@neopress/mcp 1.4.0 → 1.5.0

package/integrations/submission-guide.md

@@ -1,11 +1,12 @@
 # Neopress 리모트 MCP — 등재까지 사람 가이드
 
-작성 2026-07-28. 대상: PR #782 머지 이후, Claude 커넥터 디렉토리 + ChatGPT 앱 디렉토리 등재까지.
-제출 폼에 넣을 값·문구는 전부 준비돼 있음 — `claude-remote/connector-draft.md`, `chatgpt/app-draft.md`를 열어 복사하면 된다.
+작성 2026-07-28. 2026-09-07 코드 기준: RS-only 전환은 이미 main에 반영돼 있다. 아래 인프라 절차는 신규 환경 구성·재검증용이며 현재 배포나 등재 완료를 의미하지 않는다.
+
+외부 서비스의 제출 자격·화면·심사 정책은 7월 조사 메모다. 실제 제출 시 각 서비스 공식 문서에서 다시 확인한다. 제출 초안은 `claude-remote/connector-draft.md`, `chatgpt/app-draft.md`에 있고, support URL·리뷰 환경·실제 OAuth 왕복 확인은 별도 완료가 필요하다.
 
 ## 이미 끝나 있는 것 (코드·문서 — 사람 액션 불요)
 
-- 리모트 MCP 서버(RS-only, Supabase OAuth 2.1 Server 기반), 동의 페이지, Redis 영속화, CI 배포 워크플로우, 도메인 검증 라우트(`/.well-known/openai-apps-challenge`), 계약 게이트 46건
+- 리모트 MCP 서버(RS-only, Supabase OAuth 2.1 Server 기반), 동의 페이지, Redis 영속화, CI 배포 워크플로우, 도메인 검증 라우트(`/.well-known/openai-apps-challenge`), `pnpm check:agent-contracts` 계약 게이트
 - 제출 컬래터럴: 리스팅 문구, OAuth 설정 명세, 툴 안전성 요약, 리뷰 테스트 프롬프트/케이스(양성 5·음성 3), privacy(`https://app.neopress.ai/en/privacy`)·terms(`/en/terms`) URL
 
 ## 지금 바로 시작해두면 좋은 것 (리드타임 있음 — 순서 무관)
@@ -17,7 +18,7 @@
 
 ## Phase 1 — 인프라 (머지 후, 약 30–60분)
 
-1. PR #782 머지.
+1. 배포할 main 커밋과 대상 환경을 확인한다. RS-only 코드 전환은 완료돼 있다.
 2. **Upstash Redis**: 인스턴스 준비(기존 재사용 가능) → `UPSTASH_REDIS_REST_URL`/`UPSTASH_REDIS_REST_TOKEN` 확보.
 3. **GitHub 설정**: 레포 Settings → Secrets에 `UPSTASH_REDIS_REST_URL`, `UPSTASH_REDIS_REST_TOKEN` (+ 나중에 `OPENAI_APPS_CHALLENGE_TOKEN`), Variables에 `NEOPRESS_MCP_PUBLIC_URL=https://mcp.neopress.ai`. ⚠️ 머지 직후 첫 자동 CI run은 secrets 없으면 실패가 정상 — 등록 후 재실행.
 4. **Supabase 대시보드** (프로젝트 gxrfyjmsmiakirmtzkmv): Authentication → **OAuth Server 활성 + Dynamic Client Registration 활성 + Authorization Path = `https://app.neopress.ai/oauth/consent`**.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neopress/mcp",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Neopress MCP server for first-party AI agents",
   "type": "module",
   "bin": {
@@ -37,8 +37,9 @@
     "tsdown": "^0.22.14",
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "vitest": "^4.1.5",
-    "@neopress/shared": "0.0.0",
-    "@neopress/sdk": "0.4.0"
+    "@neopress/logging": "0.0.0",
+    "@neopress/sdk": "0.4.0",
+    "@neopress/shared": "0.0.0"
   },
   "scripts": {
     "build": "NODE_OPTIONS=--max-old-space-size=4096 tsdown && node ./scripts/check-dist-contract.mjs",

package/scripts/check-dist-contract.mjs

@@ -3,15 +3,15 @@
 // for the rationale; the file-set invariant matters more here because
 // prepare-mcpb-package.mjs copies dist/bin.cjs alone into the Claude Desktop bundle,
 // so a shared chunk would produce an extension that breaks at runtime.
-import { readFileSync, readdirSync } from 'node:fs';
-import { builtinModules } from 'node:module';
-import path from 'node:path';
+import { readFileSync, readdirSync } from "node:fs";
+import { builtinModules } from "node:module";
+import path from "node:path";
 
-const packageRoot = path.resolve(import.meta.dirname, '..');
-const distDir = path.join(packageRoot, 'dist');
-const packageJson = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+const packageRoot = path.resolve(import.meta.dirname, "..");
+const distDir = path.join(packageRoot, "dist");
+const packageJson = JSON.parse(readFileSync(path.join(packageRoot, "package.json"), "utf8"));
 
-const expectedFiles = ['bin.cjs', 'http-bin.cjs', 'index.d.ts', 'index.js'];
+const expectedFiles = ["bin.cjs", "http-bin.cjs", "index.d.ts", "index.js"];
 const allowedBareImports = new Set(Object.keys(packageJson.dependencies ?? {}));
 // See the cli script: tsdown inlines a leaked third-party type instead of leaving a
 // dangling import, turning a loud failure into silent bloat. Current output is ~26KB.
@@ -24,13 +24,13 @@ const unexpected = actualFiles.filter((f) => !expectedFiles.includes(f));
 const missing = expectedFiles.filter((f) => !actualFiles.includes(f));
 if (unexpected.length > 0) {
   errors.push(
-    `dist has unexpected files: ${unexpected.join(', ')}\n` +
+    `dist has unexpected files: ${unexpected.join(", ")}\n` +
       `  Likely code splitting — give each entry its own config object in tsdown.config.ts.\n` +
-      `  dist/bin.cjs must stay self-contained: prepare-mcpb-package.mjs ships it alone.`
+      `  dist/bin.cjs must stay self-contained: prepare-mcpb-package.mjs ships it alone.`,
   );
 }
 if (missing.length > 0) {
-  errors.push(`dist is missing: ${missing.join(', ')}`);
+  errors.push(`dist is missing: ${missing.join(", ")}`);
 }
 
 // Every emitted bundle must have the workspace packages inlined. tsdown reports an
@@ -38,18 +38,18 @@ if (missing.length > 0) {
 // which would publish a binary carrying a bare require("@neopress/sdk") that no consumer
 // can resolve. Checking the .d.ts alone does not see this.
 for (const file of actualFiles.filter((f) => /\.(cjs|js|mjs)$/.test(f))) {
-  const bundle = readFileSync(path.join(distDir, file), 'utf8');
+  const bundle = readFileSync(path.join(distDir, file), "utf8");
   const leaked = [
     ...new Set(
-      [...bundle.matchAll(/(?:require\(|from\s*)["'](@neopress\/[^"']+)["']/g)].map((m) => m[1])
+      [...bundle.matchAll(/(?:require\(|from\s*)["'](@neopress\/[^"']+)["']/g)].map((m) => m[1]),
     ),
   ];
   if (leaked.length > 0) {
     errors.push(
-      `dist/${file} still imports workspace packages at runtime: ${leaked.join(', ')}\n` +
+      `dist/${file} still imports workspace packages at runtime: ${leaked.join(", ")}\n` +
         `  They must be bundled. tsdown only warns on unresolved imports, so a bare\n` +
         `  require would ship — sdk exports src directly, so this means the import failed\n` +
-        `  to resolve (renamed source file or export-map drift), not a missing prebuild.`
+        `  to resolve (renamed source file or export-map drift), not a missing prebuild.`,
     );
   }
 
@@ -57,7 +57,7 @@ for (const file of actualFiles.filter((f) => /\.(cjs|js|mjs)$/.test(f))) {
   // alone; the Docker runtime stage copies dist/ alone), so a declared
   // dependency left external is just as fatal there as a workspace leak — the
   // allowedBareImports pass above only protects the library entry.
-  if (file.endsWith('.cjs')) {
+  if (file.endsWith(".cjs")) {
     // The backtick lookbehind skips require literals inside codegen templates:
     // ajv's standalone-validator generator embeds `require("ajv/dist/...")` as
     // template text that never executes (the modules themselves are inlined).
@@ -66,29 +66,29 @@ for (const file of actualFiles.filter((f) => /\.(cjs|js|mjs)$/.test(f))) {
         [...bundle.matchAll(/(?<!`)require\(\s*["']([^"'./][^"']*)["']\s*\)/g)]
           .map((m) => m[1])
           .filter((specifier) => {
-            const name = specifier.replace(/^node:/, '').split('/')[0];
+            const name = specifier.replace(/^node:/, "").split("/")[0];
             return !builtinModules.includes(name);
-          })
+          }),
       ),
     ];
     if (bare.length > 0) {
       errors.push(
-        `dist/${file} requires packages at runtime: ${bare.join(', ')}\n` +
+        `dist/${file} requires packages at runtime: ${bare.join(", ")}\n` +
           `  This binary ships without node_modules — add the package to that entry's\n` +
-          `  deps.alwaysBundle in tsdown.config.ts.`
+          `  deps.alwaysBundle in tsdown.config.ts.`,
       );
     }
   }
 }
 
-const declarations = actualFiles.includes('index.d.ts')
-  ? readFileSync(path.join(distDir, 'index.d.ts'), 'utf8')
-  : '';
+const declarations = actualFiles.includes("index.d.ts")
+  ? readFileSync(path.join(distDir, "index.d.ts"), "utf8")
+  : "";
 if (declarations.length > maxDeclarationBytes) {
   errors.push(
     `dist/index.d.ts is ${Math.round(declarations.length / 1000)}KB, over the ${Math.round(maxDeclarationBytes / 1000)}KB ceiling\n` +
       `  A third-party type tree was probably inlined. Narrow the public surface\n` +
-      `  (@internal + stripInternal) rather than raising this number.`
+      `  (@internal + stripInternal) rather than raising this number.`,
   );
 }
 const specifiers = [
@@ -98,23 +98,51 @@ const specifiers = [
   ...[...declarations.matchAll(/\bimport\s*\(\s*["']([^"']+)["']\s*\)/g)].map((m) => m[1]),
 ];
 const unresolvable = [...new Set(specifiers)].filter((specifier) => {
-  if (specifier.startsWith('node:')) return false;
-  const packageName = specifier.startsWith('@')
-    ? specifier.split('/').slice(0, 2).join('/')
-    : specifier.split('/')[0];
+  if (specifier.startsWith("node:")) return false;
+  const packageName = specifier.startsWith("@")
+    ? specifier.split("/").slice(0, 2).join("/")
+    : specifier.split("/")[0];
   return !allowedBareImports.has(packageName);
 });
 if (unresolvable.length > 0) {
   errors.push(
-    `dist/index.d.ts imports that consumers cannot resolve: ${unresolvable.join(', ')}\n` +
+    `dist/index.d.ts imports that consumers cannot resolve: ${unresolvable.join(", ")}\n` +
       `  Allowed: node: builtins and this package's own dependencies.\n` +
-      `  Relative imports mean a type was not inlined; bare ones mean an undeclared dependency leaked.`
+      `  Relative imports mean a type was not inlined; bare ones mean an undeclared dependency leaked.`,
   );
 }
 
+// ── 3. The SDK client stays HTTP-only ───────────────────────────────────────
+// `NeopressClientOptions` is inlined into this .d.ts because the public surface
+// returns a `NeopressClient`. That makes the emitted declaration the enforceable
+// record of the option bag — assert the interface is still here (so the check
+// cannot go vacuous behind an export change) and that the direct-DB pair is not.
+const clientOptions = declarations.match(/interface NeopressClientOptions\s*\{([\s\S]*?)\n\}/);
+if (!clientOptions) {
+  errors.push(
+    `dist/index.d.ts no longer declares NeopressClientOptions\n` +
+      `  The W7 direct-DB guard reads that interface. If the surface legitimately\n` +
+      `  stopped exposing NeopressClient, re-point the guard instead of dropping it.`,
+  );
+} else {
+  const reopened = ["supabaseUrl", "supabaseAnonKey"].filter((member) =>
+    new RegExp(`^\\s*${member}\\??:`, "m").test(clientOptions[1]),
+  );
+  if (reopened.length > 0) {
+    errors.push(
+      `NeopressClientOptions re-declares direct-DB config: ${reopened.join(", ")}\n` +
+        `  The SDK must reach the API over HTTP only — assets/collections/entries/\n` +
+        `  entry_references/forms/pages/redirect_rules revoked their authenticated\n` +
+        `  write grants on that basis (docs/master/2026-09-07-billing-and-access.md).`,
+    );
+  }
+}
+
 if (errors.length > 0) {
-  console.error(`[check-dist-contract] ${packageJson.name} failed:\n\n${errors.join('\n\n')}\n`);
+  console.error(`[check-dist-contract] ${packageJson.name} failed:\n\n${errors.join("\n\n")}\n`);
   process.exit(1);
 }
 
-console.log(`[check-dist-contract] ${packageJson.name} ok — ${actualFiles.length} files, no unresolvable type imports`);
+console.log(
+  `[check-dist-contract] ${packageJson.name} ok — ${actualFiles.length} files, no unresolvable type imports`,
+);

package/scripts/prepare-mcpb-package.mjs

@@ -1,54 +1,48 @@
 #!/usr/bin/env node
-import {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  rmSync,
-  writeFileSync,
-} from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { copyFileSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 
-const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const distBin = resolve(packageRoot, 'dist/bin.cjs');
-const manifest = resolve(packageRoot, 'integrations/claude-desktop/manifest.json');
-const outDir = resolve(packageRoot, 'dist/mcpb/neopress');
-const outServerDir = resolve(outDir, 'server');
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const distBin = resolve(packageRoot, "dist/bin.cjs");
+const manifest = resolve(packageRoot, "integrations/claude-desktop/manifest.json");
+const outDir = resolve(packageRoot, "dist/mcpb/neopress");
+const outServerDir = resolve(outDir, "server");
 
 if (!existsSync(distBin)) {
-  console.error('Missing dist/bin.cjs. Run `pnpm --filter @neopress/mcp build` first.');
+  console.error("Missing dist/bin.cjs. Run `pnpm --filter @neopress/mcp build` first.");
   process.exit(1);
 }
 
 if (!existsSync(manifest)) {
-  console.error('Missing Claude Desktop MCPB manifest.');
+  console.error("Missing Claude Desktop MCPB manifest.");
   process.exit(1);
 }
 
 rmSync(outDir, { recursive: true, force: true });
 mkdirSync(outServerDir, { recursive: true });
 
-copyFileSync(manifest, resolve(outDir, 'manifest.json'));
-copyFileSync(distBin, resolve(outServerDir, 'bin.cjs'));
+copyFileSync(manifest, resolve(outDir, "manifest.json"));
+copyFileSync(distBin, resolve(outServerDir, "bin.cjs"));
 writeFileSync(
-  resolve(outDir, 'README.md'),
+  resolve(outDir, "README.md"),
   [
-    '# Neopress MCPB Draft',
-    '',
-    'This bundle stages the local Neopress stdio MCP server for Claude Desktop.',
-    '',
-    'Before installing, run `neopress login` so the MCP server can reuse and refresh',
-    'the first-party OAuth session. Alternatively, configure a short-lived OAuth',
-    'access token in the extension settings for testing only.',
-    '',
-    'To pack this directory:',
-    '',
-    '```bash',
-    'pnpm dlx @anthropic-ai/mcpb pack packages/mcp/dist/mcpb/neopress',
-    '```',
-    '',
-  ].join('\n'),
-  'utf-8'
+    "# Neopress MCPB Draft",
+    "",
+    "This bundle stages the local Neopress stdio MCP server for Claude Desktop.",
+    "",
+    "Before installing, run `neopress login` so the MCP server can reuse and refresh",
+    "the first-party OAuth session. Alternatively, configure a short-lived OAuth",
+    "access token in the extension settings for testing only.",
+    "",
+    "To pack this directory:",
+    "",
+    "```bash",
+    "pnpm dlx @anthropic-ai/mcpb pack packages/mcp/dist/mcpb/neopress",
+    "```",
+    "",
+  ].join("\n"),
+  "utf-8",
 );
 
 console.log(`Staged MCPB directory: ${outDir}`);