@neopress/mcp 1.2.0 → 1.3.1

package/dist/bin.cjs

@@ -34,7 +34,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
@@ -9338,7 +9338,8 @@ var ZodPromise = class extends ZodType {
 			});
 			return INVALID;
 		}
-		return OK((ctx.parsedType === ZodParsedType.promise ? ctx.data : Promise.resolve(ctx.data)).then((data) => {
+		const promisified = ctx.parsedType === ZodParsedType.promise ? ctx.data : Promise.resolve(ctx.data);
+		return OK(promisified.then((data) => {
 			return this._def.type.parseAsync(data, {
 				path: ctx.path,
 				errorMap: ctx.common.contextualErrorMap
@@ -10073,9 +10074,7 @@ function parseBigintDef(def, refs) {
 				setResponseValueAndErrors(res, "maximum", check.value, check.message, refs);
 			}
 			break;
-		case "multipleOf":
-			setResponseValueAndErrors(res, "multipleOf", check.value, check.message, refs);
-			break;
+		case "multipleOf": setResponseValueAndErrors(res, "multipleOf", check.value, check.message, refs);
 	}
 	return res;
 }
@@ -10122,9 +10121,7 @@ const integerDateParser = (def, refs) => {
 		case "min":
 			setResponseValueAndErrors(res, "minimum", check.value, check.message, refs);
 			break;
-		case "max":
-			setResponseValueAndErrors(res, "maximum", check.value, check.message, refs);
-			break;
+		case "max": setResponseValueAndErrors(res, "maximum", check.value, check.message, refs);
 	}
 	return res;
 };
@@ -10276,9 +10273,7 @@ function parseStringDef(def, refs) {
 				case "format:idn-email":
 					addFormat(res, "idn-email", check.message, refs);
 					break;
-				case "pattern:zod":
-					addPattern(res, zodPatterns.email, check.message, refs);
-					break;
+				case "pattern:zod": addPattern(res, zodPatterns.email, check.message, refs);
 			}
 			break;
 		case "url":
@@ -10349,16 +10344,10 @@ function parseStringDef(def, refs) {
 				case "contentEncoding:base64":
 					setResponseValueAndErrors(res, "contentEncoding", "base64", check.message, refs);
 					break;
-				case "pattern:zod":
-					addPattern(res, zodPatterns.base64, check.message, refs);
-					break;
+				case "pattern:zod": addPattern(res, zodPatterns.base64, check.message, refs);
 			}
 			break;
 		case "nanoid": addPattern(res, zodPatterns.nanoid, check.message, refs);
-		case "toLowerCase":
-		case "toUpperCase":
-		case "trim": break;
-		default:
 	}
 	return res;
 }
@@ -10705,9 +10694,7 @@ function parseNumberDef(def, refs) {
 				setResponseValueAndErrors(res, "maximum", check.value, check.message, refs);
 			}
 			break;
-		case "multipleOf":
-			setResponseValueAndErrors(res, "multipleOf", check.value, check.message, refs);
-			break;
+		case "multipleOf": setResponseValueAndErrors(res, "multipleOf", check.value, check.message, refs);
 	}
 	return res;
 }
@@ -18352,9 +18339,7 @@ var ExperimentalServerTasks = class {
 			case "url":
 				if (!clientCapabilities?.elicitation?.url) throw new Error("Client does not support url elicitation.");
 				break;
-			case "form":
-				if (!clientCapabilities?.elicitation?.form) throw new Error("Client does not support form elicitation.");
-				break;
+			case "form": if (!clientCapabilities?.elicitation?.form) throw new Error("Client does not support form elicitation.");
 		}
 		const normalizedParams = mode === "form" && params.mode === void 0 ? {
 			...params,
@@ -18436,10 +18421,7 @@ var ExperimentalServerTasks = class {
 function assertToolsCallTaskCapability(requests, method, entityName) {
 	if (!requests) throw new Error(`${entityName} does not support task creation (required for ${method})`);
 	switch (method) {
-		case "tools/call":
-			if (!requests.tools?.call) throw new Error(`${entityName} does not support task creation for tools/call (required for ${method})`);
-			break;
-		default: break;
+		case "tools/call": if (!requests.tools?.call) throw new Error(`${entityName} does not support task creation for tools/call (required for ${method})`);
 	}
 }
 /**
@@ -18459,10 +18441,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
 		case "sampling/createMessage":
 			if (!requests.sampling?.createMessage) throw new Error(`${entityName} does not support task creation for sampling/createMessage (required for ${method})`);
 			break;
-		case "elicitation/create":
-			if (!requests.elicitation?.create) throw new Error(`${entityName} does not support task creation for elicitation/create (required for ${method})`);
-			break;
-		default: break;
+		case "elicitation/create": if (!requests.elicitation?.create) throw new Error(`${entityName} does not support task creation for elicitation/create (required for ${method})`);
 	}
 }
 //#endregion
@@ -18590,10 +18569,7 @@ var Server = class extends Protocol {
 			case "elicitation/create":
 				if (!this._clientCapabilities?.elicitation) throw new Error(`Client does not support elicitation (required for ${method})`);
 				break;
-			case "roots/list":
-				if (!this._clientCapabilities?.roots) throw new Error(`Client does not support listing roots (required for ${method})`);
-				break;
-			case "ping": break;
+			case "roots/list": if (!this._clientCapabilities?.roots) throw new Error(`Client does not support listing roots (required for ${method})`);
 		}
 	}
 	assertNotificationCapability(method) {
@@ -18611,11 +18587,7 @@ var Server = class extends Protocol {
 			case "notifications/prompts/list_changed":
 				if (!this._capabilities.prompts) throw new Error(`Server does not support notifying of prompt list changes (required for ${method})`);
 				break;
-			case "notifications/elicitation/complete":
-				if (!this._clientCapabilities?.elicitation?.url) throw new Error(`Client does not support URL elicitation (required for ${method})`);
-				break;
-			case "notifications/cancelled": break;
-			case "notifications/progress": break;
+			case "notifications/elicitation/complete": if (!this._clientCapabilities?.elicitation?.url) throw new Error(`Client does not support URL elicitation (required for ${method})`);
 		}
 	}
 	assertRequestHandlerCapability(method) {
@@ -18643,11 +18615,7 @@ var Server = class extends Protocol {
 			case "tasks/get":
 			case "tasks/list":
 			case "tasks/result":
-			case "tasks/cancel":
-				if (!this._capabilities.tasks) throw new Error(`Server does not support tasks capability (required for ${method})`);
-				break;
-			case "ping":
-			case "initialize": break;
+			case "tasks/cancel": if (!this._capabilities.tasks) throw new Error(`Server does not support tasks capability (required for ${method})`);
 		}
 	}
 	assertTaskCapability(method) {
@@ -32873,7 +32841,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.JWKS_TTL = exports.BASE64URL_REGEX = exports.API_VERSIONS = exports.API_VERSION_HEADER_NAME = exports.NETWORK_FAILURE = exports.DEFAULT_HEADERS = exports.AUDIENCE = exports.STORAGE_KEY = exports.GOTRUE_URL = exports.EXPIRY_MARGIN_MS = exports.AUTO_REFRESH_TICK_THRESHOLD = exports.AUTO_REFRESH_TICK_DURATION_MS = void 0;
 	const version_1 = require_version();
 	/** Current session will be checked for refresh at this interval. */
-	exports.AUTO_REFRESH_TICK_DURATION_MS = 30 * 1e3;
+	exports.AUTO_REFRESH_TICK_DURATION_MS = 3e4;
 	/**
 	* A token refresh will be attempted this many ticks before the current session expires. */
 	exports.AUTO_REFRESH_TICK_THRESHOLD = 3;
@@ -32892,7 +32860,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports) => {
 		name: "2024-01-01"
 	} };
 	exports.BASE64URL_REGEX = /^([a-z0-9_-]{4})*($|[a-z0-9_-]{3}$|[a-z0-9_-]{2}$)$/i;
-	exports.JWKS_TTL = 600 * 1e3;
+	exports.JWKS_TTL = 6e5;
 }));
 //#endregion
 //#region ../../node_modules/@supabase/auth-js/dist/main/lib/errors.js
@@ -39315,10 +39283,7 @@ var require_GoTrueClient = /* @__PURE__ */ __commonJSMin(((exports) => {
 					case "implicit":
 						if (this.flowType === "pkce") throw new errors_1.AuthPKCEGrantCodeExchangeError("Not a valid PKCE flow url.");
 						break;
-					case "pkce":
-						if (this.flowType === "implicit") throw new errors_1.AuthImplicitGrantRedirectError("Not a valid implicit grant flow url.");
-						break;
-					default:
+					case "pkce": if (this.flowType === "implicit") throw new errors_1.AuthImplicitGrantRedirectError("Not a valid implicit grant flow url.");
 				}
 				if (callbackUrlType === "pkce") {
 					this._debug("#_initialize()", "begin", "is PKCE flow", true);
@@ -42326,7 +42291,7 @@ function shouldShowDeprecationWarning() {
 }
 if (shouldShowDeprecationWarning()) console.warn("⚠️  Node.js 18 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. Please upgrade to Node.js 20 or later. For more information, visit: https://github.com/orgs/supabase/discussions/37217");
 //#endregion
-//#region ../sdk/dist/errors.js
+//#region ../sdk/src/errors.ts
 /**
 * SDK error classes
 */
@@ -42343,13 +42308,7 @@ var NeopressApiError = class extends Error {
 	}
 };
 //#endregion
-//#region ../sdk/dist/serializers.js
-/**
-* SDK serializers — convert DB snake_case rows to SDK camelCase shapes.
-*
-* Ported 1:1 from apps/neopress/src/lib/api/v1/serializers.ts.
-* Do NOT change field mappings without updating both files.
-*/
+//#region ../sdk/src/serializers.ts
 function serializePageFull(page) {
 	return {
 		id: page.id,
@@ -42598,7 +42557,7 @@ function serializeSiteLayout(siteId, layout) {
 	};
 }
 //#endregion
-//#region ../sdk/dist/endpoints/pages.js
+//#region ../sdk/src/endpoints/pages.ts
 var PagesEndpoint = class {
 	client;
 	constructor(client) {
@@ -42932,7 +42891,7 @@ function getDefaultLogLevel() {
 }
 getDefaultLogLevel();
 //#endregion
-//#region ../sdk/dist/endpoints/collections.js
+//#region ../sdk/src/endpoints/collections.ts
 var CollectionsEndpoint = class {
 	client;
 	constructor(client) {
@@ -42998,7 +42957,7 @@ var CollectionsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/entries.js
+//#region ../sdk/src/endpoints/entries.ts
 var EntriesEndpoint = class {
 	client;
 	constructor(client) {
@@ -43071,7 +43030,7 @@ var EntriesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/forms.js
+//#region ../sdk/src/endpoints/forms.ts
 var FormsEndpoint = class {
 	client;
 	constructor(client) {
@@ -43139,7 +43098,7 @@ var FormsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/assets.js
+//#region ../sdk/src/endpoints/assets.ts
 var AssetsEndpoint = class {
 	client;
 	constructor(client) {
@@ -43200,7 +43159,7 @@ var AssetsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/site.js
+//#region ../sdk/src/endpoints/site.ts
 var SiteEndpoint = class {
 	client;
 	constructor(client) {
@@ -43245,7 +43204,7 @@ var SiteEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/redirects.js
+//#region ../sdk/src/endpoints/redirects.ts
 const DASHBOARD_ONLY_REWRITE_MESSAGE = "Rewrite proxy rules can only be managed in the dashboard.";
 function rejectModeParam(data) {
 	if (data && typeof data === "object" && Object.prototype.hasOwnProperty.call(data, "mode")) throw new NeopressApiError("REDIRECT_RULE_DASHBOARD_ONLY", DASHBOARD_ONLY_REWRITE_MESSAGE, 400);
@@ -43306,7 +43265,7 @@ var RedirectsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/publish.js
+//#region ../sdk/src/endpoints/publish.ts
 var PublishEndpoint = class {
 	client;
 	constructor(client) {
@@ -43320,7 +43279,7 @@ var PublishEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/entry-references.js
+//#region ../sdk/src/endpoints/entry-references.ts
 var EntryReferencesEndpoint = class {
 	client;
 	constructor(client) {
@@ -43351,7 +43310,7 @@ var EntryReferencesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/analytics.js
+//#region ../sdk/src/endpoints/analytics.ts
 const RESERVED_ANALYTICS_PARAMS = /* @__PURE__ */ new Set([
 	"pipe",
 	"site",
@@ -43436,7 +43395,7 @@ var AnalyticsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/templates.js
+//#region ../sdk/src/endpoints/templates.ts
 var TemplatesEndpoint = class {
 	client;
 	constructor(client) {
@@ -43500,7 +43459,7 @@ var TemplatesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/headshots.js
+//#region ../sdk/src/endpoints/headshots.ts
 /**
 * headshot_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to
 * the super-admin user, so these direct-DB calls return empty/forbidden for any
@@ -43584,7 +43543,7 @@ var HeadshotsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/logos.js
+//#region ../sdk/src/endpoints/logos.ts
 /**
 * logo_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to the
 * super-admin user, so these direct-DB calls return empty/forbidden for any other
@@ -43674,7 +43633,7 @@ var LogosEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/client.js
+//#region ../sdk/src/client.ts
 /**
 * @neopress/sdk — API Client
 *
@@ -43751,7 +43710,8 @@ var NeopressClient = class {
 	* header so RLS applies. No session persistence/refresh — token freshness is the
 	* caller's responsibility (CLI getClientAsync / MCP per-request).
 	*
-	* `@internal` (with `stripInternal`) keeps this out of the emitted declarations:
+	* `@internal` (with `stripInternal` in the cli/mcp dts configs — sdk itself no
+	* longer emits) keeps this out of the published declarations:
 	* it is plumbing for the endpoints in this package, and typing it publicly would
 	* drag `SupabaseClient` + the generated `Database` into the published `.d.ts` of
 	* `@neopress/cli` / `@neopress/mcp` — packages that declare no dependencies, so
@@ -44009,7 +43969,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - Reusable templates are normal Neopress sites marked by a \`templates\` metadata row.
 - \`templates.id\` equals \`sites.id\`.
 - Build layout, pages, collections, entries, forms, assets, compile, publish, and verify before marking a finished template.
-- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
+- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\` and \`previewVideoUrl\`. The gallery card renders \`previewImgUrls[0]\` at rest and cross-fades to \`previewVideoUrl\` on hover, so the first preview image must be that video's first frame.
 - \`referenceUrl\` is a single http(s) provenance URL. \`description\` is an optional summary of the template (max 150 characters).
 - Template metadata does not replace page TSX, CMS content, forms, or publish state.
 - Use \`neopress_template_delete\` only for explicit template-site hard deletion. It removes the metadata row and connected site.
@@ -44347,20 +44307,22 @@ const toolDefinitions = [
 	{
 		name: "neopress_template_mark",
 		title: "Mark Site As Template",
-		description: "Create or update the template metadata row for a finished template site. The template id is the site id. Requires at least one previewImgUrl.",
+		description: "Create or update the template metadata row for a finished template site. The template id is the site id. Requires at least one previewImgUrl. The gallery card shows previewImgUrls[0] at rest and plays previewVideoUrl on hover, so pass the video together with its own first frame as the first preview image.",
 		inputSchema: {
 			...siteIdShape,
 			name: string(),
 			description: string().max(150).optional(),
 			referenceUrl: httpUrlSchema,
-			previewImgUrls: array(string()).min(1)
+			previewImgUrls: array(string()).min(1),
+			previewVideoUrl: httpUrlSchema.optional()
 		},
 		handler: async (input, context, extra) => {
 			return (await context.createClient({ siteId: siteId(input) }, extra)).templates.mark({
 				name: asString(input, "name"),
 				description: asOptionalString(input, "description"),
 				referenceUrl: asString(input, "referenceUrl"),
-				previewImgUrls: input.previewImgUrls
+				previewImgUrls: input.previewImgUrls,
+				previewVideoUrl: asOptionalString(input, "previewVideoUrl")
 			});
 		}
 	},

package/dist/http-bin.cjs

@@ -34,7 +34,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
@@ -338,7 +338,7 @@ if (typeof global.crypto === "undefined") global.crypto = crypto$1.default;
 var outgoingEnded = Symbol("outgoingEnded");
 var incomingDraining = Symbol("incomingDraining");
 var DRAIN_TIMEOUT_MS = 500;
-var MAX_DRAIN_BYTES = 64 * 1024 * 1024;
+var MAX_DRAIN_BYTES = 67108864;
 var drainIncoming = (incoming) => {
 	const incomingWithDrainState = incoming;
 	if (incoming.destroyed || incomingWithDrainState[incomingDraining]) return;
@@ -10447,7 +10447,8 @@ var ZodPromise = class extends ZodType {
 			});
 			return INVALID;
 		}
-		return OK((ctx.parsedType === ZodParsedType.promise ? ctx.data : Promise.resolve(ctx.data)).then((data) => {
+		const promisified = ctx.parsedType === ZodParsedType.promise ? ctx.data : Promise.resolve(ctx.data);
+		return OK(promisified.then((data) => {
 			return this._def.type.parseAsync(data, {
 				path: ctx.path,
 				errorMap: ctx.common.contextualErrorMap
@@ -11182,9 +11183,7 @@ function parseBigintDef(def, refs) {
 				setResponseValueAndErrors(res, "maximum", check.value, check.message, refs);
 			}
 			break;
-		case "multipleOf":
-			setResponseValueAndErrors(res, "multipleOf", check.value, check.message, refs);
-			break;
+		case "multipleOf": setResponseValueAndErrors(res, "multipleOf", check.value, check.message, refs);
 	}
 	return res;
 }
@@ -11231,9 +11230,7 @@ const integerDateParser = (def, refs) => {
 		case "min":
 			setResponseValueAndErrors(res, "minimum", check.value, check.message, refs);
 			break;
-		case "max":
-			setResponseValueAndErrors(res, "maximum", check.value, check.message, refs);
-			break;
+		case "max": setResponseValueAndErrors(res, "maximum", check.value, check.message, refs);
 	}
 	return res;
 };
@@ -11385,9 +11382,7 @@ function parseStringDef(def, refs) {
 				case "format:idn-email":
 					addFormat(res, "idn-email", check.message, refs);
 					break;
-				case "pattern:zod":
-					addPattern(res, zodPatterns.email, check.message, refs);
-					break;
+				case "pattern:zod": addPattern(res, zodPatterns.email, check.message, refs);
 			}
 			break;
 		case "url":
@@ -11458,16 +11453,10 @@ function parseStringDef(def, refs) {
 				case "contentEncoding:base64":
 					setResponseValueAndErrors(res, "contentEncoding", "base64", check.message, refs);
 					break;
-				case "pattern:zod":
-					addPattern(res, zodPatterns.base64, check.message, refs);
-					break;
+				case "pattern:zod": addPattern(res, zodPatterns.base64, check.message, refs);
 			}
 			break;
 		case "nanoid": addPattern(res, zodPatterns.nanoid, check.message, refs);
-		case "toLowerCase":
-		case "toUpperCase":
-		case "trim": break;
-		default:
 	}
 	return res;
 }
@@ -11814,9 +11803,7 @@ function parseNumberDef(def, refs) {
 				setResponseValueAndErrors(res, "maximum", check.value, check.message, refs);
 			}
 			break;
-		case "multipleOf":
-			setResponseValueAndErrors(res, "multipleOf", check.value, check.message, refs);
-			break;
+		case "multipleOf": setResponseValueAndErrors(res, "multipleOf", check.value, check.message, refs);
 	}
 	return res;
 }
@@ -19461,9 +19448,7 @@ var ExperimentalServerTasks = class {
 			case "url":
 				if (!clientCapabilities?.elicitation?.url) throw new Error("Client does not support url elicitation.");
 				break;
-			case "form":
-				if (!clientCapabilities?.elicitation?.form) throw new Error("Client does not support form elicitation.");
-				break;
+			case "form": if (!clientCapabilities?.elicitation?.form) throw new Error("Client does not support form elicitation.");
 		}
 		const normalizedParams = mode === "form" && params.mode === void 0 ? {
 			...params,
@@ -19545,10 +19530,7 @@ var ExperimentalServerTasks = class {
 function assertToolsCallTaskCapability(requests, method, entityName) {
 	if (!requests) throw new Error(`${entityName} does not support task creation (required for ${method})`);
 	switch (method) {
-		case "tools/call":
-			if (!requests.tools?.call) throw new Error(`${entityName} does not support task creation for tools/call (required for ${method})`);
-			break;
-		default: break;
+		case "tools/call": if (!requests.tools?.call) throw new Error(`${entityName} does not support task creation for tools/call (required for ${method})`);
 	}
 }
 /**
@@ -19568,10 +19550,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
 		case "sampling/createMessage":
 			if (!requests.sampling?.createMessage) throw new Error(`${entityName} does not support task creation for sampling/createMessage (required for ${method})`);
 			break;
-		case "elicitation/create":
-			if (!requests.elicitation?.create) throw new Error(`${entityName} does not support task creation for elicitation/create (required for ${method})`);
-			break;
-		default: break;
+		case "elicitation/create": if (!requests.elicitation?.create) throw new Error(`${entityName} does not support task creation for elicitation/create (required for ${method})`);
 	}
 }
 //#endregion
@@ -19699,10 +19678,7 @@ var Server = class extends Protocol {
 			case "elicitation/create":
 				if (!this._clientCapabilities?.elicitation) throw new Error(`Client does not support elicitation (required for ${method})`);
 				break;
-			case "roots/list":
-				if (!this._clientCapabilities?.roots) throw new Error(`Client does not support listing roots (required for ${method})`);
-				break;
-			case "ping": break;
+			case "roots/list": if (!this._clientCapabilities?.roots) throw new Error(`Client does not support listing roots (required for ${method})`);
 		}
 	}
 	assertNotificationCapability(method) {
@@ -19720,11 +19696,7 @@ var Server = class extends Protocol {
 			case "notifications/prompts/list_changed":
 				if (!this._capabilities.prompts) throw new Error(`Server does not support notifying of prompt list changes (required for ${method})`);
 				break;
-			case "notifications/elicitation/complete":
-				if (!this._clientCapabilities?.elicitation?.url) throw new Error(`Client does not support URL elicitation (required for ${method})`);
-				break;
-			case "notifications/cancelled": break;
-			case "notifications/progress": break;
+			case "notifications/elicitation/complete": if (!this._clientCapabilities?.elicitation?.url) throw new Error(`Client does not support URL elicitation (required for ${method})`);
 		}
 	}
 	assertRequestHandlerCapability(method) {
@@ -19752,11 +19724,7 @@ var Server = class extends Protocol {
 			case "tasks/get":
 			case "tasks/list":
 			case "tasks/result":
-			case "tasks/cancel":
-				if (!this._capabilities.tasks) throw new Error(`Server does not support tasks capability (required for ${method})`);
-				break;
-			case "ping":
-			case "initialize": break;
+			case "tasks/cancel": if (!this._capabilities.tasks) throw new Error(`Server does not support tasks capability (required for ${method})`);
 		}
 	}
 	assertTaskCapability(method) {
@@ -33982,7 +33950,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.JWKS_TTL = exports.BASE64URL_REGEX = exports.API_VERSIONS = exports.API_VERSION_HEADER_NAME = exports.NETWORK_FAILURE = exports.DEFAULT_HEADERS = exports.AUDIENCE = exports.STORAGE_KEY = exports.GOTRUE_URL = exports.EXPIRY_MARGIN_MS = exports.AUTO_REFRESH_TICK_THRESHOLD = exports.AUTO_REFRESH_TICK_DURATION_MS = void 0;
 	const version_1 = require_version();
 	/** Current session will be checked for refresh at this interval. */
-	exports.AUTO_REFRESH_TICK_DURATION_MS = 30 * 1e3;
+	exports.AUTO_REFRESH_TICK_DURATION_MS = 3e4;
 	/**
 	* A token refresh will be attempted this many ticks before the current session expires. */
 	exports.AUTO_REFRESH_TICK_THRESHOLD = 3;
@@ -34001,7 +33969,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports) => {
 		name: "2024-01-01"
 	} };
 	exports.BASE64URL_REGEX = /^([a-z0-9_-]{4})*($|[a-z0-9_-]{3}$|[a-z0-9_-]{2}$)$/i;
-	exports.JWKS_TTL = 600 * 1e3;
+	exports.JWKS_TTL = 6e5;
 }));
 //#endregion
 //#region ../../node_modules/@supabase/auth-js/dist/main/lib/errors.js
@@ -40424,10 +40392,7 @@ var require_GoTrueClient = /* @__PURE__ */ __commonJSMin(((exports) => {
 					case "implicit":
 						if (this.flowType === "pkce") throw new errors_1.AuthPKCEGrantCodeExchangeError("Not a valid PKCE flow url.");
 						break;
-					case "pkce":
-						if (this.flowType === "implicit") throw new errors_1.AuthImplicitGrantRedirectError("Not a valid implicit grant flow url.");
-						break;
-					default:
+					case "pkce": if (this.flowType === "implicit") throw new errors_1.AuthImplicitGrantRedirectError("Not a valid implicit grant flow url.");
 				}
 				if (callbackUrlType === "pkce") {
 					this._debug("#_initialize()", "begin", "is PKCE flow", true);
@@ -43435,7 +43400,7 @@ function shouldShowDeprecationWarning() {
 }
 if (shouldShowDeprecationWarning()) console.warn("⚠️  Node.js 18 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. Please upgrade to Node.js 20 or later. For more information, visit: https://github.com/orgs/supabase/discussions/37217");
 //#endregion
-//#region ../sdk/dist/errors.js
+//#region ../sdk/src/errors.ts
 /**
 * SDK error classes
 */
@@ -43452,13 +43417,7 @@ var NeopressApiError = class extends Error {
 	}
 };
 //#endregion
-//#region ../sdk/dist/serializers.js
-/**
-* SDK serializers — convert DB snake_case rows to SDK camelCase shapes.
-*
-* Ported 1:1 from apps/neopress/src/lib/api/v1/serializers.ts.
-* Do NOT change field mappings without updating both files.
-*/
+//#region ../sdk/src/serializers.ts
 function serializePageFull(page) {
 	return {
 		id: page.id,
@@ -43707,7 +43666,7 @@ function serializeSiteLayout(siteId, layout) {
 	};
 }
 //#endregion
-//#region ../sdk/dist/endpoints/pages.js
+//#region ../sdk/src/endpoints/pages.ts
 var PagesEndpoint = class {
 	client;
 	constructor(client) {
@@ -44041,7 +44000,7 @@ function getDefaultLogLevel() {
 }
 getDefaultLogLevel();
 //#endregion
-//#region ../sdk/dist/endpoints/collections.js
+//#region ../sdk/src/endpoints/collections.ts
 var CollectionsEndpoint = class {
 	client;
 	constructor(client) {
@@ -44107,7 +44066,7 @@ var CollectionsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/entries.js
+//#region ../sdk/src/endpoints/entries.ts
 var EntriesEndpoint = class {
 	client;
 	constructor(client) {
@@ -44180,7 +44139,7 @@ var EntriesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/forms.js
+//#region ../sdk/src/endpoints/forms.ts
 var FormsEndpoint = class {
 	client;
 	constructor(client) {
@@ -44248,7 +44207,7 @@ var FormsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/assets.js
+//#region ../sdk/src/endpoints/assets.ts
 var AssetsEndpoint = class {
 	client;
 	constructor(client) {
@@ -44309,7 +44268,7 @@ var AssetsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/site.js
+//#region ../sdk/src/endpoints/site.ts
 var SiteEndpoint = class {
 	client;
 	constructor(client) {
@@ -44354,7 +44313,7 @@ var SiteEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/redirects.js
+//#region ../sdk/src/endpoints/redirects.ts
 const DASHBOARD_ONLY_REWRITE_MESSAGE = "Rewrite proxy rules can only be managed in the dashboard.";
 function rejectModeParam(data) {
 	if (data && typeof data === "object" && Object.prototype.hasOwnProperty.call(data, "mode")) throw new NeopressApiError("REDIRECT_RULE_DASHBOARD_ONLY", DASHBOARD_ONLY_REWRITE_MESSAGE, 400);
@@ -44415,7 +44374,7 @@ var RedirectsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/publish.js
+//#region ../sdk/src/endpoints/publish.ts
 var PublishEndpoint = class {
 	client;
 	constructor(client) {
@@ -44429,7 +44388,7 @@ var PublishEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/entry-references.js
+//#region ../sdk/src/endpoints/entry-references.ts
 var EntryReferencesEndpoint = class {
 	client;
 	constructor(client) {
@@ -44460,7 +44419,7 @@ var EntryReferencesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/analytics.js
+//#region ../sdk/src/endpoints/analytics.ts
 const RESERVED_ANALYTICS_PARAMS = /* @__PURE__ */ new Set([
 	"pipe",
 	"site",
@@ -44545,7 +44504,7 @@ var AnalyticsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/templates.js
+//#region ../sdk/src/endpoints/templates.ts
 var TemplatesEndpoint = class {
 	client;
 	constructor(client) {
@@ -44609,7 +44568,7 @@ var TemplatesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/headshots.js
+//#region ../sdk/src/endpoints/headshots.ts
 /**
 * headshot_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to
 * the super-admin user, so these direct-DB calls return empty/forbidden for any
@@ -44693,7 +44652,7 @@ var HeadshotsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/logos.js
+//#region ../sdk/src/endpoints/logos.ts
 /**
 * logo_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to the
 * super-admin user, so these direct-DB calls return empty/forbidden for any other
@@ -44783,7 +44742,7 @@ var LogosEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/client.js
+//#region ../sdk/src/client.ts
 /**
 * @neopress/sdk — API Client
 *
@@ -44860,7 +44819,8 @@ var NeopressClient = class {
 	* header so RLS applies. No session persistence/refresh — token freshness is the
 	* caller's responsibility (CLI getClientAsync / MCP per-request).
 	*
-	* `@internal` (with `stripInternal`) keeps this out of the emitted declarations:
+	* `@internal` (with `stripInternal` in the cli/mcp dts configs — sdk itself no
+	* longer emits) keeps this out of the published declarations:
 	* it is plumbing for the endpoints in this package, and typing it publicly would
 	* drag `SupabaseClient` + the generated `Database` into the published `.d.ts` of
 	* `@neopress/cli` / `@neopress/mcp` — packages that declare no dependencies, so
@@ -45118,7 +45078,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - Reusable templates are normal Neopress sites marked by a \`templates\` metadata row.
 - \`templates.id\` equals \`sites.id\`.
 - Build layout, pages, collections, entries, forms, assets, compile, publish, and verify before marking a finished template.
-- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
+- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\` and \`previewVideoUrl\`. The gallery card renders \`previewImgUrls[0]\` at rest and cross-fades to \`previewVideoUrl\` on hover, so the first preview image must be that video's first frame.
 - \`referenceUrl\` is a single http(s) provenance URL. \`description\` is an optional summary of the template (max 150 characters).
 - Template metadata does not replace page TSX, CMS content, forms, or publish state.
 - Use \`neopress_template_delete\` only for explicit template-site hard deletion. It removes the metadata row and connected site.
@@ -45456,20 +45416,22 @@ const toolDefinitions = [
 	{
 		name: "neopress_template_mark",
 		title: "Mark Site As Template",
-		description: "Create or update the template metadata row for a finished template site. The template id is the site id. Requires at least one previewImgUrl.",
+		description: "Create or update the template metadata row for a finished template site. The template id is the site id. Requires at least one previewImgUrl. The gallery card shows previewImgUrls[0] at rest and plays previewVideoUrl on hover, so pass the video together with its own first frame as the first preview image.",
 		inputSchema: {
 			...siteIdShape,
 			name: string(),
 			description: string().max(150).optional(),
 			referenceUrl: httpUrlSchema,
-			previewImgUrls: array(string()).min(1)
+			previewImgUrls: array(string()).min(1),
+			previewVideoUrl: httpUrlSchema.optional()
 		},
 		handler: async (input, context, extra) => {
 			return (await context.createClient({ siteId: siteId(input) }, extra)).templates.mark({
 				name: asString(input, "name"),
 				description: asOptionalString(input, "description"),
 				referenceUrl: asString(input, "referenceUrl"),
-				previewImgUrls: input.previewImgUrls
+				previewImgUrls: input.previewImgUrls,
+				previewVideoUrl: asOptionalString(input, "previewVideoUrl")
 			});
 		}
 	},
@@ -46342,7 +46304,7 @@ function createRemoteToolContext(options) {
 		}
 	};
 }
-const DEFAULT_CLIENT_TTL_SECONDS = 720 * 60 * 60;
+const DEFAULT_CLIENT_TTL_SECONDS = 2592e3;
 let generatedClientSecret;
 var OAuthProtocolError = class extends Error {
 	status;
@@ -46604,7 +46566,7 @@ async function readBody(request) {
 	for await (const chunk of request) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		size += buffer.byteLength;
-		if (size > 1024 * 1024) throw new OAuthProtocolError(413, "invalid_request", "Request body is too large.");
+		if (size > 1048576) throw new OAuthProtocolError(413, "invalid_request", "Request body is too large.");
 		chunks.push(buffer);
 	}
 	return Buffer.concat(chunks).toString("utf-8");

package/dist/index.d.ts

@@ -4,7 +4,7 @@ import { Server } from "node:http";
 import { ServerNotification, ServerRequest } from "@modelcontextprotocol/sdk/types.js";
 import { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
 import { AddressInfo } from "node:net";
-//#region ../sdk/dist/types.d.ts
+//#region ../sdk/src/types.d.ts
 /**
  * @neopress/sdk — First-party API types
  *
@@ -286,7 +286,7 @@ interface SearchConsoleQueryResult {
   error?: string;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/pages.d.ts
+//#region ../sdk/src/endpoints/pages.d.ts
 interface PageListParams {
   page?: number;
   limit?: number;
@@ -336,7 +336,7 @@ declare class PagesEndpoint {
   }>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/collections.d.ts
+//#region ../sdk/src/endpoints/collections.d.ts
 interface CollectionCreateParams {
   name: string;
   presetType?: string;
@@ -369,7 +369,7 @@ declare class CollectionsEndpoint {
   }>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/entries.d.ts
+//#region ../sdk/src/endpoints/entries.d.ts
 interface EntryListParams {
   page?: number;
   limit?: number;
@@ -419,7 +419,7 @@ declare class EntriesEndpoint {
   }>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/forms.d.ts
+//#region ../sdk/src/endpoints/forms.d.ts
 interface FormCreateParams {
   name: string;
   draftSchema?: unknown;
@@ -459,7 +459,7 @@ declare class FormsEndpoint {
   deleteResponse(formId: number, responseId: number): Promise<void>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/assets.d.ts
+//#region ../sdk/src/endpoints/assets.d.ts
 interface AssetRegisterParams {
   assetUrl: string;
   displayName?: string;
@@ -496,7 +496,7 @@ declare class AssetsEndpoint {
   }>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/site.d.ts
+//#region ../sdk/src/endpoints/site.d.ts
 interface SiteWithRole extends Site {
   role: string;
 }
@@ -531,7 +531,7 @@ declare class SiteEndpoint {
   }>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/redirects.d.ts
+//#region ../sdk/src/endpoints/redirects.d.ts
 interface RedirectCreateParams {
   source: string;
   destination: string;
@@ -553,7 +553,7 @@ declare class RedirectsEndpoint {
   delete(ruleId: number): Promise<void>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/publish.d.ts
+//#region ../sdk/src/endpoints/publish.d.ts
 declare class PublishEndpoint {
   private readonly client;
   constructor(client: NeopressClient);
@@ -561,7 +561,7 @@ declare class PublishEndpoint {
   site(): Promise<unknown>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/entry-references.d.ts
+//#region ../sdk/src/endpoints/entry-references.d.ts
 interface EntryReferenceListParams {
   fromEntryId?: number;
   toEntryId?: number;
@@ -581,7 +581,7 @@ declare class EntryReferencesEndpoint {
   delete(referenceId: number): Promise<void>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/analytics.d.ts
+//#region ../sdk/src/endpoints/analytics.d.ts
 declare class AnalyticsEndpoint {
   private readonly client;
   constructor(client: NeopressClient);
@@ -596,12 +596,16 @@ declare class AnalyticsEndpoint {
   searchConsole(params: SearchConsoleQueryParams): Promise<SearchConsoleQueryResult>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/templates.d.ts
+//#region ../sdk/src/endpoints/templates.d.ts
 interface TemplateMarkParams {
   name: string;
   description?: string | null;
   referenceUrl: string;
   previewImgUrls?: string[] | null;
+  /** Gallery hover video. Pair it with the poster in `previewImgUrls[0]` — the
+   * card cross-fades from poster to video, so the poster must be the video's
+   * first frame. Omit to leave an existing value untouched; `null` clears it. */
+  previewVideoUrl?: string | null;
 }
 interface TemplateDeleteResult {
   siteId: number;
@@ -628,7 +632,7 @@ declare class TemplatesEndpoint {
   }): Promise<TemplateListItem[]>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/headshots.d.ts
+//#region ../sdk/src/endpoints/headshots.d.ts
 type HeadshotAgeBand = 'young' | 'middle';
 type HeadshotGender = 'male' | 'female';
 type HeadshotEthnicity = 'asian' | 'white' | 'black' | 'latino';
@@ -695,7 +699,7 @@ declare class HeadshotsEndpoint {
   delete(id: number): Promise<HeadshotDeleteResult>;
 }
 //#endregion
-//#region ../sdk/dist/endpoints/logos.d.ts
+//#region ../sdk/src/endpoints/logos.d.ts
 type LogoType = 'wordmark' | 'lockup' | 'signature';
 type LogoTone = 'playful' | 'neutral' | 'serious';
 interface LogoListParams {
@@ -766,7 +770,7 @@ declare class LogosEndpoint {
   delete(id: number): Promise<LogoDeleteResult>;
 }
 //#endregion
-//#region ../sdk/dist/client.d.ts
+//#region ../sdk/src/client.d.ts
 interface NeopressClientOptions {
   /** OAuth access token */
   accessToken?: string;

package/dist/index.js

@@ -13359,7 +13359,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.JWKS_TTL = exports.BASE64URL_REGEX = exports.API_VERSIONS = exports.API_VERSION_HEADER_NAME = exports.NETWORK_FAILURE = exports.DEFAULT_HEADERS = exports.AUDIENCE = exports.STORAGE_KEY = exports.GOTRUE_URL = exports.EXPIRY_MARGIN_MS = exports.AUTO_REFRESH_TICK_THRESHOLD = exports.AUTO_REFRESH_TICK_DURATION_MS = void 0;
 	const version_1 = require_version();
 	/** Current session will be checked for refresh at this interval. */
-	exports.AUTO_REFRESH_TICK_DURATION_MS = 30 * 1e3;
+	exports.AUTO_REFRESH_TICK_DURATION_MS = 3e4;
 	/**
 	* A token refresh will be attempted this many ticks before the current session expires. */
 	exports.AUTO_REFRESH_TICK_THRESHOLD = 3;
@@ -13378,7 +13378,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports) => {
 		name: "2024-01-01"
 	} };
 	exports.BASE64URL_REGEX = /^([a-z0-9_-]{4})*($|[a-z0-9_-]{3}$|[a-z0-9_-]{2}$)$/i;
-	exports.JWKS_TTL = 600 * 1e3;
+	exports.JWKS_TTL = 6e5;
 }));
 //#endregion
 //#region ../../node_modules/@supabase/auth-js/dist/main/lib/errors.js
@@ -19801,10 +19801,7 @@ var require_GoTrueClient = /* @__PURE__ */ __commonJSMin(((exports) => {
 					case "implicit":
 						if (this.flowType === "pkce") throw new errors_1.AuthPKCEGrantCodeExchangeError("Not a valid PKCE flow url.");
 						break;
-					case "pkce":
-						if (this.flowType === "implicit") throw new errors_1.AuthImplicitGrantRedirectError("Not a valid implicit grant flow url.");
-						break;
-					default:
+					case "pkce": if (this.flowType === "implicit") throw new errors_1.AuthImplicitGrantRedirectError("Not a valid implicit grant flow url.");
 				}
 				if (callbackUrlType === "pkce") {
 					this._debug("#_initialize()", "begin", "is PKCE flow", true);
@@ -22812,7 +22809,7 @@ function shouldShowDeprecationWarning() {
 }
 if (shouldShowDeprecationWarning()) console.warn("⚠️  Node.js 18 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. Please upgrade to Node.js 20 or later. For more information, visit: https://github.com/orgs/supabase/discussions/37217");
 //#endregion
-//#region ../sdk/dist/errors.js
+//#region ../sdk/src/errors.ts
 /**
 * SDK error classes
 */
@@ -22829,13 +22826,7 @@ var NeopressApiError = class extends Error {
 	}
 };
 //#endregion
-//#region ../sdk/dist/serializers.js
-/**
-* SDK serializers — convert DB snake_case rows to SDK camelCase shapes.
-*
-* Ported 1:1 from apps/neopress/src/lib/api/v1/serializers.ts.
-* Do NOT change field mappings without updating both files.
-*/
+//#region ../sdk/src/serializers.ts
 function serializePageFull(page) {
 	return {
 		id: page.id,
@@ -23084,7 +23075,7 @@ function serializeSiteLayout(siteId, layout) {
 	};
 }
 //#endregion
-//#region ../sdk/dist/endpoints/pages.js
+//#region ../sdk/src/endpoints/pages.ts
 var PagesEndpoint = class {
 	client;
 	constructor(client) {
@@ -23423,7 +23414,7 @@ function getDefaultLogLevel() {
 }
 getDefaultLogLevel();
 //#endregion
-//#region ../sdk/dist/endpoints/collections.js
+//#region ../sdk/src/endpoints/collections.ts
 var CollectionsEndpoint = class {
 	client;
 	constructor(client) {
@@ -23489,7 +23480,7 @@ var CollectionsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/entries.js
+//#region ../sdk/src/endpoints/entries.ts
 var EntriesEndpoint = class {
 	client;
 	constructor(client) {
@@ -23562,7 +23553,7 @@ var EntriesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/forms.js
+//#region ../sdk/src/endpoints/forms.ts
 var FormsEndpoint = class {
 	client;
 	constructor(client) {
@@ -23630,7 +23621,7 @@ var FormsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/assets.js
+//#region ../sdk/src/endpoints/assets.ts
 var AssetsEndpoint = class {
 	client;
 	constructor(client) {
@@ -23691,7 +23682,7 @@ var AssetsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/site.js
+//#region ../sdk/src/endpoints/site.ts
 var SiteEndpoint = class {
 	client;
 	constructor(client) {
@@ -23736,7 +23727,7 @@ var SiteEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/redirects.js
+//#region ../sdk/src/endpoints/redirects.ts
 const DASHBOARD_ONLY_REWRITE_MESSAGE = "Rewrite proxy rules can only be managed in the dashboard.";
 function rejectModeParam(data) {
 	if (data && typeof data === "object" && Object.prototype.hasOwnProperty.call(data, "mode")) throw new NeopressApiError("REDIRECT_RULE_DASHBOARD_ONLY", DASHBOARD_ONLY_REWRITE_MESSAGE, 400);
@@ -23797,7 +23788,7 @@ var RedirectsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/publish.js
+//#region ../sdk/src/endpoints/publish.ts
 var PublishEndpoint = class {
 	client;
 	constructor(client) {
@@ -23811,7 +23802,7 @@ var PublishEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/entry-references.js
+//#region ../sdk/src/endpoints/entry-references.ts
 var EntryReferencesEndpoint = class {
 	client;
 	constructor(client) {
@@ -23842,7 +23833,7 @@ var EntryReferencesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/analytics.js
+//#region ../sdk/src/endpoints/analytics.ts
 const RESERVED_ANALYTICS_PARAMS = /* @__PURE__ */ new Set([
 	"pipe",
 	"site",
@@ -23927,7 +23918,7 @@ var AnalyticsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/templates.js
+//#region ../sdk/src/endpoints/templates.ts
 var TemplatesEndpoint = class {
 	client;
 	constructor(client) {
@@ -23991,7 +23982,7 @@ var TemplatesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/headshots.js
+//#region ../sdk/src/endpoints/headshots.ts
 /**
 * headshot_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to
 * the super-admin user, so these direct-DB calls return empty/forbidden for any
@@ -24075,7 +24066,7 @@ var HeadshotsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/logos.js
+//#region ../sdk/src/endpoints/logos.ts
 /**
 * logo_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to the
 * super-admin user, so these direct-DB calls return empty/forbidden for any other
@@ -24165,7 +24156,7 @@ var LogosEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/client.js
+//#region ../sdk/src/client.ts
 /**
 * @neopress/sdk — API Client
 *
@@ -24242,7 +24233,8 @@ var NeopressClient = class {
 	* header so RLS applies. No session persistence/refresh — token freshness is the
 	* caller's responsibility (CLI getClientAsync / MCP per-request).
 	*
-	* `@internal` (with `stripInternal`) keeps this out of the emitted declarations:
+	* `@internal` (with `stripInternal` in the cli/mcp dts configs — sdk itself no
+	* longer emits) keeps this out of the published declarations:
 	* it is plumbing for the endpoints in this package, and typing it publicly would
 	* drag `SupabaseClient` + the generated `Database` into the published `.d.ts` of
 	* `@neopress/cli` / `@neopress/mcp` — packages that declare no dependencies, so
@@ -24500,7 +24492,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - Reusable templates are normal Neopress sites marked by a \`templates\` metadata row.
 - \`templates.id\` equals \`sites.id\`.
 - Build layout, pages, collections, entries, forms, assets, compile, publish, and verify before marking a finished template.
-- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\`.
+- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\` and \`previewVideoUrl\`. The gallery card renders \`previewImgUrls[0]\` at rest and cross-fades to \`previewVideoUrl\` on hover, so the first preview image must be that video's first frame.
 - \`referenceUrl\` is a single http(s) provenance URL. \`description\` is an optional summary of the template (max 150 characters).
 - Template metadata does not replace page TSX, CMS content, forms, or publish state.
 - Use \`neopress_template_delete\` only for explicit template-site hard deletion. It removes the metadata row and connected site.
@@ -24838,20 +24830,22 @@ const toolDefinitions = [
 	{
 		name: "neopress_template_mark",
 		title: "Mark Site As Template",
-		description: "Create or update the template metadata row for a finished template site. The template id is the site id. Requires at least one previewImgUrl.",
+		description: "Create or update the template metadata row for a finished template site. The template id is the site id. Requires at least one previewImgUrl. The gallery card shows previewImgUrls[0] at rest and plays previewVideoUrl on hover, so pass the video together with its own first frame as the first preview image.",
 		inputSchema: {
 			...siteIdShape,
 			name: z.string(),
 			description: z.string().max(150).optional(),
 			referenceUrl: httpUrlSchema,
-			previewImgUrls: z.array(z.string()).min(1)
+			previewImgUrls: z.array(z.string()).min(1),
+			previewVideoUrl: httpUrlSchema.optional()
 		},
 		handler: async (input, context, extra) => {
 			return (await context.createClient({ siteId: siteId(input) }, extra)).templates.mark({
 				name: asString(input, "name"),
 				description: asOptionalString(input, "description"),
 				referenceUrl: asString(input, "referenceUrl"),
-				previewImgUrls: input.previewImgUrls
+				previewImgUrls: input.previewImgUrls,
+				previewVideoUrl: asOptionalString(input, "previewVideoUrl")
 			});
 		}
 	},
@@ -25724,7 +25718,7 @@ function createRemoteToolContext(options) {
 		}
 	};
 }
-const DEFAULT_CLIENT_TTL_SECONDS = 720 * 60 * 60;
+const DEFAULT_CLIENT_TTL_SECONDS = 2592e3;
 let generatedClientSecret;
 var OAuthProtocolError = class extends Error {
 	status;
@@ -25986,7 +25980,7 @@ async function readBody(request) {
 	for await (const chunk of request) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		size += buffer.byteLength;
-		if (size > 1024 * 1024) throw new OAuthProtocolError(413, "invalid_request", "Request body is too large.");
+		if (size > 1048576) throw new OAuthProtocolError(413, "invalid_request", "Request body is too large.");
 		chunks.push(buffer);
 	}
 	return Buffer.concat(chunks).toString("utf-8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neopress/mcp",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Neopress MCP server for first-party AI agents",
   "type": "module",
   "bin": {
@@ -39,7 +39,7 @@
     "@neopress/sdk": "0.4.0"
   },
   "scripts": {
-    "build": "tsdown && node ./scripts/check-dist-contract.mjs",
+    "build": "NODE_OPTIONS=--max-old-space-size=4096 tsdown && node ./scripts/check-dist-contract.mjs",
     "mcpb:stage": "node ./scripts/prepare-mcpb-package.mjs",
     "start:http": "node ./dist/http-bin.cjs",
     "lint": "tsc --noEmit",

package/scripts/check-dist-contract.mjs

@@ -33,7 +33,7 @@ if (missing.length > 0) {
 }
 
 // Every emitted bundle must have the workspace packages inlined. tsdown reports an
-// unresolved import (a missing packages/sdk/dist, say) as a *warning* and still exits 0,
+// unresolved import (an sdk src file that fails to resolve, say) as a *warning* and still exits 0,
 // which would publish a binary carrying a bare require("@neopress/sdk") that no consumer
 // can resolve. Checking the .d.ts alone does not see this.
 for (const file of actualFiles.filter((f) => /\.(cjs|js|mjs)$/.test(f))) {
@@ -46,8 +46,9 @@ for (const file of actualFiles.filter((f) => /\.(cjs|js|mjs)$/.test(f))) {
   if (leaked.length > 0) {
     errors.push(
       `dist/${file} still imports workspace packages at runtime: ${leaked.join(', ')}\n` +
-        `  They must be bundled. A missing dependency build leaves these unresolved and\n` +
-        `  tsdown only warns — build the workspace deps first (turbo handles this via ^build).`
+        `  They must be bundled. tsdown only warns on unresolved imports, so a bare\n` +
+        `  require would ship — sdk exports src directly, so this means the import failed\n` +
+        `  to resolve (renamed source file or export-map drift), not a missing prebuild.`
     );
   }
 }