@sync.so/mcp-server 0.1.3 → 0.2.0

package/README.md

@@ -1,118 +1,222 @@
-# Sync MCP Server
+# sync. MCP server
 
-An open-source [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server for the [Sync](https://sync.so) API. Gives AI agents — Claude Code, ChatGPT, Cursor, Codex, and any MCP-compatible client — the ability to create lipsync videos, manage assets, check generation status, and more.
+Connect your AI agent to [sync.](https://sync.so) to lip-sync videos, translate
+and dub them into other languages, clone voices, and manage assets and projects
+from a chat or a coding session.
 
-Tools are **auto-generated from the Sync OpenAPI spec** at startup. As new API endpoints ship, they become available to agents automatically — no server update needed.
+sync. hosts this server at **`https://mcp.sync.so/mcp`**. You sign in with your
+sync. account, so there is nothing to install and no API key to copy. Every merge
+to this repository's `main` deploys there.
 
-## Quick Start
+## Connect your agent
+
+### ChatGPT
+
+Open [sync. in ChatGPT](https://chatgpt.com/plugins/plugin_asdk_app_6a398355fbc08191a232e7eeeacb73d5)
+and connect your account. In ChatGPT, sync. Studio also opens inside the chat.
+
+### Claude (claude.ai and Claude Desktop)
+
+1. Open **Settings → Connectors** and choose **Add custom connector**.
+2. Name it `sync.` and set the URL to `https://mcp.sync.so/mcp`.
+3. Click **Connect** and sign in to sync.
 
 ### Claude Code
 
 ```bash
-claude mcp add sync -- npx -y @sync.so/mcp-server --api-key YOUR_API_KEY
+claude mcp add --transport http sync https://mcp.sync.so/mcp
 ```
 
-Or add to `.mcp.json` in your project root:
+Then run `/mcp` in Claude Code, select `sync` and sign in. Add `--scope user` to
+use it in every project.
 
-```json
-{
-  "mcpServers": {
-    "sync": {
-      "command": "npx",
-      "args": ["-y", "@sync.so/mcp-server"],
-      "env": {
-        "SYNC_API_KEY": "your-api-key"
-      }
-    }
-  }
-}
+### Codex
+
+```bash
+codex mcp add sync --url https://mcp.sync.so/mcp
+codex mcp login sync
 ```
 
-### Claude Desktop
+### Cursor
 
-Add to `claude_desktop_config.json`:
+Add to `.cursor/mcp.json` in a project, or `~/.cursor/mcp.json` for all projects:
 
 ```json
 {
   "mcpServers": {
-    "sync": {
-      "command": "npx",
-      "args": ["-y", "@sync.so/mcp-server"],
-      "env": {
-        "SYNC_API_KEY": "your-api-key"
-      }
-    }
+    "sync": { "url": "https://mcp.sync.so/mcp" }
   }
 }
 ```
 
-### Cursor
+Cursor asks you to sign in to sync. the first time it connects.
+
+### VS Code
 
-Add to `.cursor/mcp.json` in your project:
+Add to `.vscode/mcp.json`:
 
 ```json
 {
-  "mcpServers": {
-    "sync": {
-      "command": "npx",
-      "args": ["-y", "@sync.so/mcp-server"],
-      "env": {
-        "SYNC_API_KEY": "your-api-key"
-      }
-    }
+  "servers": {
+    "sync": { "type": "http", "url": "https://mcp.sync.so/mcp" }
   }
 }
 ```
 
-### Without an API key (interactive login)
+### Other clients
+
+Any client that supports remote MCP servers over Streamable HTTP with OAuth can
+use `https://mcp.sync.so/mcp`. The client registers itself, and you sign in to
+sync. in the browser.
+
+The server is listed in the [official MCP Registry](https://registry.modelcontextprotocol.io)
+as `io.github.synchronicity-labs/mcp-server`, so clients and directories that read
+the registry can find and add it. `server.json` is that listing.
 
-Omit `SYNC_API_KEY` and the server will start a device auth flow on first run:
+### Local server with an API key
+
+For clients without remote MCP support, and for scripts and CI, run the server
+locally over stdio with a sync. [API key](https://sync.so/docs/api-reference/guides/authentication):
+
+```bash
+claude mcp add sync -e SYNC_API_KEY=your-api-key -- npx -y @sync.so/mcp-server@latest
+```
+
+Or in a client's JSON config:
 
 ```json
 {
   "mcpServers": {
     "sync": {
       "command": "npx",
-      "args": ["-y", "@sync.so/mcp-server"]
+      "args": ["-y", "@sync.so/mcp-server@latest"],
+      "env": { "SYNC_API_KEY": "your-api-key" }
     }
   }
 }
 ```
 
-You'll be prompted to visit a URL and enter a code. After approval, the token is cached at `~/.config/sync/mcp-credentials.json`.
-
-## Getting an API Key
-
-1. Sign up at [sync.so](https://sync.so)
-2. Go to your dashboard settings
-3. Generate an API key
-
-See the [authentication guide](https://sync.so/docs/api-reference/guides/authentication) for details.
+Without `SYNC_API_KEY`, the server starts a device login on first run: visit the
+URL it prints and enter the code. The token is cached at
+`~/.config/sync/mcp-credentials.json`.
+
+npm releases are published separately from the hosted deploy and can lag behind
+it, so prefer the hosted server when your client supports it. `@latest` makes npx
+fetch the newest release when the client restarts the server; without it, npx can
+keep running an old cached copy.
+
+#### Update notice
+
+At startup a local server asks the npm registry for the latest version, at most once
+a day (the answer is cached in `~/.config/sync/mcp-update-check.json`). The check runs
+in the background with a two-second limit and never delays startup or a tool call; if
+it fails, nothing is shown. When a newer version exists, the server's instructions and
+the first tool result of the session tell the agent to ask you to restart with
+`npx -y @sync.so/mcp-server@latest` or switch to the hosted server.
+
+To turn it off, set `SYNC_MCP_UPDATE_CHECK=off` or pass `--no-update-check`. It is
+also skipped when `CI` is set, and the hosted server never checks.
+
+## What to ask
+
+Paste prompts like these into your agent. Asset IDs come from your sync. library.
+Links can be public media URLs or YouTube, TikTok, Instagram and Facebook videos.
+
+| Ask | What the agent does |
+| --- | --- |
+| "Lipsync video asset `<video-asset-id>` with audio asset `<audio-asset-id>`." | `lipsync_create` with the saved assets, then waits for the result |
+| "Lipsync https://example.com/talk.mp4 to https://example.com/voiceover.wav." | `lipsync_create` with public URLs |
+| "Translate https://www.youtube.com/watch?v=… to Spanish." | Imports the link with `assets_create`, quotes the cost, and after you confirm runs `dubbing_create` |
+| "Make video asset `<video-asset-id>` say “thanks for watching” in a calm narrator voice." | Picks a voice with `voices_list`, quotes the script, then `lipsync_create` with `script` |
+| "How many credits do I have left?" | `account_get-usage` |
+| "What did my last generation cost?" | Finds it in history and reads `generations_get-costs` |
+
+Translation, dubbing, speech previews and voice clones are quoted and confirmed
+with you before they start.
+
+### Agent skills
+
+Step-by-step workflows for these tools (lipsync, talking photos, dubbing, Edit Dialogue,
+campaigns, batches, troubleshooting and the API) are agent skills in
+[synchronicity-labs/skills](https://github.com/synchronicity-labs/skills). Install them
+in any agent with `npx skills add synchronicity-labs/skills`. The ChatGPT and Codex
+plugin ships them from a pinned commit of that repository; see
+[docs/chatgpt-plugin.md](docs/chatgpt-plugin.md).
+
+## Tools
+
+The hosted server exposes a curated set of tools to every client:
+
+| Area | Tools |
+| --- | --- |
+| Lip sync | `lipsync_create`, `lipsync_create-timeline`¹, `generations_estimate-cost`, `generations_get`, `generations_list`, `generations_get-continuation`, `generations_get-costs`, `models_list` |
+| Translation and dubbing | `dubbing_create`, `dubbing_get-options`, `translation-previews_estimate`, `translation-previews_create`, `translation-previews_get` |
+| Speech and voices | `speech-previews_create`, `speech-previews_get-options`, `speech-previews_get`, `voices_list`, `voices_clone` |
+| Edit Dialogue | `dialogue_get-options`, `dialogue_upload-source`, `dialogue-transcriptions_create`, `dialogue-transcriptions_get`, `dialogue-previews_create`, `dialogue-previews_get`, `dialogue-videos_estimate`, `dialogue-videos_create` |
+| Assets | `assets_create`, `assets_create-upload-url`, `assets_get`, `assets_list`, `assets_count`, `assets_get-download-url`, `assets_update`, `assets_delete`, `assets_get-playback-metadata`, `audio-trims_get`, `audio-trims_create` |
+| Projects | `projects_create`, `projects_get`, `projects_list`, `projects_list-generations`, `projects_rename` |
+| Batches | `batches_create`², `batches_get`², `batches_list`² |
+| Account | `account_get-context`, `account_get-usage`, `organizations_list`, `organizations_select` |
+
+¹ Not offered to the ChatGPT app, whose embedded Studio has no timeline.
+
+² Not in the ChatGPT app listing yet. A batch runs 20 or more independent generations
+(500 per batch by default), such as one campaign video localized into many languages.
+Where the account's plan doesn't include batch, the API answers 402 with `requiredPlan`
+and `billingUrl`, which the tools pass on.
+
+Organizations with the matching feature also get `scenes_detect` (camera cuts in a
+video) and `stems_separate` (vocals and background audio), outside the ChatGPT
+app. They are in the `lipsync` and `assets` toolsets locally.
+
+Clients with app support also get the tools behind the embedded Studio app:
+Studio views and drafts, the upload widget and app helpers. Those are clients
+whose MCP handshake name selects the ChatGPT or Codex app profile (`openai-mcp`,
+`openai-mcp (Codex)`; see `src/client-profile.ts`). Other clients don't see these
+tools, and their calls to them are refused.
+
+### Local toolsets
+
+The local stdio server can also offer a tool for every other public API operation in
+the [OpenAPI spec](https://api.sync.so/api-json), 65+ in all. By default it lists the
+hosted set above, without its admin tools (`assets_delete` and `voices_clone`),
+plus `jobs_get` and `jobs_wait` and the `transcriptions_*` tools, whose speaker face
+tracks feed `lipsync_create-timeline` clips.
+
+To list more, set `SYNC_MCP_TOOLSETS` or pass `--toolsets` with a comma-separated list:
+
+| Toolset | Adds |
+| --- | --- |
+| `default` | The default above, so `default,admin` adds the admin tools to it |
+| `lipsync` | Lip sync, timeline, Edit Dialogue, audio trim and batch tools, plus raw `generate_*`, `generations_*` and `dialogue-edits_*` |
+| `dubbing` | Translation and dubbing tools, and the batch tools |
+| `assets` | `assets_*` (except deletes) and the upload tools |
+| `projects` | `projects_*` (except deletes) and `projects_rename` |
+| `transcription` | `transcriptions_*` |
+| `voices` | `voices_*` (except cloning and deletes), speech previews and `tts_*` |
+| `admin` | Every delete (`assets_delete`, `projects_delete`, `generations_delete`, `voices_delete`) and `voices_clone` |
+| `all` | Every tool, as before this option existed |
+
+Job, account and generation reads (`jobs_get`, `jobs_wait`, `generations_get`,
+`account_get-context`, `organizations_list`, `organizations_select` and similar) come with
+every selection. Naming toolsets replaces
+the default rather than adding to it. To get every tool back:
 
-## Available Tools
-
-Tools are dynamically generated from the Sync API. Core tools include:
-
-| Tool | Description |
-|------|-------------|
-| `generate_create-generation` | Create a lipsync video from video + audio inputs |
-| `generate_get-generation` | Get generation status — poll until COMPLETED |
-| `models_get-public` | List available lipsync models |
-| `assets_get-all` | List all assets in your organization |
-| `assets_get` | Get a specific asset by ID |
-| `generations_estimate` | Estimate generation cost before creating |
-
-Plus every other public endpoint in the [Sync API](https://sync.so/docs/api-reference).
+```bash
+claude mcp add sync -e SYNC_API_KEY=your-api-key -e SYNC_MCP_TOOLSETS=all -- npx -y @sync.so/mcp-server@latest
+```
 
-## Example Prompts
+Unless it lists everything, the server's instructions tell the agent which toolsets are
+listed and how to get the rest, so it can ask you to restart the server with a wider
+set. The hosted server ignores this setting.
 
-Once configured, ask your AI agent:
+[Tool workflows](docs/tool-workflows.md) describes how the multi-step and paid
+tools behave.
 
-- *"List available Sync models"*
-- *"Create a lipsync video with this video URL and audio URL using the lipsync-2 model"*
-- *"Check the status of generation gen-abc123"*
-- *"Show me my recent generations"*
-- *"How much would it cost to generate a 30-second video?"*
+Tool names follow one `<noun>_<verb>` scheme (`lipsync_create`, `generations_get`).
+The names used before it (`create-lipsync`, `generate_get-generation`) still work for a
+deprecation period: calls through them run the same tool and add a one-line notice
+naming the new one. [Tool names](docs/tool-names.md) has the full old → new table.
 
 ## CLI Options
 
@@ -124,25 +228,51 @@ Options:
   --base-url <url>    API base URL (default: https://api.sync.so)
   --transport <type>  stdio (default) or http
   --port <port>       HTTP port (default: 3002, only with --transport http)
+  --no-spend-confirmation
+                      Unattended automation: drop the cost-quote and confirm-before-paying
+                      instructions (or set SYNC_MCP_SPEND_CONFIRMATION=off)
+  --no-update-check   Skip the daily npm check for a newer version (or set
+                      SYNC_MCP_UPDATE_CHECK=off; skipped when CI is set)
+  --toolsets <list>   stdio only: comma-separated tools to list (or set SYNC_MCP_TOOLSETS):
+                      default, lipsync, dubbing, assets, projects, transcription,
+                      voices, admin or all (default: the hosted set without admin)
   -h, --help          Show this help message
 ```
 
-### Environment Variables
+### Unattended automation
+
+By default the tools tell the agent to quote a paid action and wait for the user's
+approval. When the server runs a pipeline or a scheduled agent whose operator has already
+approved spending, start it with `--no-spend-confirmation` (or
+`SYNC_MCP_SPEND_CONFIRMATION=off`). The agent then creates jobs without quoting or asking,
+and estimate tools stay available. Agents cannot change this setting.
 
-| Variable | Description | Default |
-|----------|-------------|---------|
-| `SYNC_API_KEY` | Your Sync API key | — |
-| `SYNC_BASE_URL` | API base URL | `https://api.sync.so` |
+Job tools take `wait: true` to wait on the server (up to about 50 seconds per call, with
+progress notifications when the client sends a `progressToken`): `generations_get`,
+`translation-previews_get`, `transcriptions_get` and social imports
+through `assets_create`. On the local server, `jobs_wait` and `jobs_get` do the same for
+every kind of job (generation, transcription, speaker analysis, translation preview,
+import) with one input, `{kind, id, projectId?}`, and one result shape and status set;
+see [Jobs](docs/jobs.md).
+
+When the API offers it, `feedback_send` lets agents report confusing errors, wrong results
+and missing capabilities to the Sync team.
+
+Environment variables and the HTTP server's session, memory, upload and
+diagnostics limits are in [HTTP server configuration](docs/http-server.md).
 
 ## How It Works
 
-1. On startup, the server fetches the OpenAPI spec from `{baseUrl}/api-json`
-2. Parses all public endpoints into operation definitions
-3. Converts each operation into an MCP tool with a Zod input schema
-4. Registers tools on the MCP server
-5. Each tool call makes an authenticated HTTP request to the Sync API
+1. At startup, the server fetches the public OpenAPI spec from `{baseUrl}/api-json`
+   and turns each operation into an MCP tool with a Zod input schema.
+2. Hand-written tools add multi-step workflows on the same API, such as translate
+   and dub, Edit Dialogue, speech previews and cost lookups.
+3. Each tool call is an authenticated request to the sync. API, with your OAuth
+   token (hosted) or API key (local).
 
-This means **new API endpoints are automatically available** — just restart the MCP server.
+Over stdio, a new public API operation becomes a tool on the next restart. The
+hosted server only exposes tools on its allowlist, so a new hosted tool ships with
+a release of this repository.
 
 ## Programmatic Usage
 
@@ -157,25 +287,70 @@ const server = await createSyncMcpServer(config);
 
 ## Development
 
+HTTPS source tests use the local `openssl` command to create a one-day, self-signed
+test identity. Temporary certificate and key files are removed before the tests run.
+
 ```bash
 # Install dependencies
-npm install
+pnpm install
 
 # Build
-npm run build
+pnpm run build
 
 # Run tests
-npm test
+pnpm test
 
 # Lint
-npm run lint
+pnpm run lint
 
 # Type check
-npm run typecheck
+pnpm run typecheck
+
+# Script tests (monitor, smoke check, pre-commit size check)
+pnpm run test:scripts
 ```
 
+Development needs Node 26 or newer (`.nvmrc`); `devEngines` in `package.json`
+enforces it on install. `pnpm install` installs a pre-commit hook. It runs Oxlint and Oxfmt on staged
+files, and blocks a staged source file that grows past 5,000 tokens (20,000
+bytes). Files already over that size are exempt until someone splits them.
+
+### Local HTTP Transport Testing
+
+To test the HTTP transport (OAuth flow) locally:
+
+1. Copy `.env.example` to `.env` and fill in the values
+2. Start a tunnel to expose localhost:
+   ```bash
+   ngrok http 3002
+   ```
+3. Update `MCP_ISSUER_URL` in `.env` with the ngrok URL
+4. Start the server:
+   ```bash
+   source .env
+   node dist/cli.js --transport http --base-url $SYNC_BASE_URL --port 3002
+   ```
+5. Verify it works:
+   ```bash
+   curl https://<ngrok-url>/health
+   curl https://<ngrok-url>/.well-known/oauth-authorization-server
+   ```
+When an isolated Studio login requires the same-origin web proxy, set
+`SYNC_OAUTH_AUTHORIZATION_URL` to its `/api-proxy/v2/oauth/authorize` URL, while
+keeping `SYNC_BASE_URL` on the direct isolated API listener. Only browser
+navigation uses the web proxy. Registration, code exchange, refresh, revocation,
+userinfo and tool calls use the direct API and retain existing deadlines,
+PKCE and confidential-client checks. The optional URL must use HTTP(S), with no
+credentials, query or fragment. Existing deployments need no new setting.
+
+6. Add `https://<ngrok-url>/mcp` as a custom connector in [Claude Web](https://claude.ai)
+
 ## Learn More
 
+- [Tool workflows](docs/tool-workflows.md) — How multi-step and paid tools behave
+- [HTTP server configuration](docs/http-server.md) — Environment variables and runtime limits
+- [Maintainer notes](docs/maintainers.md) — Hosted compatibility, cancellation, OAuth proxy, uploads and monitoring
+- [Claude directory readiness](docs/claude-directory-readiness.md) — Review checklist and remaining submission work
 - [Sync Documentation](https://sync.so/docs) — Full API reference and guides
 - [Sync API Reference](https://sync.so/docs/api-reference) — Endpoint documentation
 - [MCP Protocol](https://modelcontextprotocol.io) — Learn about the Model Context Protocol

package/deploy/generation-status/release.json

@@ -0,0 +1,6 @@
+{
+  "repository": "synchronicity-labs/sync-api-v2",
+  "commit": "7128911c4c60a89f43b179510d88d394843084bc",
+  "htmlSha256": "b7a9f3ca4342be59c3d037c0fde58668fea441820e9dbf321bc145775ecfe795",
+  "htmlBytes": 771668
+}

package/dist/abort-signals.d.ts

@@ -0,0 +1,6 @@
+/** Compose cancellation on every supported Node runtime; dispose listeners after work. */
+export declare function combineSignals(signals: AbortSignal[]): {
+    signal: AbortSignal;
+    dispose: () => void;
+};
+//# sourceMappingURL=abort-signals.d.ts.map

package/dist/abort-signals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort-signals.d.ts","sourceRoot":"","sources":["../src/abort-signals.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG;IACtD,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAoBA"}

package/dist/abort-signals.js

@@ -0,0 +1,23 @@
+/** Compose cancellation on every supported Node runtime; dispose listeners after work. */
+export function combineSignals(signals) {
+    const controller = new AbortController();
+    const listeners = new Map();
+    const dispose = () => {
+        for (const [signal, listener] of listeners)
+            signal.removeEventListener('abort', listener);
+        listeners.clear();
+    };
+    for (const signal of signals) {
+        const abort = () => {
+            controller.abort(signal.reason);
+            dispose();
+        };
+        if (signal.aborted) {
+            abort();
+            break;
+        }
+        listeners.set(signal, abort);
+        signal.addEventListener('abort', abort, { once: true });
+    }
+    return { signal: controller.signal, dispose };
+}

package/dist/account-features.d.ts

@@ -0,0 +1,7 @@
+import type { Tool } from '@modelcontextprotocol/server';
+import type { HttpClient } from './http-client.js';
+import { type OrganizationSession } from './organization-selection.js';
+export declare function isFeatureGatedTool(name: string): boolean;
+/** The descriptors this organization may see; reads features only when a gated tool is listed. */
+export declare function listedForAccount(descriptors: Tool[], session: OrganizationSession, http: HttpClient): Promise<Tool[]>;
+//# sourceMappingURL=account-features.d.ts.map

package/dist/account-features.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-features.d.ts","sourceRoot":"","sources":["../src/account-features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,KAAK,mBAAmB,EAA4B,MAAM,6BAA6B,CAAC;AAcjG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAmCD,kGAAkG;AAClG,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,IAAI,EAAE,EACnB,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,IAAI,EAAE,CAAC,CAMjB"}

package/dist/account-features.js

@@ -0,0 +1,48 @@
+import { runInOrganizationSession } from './organization-selection.js';
+import { parseAccountOverview } from './tools/organizations.js';
+/**
+ * Tools listed only when the active organization's GET /v2/account `features` names the
+ * feature: their API routes are behind server-side flags, so other accounts would only get a
+ * 404. A tool call is not refused here; the API stays the authority, and the tool reports
+ * its 404.
+ */
+const TOOL_FEATURES = {
+    scenes_detect: 'scene_detection',
+    stems_separate: 'stem_separation',
+};
+export function isFeatureGatedTool(name) {
+    return Object.hasOwn(TOOL_FEATURES, name);
+}
+// tools/list waits on this read, so it must not take the API's full request budget.
+const FEATURES_TIMEOUT_MS = 5_000;
+/**
+ * The active organization's features, kept on the MCP session's OrganizationSession: the
+ * stdio process, or one hosted session. organizations_select and account_get-context write
+ * the same field when they read the account, so an organization switch changes what is
+ * listed. An API without the field means none. A failed read lists no gated tools and keeps
+ * nothing, so a later list reads again.
+ */
+async function sessionFeatures(session, http) {
+    const kept = session.activeFeatures();
+    if (kept)
+        return new Set(kept);
+    const stamp = session.featureStamp();
+    try {
+        // In the session, so the read names its selected organization like any other call.
+        const overview = parseAccountOverview(await runInOrganizationSession(session, () => http.request('get', '/v2/account', { signal: AbortSignal.timeout(FEATURES_TIMEOUT_MS) })));
+        const features = overview.features ?? [];
+        // Not kept if the session switched meanwhile or the answer is for another organization.
+        session.recordFeatures(features, stamp, overview.organization?.id);
+        return new Set(features);
+    }
+    catch {
+        return new Set();
+    }
+}
+/** The descriptors this organization may see; reads features only when a gated tool is listed. */
+export async function listedForAccount(descriptors, session, http) {
+    if (!descriptors.some((tool) => isFeatureGatedTool(tool.name)))
+        return descriptors;
+    const enabled = await sessionFeatures(session, http);
+    return descriptors.filter((tool) => !isFeatureGatedTool(tool.name) || enabled.has(TOOL_FEATURES[tool.name]));
+}

package/dist/app-upload-relay.d.ts

@@ -0,0 +1,13 @@
+import cors from 'cors';
+import type { RequestHandler } from 'express';
+import type { McpToolDefinition } from './tools/generator.js';
+/** Browser origins are configured separately from storage destinations. Tickets remain required. */
+export declare function createAppUploadCors(origins: string[]): (req: cors.CorsRequest, res: {
+    statusCode?: number | undefined;
+    setHeader(key: string, value: string): any;
+    end(): any;
+}, next: (err?: any) => any) => void;
+/** A ticket grants one bounded PUT to one server-issued storage URL, never arbitrary proxying. */
+export declare function relayUploadTool(tool: McpToolDefinition, origin: string, storageOrigin: string): McpToolDefinition;
+export declare const appUploadHandler: RequestHandler;
+//# sourceMappingURL=app-upload-relay.d.ts.map

package/dist/app-upload-relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-upload-relay.d.ts","sourceRoot":"","sources":["../src/app-upload-relay.ts"],"names":[],"mappings":"AAIA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,oGAAoG;AACpG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE;;;;qCAOpD;AAcD,kGAAkG;AAClG,wBAAgB,eAAe,CAC7B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,iBAAiB,CAoCnB;AAED,eAAO,MAAM,gBAAgB,EAAE,cA8E9B,CAAC"}