@neopress/mcp 1.3.0 → 1.4.0

package/dist/bin.cjs

@@ -45,6 +45,8 @@ node_process = __toESM(node_process, 1);
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let node_os = require("node:os");
+let node_dns_promises = require("node:dns/promises");
+let node_net = require("node:net");
 Object.freeze({ status: "aborted" });
 function $constructor(name, initializer, params) {
 	function init(inst, def) {
@@ -42291,7 +42293,7 @@ function shouldShowDeprecationWarning() {
 }
 if (shouldShowDeprecationWarning()) console.warn("⚠️  Node.js 18 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. Please upgrade to Node.js 20 or later. For more information, visit: https://github.com/orgs/supabase/discussions/37217");
 //#endregion
-//#region ../sdk/dist/errors.js
+//#region ../sdk/src/errors.ts
 /**
 * SDK error classes
 */
@@ -42308,13 +42310,7 @@ var NeopressApiError = class extends Error {
 	}
 };
 //#endregion
-//#region ../sdk/dist/serializers.js
-/**
-* SDK serializers — convert DB snake_case rows to SDK camelCase shapes.
-*
-* Ported 1:1 from apps/neopress/src/lib/api/v1/serializers.ts.
-* Do NOT change field mappings without updating both files.
-*/
+//#region ../sdk/src/serializers.ts
 function serializePageFull(page) {
 	return {
 		id: page.id,
@@ -42475,6 +42471,7 @@ function serializeTemplate(t) {
 		referenceUrl: t.reference_url,
 		previewImgUrls: t.preview_img_urls,
 		previewVideoUrl: t.preview_video_url ?? null,
+		language: t.language ?? null,
 		createdAt: t.created_at
 	};
 }
@@ -42563,7 +42560,7 @@ function serializeSiteLayout(siteId, layout) {
 	};
 }
 //#endregion
-//#region ../sdk/dist/endpoints/pages.js
+//#region ../sdk/src/endpoints/pages.ts
 var PagesEndpoint = class {
 	client;
 	constructor(client) {
@@ -42897,7 +42894,7 @@ function getDefaultLogLevel() {
 }
 getDefaultLogLevel();
 //#endregion
-//#region ../sdk/dist/endpoints/collections.js
+//#region ../sdk/src/endpoints/collections.ts
 var CollectionsEndpoint = class {
 	client;
 	constructor(client) {
@@ -42963,7 +42960,7 @@ var CollectionsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/entries.js
+//#region ../sdk/src/endpoints/entries.ts
 var EntriesEndpoint = class {
 	client;
 	constructor(client) {
@@ -43036,7 +43033,7 @@ var EntriesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/forms.js
+//#region ../sdk/src/endpoints/forms.ts
 var FormsEndpoint = class {
 	client;
 	constructor(client) {
@@ -43104,7 +43101,7 @@ var FormsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/assets.js
+//#region ../sdk/src/endpoints/assets.ts
 var AssetsEndpoint = class {
 	client;
 	constructor(client) {
@@ -43165,7 +43162,7 @@ var AssetsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/site.js
+//#region ../sdk/src/endpoints/site.ts
 var SiteEndpoint = class {
 	client;
 	constructor(client) {
@@ -43210,7 +43207,7 @@ var SiteEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/redirects.js
+//#region ../sdk/src/endpoints/redirects.ts
 const DASHBOARD_ONLY_REWRITE_MESSAGE = "Rewrite proxy rules can only be managed in the dashboard.";
 function rejectModeParam(data) {
 	if (data && typeof data === "object" && Object.prototype.hasOwnProperty.call(data, "mode")) throw new NeopressApiError("REDIRECT_RULE_DASHBOARD_ONLY", DASHBOARD_ONLY_REWRITE_MESSAGE, 400);
@@ -43271,7 +43268,7 @@ var RedirectsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/publish.js
+//#region ../sdk/src/endpoints/publish.ts
 var PublishEndpoint = class {
 	client;
 	constructor(client) {
@@ -43285,7 +43282,7 @@ var PublishEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/entry-references.js
+//#region ../sdk/src/endpoints/entry-references.ts
 var EntryReferencesEndpoint = class {
 	client;
 	constructor(client) {
@@ -43316,7 +43313,7 @@ var EntryReferencesEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/analytics.js
+//#region ../sdk/src/endpoints/analytics.ts
 const RESERVED_ANALYTICS_PARAMS = /* @__PURE__ */ new Set([
 	"pipe",
 	"site",
@@ -43401,7 +43398,7 @@ var AnalyticsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/templates.js
+//#region ../sdk/src/endpoints/templates.ts
 var TemplatesEndpoint = class {
 	client;
 	constructor(client) {
@@ -43443,7 +43440,7 @@ var TemplatesEndpoint = class {
 		if (siteIds.length === 0) return [];
 		const namePrefix = params?.namePrefix?.trim();
 		const limit = Math.min(Math.max(params?.limit ?? 100, 1), 500);
-		let query = this.client.db.from("templates").select("id, name, reference_url, preview_img_urls, description, created_at").in("id", siteIds);
+		let query = this.client.db.from("templates").select("id, name, reference_url, preview_img_urls, description, language, created_at").in("id", siteIds);
 		if (namePrefix) query = query.ilike("name", `${namePrefix}%`);
 		if (params?.order) query = query.order("created_at", { ascending: params.order === "asc" });
 		query = query.limit(limit);
@@ -43459,13 +43456,14 @@ var TemplatesEndpoint = class {
 				referenceUrl: t.reference_url,
 				previewImgUrls: t.preview_img_urls ?? null,
 				description: t.description ?? null,
+				language: t.language ?? null,
 				createdAt: t.created_at
 			};
 		});
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/headshots.js
+//#region ../sdk/src/endpoints/headshots.ts
 /**
 * headshot_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to
 * the super-admin user, so these direct-DB calls return empty/forbidden for any
@@ -43549,7 +43547,7 @@ var HeadshotsEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/endpoints/logos.js
+//#region ../sdk/src/endpoints/logos.ts
 /**
 * logo_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to the
 * super-admin user, so these direct-DB calls return empty/forbidden for any other
@@ -43639,7 +43637,7 @@ var LogosEndpoint = class {
 	}
 };
 //#endregion
-//#region ../sdk/dist/client.js
+//#region ../sdk/src/client.ts
 /**
 * @neopress/sdk — API Client
 *
@@ -43716,7 +43714,8 @@ var NeopressClient = class {
 	* header so RLS applies. No session persistence/refresh — token freshness is the
 	* caller's responsibility (CLI getClientAsync / MCP per-request).
 	*
-	* `@internal` (with `stripInternal`) keeps this out of the emitted declarations:
+	* `@internal` (with `stripInternal` in the cli/mcp dts configs — sdk itself no
+	* longer emits) keeps this out of the published declarations:
 	* it is plumbing for the endpoints in this package, and typing it publicly would
 	* drag `SupabaseClient` + the generated `Database` into the published `.d.ts` of
 	* `@neopress/cli` / `@neopress/mcp` — packages that declare no dependencies, so
@@ -43860,7 +43859,7 @@ function getSiteId(siteIdOverride) {
 	if (projectConfig.siteId) return projectConfig.siteId;
 	return loadSession().activeSiteId;
 }
-function setActiveSiteId(siteId) {
+async function setActiveSiteId(siteId) {
 	saveSession({
 		...loadSession(),
 		activeSiteId: siteId
@@ -43974,8 +43973,9 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - Reusable templates are normal Neopress sites marked by a \`templates\` metadata row.
 - \`templates.id\` equals \`sites.id\`.
 - Build layout, pages, collections, entries, forms, assets, compile, publish, and verify before marking a finished template.
-- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`previewImgUrls\` (at least one), and optional \`description\` and \`previewVideoUrl\`. The gallery card renders \`previewImgUrls[0]\` at rest and cross-fades to \`previewVideoUrl\` on hover, so the first preview image must be that video's first frame.
+- Use \`neopress_template_mark\` to create or update the metadata row with \`name\`, required \`referenceUrl\`, required \`language\`, required \`previewImgUrls\` (at least one), and optional \`description\` and \`previewVideoUrl\`. The gallery card renders \`previewImgUrls[0]\` at rest and cross-fades to \`previewVideoUrl\` on hover, so the first preview image must be that video's first frame.
 - \`referenceUrl\` is a single http(s) provenance URL. \`description\` is an optional summary of the template (max 150 characters).
+- \`language\` is the language the template's own content is written in, as a two-letter lowercase ISO 639-1 code (\`ko\`, \`en\`, \`es\`). Region locales like \`en-US\` are rejected.
 - Template metadata does not replace page TSX, CMS content, forms, or publish state.
 - Use \`neopress_template_delete\` only for explicit template-site hard deletion. It removes the metadata row and connected site.
 
@@ -43984,6 +43984,7 @@ Use these rules before generating pages, collection schemas, entries, forms, or
 - Dynamic pages require a collection, a page path like \`/blog/[slug]\`, a numeric \`collectionId\`, matching entries, entry publish, page compile, and site publish.
 - \`queryConfig\` is stored in page \`draftMeta.queryConfig\`.
 - Query labels become React props. Entry query results are flattened, so use \`post.body\` instead of \`post.data.body\`.
+- A query may include \`collectionWindow\` on an \`entries\` query for a dynamic detail route. Its label receives \`{ before, after, items }\`; each is a flattened-entry array around the current entry, and \`items\` combines both directions. Windows use \`published_at DESC, id DESC\`, allow 0–20 entries per direction, and may only declare that exact order. Use the exact configured label, never a guessed prop name. Optional \`matchFields\` compare raw anchor-snapshot fields only when the source field has a value.
 - Initial CMS data arrives through those injected query props. \`entryClient\`, when injected in reader/preview for a site handle, is only a client-side auxiliary for load-more/filter/get/create interactions after the initial render; do not use it for initial render or server data loading.
 - Use numeric \`collection_id\` filters. Runtime controls site, status, locale, deleted state, and published snapshots.
 
@@ -44043,6 +44044,198 @@ function toToolError(error) {
 		}]
 	};
 }
+var AssetImportError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AssetImportError";
+	}
+};
+function ipv4ToInt(address) {
+	const parts = address.split(".");
+	if (parts.length !== 4) return null;
+	let value = 0;
+	for (const part of parts) {
+		const octet = Number(part);
+		if (!Number.isInteger(octet) || octet < 0 || octet > 255) return null;
+		value = value * 256 + octet;
+	}
+	return value;
+}
+/**
+* Blocks every address that is not routable on the public internet. Includes
+* the ranges that matter for cloud metadata (169.254.0.0/16) and for reaching
+* back into our own VPC.
+*/
+function isBlockedAddress(address) {
+	const family = (0, node_net.isIP)(address);
+	if (family === 4) {
+		const value = ipv4ToInt(address);
+		if (value === null) return true;
+		const inRange = (cidrBase, bits) => {
+			const base = ipv4ToInt(cidrBase);
+			if (base === null) return false;
+			const mask = bits === 0 ? 0 : -1 << 32 - bits >>> 0;
+			return (value & mask) === (base & mask);
+		};
+		return inRange("0.0.0.0", 8) || inRange("10.0.0.0", 8) || inRange("100.64.0.0", 10) || inRange("127.0.0.0", 8) || inRange("169.254.0.0", 16) || inRange("172.16.0.0", 12) || inRange("192.0.0.0", 24) || inRange("192.168.0.0", 16) || inRange("198.18.0.0", 15) || inRange("224.0.0.0", 4) || inRange("240.0.0.0", 4);
+	}
+	if (family === 6) {
+		const normalized = address.toLowerCase().split("%")[0] ?? "";
+		const mapped = normalized.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+		if (mapped?.[1]) return isBlockedAddress(mapped[1]);
+		if (normalized === "::" || normalized === "::1") return true;
+		return normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb");
+	}
+	return true;
+}
+/**
+* Rejects non-public destinations. Resolving here (rather than trusting the
+* hostname) is what stops `metadata.internal`-style names and DNS entries that
+* deliberately point at private space.
+*/
+async function assertPublicUrl(rawUrl, resolver = defaultResolver) {
+	let url;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		throw new AssetImportError(`Not a valid URL: ${rawUrl}`);
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new AssetImportError(`Only http(s) URLs can be imported, got ${url.protocol}`);
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	const addresses = (0, node_net.isIP)(hostname) ? [hostname] : await resolver(hostname);
+	if (addresses.length === 0) throw new AssetImportError(`Could not resolve ${url.hostname}`);
+	for (const address of addresses) if (isBlockedAddress(address)) throw new AssetImportError(`Refusing to fetch ${url.hostname}: it resolves to the non-public address ${address}`);
+	return url;
+}
+async function defaultResolver(hostname) {
+	return (await (0, node_dns_promises.lookup)(hostname, { all: true }).catch(() => [])).map((record) => record.address);
+}
+/**
+* Fetches the URL with every hop validated, then reads the body under a hard
+* byte cap. `redirect: 'manual'` is deliberate: letting fetch follow redirects
+* would skip the address check on the hops in between.
+*/
+async function fetchImportableAsset(rawUrl, options) {
+	const maxBytes = options.maxBytes ?? 52428800;
+	let currentUrl = rawUrl;
+	for (let hop = 0; hop <= 3; hop += 1) {
+		const url = await assertPublicUrl(currentUrl, options.resolver);
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 3e4);
+		let response;
+		try {
+			response = await options.fetch(url.toString(), {
+				redirect: "manual",
+				signal: controller.signal
+			});
+		} finally {
+			clearTimeout(timer);
+		}
+		if (response.status >= 300 && response.status < 400) {
+			const location = response.headers.get("location");
+			if (!location) throw new AssetImportError(`Redirect from ${url.toString()} had no Location header`);
+			currentUrl = new URL(location, url).toString();
+			continue;
+		}
+		if (!response.ok) throw new AssetImportError(`Source responded ${response.status} ${response.statusText || ""}`.trim());
+		const declaredLength = Number(response.headers.get("content-length"));
+		if (Number.isFinite(declaredLength) && declaredLength > maxBytes) throw new AssetImportError(`Source is ${declaredLength} bytes, over the ${maxBytes} byte limit`);
+		return {
+			bytes: await readCapped(response, maxBytes),
+			contentType: (response.headers.get("content-type") || "").split(";")[0]?.trim() || "",
+			finalUrl: url.toString()
+		};
+	}
+	throw new AssetImportError(`Too many redirects (max 3)`);
+}
+/** Reads the body incrementally so a lying Content-Length cannot blow the cap. */
+async function readCapped(response, maxBytes) {
+	const reader = response.body?.getReader();
+	if (!reader) {
+		const buffer = new Uint8Array(await response.arrayBuffer());
+		if (buffer.byteLength > maxBytes) throw new AssetImportError(`Source exceeds the ${maxBytes} byte limit`);
+		return buffer;
+	}
+	const chunks = [];
+	let total = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		if (!value) continue;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			await reader.cancel().catch(() => {});
+			throw new AssetImportError(`Source exceeds the ${maxBytes} byte limit`);
+		}
+		chunks.push(value);
+	}
+	const merged = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		merged.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return merged;
+}
+/**
+* Derives a storage-safe file name. The source path is only a hint — anything
+* outside the allowed character set is dropped so a crafted URL cannot steer
+* the object key.
+*/
+function deriveImportFileName(finalUrl, contentType) {
+	const sanitized = decodeURIComponent(new URL(finalUrl).pathname.split("/").pop() || "").replace(/[^\w.-]/g, "").replace(/^\.+/, "");
+	if (sanitized && /\.[a-z0-9]{1,5}$/i.test(sanitized)) return sanitized.slice(0, 120);
+	const extension = extensionForContentType(contentType);
+	const stem = (sanitized || "imported-asset").slice(0, 100);
+	return extension ? `${stem}.${extension}` : stem;
+}
+function extensionForContentType(contentType) {
+	return {
+		"image/avif": "avif",
+		"image/gif": "gif",
+		"image/jpeg": "jpg",
+		"image/png": "png",
+		"image/svg+xml": "svg",
+		"image/webp": "webp",
+		"video/mp4": "mp4",
+		"application/pdf": "pdf",
+		"text/csv": "csv"
+	}[contentType.toLowerCase()] ?? null;
+}
+/**
+* Ceiling for the inline (base64) upload fallback. Enforced on the *decoded*
+* bytes: capping the base64 string instead would let a caller slip ~33% more
+* through, and the number that matters downstream is the object size.
+*
+* 1MB is a deliberate cost ceiling rather than a technical one. Inline bytes
+* traverse the model's context, so 1MB costs roughly 90K tokens — already
+* enough that a caller should reach for presign or URL import when it can.
+*/
+const MAX_INLINE_UPLOAD_BYTES = 1048576;
+/**
+* Decodes a base64 payload, tolerating a `data:` URL wrapper since models
+* routinely produce one. Rejects anything that is not valid base64: Buffer
+* silently drops invalid characters, so a corrupted payload would otherwise
+* upload as a truncated file instead of failing.
+*/
+function decodeInlineUpload(payload, maxBytes = MAX_INLINE_UPLOAD_BYTES) {
+	const dataUrl = payload.match(/^data:([^;,]*)(;base64)?,(.*)$/s);
+	const contentTypeHint = dataUrl?.[1]?.trim() || null;
+	const base64 = (dataUrl?.[3] ?? payload).replace(/\s/g, "");
+	if (base64.length === 0) throw new AssetImportError("base64Content is empty.");
+	if (!/^[A-Za-z0-9+/]*={0,2}$/.test(base64)) throw new AssetImportError("base64Content is not valid base64. Send the raw base64 of the file (a data: URL prefix is also accepted).");
+	const approximateBytes = Math.floor(base64.length * 3 / 4);
+	if (approximateBytes > maxBytes) throw new AssetImportError(oversizeMessage(approximateBytes, maxBytes));
+	const bytes = new Uint8Array(Buffer.from(base64, "base64"));
+	if (bytes.byteLength > maxBytes) throw new AssetImportError(oversizeMessage(bytes.byteLength, maxBytes));
+	return {
+		bytes,
+		contentTypeHint
+	};
+}
+function oversizeMessage(actual, maxBytes) {
+	return `Inline upload is ${Math.round(actual / 1024)}KB, over the ${Math.round(maxBytes / 1024)}KB limit. Inline bytes pass through the conversation and are expensive; use neopress_asset_presign (upload straight to storage) or neopress_asset_import_url (server fetches a public URL) instead.`;
+}
 //#endregion
 //#region src/tools.ts
 const siteIdShape = { siteId: number().int().positive().optional() };
@@ -44155,11 +44348,7 @@ function getToolMeta(tool) {
 	return {
 		securitySchemes: [{
 			type: "oauth2",
-			scopes: [
-				"neopress:read",
-				"neopress:write",
-				"offline_access"
-			]
+			scopes: []
 		}],
 		"openai/toolInvocation/invoking": `Running ${tool.title}`,
 		"openai/toolInvocation/invoked": `Finished ${tool.title}`
@@ -44237,7 +44426,7 @@ const toolDefinitions = [
 		handler: async (input, context, extra) => {
 			const selectedSiteId = asNumber(input, "siteId");
 			const site = await (await context.createClient({ siteId: selectedSiteId }, extra)).site.get();
-			context.setActiveSiteId(selectedSiteId, extra);
+			await context.setActiveSiteId(selectedSiteId, extra);
 			return {
 				siteId: selectedSiteId,
 				baseUrl: context.getBaseUrl(),
@@ -44274,7 +44463,7 @@ const toolDefinitions = [
 				language: asOptionalString(input, "language"),
 				placeholder: asOptionalBoolean(input, "placeholder")
 			});
-			if (input.select !== false) context.setActiveSiteId(site.id, extra);
+			if (input.select !== false) await context.setActiveSiteId(site.id, extra);
 			return site;
 		}
 	},
@@ -44312,12 +44501,13 @@ const toolDefinitions = [
 	{
 		name: "neopress_template_mark",
 		title: "Mark Site As Template",
-		description: "Create or update the template metadata row for a finished template site. The template id is the site id. Requires at least one previewImgUrl. The gallery card shows previewImgUrls[0] at rest and plays previewVideoUrl on hover, so pass the video together with its own first frame as the first preview image.",
+		description: "Create or update the template metadata row for a finished template site. The template id is the site id. Requires at least one previewImgUrl and a language. The gallery card shows previewImgUrls[0] at rest and plays previewVideoUrl on hover, so pass the video together with its own first frame as the first preview image.",
 		inputSchema: {
 			...siteIdShape,
 			name: string(),
 			description: string().max(150).optional(),
 			referenceUrl: httpUrlSchema,
+			language: string().regex(/^[a-z]{2}$/, "must be a two-letter ISO 639-1 language code (e.g. ko, en, es)").describe("Primary language of the template's own content, as a two-letter lowercase ISO 639-1 code (ko, en, es). Not a region locale like en-US."),
 			previewImgUrls: array(string()).min(1),
 			previewVideoUrl: httpUrlSchema.optional()
 		},
@@ -44326,6 +44516,7 @@ const toolDefinitions = [
 				name: asString(input, "name"),
 				description: asOptionalString(input, "description"),
 				referenceUrl: asString(input, "referenceUrl"),
+				language: asString(input, "language"),
 				previewImgUrls: input.previewImgUrls,
 				previewVideoUrl: asOptionalString(input, "previewVideoUrl")
 			});
@@ -45026,6 +45217,118 @@ const toolDefinitions = [
 			});
 		}
 	},
+	{
+		name: "neopress_asset_presign",
+		title: "Get Presigned Asset Upload URL",
+		description: "Preferred way to upload bytes you hold (a local file, a generated image): returns a short-lived URL to PUT the file straight to Neopress storage, then call neopress_asset_register with the returned publicUrl. Nothing passes through the conversation, so size and count cost you nothing. This requires your environment to reach the storage host directly — if that PUT is refused by a proxy or egress allowlist, fall back to neopress_asset_upload_base64. neopress_asset_upload_file does all three steps at once but only over a local (stdio) connection, since a remote server cannot read your filesystem.",
+		inputSchema: {
+			...siteIdShape,
+			fileName: string(),
+			contentType: string().optional(),
+			contentLength: number().int().positive(),
+			folder: string().optional()
+		},
+		handler: async (input, context, extra) => {
+			const client = await context.createClient({ siteId: siteId(input) }, extra);
+			const fileName = (0, node_path.basename)(asString(input, "fileName"));
+			const folder = asOptionalString(input, "folder") || "uploads";
+			return client.assets.presign({
+				fileKey: `${folder}/${Date.now()}-${fileName}`,
+				contentType: asOptionalString(input, "contentType") || getContentType(fileName),
+				contentLength: asNumber(input, "contentLength")
+			});
+		}
+	},
+	{
+		name: "neopress_asset_import_url",
+		title: "Import Asset From URL",
+		description: "Copy a publicly reachable file into Neopress storage and register it as an asset. Unlike neopress_asset_register — which only records an external URL and breaks when the source moves — this stores our own copy. The server does the fetching, so no bytes pass through the conversation.",
+		inputSchema: {
+			...siteIdShape,
+			sourceUrl: string().url(),
+			folder: string().optional(),
+			displayName: string().optional(),
+			altText: string().optional(),
+			description: string().optional(),
+			tags: array(string()).optional(),
+			metadata: optionalJsonObjectSchema
+		},
+		handler: async (input, context, extra) => {
+			const client = await context.createClient({ siteId: siteId(input) }, extra);
+			const fetched = await fetchImportableAsset(asString(input, "sourceUrl"), { fetch: context.fetch });
+			const fileName = deriveImportFileName(fetched.finalUrl, fetched.contentType);
+			const contentType = fetched.contentType || getContentType(fileName);
+			const folder = asOptionalString(input, "folder") || "uploads";
+			const { presignedUrl, publicUrl } = await client.assets.presign({
+				fileKey: `${folder}/${Date.now()}-${fileName}`,
+				contentType,
+				contentLength: fetched.bytes.byteLength
+			});
+			const uploadResponse = await context.fetch(presignedUrl, {
+				method: "PUT",
+				headers: { "Content-Type": contentType },
+				body: fetched.bytes
+			});
+			if (!uploadResponse.ok) throw new Error(`Asset upload failed: ${uploadResponse.status} ${uploadResponse.statusText}`);
+			return client.assets.register({
+				assetUrl: publicUrl,
+				displayName: asOptionalString(input, "displayName") || fileName,
+				mimeType: contentType,
+				size: fetched.bytes.byteLength,
+				altText: asOptionalString(input, "altText"),
+				description: asOptionalString(input, "description"),
+				tags: input.tags,
+				folderPath: folder,
+				metadata: input.metadata
+			});
+		}
+	},
+	{
+		name: "neopress_asset_upload_base64",
+		title: "Upload Asset Inline (base64)",
+		description: "Fallback upload for environments with no outbound network of their own: the bytes ride inside this tool call, so they travel over the connection your host already has instead of one you must open. Expensive — inline bytes pass through the conversation, so ~1MB costs roughly 90K tokens, and the limit is 1MB decoded. Reach for this only when neopress_asset_presign is refused by a proxy or egress allowlist, and prefer neopress_asset_import_url whenever the file already has a public URL.",
+		inputSchema: {
+			...siteIdShape,
+			fileName: string(),
+			base64Content: string(),
+			contentType: string().optional(),
+			folder: string().optional(),
+			displayName: string().optional(),
+			altText: string().optional(),
+			description: string().optional(),
+			tags: array(string()).optional(),
+			metadata: optionalJsonObjectSchema
+		},
+		handler: async (input, context, extra) => {
+			const client = await context.createClient({ siteId: siteId(input) }, extra);
+			const fileName = (0, node_path.basename)(asString(input, "fileName"));
+			const { bytes, contentTypeHint } = decodeInlineUpload(asString(input, "base64Content"));
+			const contentType = asOptionalString(input, "contentType") || contentTypeHint || getContentType(fileName);
+			const folder = asOptionalString(input, "folder") || "uploads";
+			const { presignedUrl, publicUrl } = await client.assets.presign({
+				fileKey: `${folder}/${Date.now()}-${fileName}`,
+				contentType,
+				contentLength: bytes.byteLength
+			});
+			const uploadResponse = await context.fetch(presignedUrl, {
+				method: "PUT",
+				headers: { "Content-Type": contentType },
+				body: bytes
+			});
+			if (!uploadResponse.ok) throw new Error(`Asset upload failed: ${uploadResponse.status} ${uploadResponse.statusText}`);
+			return client.assets.register({
+				assetUrl: publicUrl,
+				displayName: asOptionalString(input, "displayName") || fileName,
+				mimeType: contentType,
+				size: bytes.byteLength,
+				altText: asOptionalString(input, "altText"),
+				description: asOptionalString(input, "description"),
+				tags: input.tags,
+				folderPath: folder,
+				metadata: input.metadata
+			});
+		}
+	},
 	{
 		name: "neopress_asset_upload_file",
 		title: "Upload Local Asset File",