@unpuzzle/viddy-mcp 0.1.0

package/dist/index.js

@@ -0,0 +1,663 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// ../../packages/mcp-core/dist/index.js
+import { z as z2 } from "zod";
+
+// ../../packages/mcp-core/dist/tools.js
+import { z } from "zod";
+function qs(params) {
+  const sp = new URLSearchParams();
+  for (const [k, v] of Object.entries(params)) {
+    if (v !== void 0 && v !== "")
+      sp.set(k, String(v));
+  }
+  const s = sp.toString();
+  return s ? `?${s}` : "";
+}
+function seg(idOrSlug) {
+  return encodeURIComponent(idOrSlug);
+}
+var PingArgs = z.object({}).strict();
+var PING = {
+  name: "ping",
+  description: "Check that the Viddy MCP server is alive and reachable. Returns the configured Viddy base URL and a timestamp. Requires no sign-in and makes no API call, so use it to separate 'the MCP is broken' from 'my Viddy account has no data' before digging further.",
+  inputSchema: PingArgs,
+  handler: async () => ({ ok: true, timestamp: (/* @__PURE__ */ new Date()).toISOString() })
+};
+var WhoamiArgs = z.object({}).strict();
+var WHOAMI = {
+  name: "whoami",
+  description: "Return the Viddy account this connection is acting as: name, email, the granted scopes, and how many videos the account owns. Use it when the user asks 'am I connected', 'which account is this', or when a tool returns nothing and you want to confirm you are looking at the right account.",
+  inputSchema: WhoamiArgs,
+  handler: async (_args, api) => api.fetch("/api/v1/me")
+};
+var ListVideosArgs = z.object({
+  query: z.string().min(1).max(200).optional().describe("Case-insensitive substring match against the video title."),
+  limit: z.number().int().min(1).max(50).optional().describe("Page size. Default 20, max 50."),
+  cursor: z.string().min(1).optional().describe("Opaque cursor: pass `nextCursor` from the previous response to get the next page.")
+}).strict();
+var LIST_VIDEOS = {
+  name: "list_videos",
+  description: "List the videos the user owns, newest first. This is the starting point for almost every Viddy question: use it to find a video by title before calling get_transcript, get_video, or list_notes. Each row has id, title, slug, url (the shareable link), createdAt, durationSeconds, visibility (private/everyone/teams), source (upload/recording), hasTranscript, and noteCount. Pass `query` to filter by title. Returns { videos, nextCursor }; `nextCursor` is null on the last page.",
+  inputSchema: ListVideosArgs,
+  handler: async (args, api) => api.fetch(`/api/v1/videos${qs({ query: args.query, limit: args.limit, cursor: args.cursor })}`)
+};
+var GetVideoArgs = z.object({
+  id_or_slug: z.string().min(1).describe("The video's UUID, or its slug (the last path part of a viddy.lol/v/... link).")
+}).strict();
+var GET_VIDEO = {
+  name: "get_video",
+  description: "Fetch one video's metadata by id or slug: title, shareable url, duration, visibility, source, created date, whether a transcript exists and its status, and the note count. Use it when the user pastes a Viddy link or names a specific video and you need its details before pulling the transcript or notes. Returns 404 if the video does not exist or is not owned by this account.",
+  inputSchema: GetVideoArgs,
+  handler: async (args, api) => api.fetch(`/api/v1/videos/${seg(args.id_or_slug)}`)
+};
+var GetTranscriptArgs = z.object({
+  id_or_slug: z.string().min(1).describe("The video's UUID, or its slug (the last path part of a viddy.lol/v/... link)."),
+  format: z.enum(["text", "segments"]).optional().describe('"text" (default) returns one prose blob \u2014 best for summarizing. "segments" returns timestamped chunks [{start,end,text}] \u2014 use it when the user wants timecodes or quotes you can link to.'),
+  start_sec: z.number().min(0).optional().describe("Only include transcript from this many seconds into the video."),
+  end_sec: z.number().min(0).optional().describe("Only include transcript up to this many seconds into the video.")
+}).strict();
+var GET_TRANSCRIPT = {
+  name: "get_transcript",
+  description: "Get the transcript of a Viddy video (transcribed on-device by the desktop app). Returns { status, language, text } or { status, language, segments } depending on `format`. status is 'ready', 'pending' (still transcribing \u2014 try again later), 'failed', 'empty' (transcribed, but the recording has no speech \u2014 say so instead of guessing at content), or 'none' (never transcribed). For long recordings the text is capped at 60,000 characters and `truncated` is set \u2014 when that happens, call again with start_sec/end_sec to walk the video in chunks rather than asking for the whole thing.",
+  inputSchema: GetTranscriptArgs,
+  handler: async (args, api) => api.fetch(`/api/v1/videos/${seg(args.id_or_slug)}/transcript${qs({
+    format: args.format,
+    start_sec: args.start_sec,
+    end_sec: args.end_sec
+  })}`)
+};
+var SearchTranscriptsArgs = z.object({
+  query: z.string().min(2).max(200).describe("Text to look for inside transcripts. Matching is case-insensitive substring, not semantic \u2014 prefer distinctive words over whole sentences."),
+  limit: z.number().int().min(1).max(20).optional().describe("Maximum number of matching moments to return. Default 10, max 20.")
+}).strict();
+var SEARCH_TRANSCRIPTS = {
+  name: "search_transcripts",
+  description: "Search across the transcripts of every video the user owns and return the exact moments where a phrase was said. Use this for 'when did I talk about X' or 'which recording covers Y' \u2014 it is far cheaper than pulling whole transcripts. Each hit has the video (id, title, slug, url), the segment start/end in seconds, the matching segment text, and a snippet with surrounding context. Matching is case-insensitive substring, so search for distinctive keywords rather than full sentences.",
+  inputSchema: SearchTranscriptsArgs,
+  handler: async (args, api) => api.fetch(`/api/v1/transcripts/search${qs({ q: args.query, limit: args.limit })}`)
+};
+var ListNotesArgs = z.object({
+  id_or_slug: z.string().min(1).describe("The video's UUID, or its slug (the last path part of a viddy.lol/v/... link).")
+}).strict();
+var LIST_NOTES = {
+  name: "list_notes",
+  description: "List the timestamped notes viewers left on a video, in video order. Notes are the feedback people leave while watching a Viddy share link, each pinned to a moment. Use this for 'what feedback did I get on this video' or to collect review comments into a to-do list. Each note has the author (name and email), timestampSeconds, text, and createdAt.",
+  inputSchema: ListNotesArgs,
+  handler: async (args, api) => api.fetch(`/api/v1/videos/${seg(args.id_or_slug)}/notes`)
+};
+var TOOLS = [
+  PING,
+  WHOAMI,
+  LIST_VIDEOS,
+  GET_VIDEO,
+  GET_TRANSCRIPT,
+  SEARCH_TRANSCRIPTS,
+  LIST_NOTES
+];
+var TOOL_NAMES = TOOLS.map((t) => t.name);
+
+// ../../packages/mcp-core/dist/index.js
+var UnknownToolError = class extends Error {
+  toolName;
+  constructor(toolName) {
+    super(`Unknown tool "${toolName}". Viddy exposes: ${TOOL_NAMES.join(", ")}.`);
+    this.toolName = toolName;
+    this.name = "UnknownToolError";
+  }
+};
+var ToolArgsError = class extends Error {
+  toolName;
+  issues;
+  constructor(toolName, issues) {
+    const detail = issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+    super(`Invalid arguments for "${toolName}" \u2014 ${detail}`);
+    this.toolName = toolName;
+    this.issues = issues;
+    this.name = "ToolArgsError";
+  }
+};
+function getTool(name) {
+  return TOOLS.find((t) => t.name === name);
+}
+function toMcpToolList() {
+  return TOOLS.map((t) => ({
+    name: t.name,
+    description: t.description,
+    inputSchema: z2.toJSONSchema(t.inputSchema, {
+      io: "input",
+      target: "draft-7"
+    })
+  }));
+}
+async function runTool(name, args, api) {
+  const tool = getTool(name);
+  if (!tool)
+    throw new UnknownToolError(name);
+  const parsed = tool.inputSchema.safeParse(args ?? {});
+  if (!parsed.success)
+    throw new ToolArgsError(name, parsed.error.issues);
+  return tool.handler(parsed.data, api);
+}
+
+// src/config.ts
+var CLIENT_ID = "viddy-mcp";
+var DEFAULT_BASE_URL = "https://viddy.lol";
+function getBaseUrl() {
+  const fromEnv = process.env["VIDDY_BASE_URL"];
+  if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\/+$/, "");
+  return DEFAULT_BASE_URL;
+}
+var REQUESTED_SCOPES = [
+  "videos.read",
+  "transcripts.read",
+  "annotations.read"
+];
+var PACKAGE_NAME = "@unpuzzle/viddy-mcp";
+var PACKAGE_VERSION = "0.1.0";
+
+// src/auth.ts
+import { mkdir, readFile, writeFile, chmod, rename, unlink } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import envPaths from "env-paths";
+
+// src/log.ts
+function log(level, message, extra) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const line = extra !== void 0 ? `[${ts}] ${level} ${message} ${safeJson(extra)}` : `[${ts}] ${level} ${message}`;
+  process.stderr.write(line + "\n");
+}
+function safeJson(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+
+// src/auth.ts
+var PATHS = envPaths("viddy-mcp", { suffix: "" });
+var AUTH_PATH = join(PATHS.config, "auth.json");
+async function readFileOrNull() {
+  try {
+    const parsed = JSON.parse(await readFile(AUTH_PATH, "utf8"));
+    if (parsed?.schemaVersion !== 1) {
+      log("warn", "auth.json schemaVersion mismatch; ignoring stored tokens", {
+        path: AUTH_PATH
+      });
+      return null;
+    }
+    return parsed;
+  } catch (e) {
+    if (e?.code === "ENOENT") return null;
+    log("warn", "failed to read auth.json; treating as no stored tokens", {
+      path: AUTH_PATH,
+      error: e instanceof Error ? e.message : String(e)
+    });
+    return null;
+  }
+}
+async function writeAtomic(file) {
+  await mkdir(dirname(AUTH_PATH), { recursive: true, mode: 448 });
+  const tmp = `${AUTH_PATH}.${process.pid}.tmp`;
+  try {
+    await writeFile(tmp, JSON.stringify(file, null, 2), { encoding: "utf8", mode: 384 });
+    try {
+      await chmod(tmp, 384);
+    } catch {
+    }
+    await rename(tmp, AUTH_PATH);
+  } catch (e) {
+    await unlink(tmp).catch(() => {
+    });
+    throw e;
+  }
+}
+async function loadTokens() {
+  const file = await readFileOrNull();
+  if (!file) return null;
+  return file.byBaseUrl[getBaseUrl()] ?? null;
+}
+async function saveTokens(tokens) {
+  const file = await readFileOrNull() ?? { schemaVersion: 1, byBaseUrl: {} };
+  file.byBaseUrl[getBaseUrl()] = tokens;
+  await writeAtomic(file);
+}
+async function clearTokens() {
+  const file = await readFileOrNull();
+  if (!file) return;
+  delete file.byBaseUrl[getBaseUrl()];
+  await writeAtomic(file);
+}
+function authFilePath() {
+  return AUTH_PATH;
+}
+function accessTokenIsFresh(tokens) {
+  return tokens.expiresAt - Date.now() > 3e4;
+}
+
+// src/oauth.ts
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { platform } from "node:os";
+function pkcePair() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function stateMatches(a, b) {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+function openBrowser(url) {
+  const override = process.env["VIDDY_BROWSER_CMD"];
+  if (override) {
+    spawn(override, [url], { stdio: "ignore", detached: true }).unref();
+    return;
+  }
+  const p = platform();
+  if (p === "darwin") {
+    spawn("open", [url], { stdio: "ignore", detached: true }).unref();
+  } else if (p === "win32") {
+    spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
+  } else {
+    spawn("xdg-open", [url], { stdio: "ignore", detached: true }).unref();
+  }
+}
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => {
+    switch (c) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      default:
+        return "&#39;";
+    }
+  });
+}
+function renderCallbackHtml(ok, message) {
+  const title = ok ? "Connected" : "Sign-in error";
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>
+  body{font-family:system-ui,sans-serif;max-width:440px;margin:80px auto;padding:0 20px;color:#111;line-height:1.5}
+  h1{font-size:20px;margin:0 0 10px}
+  p{color:#555}
+  .ok{color:#0f6b35}
+  .err{color:#b91c1c}
+  @media (prefers-color-scheme: dark){
+    body{background:#0b0b0d;color:#e8e8ea}
+    p{color:#a1a1aa}
+    .ok{color:#4ade80}
+    .err{color:#f87171}
+  }
+</style></head><body>
+<h1 class="${ok ? "ok" : "err"}">${ok ? "Connected to Viddy" : "Sign-in error"}</h1>
+<p>${escapeHtml(message)}</p>
+${ok ? "<p>You can close this tab and return to your terminal.</p>" : ""}
+</body></html>`;
+}
+async function runAuthorizationFlow(opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 5 * 60 * 1e3;
+  const baseUrl = getBaseUrl();
+  const { verifier, challenge } = pkcePair();
+  const state = randomBytes(16).toString("base64url");
+  const { server, redirectUri, codePromise } = await startCallbackServer(state);
+  let timer;
+  try {
+    const authorizeUrl = new URL("/api/oauth/authorize", baseUrl);
+    authorizeUrl.searchParams.set("client_id", CLIENT_ID);
+    authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizeUrl.searchParams.set("response_type", "code");
+    authorizeUrl.searchParams.set("scope", REQUESTED_SCOPES.join(" "));
+    authorizeUrl.searchParams.set("state", state);
+    authorizeUrl.searchParams.set("code_challenge", challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    log("info", "opening browser for Viddy consent");
+    process.stderr.write(
+      `
+If your browser didn't open automatically, paste this URL:
+  ${authorizeUrl.toString()}
+
+`
+    );
+    openBrowser(authorizeUrl.toString());
+    const code = await Promise.race([
+      codePromise,
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("Viddy sign-in timed out after 5 minutes. Run the `connect` tool to try again.")),
+          timeoutMs
+        );
+      })
+    ]);
+    const tokens = await exchangeCodeForTokens({ code, verifier, redirectUri });
+    await saveTokens(tokens);
+    log("info", "OAuth flow complete; tokens saved");
+    return tokens;
+  } finally {
+    if (timer) clearTimeout(timer);
+    server.close();
+  }
+}
+function startCallbackServer(expectedState) {
+  return new Promise((resolveOuter, rejectOuter) => {
+    let onCode;
+    let onError;
+    const codePromise = new Promise((res, rej) => {
+      onCode = res;
+      onError = rej;
+    });
+    const server = createServer((req, res) => {
+      if (!req.url) {
+        res.writeHead(400).end();
+        return;
+      }
+      const url = new URL(req.url, "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(renderCallbackHtml(false, "Unknown path on the local callback server."));
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      const errorDescription = url.searchParams.get("error_description");
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(renderCallbackHtml(false, `${error}: ${errorDescription ?? "sign-in failed"}`));
+        onError(new Error(`OAuth error: ${error} \u2014 ${errorDescription ?? ""}`));
+        return;
+      }
+      if (!code) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(renderCallbackHtml(false, "Authorization response did not include a code."));
+        onError(new Error("OAuth callback missing ?code="));
+        return;
+      }
+      if (!state || !stateMatches(state, expectedState)) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(renderCallbackHtml(false, "CSRF check failed: state mismatch."));
+        onError(new Error("OAuth callback state mismatch \u2014 possible CSRF"));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(renderCallbackHtml(true, "Authorization complete."));
+      onCode(code);
+    });
+    server.on("error", (e) => rejectOuter(e));
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (!addr || typeof addr === "string") {
+        server.close();
+        rejectOuter(new Error("failed to read callback server port"));
+        return;
+      }
+      resolveOuter({
+        server,
+        redirectUri: `http://localhost:${addr.port}/callback`,
+        codePromise
+      });
+    });
+  });
+}
+async function postToken(body) {
+  const res = await fetch(`${getBaseUrl()}/api/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+    body: body.toString()
+  });
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error(`Viddy token endpoint returned a non-JSON response (HTTP ${res.status}).`);
+  }
+  if (!res.ok) {
+    throw new Error(
+      `${json["error"] ?? `HTTP ${res.status}`} \u2014 ${json["error_description"] ?? "token request rejected"}`
+    );
+  }
+  const t = json;
+  const now = Date.now();
+  return {
+    accessToken: t.access_token,
+    refreshToken: t.refresh_token,
+    expiresAt: now + t.expires_in * 1e3,
+    scope: t.scope,
+    grantedAt: now
+  };
+}
+async function exchangeCodeForTokens(args) {
+  return postToken(
+    new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      code: args.code,
+      code_verifier: args.verifier,
+      redirect_uri: args.redirectUri
+    })
+  );
+}
+async function refreshTokens(currentRefreshToken) {
+  const tokens = await postToken(
+    new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: CLIENT_ID,
+      refresh_token: currentRefreshToken
+    })
+  );
+  await saveTokens(tokens);
+  return tokens;
+}
+
+// src/api.ts
+var ApiError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "ApiError";
+  }
+};
+var NotConnectedError = class extends Error {
+  constructor() {
+    super(
+      "Not connected to Viddy. Run the `connect` tool to sign in \u2014 or just ask for your videos again and consent will open in your browser."
+    );
+    this.name = "NotConnectedError";
+  }
+};
+async function ensureTokens(opts) {
+  let tokens = await loadTokens();
+  if (!tokens) {
+    if (opts.noAutoAuth) throw new NotConnectedError();
+    log("info", "no tokens found; starting OAuth flow");
+    tokens = await runAuthorizationFlow();
+  }
+  if (!accessTokenIsFresh(tokens)) {
+    log("info", "access token near expiry; refreshing");
+    try {
+      tokens = await refreshTokens(tokens.refreshToken);
+    } catch (e) {
+      log("warn", "refresh failed; clearing tokens", {
+        error: e instanceof Error ? e.message : String(e)
+      });
+      await clearTokens();
+      if (opts.noAutoAuth) throw new NotConnectedError();
+      tokens = await runAuthorizationFlow();
+    }
+  }
+  return tokens;
+}
+async function apiFetch(path, init = {}) {
+  const { noAutoAuth, headers: extraHeaders, ...rest } = init;
+  const tokens = await ensureTokens({ noAutoAuth: noAutoAuth ?? false });
+  const doRequest = (token) => fetch(`${getBaseUrl()}${path}`, {
+    ...rest,
+    headers: {
+      ...extraHeaders,
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json"
+    }
+  });
+  let res = await doRequest(tokens.accessToken);
+  if (res.status === 401) {
+    log("info", "got 401; attempting refresh + replay");
+    let refreshed;
+    try {
+      refreshed = await refreshTokens(tokens.refreshToken);
+    } catch {
+      await clearTokens();
+      throw new NotConnectedError();
+    }
+    res = await doRequest(refreshed.accessToken);
+  }
+  if (!res.ok) {
+    let body = null;
+    try {
+      body = await res.json();
+    } catch {
+      body = await res.text().catch(() => null);
+    }
+    if (res.status === 403 && typeof body === "object" && body !== null && "reason" in body) {
+      const b = body;
+      if (b.reason === "insufficient_scope") {
+        throw new ApiError(
+          `This tool needs the "${b.required_scope}" scope, which the current connection doesn't have. Revoke Viddy MCP under Settings \u2192 Connected Apps on viddy.lol, then run \`connect\` again to grant it.`,
+          403,
+          body
+        );
+      }
+    }
+    const code = typeof body === "object" && body !== null && "error" in body ? String(body.error) : `HTTP ${res.status}`;
+    const description = typeof body === "object" && body !== null && "error_description" in body ? String(body.error_description) : "";
+    throw new ApiError(description || `${code} (${res.status})`, res.status, body);
+  }
+  if (res.status === 204) return void 0;
+  return await res.json();
+}
+var apiClient = {
+  fetch: (path, init) => apiFetch(path, init)
+};
+
+// src/index.ts
+function textResult(payload) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
+  };
+}
+function errorResult(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  const errorName = err instanceof Error ? err.name : "Error";
+  log("error", "tool call failed", { name: errorName, message });
+  const text = errorName === "NotConnectedError" ? `${errorName}: ${message}` : message;
+  return {
+    isError: true,
+    content: [{ type: "text", text }]
+  };
+}
+var LOCAL_TOOLS = [
+  {
+    name: "connect",
+    description: "Start the Viddy sign-in flow: opens the user's browser to the consent screen on viddy.lol. Use it when the user says 'connect to Viddy' or after `disconnect`. The other tools trigger this automatically when no connection exists, so calling it directly is rarely necessary.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+  },
+  {
+    name: "disconnect",
+    description: "Forget the Viddy tokens stored on this machine. The user is asked to consent again on the next tool call. This does NOT revoke the grant on the server \u2014 for that, the user visits Settings \u2192 Connected Apps on viddy.lol. Use it for 'log out', 'disconnect', or 'forget my credentials'.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false }
+  }
+];
+async function main() {
+  const server = new Server(
+    { name: PACKAGE_NAME, version: PACKAGE_VERSION },
+    { capabilities: { tools: {} } }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: [...toMcpToolList(), ...LOCAL_TOOLS]
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name } = request.params;
+    const args = request.params.arguments ?? {};
+    try {
+      if (name === "connect") {
+        const existing = await loadTokens();
+        if (existing) {
+          return textResult({
+            ok: true,
+            alreadyConnected: true,
+            baseUrl: getBaseUrl(),
+            scope: existing.scope,
+            message: "Already connected to Viddy. Use `disconnect` to forget these credentials.",
+            authFile: authFilePath()
+          });
+        }
+        const tokens = await runAuthorizationFlow();
+        return textResult({
+          ok: true,
+          message: "Connected to Viddy.",
+          baseUrl: getBaseUrl(),
+          scope: tokens.scope,
+          authFile: authFilePath()
+        });
+      }
+      if (name === "disconnect") {
+        const existing = await loadTokens();
+        if (!existing) {
+          return textResult({
+            ok: true,
+            wasConnected: false,
+            message: "No stored credentials \u2014 nothing to disconnect."
+          });
+        }
+        await clearTokens();
+        return textResult({
+          ok: true,
+          wasConnected: true,
+          message: `Cleared the Viddy credentials on this machine. To revoke the grant on the server too, visit ${getBaseUrl()}/settings/connected-apps.`
+        });
+      }
+      if (name === "ping") {
+        const result = await runTool(name, args, apiClient);
+        return textResult({
+          ...result,
+          package: PACKAGE_NAME,
+          version: PACKAGE_VERSION,
+          baseUrl: getBaseUrl(),
+          connected: await loadTokens() !== null
+        });
+      }
+      return textResult(await runTool(name, args, apiClient));
+    } catch (e) {
+      return errorResult(e);
+    }
+  });
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  log("info", `${PACKAGE_NAME}@${PACKAGE_VERSION} connected over stdio`, {
+    baseUrl: getBaseUrl()
+  });
+}
+main().catch((err) => {
+  log("error", "fatal error in MCP server", {
+    message: err instanceof Error ? err.message : String(err),
+    stack: err instanceof Error ? err.stack : void 0
+  });
+  process.exit(1);
+});

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,+CAA+C;AAC/C,SAAS,UAAU,CAAC,OAAgB;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5D,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,IAAI,GAAG,SAAS,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,IAAa;QACtB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EACT,kRAAkR;QACpR,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;KAC7E;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,4RAA4R;QAC9R,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE;KAC7E;CACO,CAAC;AAEX,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,EAChD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,2EAA2E;IAC3E,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,CAAC,GAAG,aAAa,EAAE,EAAE,GAAG,WAAW,CAAC;KAC5C,CAAC,CAAC,CAAC;IAEJ,2EAA2E;IAC3E,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QAE5C,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC;gBACpC,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,UAAU,CAAC;wBAChB,EAAE,EAAE,IAAI;wBACR,gBAAgB,EAAE,IAAI;wBACtB,OAAO,EAAE,UAAU,EAAE;wBACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,OAAO,EAAE,2EAA2E;wBACpF,QAAQ,EAAE,YAAY,EAAE;qBACzB,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;gBAC5C,OAAO,UAAU,CAAC;oBAChB,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,qBAAqB;oBAC9B,OAAO,EAAE,UAAU,EAAE;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,QAAQ,EAAE,YAAY,EAAE;iBACzB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,UAAU,CAAC;wBAChB,EAAE,EAAE,IAAI;wBACR,YAAY,EAAE,KAAK;wBACnB,OAAO,EAAE,gDAAgD;qBAC1D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,WAAW,EAAE,CAAC;gBACpB,OAAO,UAAU,CAAC;oBAChB,EAAE,EAAE,IAAI;oBACR,YAAY,EAAE,IAAI;oBAClB,OAAO,EACL,wFAAwF;wBACxF,SAAS,UAAU,EAAE,2BAA2B;iBACnD,CAAC,CAAC;YACL,CAAC;YAED,mEAAmE;YACnE,oDAAoD;YACpD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAA4B,CAAC;gBACjF,OAAO,UAAU,CAAC;oBAChB,GAAG,MAAM;oBACT,OAAO,EAAE,YAAY;oBACrB,OAAO,EAAE,eAAe;oBACxB,OAAO,EAAE,UAAU,EAAE;oBACrB,SAAS,EAAE,CAAC,MAAM,UAAU,EAAE,CAAC,KAAK,IAAI;iBACzC,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,wEAAwE;YACxE,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,GAAG,CAAC,MAAM,EAAE,GAAG,YAAY,IAAI,eAAe,uBAAuB,EAAE;QACrE,OAAO,EAAE,UAAU,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,GAAG,CAAC,OAAO,EAAE,2BAA2B,EAAE;QACxC,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACzD,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Structured stderr logging.
+ *
+ * stdout carries the MCP protocol frames — anything written there corrupts the
+ * stream and the host drops the connection. Every diagnostic goes to stderr.
+ *
+ * This lives in its own module (rather than in index.ts, as the Vibe Marketing
+ * package does) so auth/oauth/api can import it without a cycle back through
+ * the server entry point.
+ */
+export type LogLevel = "info" | "warn" | "error";
+export declare function log(level: LogLevel, message: string, extra?: unknown): void;
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,CAO3E"}