@unpuzzle/viddy-mcp 0.1.0

package/dist/log.js

@@ -0,0 +1,27 @@
+/**
+ * Structured stderr logging.
+ *
+ * stdout carries the MCP protocol frames — anything written there corrupts the
+ * stream and the host drops the connection. Every diagnostic goes to stderr.
+ *
+ * This lives in its own module (rather than in index.ts, as the Vibe Marketing
+ * package does) so auth/oauth/api can import it without a cycle back through
+ * the server entry point.
+ */
+export function log(level, message, extra) {
+    const ts = new Date().toISOString();
+    const line = extra !== undefined
+        ? `[${ts}] ${level} ${message} ${safeJson(extra)}`
+        : `[${ts}] ${level} ${message}`;
+    process.stderr.write(line + "\n");
+}
+/** Never let a logging call throw on a circular object. */
+function safeJson(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,UAAU,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,KAAe;IACnE,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GACR,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE;QAClD,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,OAAO,EAAE,CAAC;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,35 @@
+/**
+ * OAuth 2.1 client flow — the browser-based PKCE dance against Viddy.
+ *
+ * runAuthorizationFlow():
+ *   1. Generate a PKCE verifier + S256 challenge.
+ *   2. Bind a temp HTTP server to 127.0.0.1 on a free port (port 0).
+ *   3. Open the browser to /api/oauth/authorize with a loopback redirect_uri.
+ *   4. Receive ?code=&state= on /callback, verify state, close the server.
+ *   5. POST /api/oauth/token with the code + verifier.
+ *   6. Persist the tokens.
+ *
+ * Loopback security model (RFC 8252):
+ *   - Viddy's oauth_client row for `viddy-mcp` registers loopback redirect
+ *     URIs, so the port can be chosen at runtime.
+ *   - Binding to 127.0.0.1 explicitly means only this machine's user can reach
+ *     the callback; PKCE is the proof of possession.
+ *   - `state` is fresh per flow and verified on callback (CSRF defence).
+ */
+import { type StoredTokens } from "./auth.js";
+/**
+ * Run the browser-based OAuth flow and resolve to fresh, saved tokens.
+ * `timeoutMs` is how long to wait for the user at the consent screen.
+ */
+export declare function runAuthorizationFlow(opts?: {
+    timeoutMs?: number;
+}): Promise<StoredTokens>;
+/**
+ * Trade a refresh token for a new pair and save it.
+ *
+ * Refresh tokens rotate, so the old one is dead the moment this succeeds.
+ * Throws when the grant was revoked from Settings → Connected Apps; the caller
+ * clears stored tokens and re-runs the consent flow.
+ */
+export declare function refreshTokens(currentRefreshToken: string): Promise<StoredTokens>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAkF1D;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,YAAY,CAAC,CA2CvB;AA+HD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAUtF"}

package/dist/oauth.js

@@ -0,0 +1,252 @@
+/**
+ * OAuth 2.1 client flow — the browser-based PKCE dance against Viddy.
+ *
+ * runAuthorizationFlow():
+ *   1. Generate a PKCE verifier + S256 challenge.
+ *   2. Bind a temp HTTP server to 127.0.0.1 on a free port (port 0).
+ *   3. Open the browser to /api/oauth/authorize with a loopback redirect_uri.
+ *   4. Receive ?code=&state= on /callback, verify state, close the server.
+ *   5. POST /api/oauth/token with the code + verifier.
+ *   6. Persist the tokens.
+ *
+ * Loopback security model (RFC 8252):
+ *   - Viddy's oauth_client row for `viddy-mcp` registers loopback redirect
+ *     URIs, so the port can be chosen at runtime.
+ *   - Binding to 127.0.0.1 explicitly means only this machine's user can reach
+ *     the callback; PKCE is the proof of possession.
+ *   - `state` is fresh per flow and verified on callback (CSRF defence).
+ */
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { platform } from "node:os";
+import { CLIENT_ID, REQUESTED_SCOPES, getBaseUrl } from "./config.js";
+import { saveTokens } from "./auth.js";
+import { log } from "./log.js";
+function pkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+/** Constant-time state comparison — the values are same-length base64url. */
+function stateMatches(a, b) {
+    const ab = Buffer.from(a, "utf8");
+    const bb = Buffer.from(b, "utf8");
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
+/** Open the user's default browser. OS commands, so no extra dependency. */
+function openBrowser(url) {
+    const override = process.env["VIDDY_BROWSER_CMD"];
+    if (override) {
+        spawn(override, [url], { stdio: "ignore", detached: true }).unref();
+        return;
+    }
+    const p = platform();
+    if (p === "darwin") {
+        spawn("open", [url], { stdio: "ignore", detached: true }).unref();
+    }
+    else if (p === "win32") {
+        spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
+    }
+    else {
+        spawn("xdg-open", [url], { stdio: "ignore", detached: true }).unref();
+    }
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => {
+        switch (c) {
+            case "&":
+                return "&amp;";
+            case "<":
+                return "&lt;";
+            case ">":
+                return "&gt;";
+            case '"':
+                return "&quot;";
+            default:
+                return "&#39;";
+        }
+    });
+}
+/** The tiny page the user lands on after the redirect. */
+function renderCallbackHtml(ok, message) {
+    const title = ok ? "Connected" : "Sign-in error";
+    return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>
+  body{font-family:system-ui,sans-serif;max-width:440px;margin:80px auto;padding:0 20px;color:#111;line-height:1.5}
+  h1{font-size:20px;margin:0 0 10px}
+  p{color:#555}
+  .ok{color:#0f6b35}
+  .err{color:#b91c1c}
+  @media (prefers-color-scheme: dark){
+    body{background:#0b0b0d;color:#e8e8ea}
+    p{color:#a1a1aa}
+    .ok{color:#4ade80}
+    .err{color:#f87171}
+  }
+</style></head><body>
+<h1 class="${ok ? "ok" : "err"}">${ok ? "Connected to Viddy" : "Sign-in error"}</h1>
+<p>${escapeHtml(message)}</p>
+${ok ? "<p>You can close this tab and return to your terminal.</p>" : ""}
+</body></html>`;
+}
+/**
+ * Run the browser-based OAuth flow and resolve to fresh, saved tokens.
+ * `timeoutMs` is how long to wait for the user at the consent screen.
+ */
+export async function runAuthorizationFlow(opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 5 * 60 * 1000;
+    const baseUrl = getBaseUrl();
+    const { verifier, challenge } = pkcePair();
+    const state = randomBytes(16).toString("base64url");
+    const { server, redirectUri, codePromise } = await startCallbackServer(state);
+    let timer;
+    try {
+        const authorizeUrl = new URL("/api/oauth/authorize", baseUrl);
+        authorizeUrl.searchParams.set("client_id", CLIENT_ID);
+        authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+        authorizeUrl.searchParams.set("response_type", "code");
+        authorizeUrl.searchParams.set("scope", REQUESTED_SCOPES.join(" "));
+        authorizeUrl.searchParams.set("state", state);
+        authorizeUrl.searchParams.set("code_challenge", challenge);
+        authorizeUrl.searchParams.set("code_challenge_method", "S256");
+        log("info", "opening browser for Viddy consent");
+        process.stderr.write(`\nIf your browser didn't open automatically, paste this URL:\n  ${authorizeUrl.toString()}\n\n`);
+        openBrowser(authorizeUrl.toString());
+        const code = await Promise.race([
+            codePromise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error("Viddy sign-in timed out after 5 minutes. Run the `connect` tool to try again.")), timeoutMs);
+            }),
+        ]);
+        const tokens = await exchangeCodeForTokens({ code, verifier, redirectUri });
+        await saveTokens(tokens);
+        log("info", "OAuth flow complete; tokens saved");
+        return tokens;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        server.close();
+    }
+}
+function startCallbackServer(expectedState) {
+    return new Promise((resolveOuter, rejectOuter) => {
+        let onCode;
+        let onError;
+        const codePromise = new Promise((res, rej) => {
+            onCode = res;
+            onError = rej;
+        });
+        const server = createServer((req, res) => {
+            if (!req.url) {
+                res.writeHead(400).end();
+                return;
+            }
+            const url = new URL(req.url, "http://127.0.0.1");
+            if (url.pathname !== "/callback") {
+                // Favicon and stray probes shouldn't fail the flow.
+                res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderCallbackHtml(false, "Unknown path on the local callback server."));
+                return;
+            }
+            const code = url.searchParams.get("code");
+            const state = url.searchParams.get("state");
+            const error = url.searchParams.get("error");
+            const errorDescription = url.searchParams.get("error_description");
+            if (error) {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderCallbackHtml(false, `${error}: ${errorDescription ?? "sign-in failed"}`));
+                onError(new Error(`OAuth error: ${error} — ${errorDescription ?? ""}`));
+                return;
+            }
+            if (!code) {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderCallbackHtml(false, "Authorization response did not include a code."));
+                onError(new Error("OAuth callback missing ?code="));
+                return;
+            }
+            if (!state || !stateMatches(state, expectedState)) {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderCallbackHtml(false, "CSRF check failed: state mismatch."));
+                onError(new Error("OAuth callback state mismatch — possible CSRF"));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(renderCallbackHtml(true, "Authorization complete."));
+            onCode(code);
+        });
+        server.on("error", (e) => rejectOuter(e));
+        // Port 0 → the OS picks a free port. `localhost` (not the literal
+        // 127.0.0.1) goes in the redirect_uri because some environments rewrite
+        // one to the other during the redirect, which would then mismatch the
+        // value bound to the auth code. Viddy's loopback matcher accepts both.
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            if (!addr || typeof addr === "string") {
+                server.close();
+                rejectOuter(new Error("failed to read callback server port"));
+                return;
+            }
+            resolveOuter({
+                server,
+                redirectUri: `http://localhost:${addr.port}/callback`,
+                codePromise,
+            });
+        });
+    });
+}
+async function postToken(body) {
+    const res = await fetch(`${getBaseUrl()}/api/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+        body: body.toString(),
+    });
+    let json;
+    try {
+        json = (await res.json());
+    }
+    catch {
+        throw new Error(`Viddy token endpoint returned a non-JSON response (HTTP ${res.status}).`);
+    }
+    if (!res.ok) {
+        throw new Error(`${json["error"] ?? `HTTP ${res.status}`} — ${json["error_description"] ?? "token request rejected"}`);
+    }
+    const t = json;
+    const now = Date.now();
+    return {
+        accessToken: t.access_token,
+        refreshToken: t.refresh_token,
+        expiresAt: now + t.expires_in * 1000,
+        scope: t.scope,
+        grantedAt: now,
+    };
+}
+async function exchangeCodeForTokens(args) {
+    return postToken(new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: CLIENT_ID,
+        code: args.code,
+        code_verifier: args.verifier,
+        redirect_uri: args.redirectUri,
+    }));
+}
+/**
+ * Trade a refresh token for a new pair and save it.
+ *
+ * Refresh tokens rotate, so the old one is dead the moment this succeeds.
+ * Throws when the grant was revoked from Settings → Connected Apps; the caller
+ * clears stored tokens and re-runs the consent flow.
+ */
+export async function refreshTokens(currentRefreshToken) {
+    const tokens = await postToken(new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: CLIENT_ID,
+        refresh_token: currentRefreshToken,
+    }));
+    await saveTokens(tokens);
+    return tokens;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,UAAU,EAAqB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAU/B,SAAS,QAAQ;IACf,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACpE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACpE,CAAC;SAAM,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QACzB,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,GAAG;gBACN,OAAO,OAAO,CAAC;YACjB,KAAK,GAAG;gBACN,OAAO,MAAM,CAAC;YAChB,KAAK,GAAG;gBACN,OAAO,MAAM,CAAC;YAChB,KAAK,GAAG;gBACN,OAAO,QAAQ,CAAC;YAClB;gBACE,OAAO,OAAO,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,EAAW,EAAE,OAAe;IACtD,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACjD,OAAO,2DAA2D,KAAK;;;;;;;;;;;;;;aAc5D,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe;KACzE,UAAU,CAAC,OAAO,CAAC;EACtB,EAAE,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,EAAE;eACzD,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA+B,EAAE;IAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAClD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEpD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAiC,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAC9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACtD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAE/D,GAAG,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mEAAmE,YAAY,CAAC,QAAQ,EAAE,MAAM,CACjG,CAAC;QACF,WAAW,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,WAAW;YACX,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC,EACxG,SAAS,CACV,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5E,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,GAAG,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAQD,SAAS,mBAAmB,CAAC,aAAqB;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;QAC/C,IAAI,MAA+B,CAAC;QACpC,IAAI,OAA4B,CAAC;QACjC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,CAAC;YACb,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACxE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,oDAAoD;gBACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAEnE,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,KAAK,KAAK,gBAAgB,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC;gBACxF,OAAO,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,MAAM,gBAAgB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,gDAAgD,CAAC,CAAC,CAAC;gBACrF,OAAO,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC,CAAC;gBACzE,OAAO,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,kEAAkE;QAClE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,YAAY,CAAC;gBACX,MAAM;gBACN,WAAW,EAAE,oBAAoB,IAAI,CAAC,IAAI,WAAW;gBACrD,WAAW;aACZ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,EAAE,kBAAkB,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,wBAAwB,EAAE,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,IAAgC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,IAAI;QACpC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAIpC;IACC,OAAO,SAAS,CACd,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,QAAQ;QAC5B,YAAY,EAAE,IAAI,CAAC,WAAW;KAC/B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,mBAA2B;IAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,mBAAmB;KACnC,CAAC,CACH,CAAC;IACF,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@unpuzzle/viddy-mcp",
+  "version": "0.1.0",
+  "description": "MCP server for Viddy \u2014 ask Claude about your screen recordings: transcripts, timestamped notes, and shareable links.",
+  "type": "module",
+  "bin": {
+    "viddy-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "node scripts/check-integrity.mjs && tsc && node scripts/bundle.mjs",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build && node scripts/verify-package.mjs",
+    "bundle": "node scripts/bundle.mjs"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "claude",
+    "viddy",
+    "screen-recording",
+    "transcript",
+    "anthropic"
+  ],
+  "author": "Muscled <hello@muscled.co>",
+  "license": "MIT",
+  "homepage": "https://viddy.lol/install/mcp",
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "env-paths": "^3.0.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "@viddy/mcp-core": "*",
+    "esbuild": "^0.25.12",
+    "typescript": "^5"
+  }
+}