEND),
         allowDelete: truthy(env.MICROPAGE_MCP_ALLOW_DELETE),
-        submissions: truthy(env.MICROPAGE_MCP_SUBMISSIONS),
+        allowSubmissions: truthy(env.MICROPAGE_MCP_SUBMISSIONS),
     };
 }
+export const NO_PERMISSIONS = Object.freeze({ allowSend: false, allowDelete: false, allowSubmissions: false });
 // ---------------------------------------------------------------------------
 // Confirm arguments
 //
@@ -36,15 +38,17 @@ export const DEFAULT_TOKEN_TTL_MS = 15 * 60 * 1000;
 export class ConfirmationTokens {
     key;
     now;
-    constructor(options = {}) {
-        this.key = options.key ?? randomBytes(32);
+    constructor(options) {
+        if (options.key.length < 32)
+            throw new Error("ConfirmationTokens needs a key of at least 32 bytes.");
+        this.key = options.key;
         this.now = options.now ?? Date.now;
     }
-    mint(payload, ttlMs = DEFAULT_TOKEN_TTL_MS) {
+    mint(sub, payload, ttlMs = DEFAULT_TOKEN_TTL_MS) {
         const expiresAt = this.now() + ttlMs;
-        return `${expiresAt.toString(36)}.${this.sign(expiresAt, payload)}`;
+        return `${expiresAt.toString(36)}.${this.sign(expiresAt, sub, payload)}`;
     }
-    verify(token, payload) {
+    verify(token, sub, payload) {
         const match = /^([0-9a-z]+)\.([A-Za-z0-9_-]+)$/.exec(token.trim());
         if (!match)
             return { ok: false, reason: "malformed" };
@@ -56,7 +60,7 @@ export class ConfirmationTokens {
         // strings can decode to the same bytes; only accept the canonical one.
         if (given.toString("base64url") !== match[2])
             return { ok: false, reason: "mismatch" };
-        const expected = Buffer.from(this.sign(expiresAt, payload), "base64url");
+        const expected = Buffer.from(this.sign(expiresAt, sub, payload), "base64url");
         // Signature is checked before expiry so a forged timestamp reads as a
         // mismatch rather than leaking which part was wrong.
         if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
@@ -66,16 +70,14 @@ export class ConfirmationTokens {
             return { ok: false, reason: "expired" };
         return { ok: true };
     }
-    sign(expiresAt, payload) {
+    sign(expiresAt, sub, payload) {
         return createHmac("sha256", this.key)
-            .update(`${expiresAt}\n${canonicalJson(payload)}`)
+            .update(`${expiresAt}\n${canonicalJson({ sub, payload })}`)
             .digest("base64url");
     }
 }
-/** Per-process instance; restarting the server invalidates every outstanding token. */
-export const confirmationTokens = new ConfirmationTokens();
-export function requireConfirmationToken(tokens, token, payload, previewTool) {
-    const check = token ? tokens.verify(token, payload) : { ok: false, reason: "malformed" };
+export function requireConfirmationToken(tokens, token, sub, payload, previewTool) {
+    const check = token ? tokens.verify(token, sub, payload) : { ok: false, reason: "malformed" };
     if (check.ok)
         return;
     const why = !token
@@ -83,7 +85,7 @@ export function requireConfirmationToken(tokens, token, payload, previewTool) {
         : check.reason === "expired"
             ? "The confirmation_token has expired."
             : check.reason === "mismatch"
-                ? "The confirmation_token does not match the current state (it changed since the preview, or the token came from another session)."
+                ? "The confirmation_token does not match the current state (it changed since the preview, or the token came from another session or account)."
                 : "The confirmation_token is not one this server issued.";
     throw new MicropageError("CONFIRM_INVALID", `${why} Call ${previewTool} again, show the user what it reports, and pass its new confirmation_token. Nothing was changed.`);
 }
@@ -153,12 +155,12 @@ export const DEPLOY_TOKEN_TOOLS = new Set([
     "list_builds",
     "list_files",
 ]);
-export function assertDeployTokenAllows(auth, tool, projectUuid) {
+export function assertDeployTokenAllows(auth, tool, projectUuid, elsewhere = STDIO_HINTS.deployTokenElsewhere) {
     if (auth.mode !== "deploy_token")
         return;
     if (!DEPLOY_TOKEN_TOOLS.has(tool)) {
         throw new MicropageError("NOT_ALLOWED_IN_DEPLOY_TOKEN_MODE", `${tool} is not available with a deploy token. This server is limited to: ` +
-            `${[...DEPLOY_TOKEN_TOOLS].join(", ")}. Use a full \`micropage login\` session for anything else.`);
+            `${[...DEPLOY_TOKEN_TOOLS].join(", ")}. ${elsewhere}`);
     }
     if (projectUuid !== undefined && projectUuid !== auth.pinnedProjectUuid) {
         throw new MicropageError("NOT_ALLOWED_IN_DEPLOY_TOKEN_MODE", `This deploy token is pinned to project ${auth.pinnedProjectUuid ?? "(unset)"}; ` +

package/dist/guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EACL,aAAa,EACb,aAAa,GAId,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAW,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9F,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACnD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,mEAAmE;AACnE,8EAA8E;AAE9E,MAAM,UAAU,cAAc,CAAC,IAAuC,EAAE,MAAc;IACpF,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO;IAClC,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,GAAG,MAAM,uFAAuF;QAC9F,oEAAoE,CACvE,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CACjC,KAAyB,EACzB,QAAgB,EAChB,OAAe,EACf,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO;IAChG,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,GAAG,MAAM,YAAY,OAAO,MAAM,QAAQ,0DAA0D;QAClG,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAiBD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,OAAO,kBAAkB;IACZ,GAAG,CAAS;IACZ,GAAG,CAAe;IAEnC,YAAY,UAAgD,EAAE;QAC5D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,OAAqB,EAAE,QAAgB,oBAAoB;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,OAAqB;QACzC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEhF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;QAClD,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;QACzE,sEAAsE;QACtE,qDAAqD;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,SAAiB,EAAE,OAAqB;QACnD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC;aAClC,MAAM,CAAC,GAAG,SAAS,KAAK,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;aACjD,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAE3D,MAAM,UAAU,wBAAwB,CACtC,MAA0B,EAC1B,KAAyB,EACzB,OAAqB,EACrB,WAAmB;IAEnB,MAAM,KAAK,GAAe,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrG,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO;IACrB,MAAM,GAAG,GACP,CAAC,KAAK;QACJ,CAAC,CAAC,kCAAkC;QACpC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU;gBAC3B,CAAC,CAAC,iIAAiI;gBACnI,CAAC,CAAC,uDAAuD,CAAC;IAClE,MAAM,IAAI,cAAc,CACtB,iBAAiB,EACjB,GAAG,GAAG,SAAS,WAAW,kGAAkG,CAC7H,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC;aAC1C,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA0BD,MAAM,UAAU,uBAAuB,CAAC,IAAoC;IAC1E,MAAM,WAAW,GAAI,IAA8D,EAAE,WAAW,CAAC;IACjG,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,oEAAoE;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,IAAI,WAAW,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,IAAoC,EACpC,OAA2B;IAE3B,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrE,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,aAAa,CAAC;YACpB,aAAa,EAAE;gBACb,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;oBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,eAAe,EAAE;wBACf,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE;yBACjF;wBACD,QAAQ,EAAE,CAAC,SAAS,CAAC;qBACtB;iBACF,CAAC;aACH;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IAC7D,QAAQ;IACR,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,cAAc;IACd,eAAe;IACf,mBAAmB;IACnB,aAAa;IACb,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,IAAsD,EACtD,IAAY,EACZ,WAAoB;IAEpB,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO;IACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CACtB,kCAAkC,EAClC,GAAG,IAAI,oEAAoE;YACzE,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxE,MAAM,IAAI,cAAc,CACtB,kCAAkC,EAClC,0CAA0C,IAAI,CAAC,iBAAiB,IAAI,SAAS,IAAI;YAC/E,oBAAoB,WAAW,4CAA4C,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EACL,aAAa,EACb,aAAa,GAId,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAW,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9F,MAAM,UAAU,cAAc,CAAC,MAAoD,OAAO,CAAC,GAAG;IAC5F,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACnD,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAA0B,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;AAEtI,8EAA8E;AAC9E,oBAAoB;AACpB,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,mEAAmE;AACnE,8EAA8E;AAE9E,MAAM,UAAU,cAAc,CAAC,IAAuC,EAAE,MAAc;IACpF,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO;IAClC,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,GAAG,MAAM,uFAAuF;QAC9F,oEAAoE,CACvE,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CACjC,KAAyB,EACzB,QAAgB,EAChB,OAAe,EACf,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO;IAChG,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,GAAG,MAAM,YAAY,OAAO,MAAM,QAAQ,0DAA0D;QAClG,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAmBD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAKnD,MAAM,OAAO,kBAAkB;IACZ,GAAG,CAAW;IACd,GAAG,CAAe;IAEnC,YAAY,OAA8C;QACxD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,GAAW,EAAE,OAAqB,EAAE,QAAgB,oBAAoB;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,GAAW,EAAE,OAAqB;QACtD,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEhF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;QAClD,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;QAC9E,sEAAsE;QACtE,qDAAqD;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,SAAiB,EAAE,GAAW,EAAE,OAAqB;QAChE,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC;aAClC,MAAM,CAAC,GAAG,SAAS,KAAK,aAAa,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;aAC1D,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CACtC,MAA0B,EAC1B,KAAyB,EACzB,GAAW,EACX,OAAqB,EACrB,WAAmB;IAEnB,MAAM,KAAK,GAAe,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC1G,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO;IACrB,MAAM,GAAG,GACP,CAAC,KAAK;QACJ,CAAC,CAAC,kCAAkC;QACpC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU;gBAC3B,CAAC,CAAC,4IAA4I;gBAC9I,CAAC,CAAC,uDAAuD,CAAC;IAClE,MAAM,IAAI,cAAc,CACtB,iBAAiB,EACjB,GAAG,GAAG,SAAS,WAAW,kGAAkG,CAC7H,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC;aAC1C,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA0BD,MAAM,UAAU,uBAAuB,CAAC,IAAoC;IAC1E,MAAM,WAAW,GAAI,IAA8D,EAAE,WAAW,CAAC;IACjG,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,oEAAoE;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,IAAI,WAAW,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,IAAoC,EACpC,OAA2B;IAE3B,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrE,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,aAAa,CAAC;YACpB,aAAa,EAAE;gBACb,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;oBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,eAAe,EAAE;wBACf,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE;yBACjF;wBACD,QAAQ,EAAE,CAAC,SAAS,CAAC;qBACtB;iBACF,CAAC;aACH;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IAC7D,QAAQ;IACR,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,cAAc;IACd,eAAe;IACf,mBAAmB;IACnB,aAAa;IACb,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,IAAsD,EACtD,IAAY,EACZ,WAAoB,EACpB,YAAoB,WAAW,CAAC,oBAAoB;IAEpD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO;IACzC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CACtB,kCAAkC,EAClC,GAAG,IAAI,oEAAoE;YACzE,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxE,MAAM,IAAI,cAAc,CACtB,kCAAkC,EAClC,0CAA0C,IAAI,CAAC,iBAAiB,IAAI,SAAS,IAAI;YAC/E,oBAAoB,WAAW,4CAA4C,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/hints.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Model-facing wording that names how the user changes a setting or fixes a
+ * login. The stdio server points at env switches and `micropage login`; a
+ * hosted connection has neither, so it points at the micropage account page
+ * or the MCP client's reconnect instead.
+ */
+export interface ModeHints {
+    /** Completes "...whether this server is allowed to send email (<here>)." */
+    sendSwitchName: string;
+    /** Completes "...refused unless <here>;". */
+    sendEnabledBy: string;
+    /** Output field description of preview_post_send's send_allowed. */
+    sendAllowedField: string;
+    /** Why an emailing post was refused, and what the user can do about it. */
+    sendDisabled: string;
+    /** Last sentence of delete_project's description. */
+    deleteAvailable: string;
+    /** write_post prompt: the line about emailing subscribers. */
+    promptSendRule: string;
+    /** review_submissions prompt: the line about list_submissions being absent. */
+    promptSubmissionsRule: string;
+    /** whoami description: which kinds of credentials it reports. */
+    whoamiModes: string;
+    /** whoami description: what the note usually tells the user to do. */
+    whoamiFix: string;
+    /** whoami note when the token is rejected by the API. */
+    loginInvalid: string;
+    /** Appended to the deploy-token refusal: where the other tools are. */
+    deployTokenElsewhere: string;
+    /** Error when the API answers 401 even after a forced token refresh. */
+    sessionInvalid: string;
+    /** Error when the access token carries no user id. */
+    tokenNoUser: string;
+    /** Follows "The deploy token was rejected (<detail>)." on a refused exchange. */
+    deployTokenCheck: string;
+    /** Follows "No project with uuid <uuid> exists (<detail>)." on a refused exchange. */
+    deployProjectCheck: string;
+    /** upload_asset description: which source to prefer; empty when there is no preference. */
+    uploadSourceNote: string;
+}
+export declare const STDIO_HINTS: ModeHints;
+export declare const CONNECTED_APPS_URL = "https://app.micropage.sh/account/connected-apps";
+/** A hosted connection authorized through OAuth: permissions live on the user's Connected AI apps page. */
+export declare const REMOTE_OAUTH_HINTS: ModeHints;
+/** A hosted connection on a project deploy token: no account-level settings apply. */
+export declare const REMOTE_DEPLOY_TOKEN_HINTS: ModeHints;

package/dist/hints.js

@@ -0,0 +1,70 @@
+export const STDIO_HINTS = Object.freeze({
+    sendSwitchName: "MICROPAGE_MCP_ALLOW_SEND",
+    sendEnabledBy: "the user has set MICROPAGE_MCP_ALLOW_SEND=1 in this server's config",
+    sendAllowedField: "MICROPAGE_MCP_ALLOW_SEND is set, so this server may email subscribers.",
+    sendDisabled: "Emailing from the MCP server is turned off. The user can turn it on by adding MICROPAGE_MCP_ALLOW_SEND=1 to this server's env in their MCP client config " +
+        "and restarting it, or publish from the micropage editor or with `micropage posts publish`. To publish on the web only, save the post with email: false " +
+        "(upsert_post), then call preview_post_send again.",
+    deleteAvailable: "Available only because MICROPAGE_MCP_ALLOW_DELETE is set.",
+    promptSendRule: "- Emailing subscribers needs MICROPAGE_MCP_ALLOW_SEND=1 in my MCP server config. If publish_post refuses to send because it is off, tell me; do not try to work around it.",
+    promptSubmissionsRule: "If list_submissions is not available, submission access is off: it needs MICROPAGE_MCP_SUBMISSIONS=1 in my MCP server config. Tell me that rather than looking for another way in.",
+    whoamiModes: "whether it runs on the user's `micropage login` session or on a project deploy token (and if so, which project it is pinned to)",
+    whoamiFix: "usually run `micropage login` in a terminal",
+    loginInvalid: "The micropage login session is no longer valid. Run `micropage login` in a terminal, then retry.",
+    deployTokenElsewhere: "Use a full `micropage login` session for anything else.",
+    sessionInvalid: "The micropage session is no longer valid. Ask the user to run `micropage login` in a terminal, then retry.",
+    tokenNoUser: "The micropage access token has no user id. Run `micropage login` in a terminal, then retry.",
+    deployTokenCheck: "Ask the user to check MICROPAGE_DEPLOY_TOKEN, or to create a new token in the micropage editor under Settings > Deploy tokens.",
+    deployProjectCheck: "Ask the user to check MICROPAGE_DEPLOY_PROJECT.",
+    uploadSourceNote: "",
+});
+export const CONNECTED_APPS_URL = "https://app.micropage.sh/account/connected-apps";
+const CONNECTED_APPS = `Micropage → Connected AI apps (${CONNECTED_APPS_URL})`;
+const RECONNECT = "Ask the user to reconnect (re-authenticate) the micropage connector in their AI app, then retry.";
+const CHECK_CONNECTOR = "Ask the user to check the deploy token and the X-Micropage-Project header in the connector settings, then retry.";
+const REMOTE_DEPLOY_TOKEN_CHECK = "Ask the user to check the deploy token in the AI app's connector settings, or to create a new token in the micropage editor under Settings > Deploy tokens.";
+const REMOTE_DEPLOY_PROJECT_CHECK = "Ask the user to check the X-Micropage-Project header in the AI app's connector settings.";
+// Base64 travels through the model's context and the request body, which is
+// capped well below what a fetched URL may be.
+const REMOTE_UPLOAD_SOURCE_NOTE = "Prefer source.url whenever the image is on a public https host; use source.base64 only for an image that is not hosted anywhere.";
+/** A hosted connection authorized through OAuth: permissions live on the user's Connected AI apps page. */
+export const REMOTE_OAUTH_HINTS = Object.freeze({
+    sendSwitchName: "the 'Let it send newsletter emails' setting for this app",
+    sendEnabledBy: `the user has turned on 'Let it send newsletter emails' for this app in ${CONNECTED_APPS}`,
+    sendAllowedField: "The user turned on 'Let it send newsletter emails' for this app, so it may email subscribers.",
+    sendDisabled: `Emailing from this app is turned off. The user can turn on 'Let it send newsletter emails' for this app in ${CONNECTED_APPS}, ` +
+        "or publish from the micropage editor. To publish on the web only, save the post with email: false (upsert_post), then call preview_post_send again.",
+    deleteAvailable: `Available only because the user turned on 'Let it delete projects' for this app in ${CONNECTED_APPS}.`,
+    promptSendRule: `- Emailing subscribers needs 'Let it send newsletter emails' turned on for this app in ${CONNECTED_APPS}. If publish_post refuses to send because it is off, tell me; do not try to work around it.`,
+    promptSubmissionsRule: `If list_submissions is not available, submission access is off: it needs 'Let it read form submissions' turned on for this app in ${CONNECTED_APPS}. Tell me that rather than looking for another way in.`,
+    whoamiModes: "whether it runs on the user's connected-app authorization (OAuth) or on a project deploy token (and if so, which project it is pinned to)",
+    whoamiFix: "usually reconnect the micropage connector in their AI app",
+    loginInvalid: `The micropage authorization for this connection is no longer valid. ${RECONNECT}`,
+    deployTokenElsewhere: "Connect micropage to the AI app with the user's micropage account for anything else.",
+    sessionInvalid: `The micropage authorization for this connection is no longer valid. ${RECONNECT}`,
+    tokenNoUser: `The micropage authorization for this connection has no user id. ${RECONNECT}`,
+    deployTokenCheck: REMOTE_DEPLOY_TOKEN_CHECK,
+    deployProjectCheck: REMOTE_DEPLOY_PROJECT_CHECK,
+    uploadSourceNote: REMOTE_UPLOAD_SOURCE_NOTE,
+});
+/** A hosted connection on a project deploy token: no account-level settings apply. */
+export const REMOTE_DEPLOY_TOKEN_HINTS = Object.freeze({
+    sendSwitchName: "not available with a deploy token",
+    sendEnabledBy: "the connection uses the user's micropage account (emailing is not available with a deploy token)",
+    sendAllowedField: "Always false with a deploy token: emailing is not available with a deploy token.",
+    sendDisabled: "Emailing subscribers is not available with a deploy token. The user can publish from the micropage editor. To publish on the web only, " +
+        "save the post with email: false (upsert_post), then call preview_post_send again.",
+    deleteAvailable: "Deleting projects is not available with a deploy token.",
+    promptSendRule: "- Emailing subscribers is not available with a deploy token. If publish_post refuses to send, tell me; do not try to work around it.",
+    promptSubmissionsRule: "If list_submissions is not available, that is because reading form submissions is not available with a deploy token. Tell me that rather than looking for another way in.",
+    whoamiModes: "whether it runs on the user's connected-app authorization (OAuth) or on a project deploy token (and if so, which project it is pinned to)",
+    whoamiFix: "usually check the deploy token and the X-Micropage-Project header in the AI app's connector settings",
+    loginInvalid: `The deploy token was rejected. ${CHECK_CONNECTOR}`,
+    deployTokenElsewhere: "Connect micropage to the AI app with the user's micropage account for anything else.",
+    sessionInvalid: `The deploy-token session is no longer valid. ${CHECK_CONNECTOR}`,
+    tokenNoUser: `The deploy-token session has no user id. ${CHECK_CONNECTOR}`,
+    deployTokenCheck: REMOTE_DEPLOY_TOKEN_CHECK,
+    deployProjectCheck: REMOTE_DEPLOY_PROJECT_CHECK,
+    uploadSourceNote: REMOTE_UPLOAD_SOURCE_NOTE,
+});
+//# sourceMappingURL=hints.js.map

package/dist/hints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hints.js","sourceRoot":"","sources":["../src/hints.ts"],"names":[],"mappings":"AAyCA,MAAM,CAAC,MAAM,WAAW,GAAc,MAAM,CAAC,MAAM,CAAC;IAClD,cAAc,EAAE,0BAA0B;IAC1C,aAAa,EAAE,qEAAqE;IACpF,gBAAgB,EAAE,wEAAwE;IAC1F,YAAY,EACV,2JAA2J;QAC3J,yJAAyJ;QACzJ,mDAAmD;IACrD,eAAe,EAAE,2DAA2D;IAC5E,cAAc,EACZ,4KAA4K;IAC9K,qBAAqB,EACnB,oLAAoL;IACtL,WAAW,EAAE,iIAAiI;IAC9I,SAAS,EAAE,6CAA6C;IACxD,YAAY,EAAE,kGAAkG;IAChH,oBAAoB,EAAE,yDAAyD;IAC/E,cAAc,EAAE,4GAA4G;IAC5H,WAAW,EAAE,6FAA6F;IAC1G,gBAAgB,EACd,gIAAgI;IAClI,kBAAkB,EAAE,iDAAiD;IACrE,gBAAgB,EAAE,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iDAAiD,CAAC;AACpF,MAAM,cAAc,GAAG,kCAAkC,kBAAkB,GAAG,CAAC;AAC/E,MAAM,SAAS,GACb,kGAAkG,CAAC;AACrG,MAAM,eAAe,GACnB,kHAAkH,CAAC;AACrH,MAAM,yBAAyB,GAC7B,6JAA6J,CAAC;AAChK,MAAM,2BAA2B,GAAG,0FAA0F,CAAC;AAC/H,4EAA4E;AAC5E,+CAA+C;AAC/C,MAAM,yBAAyB,GAC7B,kIAAkI,CAAC;AAErI,2GAA2G;AAC3G,MAAM,CAAC,MAAM,kBAAkB,GAAc,MAAM,CAAC,MAAM,CAAC;IACzD,cAAc,EAAE,0DAA0D;IAC1E,aAAa,EAAE,0EAA0E,cAAc,EAAE;IACzG,gBAAgB,EAAE,+FAA+F;IACjH,YAAY,EACV,8GAA8G,cAAc,IAAI;QAChI,qJAAqJ;IACvJ,eAAe,EAAE,sFAAsF,cAAc,GAAG;IACxH,cAAc,EACZ,0FAA0F,cAAc,6FAA6F;IACvM,qBAAqB,EACnB,qIAAqI,cAAc,wDAAwD;IAC7M,WAAW,EAAE,2IAA2I;IACxJ,SAAS,EAAE,2DAA2D;IACtE,YAAY,EAAE,uEAAuE,SAAS,EAAE;IAChG,oBAAoB,EAAE,sFAAsF;IAC5G,cAAc,EAAE,uEAAuE,SAAS,EAAE;IAClG,WAAW,EAAE,mEAAmE,SAAS,EAAE;IAC3F,gBAAgB,EAAE,yBAAyB;IAC3C,kBAAkB,EAAE,2BAA2B;IAC/C,gBAAgB,EAAE,yBAAyB;CAC5C,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAc,MAAM,CAAC,MAAM,CAAC;IAChE,cAAc,EAAE,mCAAmC;IACnD,aAAa,EAAE,kGAAkG;IACjH,gBAAgB,EAAE,kFAAkF;IACpG,YAAY,EACV,yIAAyI;QACzI,mFAAmF;IACrF,eAAe,EAAE,yDAAyD;IAC1E,cAAc,EAAE,sIAAsI;IACtJ,qBAAqB,EACnB,2KAA2K;IAC7K,WAAW,EAAE,2IAA2I;IACxJ,SAAS,EAAE,sGAAsG;IACjH,YAAY,EAAE,kCAAkC,eAAe,EAAE;IACjE,oBAAoB,EAAE,sFAAsF;IAC5G,cAAc,EAAE,gDAAgD,eAAe,EAAE;IACjF,WAAW,EAAE,4CAA4C,eAAe,EAAE;IAC1E,gBAAgB,EAAE,yBAAyB;IAC3C,kBAAkB,EAAE,2BAA2B;IAC/C,gBAAgB,EAAE,yBAAyB;CAC5C,CAAC,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
-import { createDeps, createServerFactory } from "./server.js";
+import { createDeps } from "./node/deps.js";
+import { createServerFactory } from "./server.js";
 // stdout carries the protocol; diagnostics must go to stderr or the client
 // sees a corrupted JSON-RPC stream.
 const logError = (err) => {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAEhE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE9D,2EAA2E;AAC3E,oCAAoC;AACpC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAQ,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,IAAI,CAAC;IACH,UAAU,CAAC,mBAAmB,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AACvE,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAEhE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,2EAA2E;AAC3E,oCAAoC;AACpC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAQ,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,IAAI,CAAC;IACH,UAAU,CAAC,mBAAmB,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AACvE,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/node/deps.d.ts

@@ -0,0 +1,26 @@
+import type { HostLookup } from "../client/assets.js";
+import type { AuthProvider } from "../client/auth-provider.js";
+import { type MicropageConfig } from "../client/config.js";
+import { type FetchLike } from "../client/http.js";
+import type { ServerDeps } from "../context.js";
+export interface CreateDepsOptions {
+    /** Replaces global fetch for every outbound call (tests). */
+    fetch?: FetchLike;
+    now?: () => number;
+    /** Replaces the system resolver for `{url}` uploads (tests). */
+    lookupHost?: HostLookup;
+}
+/**
+ * Picks where tokens come from: a deploy token when MICROPAGE_DEPLOY_TOKEN and
+ * MICROPAGE_DEPLOY_PROJECT are both set (only one set throws), else the CLI
+ * session file. The session provider is used even when the file does not
+ * exist yet, so a `micropage login` after the server started takes effect
+ * without a restart; until then every call fails with NOT_LOGGED_IN.
+ */
+export declare function createAuthProvider(env: NodeJS.ProcessEnv, config: MicropageConfig, options?: CreateDepsOptions): AuthProvider;
+/**
+ * The stdio server's deps, built once per process from the environment. The
+ * confirmation-token key is random per process, so restarting the server
+ * invalidates every outstanding preview token.
+ */
+export declare function createDeps(env?: NodeJS.ProcessEnv, options?: CreateDepsOptions): ServerDeps;

package/dist/node/deps.js

@@ -0,0 +1,51 @@
+import { randomBytes } from "node:crypto";
+import { loadConfig } from "../client/config.js";
+import { DeployTokenAuthProvider, readDeployTokenEnv } from "../client/deploy-token.js";
+import { Http } from "../client/http.js";
+import { SessionAuthProvider, sessionFilePath } from "../client/session-store.js";
+import { PlanGate } from "../client/tier.js";
+import { ConfirmationTokens, envPermissions } from "../guards.js";
+import { nodeHostLookup } from "./host-lookup.js";
+import { nodePathLoader } from "./path-source.js";
+/**
+ * Picks where tokens come from: a deploy token when MICROPAGE_DEPLOY_TOKEN and
+ * MICROPAGE_DEPLOY_PROJECT are both set (only one set throws), else the CLI
+ * session file. The session provider is used even when the file does not
+ * exist yet, so a `micropage login` after the server started takes effect
+ * without a restart; until then every call fails with NOT_LOGGED_IN.
+ */
+export function createAuthProvider(env, config, options = {}) {
+    const shared = {
+        config,
+        ...(options.fetch ? { fetch: options.fetch } : {}),
+        ...(options.now ? { now: options.now } : {}),
+    };
+    const deploy = readDeployTokenEnv(env);
+    if (deploy)
+        return new DeployTokenAuthProvider({ ...shared, ...deploy });
+    return new SessionAuthProvider({ ...shared, path: sessionFilePath(env) });
+}
+/**
+ * The stdio server's deps, built once per process from the environment. The
+ * confirmation-token key is random per process, so restarting the server
+ * invalidates every outstanding preview token.
+ */
+export function createDeps(env = process.env, options = {}) {
+    const config = loadConfig(env);
+    const auth = createAuthProvider(env, config, options);
+    const http = new Http({ config, auth, ...(options.fetch ? { fetch: options.fetch } : {}) });
+    const tier = new PlanGate({ http, auth, ...(options.now ? { now: options.now } : {}) });
+    return {
+        config,
+        auth,
+        http,
+        tier,
+        permissions: envPermissions(env),
+        confirmationTokens: new ConfirmationTokens({ key: randomBytes(32), ...(options.now ? { now: options.now } : {}) }),
+        uploads: {
+            pathLoader: nodePathLoader,
+            lookupHost: options.lookupHost ?? nodeHostLookup,
+        },
+    };
+}
+//# sourceMappingURL=deps.js.map