@neopress/mcp 1.3.1 → 1.5.0

package/integrations/README.md

@@ -18,12 +18,12 @@ to any external directory yet.
 - Local stdio MCP is ready for agents that can launch `neopress-mcp`.
 - Remote Streamable HTTP MCP is ready as a standalone server, pending deployment
   to a stable public HTTPS origin such as `https://mcp.neopress.ai/mcp`.
-- Production remote MCP requires a stable `NEOPRESS_MCP_OAUTH_CLIENT_SECRET` so
-  dynamically registered OAuth clients survive restarts and revisions.
+- Remote MCP is a pure Resource Server (RFC 9728): the OAuth 2.1 Authorization
+  Server is Supabase Auth, discovered from `authorization_servers` in the
+  protected resource metadata. Clients register and exchange tokens against
+  Supabase directly; consent is delegated to the Neopress app consent page.
 - Tool descriptors include required read/write/destructive/open-world
   annotations and short invocation status metadata for ChatGPT-compatible hosts.
-- Remote OAuth metadata advertises refresh-token continuity through
-  `offline_access` and supports dynamic public client registration.
 - Claude Desktop MCPB staging is prepared through
   `pnpm --filter @neopress/mcp mcpb:stage`.
 
@@ -35,9 +35,9 @@ to any external directory yet.
 - Prepare review/test credentials in a non-production Neopress workspace.
 - Run real client scans in ChatGPT Developer Mode and Claude remote connector
   settings after deployment.
-- Decide whether remote active site selection should stay in-memory or move to
-  a durable store. Until then, clients should pass `siteId` explicitly or call
-  `neopress_site_select` at the beginning of a session.
+- Enable the Supabase OAuth Server (toggle, dynamic client registration, and
+  the consent Authorization Path) per the human runbook, then run a real
+  end-to-end OAuth round-trip.
 
 ## Official References Checked
 

package/integrations/chatgpt/app-draft.md

@@ -1,7 +1,8 @@
 # ChatGPT MCP App Draft
 
-Submission state: draft only. This is prepared for Developer Mode testing and
-workspace review, not public submission.
+Submission state: collateral ready — pending human-only items. Listing copy,
+OAuth configuration, and review test cases below are submission-ready; the
+remaining work is the human-action rows in the Submission Checklist.
 
 ## App Metadata
 
@@ -13,9 +14,9 @@ workspace review, not public submission.
 | MCP endpoint | `https://mcp.neopress.ai/mcp` |
 | Authentication | OAuth |
 | Website | `https://app.neopress.ai` |
-| Privacy policy | TODO |
-| Terms | TODO |
-| Support | TODO |
+| Privacy policy | `https://app.neopress.ai/en/privacy` |
+| Terms | `https://app.neopress.ai/en/terms` |
+| Support | TODO (deferred decision) |
 
 ## Short Description
 
@@ -36,15 +37,24 @@ forms, and assets, then publish entries and sites after explicit confirmation.
 
 ## OAuth Configuration
 
-- Authorization server: `https://mcp.neopress.ai`
+The MCP endpoint is a pure Resource Server (RFC 9728); the OAuth 2.1
+Authorization Server is Supabase Auth, discovered from `authorization_servers`
+in the protected resource metadata.
+
 - Protected resource: `https://mcp.neopress.ai/mcp`
-- Authorization endpoint: `https://mcp.neopress.ai/oauth/authorize`
-- Token endpoint: `https://mcp.neopress.ai/oauth/token`
-- Dynamic registration endpoint: `https://mcp.neopress.ai/oauth/register`
-- Scopes: `neopress:read`, `neopress:write`, `offline_access`
+- Resource metadata: `https://mcp.neopress.ai/.well-known/oauth-protected-resource/mcp`
+- Authorization server issuer: `https://gxrfyjmsmiakirmtzkmv.supabase.co/auth/v1`
+- Authorization server metadata: `https://gxrfyjmsmiakirmtzkmv.supabase.co/.well-known/oauth-authorization-server/auth/v1`
+- Authorization endpoint: `https://gxrfyjmsmiakirmtzkmv.supabase.co/auth/v1/oauth/authorize`
+- Token endpoint: `https://gxrfyjmsmiakirmtzkmv.supabase.co/auth/v1/oauth/token`
+- Dynamic registration endpoint: `https://gxrfyjmsmiakirmtzkmv.supabase.co/auth/v1/oauth/clients/register`
+- Scopes: none advertised — consent shows a static description instead
+  ("This app manages sites with your Neopress account")
+- Consent: delegated by Supabase to `https://app.neopress.ai/oauth/consent`,
+  gated on the signed-in Neopress session
 - PKCE: required, S256 only
 - Token endpoint auth method: `none`
-- Refresh grant: supported
+- Refresh grant: supported by the Supabase token endpoint
 
 ## Tool Categories
 
@@ -87,10 +97,94 @@ forms, and assets, then publish entries and sites after explicit confirmation.
 8. Fetch the live page URLs outside ChatGPT and confirm 200 responses.
 9. Reopen the app after token expiry and confirm refresh-token continuity.
 
-## Submission Blockers
-
-- Deploy and verify `https://mcp.neopress.ai/mcp`.
-- Fill legal/support URLs.
-- Add a production icon and screenshots if requested by the review flow.
-- Prepare review credentials and a throwaway Neopress workspace.
+## Review Test Cases
+
+Submission requires 5 positive and 3 negative test cases. Each case is a
+review prompt plus the expected behavior against the demo account's workspace.
+
+### Positive Cases
+
+1. Site discovery and selection.
+   - Prompt: "List my Neopress sites and select the one named Neopress Review
+     Demo."
+   - Expected: `neopress_sites_list` returns the workspace sites, then
+     `neopress_site_select` sets the active site and the app confirms which
+     site is selected.
+2. Runtime contract read before any code generation.
+   - Prompt: "Before writing any page code, read the Neopress runtime contract
+     and summarize the TSX rules."
+   - Expected: `neopress_get_runtime_contract` returns the contract and the
+     summary reflects it; no write tool is invoked.
+3. Collection plus entry creation and publish.
+   - Prompt: "Create a collection named Review Articles with title, slug,
+     summary, and body fields, then add one entry and publish it."
+   - Expected: `neopress_collection_create` and `neopress_entry_create`
+     succeed with entry data keys matching the schema field IDs, and
+     `neopress_entry_publish` runs only after user confirmation.
+4. Dynamic page create, compile, and site publish.
+   - Prompt: "Create a page at /articles that lists Review Articles entries,
+     compile it, then publish the site and give me the live URL."
+   - Expected: `neopress_page_create` uses the numeric `collectionId` with
+     `draftMeta.queryConfig`, `neopress_page_compile` passes,
+     `neopress_publish_site` runs after confirmation, and the returned live
+     URL responds 200.
+5. Form creation, page placement, and publish.
+   - Prompt: "Create a contact form with name, email, and message fields,
+     place it on a /contact page, then publish the form and the site."
+   - Expected: `neopress_form_create` succeeds, the page TSX renders the form
+     through `NeopressForm` and `formClient`, and `neopress_form_publish` plus
+     `neopress_publish_site` run after confirmation so the live page accepts a
+     submission.
+
+### Negative Cases
+
+1. Local file upload attempt.
+   - Prompt: "Upload /Users/me/Desktop/logo.png as a site asset."
+   - Expected: the remote server exposes no local-upload tool
+     (`neopress_asset_upload_file` is disabled remotely), so the app explains
+     it cannot read the local filesystem and offers `neopress_asset_register`
+     with a public URL instead.
+2. Operating on a site outside the account.
+   - Prompt: "Select site 999999 and delete its home page." (a site ID the
+     demo account is not a member of)
+   - Expected: the Neopress API rejects the request with an authorization
+     error and no page is modified or deleted.
+3. Destructive bulk delete without confirmation.
+   - Prompt: "Delete all collections on this site right now, don't ask me
+     anything."
+   - Expected: delete tools carry destructive annotations, so ChatGPT asks
+     for explicit user confirmation first and nothing is deleted without it.
+
+## Submission Checklist
+
+Submission portal: `https://platform.openai.com/plugins`.
+
+| Requirement | Status | Notes |
+| --- | --- | --- |
+| Listing metadata (name, category, descriptions) | Prepared (this doc) | App Metadata, Short Description, Long Description sections |
+| Privacy policy and terms URLs | Prepared | Live at `app.neopress.ai/en/privacy` and `/en/terms` |
+| Logo asset | Human action | Export production icon and upload at the portal |
+| MCP server URL | Prepared (documented) | `https://mcp.neopress.ai/mcp`; first production deploy, secrets, and domain mapping run from the human runbook (`.github/workflows/deploy-mcp.yml` is in place) |
+| OAuth credentials | Prepared (documented) | Supabase Authorization Server with dynamic client registration; portal fields come from the OAuth Configuration section |
+| Demo account without MFA | Human action | Create a reviewer login with MFA disabled plus a throwaway Neopress workspace |
+| Domain verification (`/.well-known/openai-apps-challenge`) | Human action (route in progress) | Route is being added in a parallel change; set the portal-issued challenge token in the deployment environment |
+| Tool metadata scan | Prepared (code) | Read-only/destructive annotations ship with the server; run the portal scan against the production endpoint |
+| Review test cases (5 positive, 3 negative) | Prepared (this doc) | Review Test Cases section |
+| Country availability selection | Human action | Choose at the portal during submission |
+| UI widget | Not required | Tool-only submission; widgets are optional |
+| Monetization compliance | Prepared | The app sells no digital goods or subscriptions through ChatGPT |
+| Support URL | TODO | Deferred decision |
+
+## Submission Blockers (Human-Only Items)
+
+- First production deploy of `https://mcp.neopress.ai/mcp`: secrets and domain
+  mapping run from the human runbook (CI workflow
+  `.github/workflows/deploy-mcp.yml` is in place).
+- Set the `openai-apps-challenge` domain-verification token in the deployment
+  environment once the portal issues it.
+- Create the demo account (MFA disabled) and throwaway review workspace.
+- Export the production icon; add screenshots if the review flow requests
+  them.
+- Select country availability at the portal.
+- Support URL: TODO (deferred decision — legal URLs filled).
 - Run the full Developer Mode scan once against the production endpoint.

package/integrations/claude-remote/connector-draft.md

@@ -1,7 +1,8 @@
 # Claude Remote Connector Draft
 
-Submission state: draft only. Do not submit until the production MCP URL,
-privacy/support URLs, and test workspace are finalized.
+Submission state: collateral ready — pending human-only items. Listing copy,
+authentication details, and review prompts below are submission-ready; the
+remaining work is listed under Submission Blockers.
 
 ## Listing Metadata
 
@@ -12,9 +13,9 @@ privacy/support URLs, and test workspace are finalized.
 | Category | Productivity / Websites / CMS |
 | Remote MCP URL | `https://mcp.neopress.ai/mcp` |
 | Website | `https://app.neopress.ai` |
-| Support URL | TODO |
-| Privacy policy URL | TODO |
-| Terms URL | TODO |
+| Support URL | TODO (deferred decision) |
+| Privacy policy URL | `https://app.neopress.ai/en/privacy` |
+| Terms URL | `https://app.neopress.ai/en/terms` |
 
 ## Short Description
 
@@ -36,12 +37,26 @@ Neopress API on every request.
 
 ## Authentication
 
-- Type: OAuth 2.1 compatible authorization code with PKCE.
-- Registration: dynamic public client registration at `/oauth/register`.
-- Authorization metadata: `/.well-known/oauth-authorization-server`.
-- Resource metadata: `/.well-known/oauth-protected-resource/mcp`.
-- Scopes: `neopress:read`, `neopress:write`, `offline_access`.
-- Refresh: supported by `/oauth/token` with `grant_type=refresh_token`.
+The MCP server is a pure Resource Server (RFC 9728). The OAuth 2.1
+Authorization Server is Supabase Auth; clients discover it from
+`authorization_servers` in the resource metadata and run registration,
+authorization, and token exchange against Supabase directly.
+
+- Type: OAuth 2.1 authorization code with PKCE (S256).
+- Resource metadata:
+  `https://mcp.neopress.ai/.well-known/oauth-protected-resource/mcp`.
+- Authorization server metadata:
+  `https://gxrfyjmsmiakirmtzkmv.supabase.co/.well-known/oauth-authorization-server/auth/v1`.
+- Registration: Supabase dynamic client registration at
+  `https://gxrfyjmsmiakirmtzkmv.supabase.co/auth/v1/oauth/clients/register`.
+- Scopes: none advertised (`scopes_supported` is intentionally absent from the
+  resource metadata). The consent page shows a static description instead:
+  "This app manages sites with your Neopress account."
+- Consent: Supabase delegates authorization to the Neopress app consent page
+  (`https://app.neopress.ai/oauth/consent`), gated on the signed-in Neopress
+  session.
+- Refresh: supported by the Supabase token endpoint
+  (`grant_type=refresh_token`).
 
 ## Tool Safety Summary
 
@@ -63,11 +78,33 @@ Neopress API on every request.
 5. "Create a dynamic page for the entry, compile it, publish the site, and show the live URL."
 6. "Create a simple dashboard-managed contact form, publish it, add it to a page, and publish the site."
 
+## Submission Process
+
+- Submission portal:
+  `https://claude.ai/admin-settings/directory/submissions/new`.
+- Organization requirement: submitting requires a Claude Team or Enterprise
+  organization, and only an Owner of the primary organization can submit.
+- Review flow: an automated policy scan runs on submission; passing it lists
+  the connector in the directory as a Community connector.
+- Verified status: Community connectors are escalated to Verified based on
+  usage — there is no separate application to prepare for it here.
+- Review contact: `mcp-review@anthropic.com`.
+
 ## Submission Blockers
 
-- Deploy remote MCP to a stable HTTPS origin.
+Remaining human-only items:
+
+- First production deploy of `https://mcp.neopress.ai/mcp`: secrets and domain
+  mapping run from the human runbook (CI workflow
+  `.github/workflows/deploy-mcp.yml` is in place).
+- Submitter access: an Owner seat in the primary Claude Team/Enterprise
+  organization must perform the submission.
+- Prepare a non-production test site and review credentials.
 - Verify OAuth refresh behavior in Claude after a token expiry window.
-- Replace TODO legal/support URLs.
-- Prepare a non-production test site and test credentials for review.
-- Capture any required screenshots or screen recordings.
-- Decide whether to persist active site selection outside process memory.
+- Support URL: TODO (deferred decision — legal URLs filled).
+- Capture screenshots or screen recordings if the review flow requests them.
+
+Resolved:
+
+- Active site selection persistence — stored in Upstash Redis with a 30-day
+  TTL, no longer process memory.

package/integrations/submission-guide.md

@@ -0,0 +1,61 @@
+# Neopress 리모트 MCP — 등재까지 사람 가이드
+
+작성 2026-07-28. 2026-09-07 코드 기준: RS-only 전환은 이미 main에 반영돼 있다. 아래 인프라 절차는 신규 환경 구성·재검증용이며 현재 배포나 등재 완료를 의미하지 않는다.
+
+외부 서비스의 제출 자격·화면·심사 정책은 7월 조사 메모다. 실제 제출 시 각 서비스 공식 문서에서 다시 확인한다. 제출 초안은 `claude-remote/connector-draft.md`, `chatgpt/app-draft.md`에 있고, support URL·리뷰 환경·실제 OAuth 왕복 확인은 별도 완료가 필요하다.
+
+## 이미 끝나 있는 것 (코드·문서 — 사람 액션 불요)
+
+- 리모트 MCP 서버(RS-only, Supabase OAuth 2.1 Server 기반), 동의 페이지, Redis 영속화, CI 배포 워크플로우, 도메인 검증 라우트(`/.well-known/openai-apps-challenge`), `pnpm check:agent-contracts` 계약 게이트
+- 제출 컬래터럴: 리스팅 문구, OAuth 설정 명세, 툴 안전성 요약, 리뷰 테스트 프롬프트/케이스(양성 5·음성 3), privacy(`https://app.neopress.ai/en/privacy`)·terms(`/en/terms`) URL
+
+## 지금 바로 시작해두면 좋은 것 (리드타임 있음 — 순서 무관)
+
+| # | 액션 | 왜 먼저 |
+|---|------|--------|
+| A | **Claude Team/Enterprise 조직 확인** — 제출 포털(`claude.ai/admin-settings/directory/submissions/new`)은 Team/Enterprise 조직의 **기본 조직 Owner**만 접근 가능. 개인 플랜엔 메뉴 자체가 없음 | 조직이 없으면 개설/업그레이드에 시간 소요 |
+| B | **OpenAI 조직 identity 검증** — platform.openai.com에서 개발자/사업자 인증(미검증 = 리젝). 제출엔 Apps Management write 권한 필요 | 검증 심사가 며칠 걸릴 수 있음 |
+
+## Phase 1 — 인프라 (머지 후, 약 30–60분)
+
+1. 배포할 main 커밋과 대상 환경을 확인한다. RS-only 코드 전환은 완료돼 있다.
+2. **Upstash Redis**: 인스턴스 준비(기존 재사용 가능) → `UPSTASH_REDIS_REST_URL`/`UPSTASH_REDIS_REST_TOKEN` 확보.
+3. **GitHub 설정**: 레포 Settings → Secrets에 `UPSTASH_REDIS_REST_URL`, `UPSTASH_REDIS_REST_TOKEN` (+ 나중에 `OPENAI_APPS_CHALLENGE_TOKEN`), Variables에 `NEOPRESS_MCP_PUBLIC_URL=https://mcp.neopress.ai`. ⚠️ 머지 직후 첫 자동 CI run은 secrets 없으면 실패가 정상 — 등록 후 재실행.
+4. **Supabase 대시보드** (프로젝트 gxrfyjmsmiakirmtzkmv): Authentication → **OAuth Server 활성 + Dynamic Client Registration 활성 + Authorization Path = `https://app.neopress.ai/oauth/consent`**.
+5. **배포**: Actions → deploy-mcp → Run workflow (또는 로컬 `pnpm deploy:mcp`).
+6. **도메인**: `gcloud run domain-mappings create --service neopress-mcp-server --domain mcp.neopress.ai --region us-west1 --project inblog-ver-2` → 안내된 CNAME을 DNS에 등록.
+7. **확인**: `curl https://mcp.neopress.ai/healthz`(200), `curl https://gxrfyjmsmiakirmtzkmv.supabase.co/.well-known/oauth-authorization-server/auth/v1`(feature_disabled가 아닌 JSON), `curl https://mcp.neopress.ai/.well-known/oauth-protected-resource/mcp`.
+
+## Phase 2 — 실동작 검증 스파이크 (토글 후, 1회)
+
+이 단계는 저(에이전트)에게 "스파이크 돌려줘"라고 시키면 됨 — 사람은 결과 확인만.
+
+- MCP inspector(`npx @modelcontextprotocol/inspector`)로 `https://mcp.neopress.ai/mcp` 연결 → DCR→동의 페이지→토큰→툴 호출 E2E 왕복
+- OAuth 발급 토큰의 서명 alg 실측(ES256이면 JWKS 로컬 검증 전환 후보 — 등재 전 게이트)
+- DCR register 엔드포인트 rate limit 관찰 + 테스트 클라이언트 정리
+- Claude Code(`claude mcp add --transport http neopress https://mcp.neopress.ai/mcp`)와 ChatGPT Developer mode(Settings → Connectors → Advanced)로 각 클라이언트 실연결 확인
+
+## Phase 3 — 사람만 할 수 있는 결정·준비 2건
+
+1. **Support URL 확정** (현재 유일하게 비어 있는 리스팅 필드): 권장 = `mailto:support@neopress.ai`(수신 가능해야 함) 또는 Crisp 채팅이 뜨는 `https://app.neopress.ai`. 결정 후 저에게 알려주면 드래프트 2종에 반영.
+2. **리뷰어용 데모 계정 + 테스트 사이트**: 프로덕션에 리뷰 전용 계정 생성(**MFA 없이 로그인 가능해야 함** — OpenAI 요건), 테스트 사이트 1개 연결(실사용자 데이터 없는 것). 크리덴셜은 제출 폼에만 입력.
+
+## Phase 4 — Claude 커넥터 제출 (약 15분)
+
+1. Team/Enterprise **Owner 계정**으로 `claude.ai/admin-settings/directory/submissions/new` 접속.
+2. `connector-draft.md`의 값 그대로 입력: 이름/카테고리/설명/MCP URL(`https://mcp.neopress.ai/mcp`)/웹사이트/privacy/terms/support + 리뷰 테스트 프롬프트.
+3. 제출 → 자동 정책 스캔 통과 시 **Community 커넥터로 즉시 등재**됨(별도 심사 대기 없음). 이후 사용량 기반으로 Anthropic이 Verified 리뷰로 자동 에스컬레이션. 문의: mcp-review@anthropic.com.
+
+## Phase 5 — ChatGPT 앱 제출 (약 30분 + 심사 대기)
+
+1. 사전: Phase 2에서 Developer mode 연결이 이미 확인된 상태여야 함.
+2. **platform.openai.com/plugins**에서 제출 시작 → `app-draft.md`의 리스팅 값 입력(로고 이미지는 사람 준비 — 기존 브랜드 자산 사용).
+3. **도메인 검증**: 폼이 발급하는 challenge 토큰을 받아 → GitHub Secrets `OPENAI_APPS_CHALLENGE_TOKEN`에 등록 → deploy-mcp 재실행 → `curl https://mcp.neopress.ai/.well-known/openai-apps-challenge`가 토큰을 반환하는지 확인 → 폼에서 검증 진행.
+4. 데모 계정 크리덴셜, 테스트 케이스(app-draft의 양성 5·음성 3), 국가 가용성 입력 → 제출.
+5. 심사는 수동, 기간 미공표. ⚠️ 앱 내 디지털 상품/구독 판매 금지 — Neopress 유료 플랜 판매를 앱 안에서 유도하지 말 것(외부 웹사이트 결제는 무관).
+
+## 등재 후·병행 트랙 (원하면 저에게 시키면 되는 것)
+
+- JWKS 로컬 검증 전환(Phase 2 실측이 ES256이면), DCR 레지스트리 정리 runbook 작성
+- 셀프서브 등재: GitHub MCP Registry(`mcp-publisher` + DNS 검증), Cursor 딥링크+cursor.directory, Gemini CLI extension — 심사 없이 가능
+- Claude Code **Plugin Directory**(스킬+MCP 번들, 공개 GitHub repo 필수)는 별도 트랙 — `packages/ai-skills`를 공개 repo로 재포장할지 결정 필요

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neopress/mcp",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "Neopress MCP server for first-party AI agents",
   "type": "module",
   "bin": {
@@ -29,6 +29,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.25.2",
+    "@upstash/redis": "^1.34.0",
     "zod": "^4.1.12"
   },
   "devDependencies": {
@@ -36,7 +37,9 @@
     "tsdown": "^0.22.14",
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "vitest": "^4.1.5",
-    "@neopress/sdk": "0.4.0"
+    "@neopress/logging": "0.0.0",
+    "@neopress/sdk": "0.4.0",
+    "@neopress/shared": "0.0.0"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsdown && node ./scripts/check-dist-contract.mjs",

package/scripts/check-dist-contract.mjs

@@ -3,14 +3,15 @@
 // for the rationale; the file-set invariant matters more here because
 // prepare-mcpb-package.mjs copies dist/bin.cjs alone into the Claude Desktop bundle,
 // so a shared chunk would produce an extension that breaks at runtime.
-import { readFileSync, readdirSync } from 'node:fs';
-import path from 'node:path';
+import { readFileSync, readdirSync } from "node:fs";
+import { builtinModules } from "node:module";
+import path from "node:path";
 
-const packageRoot = path.resolve(import.meta.dirname, '..');
-const distDir = path.join(packageRoot, 'dist');
-const packageJson = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+const packageRoot = path.resolve(import.meta.dirname, "..");
+const distDir = path.join(packageRoot, "dist");
+const packageJson = JSON.parse(readFileSync(path.join(packageRoot, "package.json"), "utf8"));
 
-const expectedFiles = ['bin.cjs', 'http-bin.cjs', 'index.d.ts', 'index.js'];
+const expectedFiles = ["bin.cjs", "http-bin.cjs", "index.d.ts", "index.js"];
 const allowedBareImports = new Set(Object.keys(packageJson.dependencies ?? {}));
 // See the cli script: tsdown inlines a leaked third-party type instead of leaving a
 // dangling import, turning a loud failure into silent bloat. Current output is ~26KB.
@@ -23,13 +24,13 @@ const unexpected = actualFiles.filter((f) => !expectedFiles.includes(f));
 const missing = expectedFiles.filter((f) => !actualFiles.includes(f));
 if (unexpected.length > 0) {
   errors.push(
-    `dist has unexpected files: ${unexpected.join(', ')}\n` +
+    `dist has unexpected files: ${unexpected.join(", ")}\n` +
       `  Likely code splitting — give each entry its own config object in tsdown.config.ts.\n` +
-      `  dist/bin.cjs must stay self-contained: prepare-mcpb-package.mjs ships it alone.`
+      `  dist/bin.cjs must stay self-contained: prepare-mcpb-package.mjs ships it alone.`,
   );
 }
 if (missing.length > 0) {
-  errors.push(`dist is missing: ${missing.join(', ')}`);
+  errors.push(`dist is missing: ${missing.join(", ")}`);
 }
 
 // Every emitted bundle must have the workspace packages inlined. tsdown reports an
@@ -37,30 +38,57 @@ if (missing.length > 0) {
 // which would publish a binary carrying a bare require("@neopress/sdk") that no consumer
 // can resolve. Checking the .d.ts alone does not see this.
 for (const file of actualFiles.filter((f) => /\.(cjs|js|mjs)$/.test(f))) {
-  const bundle = readFileSync(path.join(distDir, file), 'utf8');
+  const bundle = readFileSync(path.join(distDir, file), "utf8");
   const leaked = [
     ...new Set(
-      [...bundle.matchAll(/(?:require\(|from\s*)["'](@neopress\/[^"']+)["']/g)].map((m) => m[1])
+      [...bundle.matchAll(/(?:require\(|from\s*)["'](@neopress\/[^"']+)["']/g)].map((m) => m[1]),
     ),
   ];
   if (leaked.length > 0) {
     errors.push(
-      `dist/${file} still imports workspace packages at runtime: ${leaked.join(', ')}\n` +
+      `dist/${file} still imports workspace packages at runtime: ${leaked.join(", ")}\n` +
         `  They must be bundled. tsdown only warns on unresolved imports, so a bare\n` +
         `  require would ship — sdk exports src directly, so this means the import failed\n` +
-        `  to resolve (renamed source file or export-map drift), not a missing prebuild.`
+        `  to resolve (renamed source file or export-map drift), not a missing prebuild.`,
     );
   }
+
+  // The .cjs binaries run without node_modules (the MCPB bundle ships bin.cjs
+  // alone; the Docker runtime stage copies dist/ alone), so a declared
+  // dependency left external is just as fatal there as a workspace leak — the
+  // allowedBareImports pass above only protects the library entry.
+  if (file.endsWith(".cjs")) {
+    // The backtick lookbehind skips require literals inside codegen templates:
+    // ajv's standalone-validator generator embeds `require("ajv/dist/...")` as
+    // template text that never executes (the modules themselves are inlined).
+    const bare = [
+      ...new Set(
+        [...bundle.matchAll(/(?<!`)require\(\s*["']([^"'./][^"']*)["']\s*\)/g)]
+          .map((m) => m[1])
+          .filter((specifier) => {
+            const name = specifier.replace(/^node:/, "").split("/")[0];
+            return !builtinModules.includes(name);
+          }),
+      ),
+    ];
+    if (bare.length > 0) {
+      errors.push(
+        `dist/${file} requires packages at runtime: ${bare.join(", ")}\n` +
+          `  This binary ships without node_modules — add the package to that entry's\n` +
+          `  deps.alwaysBundle in tsdown.config.ts.`,
+      );
+    }
+  }
 }
 
-const declarations = actualFiles.includes('index.d.ts')
-  ? readFileSync(path.join(distDir, 'index.d.ts'), 'utf8')
-  : '';
+const declarations = actualFiles.includes("index.d.ts")
+  ? readFileSync(path.join(distDir, "index.d.ts"), "utf8")
+  : "";
 if (declarations.length > maxDeclarationBytes) {
   errors.push(
     `dist/index.d.ts is ${Math.round(declarations.length / 1000)}KB, over the ${Math.round(maxDeclarationBytes / 1000)}KB ceiling\n` +
       `  A third-party type tree was probably inlined. Narrow the public surface\n` +
-      `  (@internal + stripInternal) rather than raising this number.`
+      `  (@internal + stripInternal) rather than raising this number.`,
   );
 }
 const specifiers = [
@@ -70,23 +98,51 @@ const specifiers = [
   ...[...declarations.matchAll(/\bimport\s*\(\s*["']([^"']+)["']\s*\)/g)].map((m) => m[1]),
 ];
 const unresolvable = [...new Set(specifiers)].filter((specifier) => {
-  if (specifier.startsWith('node:')) return false;
-  const packageName = specifier.startsWith('@')
-    ? specifier.split('/').slice(0, 2).join('/')
-    : specifier.split('/')[0];
+  if (specifier.startsWith("node:")) return false;
+  const packageName = specifier.startsWith("@")
+    ? specifier.split("/").slice(0, 2).join("/")
+    : specifier.split("/")[0];
   return !allowedBareImports.has(packageName);
 });
 if (unresolvable.length > 0) {
   errors.push(
-    `dist/index.d.ts imports that consumers cannot resolve: ${unresolvable.join(', ')}\n` +
+    `dist/index.d.ts imports that consumers cannot resolve: ${unresolvable.join(", ")}\n` +
       `  Allowed: node: builtins and this package's own dependencies.\n` +
-      `  Relative imports mean a type was not inlined; bare ones mean an undeclared dependency leaked.`
+      `  Relative imports mean a type was not inlined; bare ones mean an undeclared dependency leaked.`,
+  );
+}
+
+// ── 3. The SDK client stays HTTP-only ───────────────────────────────────────
+// `NeopressClientOptions` is inlined into this .d.ts because the public surface
+// returns a `NeopressClient`. That makes the emitted declaration the enforceable
+// record of the option bag — assert the interface is still here (so the check
+// cannot go vacuous behind an export change) and that the direct-DB pair is not.
+const clientOptions = declarations.match(/interface NeopressClientOptions\s*\{([\s\S]*?)\n\}/);
+if (!clientOptions) {
+  errors.push(
+    `dist/index.d.ts no longer declares NeopressClientOptions\n` +
+      `  The W7 direct-DB guard reads that interface. If the surface legitimately\n` +
+      `  stopped exposing NeopressClient, re-point the guard instead of dropping it.`,
+  );
+} else {
+  const reopened = ["supabaseUrl", "supabaseAnonKey"].filter((member) =>
+    new RegExp(`^\\s*${member}\\??:`, "m").test(clientOptions[1]),
   );
+  if (reopened.length > 0) {
+    errors.push(
+      `NeopressClientOptions re-declares direct-DB config: ${reopened.join(", ")}\n` +
+        `  The SDK must reach the API over HTTP only — assets/collections/entries/\n` +
+        `  entry_references/forms/pages/redirect_rules revoked their authenticated\n` +
+        `  write grants on that basis (docs/master/2026-09-07-billing-and-access.md).`,
+    );
+  }
 }
 
 if (errors.length > 0) {
-  console.error(`[check-dist-contract] ${packageJson.name} failed:\n\n${errors.join('\n\n')}\n`);
+  console.error(`[check-dist-contract] ${packageJson.name} failed:\n\n${errors.join("\n\n")}\n`);
   process.exit(1);
 }
 
-console.log(`[check-dist-contract] ${packageJson.name} ok — ${actualFiles.length} files, no unresolvable type imports`);
+console.log(
+  `[check-dist-contract] ${packageJson.name} ok — ${actualFiles.length} files, no unresolvable type imports`,
+);

package/scripts/deploy-cloud-run.sh

@@ -15,7 +15,6 @@ PUBLIC_URL="${NEOPRESS_MCP_PUBLIC_URL:-}"
 BASE_URL="${NEOPRESS_BASE_URL:-https://app.neopress.ai}"
 AUTH_MODE="${NEOPRESS_MCP_AUTH_MODE:-oauth}"
 CORS_ORIGINS="${NEOPRESS_MCP_CORS_ORIGINS:-}"
-OAUTH_PROVIDER="${NEOPRESS_MCP_OAUTH_PROVIDER:-google}"
 
 require_command() {
   if ! command -v "$1" >/dev/null 2>&1; then
@@ -27,6 +26,13 @@ require_command() {
 ensure_gcp_services_enabled() {
   require_command gcloud
 
+  # CI deployer SA has no serviceusage.serviceUsageAdmin; services are already
+  # enabled on this project, so CI sets SKIP_SERVICE_ENABLE=1.
+  if [[ "${SKIP_SERVICE_ENABLE:-0}" == "1" ]]; then
+    echo "Skipping GCP service enablement (SKIP_SERVICE_ENABLE=1)"
+    return
+  fi
+
   local services=(
     artifactregistry.googleapis.com
     cloudbuild.googleapis.com
@@ -125,17 +131,8 @@ env_vars=(
   "NODE_ENV=production"
   "NEOPRESS_BASE_URL=${BASE_URL}"
   "NEOPRESS_MCP_AUTH_MODE=${AUTH_MODE}"
-  "NEOPRESS_MCP_OAUTH_PROVIDER=${OAUTH_PROVIDER}"
 )
 
-if [[ -n "${NEOPRESS_MCP_OAUTH_CLIENT_SECRET:-}" ]]; then
-  env_vars+=("NEOPRESS_MCP_OAUTH_CLIENT_SECRET=${NEOPRESS_MCP_OAUTH_CLIENT_SECRET}")
-elif [[ "${service_exists}" == false ]]; then
-  echo "NEOPRESS_MCP_OAUTH_CLIENT_SECRET is required for first production remote MCP deploy." >&2
-  echo "Use a stable random value, for example: openssl rand -base64 32" >&2
-  exit 1
-fi
-
 if [[ -n "${PUBLIC_URL}" ]]; then
   env_vars+=("NEOPRESS_MCP_PUBLIC_URL=${PUBLIC_URL}")
 fi
@@ -152,14 +149,36 @@ if [[ -n "${NEOPRESS_SUPABASE_ANON_KEY:-}" ]]; then
   env_vars+=("NEOPRESS_SUPABASE_ANON_KEY=${NEOPRESS_SUPABASE_ANON_KEY}")
 fi
 
-env_arg="^~^$(IFS=~; echo "${env_vars[*]}")"
+if [[ -n "${UPSTASH_REDIS_REST_URL:-}" ]]; then
+  env_vars+=("UPSTASH_REDIS_REST_URL=${UPSTASH_REDIS_REST_URL}")
+fi
+
+if [[ -n "${UPSTASH_REDIS_REST_TOKEN:-}" ]]; then
+  env_vars+=("UPSTASH_REDIS_REST_TOKEN=${UPSTASH_REDIS_REST_TOKEN}")
+fi
+
+if [[ -n "${OPENAI_APPS_CHALLENGE_TOKEN:-}" ]]; then
+  env_vars+=("OPENAI_APPS_CHALLENGE_TOKEN=${OPENAI_APPS_CHALLENGE_TOKEN}")
+fi
+
+# A YAML env file instead of delimiter syntax: the "^~^k=v~k=v" form was
+# observed collapsing every pair into a single NODE_ENV value on the CI runner
+# (revisions 00001/00002 shipped one 276-char env var), which silently dropped
+# the Upstash credentials and NEOPRESS_MCP_PUBLIC_URL. --env-vars-file has no
+# delimiter to mis-parse; it replaces the full env set on every deploy, which
+# is the intent here (this array is the complete contract).
+env_file="$(mktemp)"
+trap 'rm -f "${env_file}"' EXIT
+for pair in "${env_vars[@]}"; do
+  printf '%s: "%s"\n' "${pair%%=*}" "${pair#*=}" >> "${env_file}"
+done
 
 if [[ "${service_exists}" == true ]]; then
   gcloud run services update "${SERVICE}" \
     --project "${PROJECT_ID}" \
     --region "${REGION}" \
     --image "${IMAGE}" \
-    --update-env-vars "${env_arg}"
+    --env-vars-file "${env_file}"
 else
   gcloud run deploy "${SERVICE}" \
     --project "${PROJECT_ID}" \
@@ -171,7 +190,7 @@ else
     --cpu 1 \
     --min-instances 0 \
     --max-instances 10 \
-    --set-env-vars "${env_arg}"
+    --env-vars-file "${env_file}"
 fi
 
 echo "Latest ready revision:"