@neopress/mcp 1.3.1 → 1.5.0

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
+import { AddressInfo } from "node:net";
 import { Server } from "node:http";
+import { Redis } from "@upstash/redis";
 import { ServerNotification, ServerRequest } from "@modelcontextprotocol/sdk/types.js";
 import { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
-import { AddressInfo } from "node:net";
 //#region ../sdk/src/types.d.ts
 /**
  * @neopress/sdk — First-party API types
@@ -25,7 +26,7 @@ interface PaginatedResponse<T> {
   pagination: PaginationMeta;
 }
 /** Sort direction for list endpoints that support opt-in created_at ordering. */
-type SortOrder = 'asc' | 'desc';
+type SortOrder = "asc" | "desc";
 interface Site {
   id: number;
   name: string | null;
@@ -38,7 +39,7 @@ interface Site {
   localeConfig: {
     defaultLocale: string;
     locales: string[];
-    localePrefix?: 'as-needed';
+    localePrefix?: "as-needed";
   } | null;
   createdAt: string | null;
   updatedAt: string | null;
@@ -50,6 +51,8 @@ interface Template {
   referenceUrl: string;
   previewImgUrls: string[] | null;
   previewVideoUrl: string | null;
+  /** Primary language of the template's content, as an ISO 639-1 code (ko/en/es). */
+  language: string | null;
   createdAt: string | null;
 }
 interface TemplateListItem {
@@ -60,6 +63,7 @@ interface TemplateListItem {
   referenceUrl: string;
   previewImgUrls: string[] | null;
   description: string | null;
+  language: string | null;
   createdAt: string;
 }
 interface Page {
@@ -172,7 +176,7 @@ interface RedirectRule {
   siteId: number;
   source: string;
   destination: string;
-  mode: 'redirect' | 'proxy';
+  mode: "redirect" | "proxy";
   redirectType: number;
   includeChildren: boolean;
   preservePath: boolean;
@@ -258,7 +262,7 @@ interface AnalyticsDateRangeParams {
   limit?: number;
   params?: Record<string, AnalyticsQueryValue>;
 }
-type SearchConsoleDimension = 'query' | 'page' | 'country' | 'device';
+type SearchConsoleDimension = "query" | "page" | "country" | "device";
 interface SearchConsoleQueryParams {
   dateFrom: string;
   dateTo: string;
@@ -290,7 +294,7 @@ interface SearchConsoleQueryResult {
 interface PageListParams {
   page?: number;
   limit?: number;
-  status?: 'draft' | 'published';
+  status?: "draft" | "published";
   fields?: string[];
   /** When set, sort by created_at instead of path. */
   order?: SortOrder;
@@ -298,9 +302,9 @@ interface PageListParams {
 interface PageCreateParams {
   path: string;
   title?: string;
-  type?: 'static' | 'dynamic';
-  status?: 'draft' | 'published';
-  visibility?: 'public' | 'hidden';
+  type?: "static" | "dynamic";
+  status?: "draft" | "published";
+  visibility?: "public" | "hidden";
   draftTsx?: string;
   draftI18n?: unknown;
   draftPublicLocales?: string[] | null;
@@ -313,7 +317,7 @@ interface PageUpdateParams {
   title?: string;
   type?: string;
   status?: string;
-  visibility?: 'public' | 'hidden';
+  visibility?: string;
   draftTsx?: string;
   draftI18n?: unknown;
   draftPublicLocales?: string[] | null;
@@ -350,6 +354,12 @@ declare class CollectionsEndpoint {
     order?: SortOrder;
   }): Promise<Collection[]>;
   get(collectionId: number): Promise<Collection>;
+  /**
+   * Preset normalization (`normalizeCollectionPresetType` +
+   * `ensureCollectionPresetBaselineFields`) now runs server-side in
+   * `CollectionsApi.create`, which applies the identical pair in the identical
+   * order — the stored row is unchanged by the move to HTTP.
+   */
   create(data: CollectionCreateParams): Promise<Collection>;
   update(collectionId: number, data: Partial<CollectionCreateParams>): Promise<Collection>;
   delete(collectionId: number): Promise<void>;
@@ -358,10 +368,6 @@ declare class CollectionsEndpoint {
     draftSchema: unknown;
     prodSchema: unknown;
   }>;
-  /**
-   * Updates the collection's draft_schema directly in Supabase.
-   * validateApiCollectionSchema (app-local) is skipped — CLI/MCP callers are trusted.
-   */
   updateSchema(collectionId: number, schema: unknown): Promise<{
     collectionId: number;
     draftSchema: unknown;
@@ -373,7 +379,7 @@ declare class CollectionsEndpoint {
 interface EntryListParams {
   page?: number;
   limit?: number;
-  status?: 'draft' | 'published' | 'archived';
+  status?: "draft" | "published" | "archived";
   locale?: string;
   /** created_at sort direction. Defaults to 'desc' (newest first). */
   order?: SortOrder;
@@ -397,6 +403,7 @@ interface EntryUpdateParams {
 declare class EntriesEndpoint {
   private readonly client;
   constructor(client: NeopressClient);
+  private get basePath();
   list(collectionId: number, params?: EntryListParams): Promise<PaginatedResponse<Entry>>;
   get(entryId: number): Promise<Entry>;
   create(collectionId: number, data: EntryCreateParams): Promise<Entry>;
@@ -487,7 +494,12 @@ declare class AssetsEndpoint {
   }): Promise<PaginatedResponse<Asset>>;
   get(assetId: number): Promise<Asset>;
   register(data: AssetRegisterParams): Promise<Asset>;
-  update(assetId: number, data: Partial<Omit<AssetRegisterParams, 'assetUrl'>>): Promise<Asset>;
+  update(assetId: number, data: Partial<Omit<AssetRegisterParams, "assetUrl">>): Promise<Asset>;
+  /**
+   * Hard delete. The route additionally requires the caller to be the site
+   * owner, matching `assets_delete_policy` = `is_site_owner(site_id)` — the
+   * registry axes alone would have widened this (W7 mapping §3-B1).
+   */
   delete(assetId: number): Promise<void>;
   presign(data: AssetPresignParams): Promise<{
     presignedUrl: string;
@@ -498,6 +510,12 @@ declare class AssetsEndpoint {
 //#endregion
 //#region ../sdk/src/endpoints/site.d.ts
 interface SiteWithRole extends Site {
+  /** Project role of the caller on this site: "owner" | "admin" | "member". */
+  projectRole: string;
+  /**
+   * @deprecated Legacy site role derived from `projectRole` for backwards
+   * compatibility ("owner" | "admin" | "member"). Use `projectRole` instead.
+   */
   role: string;
 }
 interface SiteCreateParams {
@@ -505,18 +523,25 @@ interface SiteCreateParams {
   siteHandle?: string;
   prompt?: string;
   language?: string;
-  placeholder?: boolean;
 }
 declare class SiteEndpoint {
   private readonly client;
   constructor(client: NeopressClient);
+  /**
+   * Global (not site-scoped): lists the caller's own memberships, so it does not
+   * hang off `siteBasePath`. The membership + soft-delete filters that RLS used
+   * to apply now live in the route.
+   */
   list(params?: {
     order?: SortOrder;
   }): Promise<SiteWithRole[]>;
   get(): Promise<Site>;
   create(data: SiteCreateParams): Promise<Site>;
-  update(data: Partial<Pick<Site, 'name' | 'metadata' | 'localeConfig'>> & {
-    globalCss?: string;
+  /**
+   * Site settings only. The stylesheet is not here — it lives on the layout
+   * (`updateLayout({ draftGlobalCss })`), which is what the reader renders.
+   */
+  update(data: Partial<Pick<Site, "name" | "metadata" | "localeConfig">> & {
     instructions?: unknown;
   }): Promise<Site>;
   getLayout(): Promise<SiteLayout>;
@@ -544,11 +569,17 @@ interface RedirectCreateParams {
 declare class RedirectsEndpoint {
   private readonly client;
   constructor(client: NeopressClient);
+  private get basePath();
   list(params?: {
     order?: SortOrder;
   }): Promise<RedirectRule[]>;
   create(data: RedirectCreateParams): Promise<RedirectRule>;
-  private assertRedirectRuleWritable;
+  /**
+   * The proxy preflight that used to run here (`assertRedirectRuleWritable`)
+   * needs a DB read, so it moved into the route. Its two error codes —
+   * `REDIRECT_RULE_NOT_FOUND` and `REDIRECT_RULE_DASHBOARD_ONLY` — are returned
+   * by the server verbatim, so `NeopressApiError.code` is unchanged for callers.
+   */
   update(ruleId: number, data: Partial<RedirectCreateParams>): Promise<RedirectRule>;
   delete(ruleId: number): Promise<void>;
 }
@@ -576,6 +607,7 @@ interface EntryReferenceCreateParams {
 declare class EntryReferencesEndpoint {
   private readonly client;
   constructor(client: NeopressClient);
+  private get basePath();
   list(params?: EntryReferenceListParams): Promise<EntryReference[]>;
   create(data: EntryReferenceCreateParams): Promise<EntryReference>;
   delete(referenceId: number): Promise<void>;
@@ -606,6 +638,11 @@ interface TemplateMarkParams {
    * card cross-fades from poster to video, so the poster must be the video's
    * first frame. Omit to leave an existing value untouched; `null` clears it. */
   previewVideoUrl?: string | null;
+  /** Primary language of the template's content — required, ISO 639-1 lowercase
+   * two-letter code (`ko`, `en`, `es`). Region-qualified locales (`en-US`) are
+   * rejected: the gallery filters on this key and must not see one language
+   * under two spellings. */
+  language: string;
 }
 interface TemplateDeleteResult {
   siteId: number;
@@ -621,9 +658,8 @@ declare class TemplatesEndpoint {
   /**
    * List templates across the sites the caller can access.
    *
-   * Direct-DB: `templates` is public-read and `sites` RLS scopes the visible set
-   * (own active memberships, or all sites for the super admin), so no server
-   * route is needed — the two RLS-scoped queries reproduce the old handler.
+   * Global (not site-scoped) — the accessible-site set is resolved server-side,
+   * where RLS used to do it.
    */
   list(params?: {
     namePrefix?: string;
@@ -633,10 +669,10 @@ declare class TemplatesEndpoint {
 }
 //#endregion
 //#region ../sdk/src/endpoints/headshots.d.ts
-type HeadshotAgeBand = 'young' | 'middle';
-type HeadshotGender = 'male' | 'female';
-type HeadshotEthnicity = 'asian' | 'white' | 'black' | 'latino';
-type HeadshotAttire = 'formal' | 'casual';
+type HeadshotAgeBand = "young" | "middle";
+type HeadshotGender = "male" | "female";
+type HeadshotEthnicity = "asian" | "white" | "black" | "latino";
+type HeadshotAttire = "formal" | "casual";
 interface HeadshotListParams {
   page?: number;
   limit?: number;
@@ -685,9 +721,11 @@ interface HeadshotDeleteResult {
   deleted: true;
 }
 /**
- * headshot_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to
- * the super-admin user, so these direct-DB calls return empty/forbidden for any
- * other account. No site id is used.
+ * `headshot_pool` is a GLOBAL (not site-scoped) admin table, so these calls run
+ * over `/api/v1/headshots` — no `siteId` in the path — instead of the
+ * site-scoped `withAuth` routes (W7 T5). The routes gate on the super-admin
+ * user id, which is the same check the table's single RLS policy made; a
+ * non-super-admin now gets 403 where the direct-DB read returned an empty list.
  */
 declare class HeadshotsEndpoint {
   private readonly client;
@@ -700,8 +738,8 @@ declare class HeadshotsEndpoint {
 }
 //#endregion
 //#region ../sdk/src/endpoints/logos.d.ts
-type LogoType = 'wordmark' | 'lockup' | 'signature';
-type LogoTone = 'playful' | 'neutral' | 'serious';
+type LogoType = "wordmark" | "lockup" | "signature";
+type LogoTone = "playful" | "neutral" | "serious";
 interface LogoListParams {
   page?: number;
   limit?: number;
@@ -756,9 +794,11 @@ interface LogoDeleteResult {
   deleted: true;
 }
 /**
- * logo_pool is a GLOBAL (not site-scoped) admin table. RLS exposes it only to the
- * super-admin user, so these direct-DB calls return empty/forbidden for any other
- * account. No site id is used.
+ * `logo_pool` is a GLOBAL (not site-scoped) admin table, so these calls run over
+ * `/api/v1/logos` — no `siteId` in the path — instead of the site-scoped
+ * `withAuth` routes (W7 T5). The routes gate on the super-admin user id, which
+ * is the same check the table's single RLS policy made; a non-super-admin now
+ * gets 403 where the direct-DB read returned an empty list.
  */
 declare class LogosEndpoint {
   private readonly client;
@@ -771,28 +811,29 @@ declare class LogosEndpoint {
 }
 //#endregion
 //#region ../sdk/src/client.d.ts
+/**
+ * ⚠️ No `supabaseUrl` / `supabaseAnonKey`. This client speaks HTTP to
+ * `/api/v1/**` and nothing else — the direct-DB escape hatch (`client.db`) was
+ * removed in W7 so the seven tables it wrote to could have their
+ * `authenticated` write grants revoked
+ * (`docs/plan/2026-08-17-w7-sdk-retirement.md`). `check-dist-contract.mjs` in
+ * `@neopress/cli` / `@neopress/mcp` fails the build if either option returns.
+ */
 interface NeopressClientOptions {
   /** OAuth access token */
   accessToken?: string;
   /** Site ID to operate on */
   siteId: number | string;
-  /** Base URL (default: https://app.neopress.ai) — used by orchestration/analytics (HTTP) routes */
+  /** Base URL (default: https://app.neopress.ai) */
   baseUrl?: string;
   /** Request timeout in ms (default: 30000) */
   timeout?: number;
-  /** Supabase project URL — enables direct-DB reads/CRUD (transparent routing). */
-  supabaseUrl?: string;
-  /** Supabase anon key (paired with the user accessToken so RLS applies). */
-  supabaseAnonKey?: string;
 }
 declare class NeopressClient {
   private readonly baseUrl;
   private readonly accessToken;
   private readonly siteId;
   private readonly timeout;
-  private readonly supabaseUrl?;
-  private readonly supabaseAnonKey?;
-  private _db;
   readonly pages: PagesEndpoint;
   readonly collections: CollectionsEndpoint;
   readonly entries: EntriesEndpoint;
@@ -808,26 +849,6 @@ declare class NeopressClient {
   readonly logos: LogosEndpoint;
   constructor(options: NeopressClientOptions);
   get siteBasePath(): string;
-  /** Numeric site id for direct DB queries. */
-  get siteIdNumber(): number;
-  /**
-   * Authenticated user's profile id, decoded locally from the access token's
-   * JWT `sub` claim (no network round-trip). Returns null if there is no token
-   * or it cannot be parsed. Subsequent DB queries are RLS-protected, so a local
-   * decode is sufficient — no server-side validation is required here.
-   */
-  get authUserId(): string | null;
-  /** Mirror of v1 parsePagination(defaultLimit=20, maxLimit=100). */
-  resolvePagination(params?: {
-    page?: number;
-    limit?: number;
-  }): {
-    page: number;
-    limit: number;
-    offset: number;
-  };
-  /** Build the paginated envelope matching the v1 API. */
-  paginationMeta(page: number, limit: number, offset: number, totalCount: number): PaginationMeta;
   request<T>(method: string, path: string, body?: unknown): Promise<T>;
   get<T>(path: string): Promise<ApiResponse<T>>;
   getList<T>(path: string): Promise<PaginatedResponse<T>>;
@@ -850,7 +871,7 @@ interface ToolContext {
     size: number;
   };
   fetch: typeof fetch;
-  setActiveSiteId(siteId: number, extra?: ToolRequestExtra): void;
+  setActiveSiteId(siteId: number, extra?: ToolRequestExtra): Promise<void>;
   getBaseUrl(): string;
 }
 interface NeopressToolDefinition {
@@ -875,8 +896,8 @@ declare function createNeopressMcpServer(options?: NeopressMcpServerOptions): Mc
 //#endregion
 //#region src/remote/context.d.ts
 interface RemoteSiteSelectionStore {
-  get(userKey: string): number | undefined;
-  set(userKey: string, siteId: number): void;
+  get(userKey: string): Promise<number | undefined>;
+  set(userKey: string, siteId: number): Promise<void>;
 }
 interface RemoteToolContextOptions {
   baseUrl: string;
@@ -886,15 +907,14 @@ declare function createMemoryRemoteSiteSelectionStore(): RemoteSiteSelectionStor
 declare function createRemoteToolContext(options: RemoteToolContextOptions): ToolContext;
 //#endregion
 //#region src/remote/http-server.d.ts
-type RemoteMcpAuthMode = 'oauth' | 'none';
+type RemoteMcpAuthMode = "oauth" | "none";
 interface NeopressMcpHttpServerOptions {
   authMode?: RemoteMcpAuthMode;
   baseUrl?: string;
-  corsOrigins?: string[] | '*';
+  corsOrigins?: string[] | "*";
   fetch?: typeof fetch;
   host?: string;
-  oauthClientSecret?: string;
-  oauthProvider?: string;
+  openaiAppsChallengeToken?: string;
   port?: number;
   publicUrl?: string;
   siteSelectionStore?: RemoteSiteSelectionStore;