@walkeros/mcp 4.3.0-next-1784055686454 → 4.3.0

package/dist/index.d.ts

@@ -16,6 +16,9 @@ interface RegrantPreviewOptions {
     flowId: string;
     previewId: string;
     origins: string[];
+    /** Observe session id — binds the minted grant to that session so
+     *  forwarded events reach its container. Opaque identifier. */
+    sessionId?: string;
 }
 /**
  * The assembled cross-runtime journeys for a flow's active Observe session,
@@ -100,10 +103,10 @@ interface ToolClient {
     deletePreview(options: DeletePreviewOptions): Promise<unknown>;
     /**
      * Mint a fresh, origin-bound activation grant for an existing preview.
-     * OPTIONAL: only in-process hosts (the walkerOS app itself) implement it; the
-     * CLI-backed HTTP client omits it, and the flow_manage handler guards on its
-     * presence before calling. Returns an already-redacted grant summary (never
-     * the ingest token or project id).
+     * OPTIONAL: clients that cannot mint grants may omit it, and the
+     * flow_manage handler guards on its presence before calling. Clients may
+     * return their raw API response; the flow_manage handler whitelists the
+     * fields it surfaces (never the ingest token or project id).
      */
     regrantPreview?(options: RegrantPreviewOptions): Promise<unknown>;
     listSecrets(options: ListSecretsOptions): Promise<unknown>;
@@ -262,8 +265,11 @@ declare class HttpToolClient implements ToolClient {
     }): Promise<unknown>;
     listPreviews(options: ListPreviewsOptions): Promise<unknown>;
     getPreview(options: GetPreviewOptions): Promise<unknown>;
-    createPreview(options: CreatePreviewOptions): Promise<unknown>;
+    createPreview(options: CreatePreviewOptions & {
+        siteUrl?: string;
+    }): Promise<unknown>;
     deletePreview(options: DeletePreviewOptions): Promise<unknown>;
+    regrantPreview(options: RegrantPreviewOptions): Promise<unknown>;
     listSecrets(options: ListSecretsOptions): Promise<unknown>;
     createSecret(options: CreateSecretOptions): Promise<unknown>;
     updateSecret(options: UpdateSecretOptions): Promise<unknown>;

package/dist/index.js

@@ -550,6 +550,9 @@ var inputSchema3 = {
   ),
   origins: z3.array(z3.string()).optional().describe(
     "Site origins (bare https://host[:port]) to mint a preview activation grant for. Used by preview_regrant; the returned activationUrl targets the first origin."
+  ),
+  sessionId: z3.string().optional().describe(
+    "Observe session id \u2014 when set, preview_regrant mints an activation/forwarding grant PAIR: the returned activationUrl both activates the web preview and lets the page forward events to the session container (elbPreviewSession param). Pass it to observe server-side hops; omit for a plain web preview."
   )
 };
 var annotations3 = {
@@ -558,6 +561,39 @@ var annotations3 = {
   idempotentHint: false,
   openWorldHint: true
 };
+var PREVIEW_SUMMARY_FIELDS = [
+  "id",
+  "previewId",
+  "flowId",
+  "flowSettingsId",
+  "bundleUrl",
+  "activationUrl",
+  "grant",
+  "sessionGrant",
+  "sessionExpiresAt",
+  "status",
+  "observeFeed",
+  "createdBy",
+  "createdAt"
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function redactPreview(data) {
+  if (!isRecord(data)) return {};
+  const out = {};
+  for (const field of PREVIEW_SUMMARY_FIELDS) {
+    if (data[field] !== void 0) out[field] = data[field];
+  }
+  return out;
+}
+function redactPreviewList(data) {
+  if (!isRecord(data)) return { previews: [] };
+  return {
+    previews: Array.isArray(data.previews) ? data.previews.map(redactPreview) : [],
+    ...data.total !== void 0 ? { total: data.total } : {}
+  };
+}
 function createFlowManageToolSpec(client) {
   return {
     name: "flow_manage",
@@ -587,7 +623,8 @@ async function flowManageHandlerBody(client, input) {
     flowSettingsId,
     source,
     siteUrl,
-    origins
+    origins,
+    sessionId
   } = input ?? {};
   const validationError = validateActionInput(
     "flow_manage",
@@ -751,7 +788,7 @@ async function flowManageHandlerBody(client, input) {
           projectId: resolvedProjectId,
           flowId
         });
-        return mcpResult3(data);
+        return mcpResult3(redactPreviewList(data));
       }
       case "preview_get": {
         assertParam(flowId, "flowId", "preview_get");
@@ -761,7 +798,7 @@ async function flowManageHandlerBody(client, input) {
           flowId,
           previewId
         });
-        return mcpResult3(data);
+        return mcpResult3(redactPreview(data));
       }
       case "preview_create": {
         assertParam(flowId, "flowId", "preview_create");
@@ -777,7 +814,7 @@ async function flowManageHandlerBody(client, input) {
           ...source ? { source } : {},
           ...siteUrl ? { siteUrl } : {}
         });
-        return mcpResult3(preview, {
+        return mcpResult3(redactPreview(preview), {
           next: [
             'Open activationUrl on your site to activate preview mode. When activationUrl is null, no grant has been minted for a site yet \u2014 use action "preview_regrant" with your site origins to mint one.',
             "Poll observeFeed (observe_journeys with this flowId) to watch preview events arrive."
@@ -812,11 +849,12 @@ async function flowManageHandlerBody(client, input) {
           projectId: resolvedProjectId,
           flowId,
           previewId,
-          origins: origins ?? []
+          origins: origins ?? [],
+          ...sessionId ? { sessionId } : {}
         });
-        return mcpResult3(data, {
+        return mcpResult3(redactPreview(data), {
           next: [
-            "Open activationUrl on the target origin to activate preview mode."
+            sessionId ? "Open activationUrl on the target origin: it activates the web preview AND forwards its events to the observe session. Use sessionGrant as the X-Walkeros-Preview header for direct server-hop test events." : "Open activationUrl on the target origin to activate preview mode."
           ]
         });
       }
@@ -1344,7 +1382,7 @@ async function feedbackHandlerBody(client, input) {
     const isAnonymous = explicitAnonymous ?? anonymous ?? true;
     await client.submitFeedback(text, {
       anonymous: isAnonymous,
-      version: "4.3.0-next-1784055686454"
+      version: "4.3.0"
     });
     return mcpResult7({ ok: true });
   } catch (error) {
@@ -2082,7 +2120,7 @@ var NPM_SEARCH_URL = "https://registry.npmjs.org/-/v1/search";
 var JSDELIVR_BASE = "https://cdn.jsdelivr.net/npm";
 var WALKEROS_JSON_PATH = "dist/walkerOS.json";
 var CACHE_TTL = 5 * 60 * 1e3;
-var CLIENT_HEADER = "walkeros-mcp/4.3.0-next-1784055686454";
+var CLIENT_HEADER = "walkeros-mcp/4.3.0";
 function getPackageBaseUrl() {
   return process.env.WALKEROS_APP_URL || void 0;
 }
@@ -2707,7 +2745,7 @@ var spec_default = {
   openapi: "3.1.0",
   info: {
     title: "walkerOS Tag Manager API",
-    version: "2.4.0",
+    version: "3.1.0",
     description: "API for managing walkerOS flows, projects, and real-time event observation.",
     contact: {
       name: "elbwalker",
@@ -5031,6 +5069,9 @@ var spec_default = {
           sessionExpiresAt: {
             type: "string",
             format: "date-time"
+          },
+          sessionGrant: {
+            type: "string"
           }
         },
         required: ["grant", "activationUrl", "sessionExpiresAt"]
@@ -5105,15 +5146,15 @@ var spec_default = {
           token: {
             type: "string"
           },
-          activationUrl: {
-            type: ["string", "null"]
+          previewEnabled: {
+            type: "boolean"
           },
           bundleUrl: {
             type: "string",
             format: "uri"
           }
         },
-        required: ["previewId", "token", "activationUrl", "bundleUrl"]
+        required: ["previewId", "token", "previewEnabled", "bundleUrl"]
       },
       ObserveSessionJourneysResponse: {
         type: "object",
@@ -7194,6 +7235,65 @@ var spec_default = {
         },
         required: ["email"]
       },
+      VerifyResponse: {
+        oneOf: [
+          {
+            type: "object",
+            properties: {
+              status: {
+                type: "string",
+                enum: ["ok"]
+              },
+              redirectTo: {
+                type: "string",
+                example: "/"
+              }
+            },
+            required: ["status", "redirectTo"]
+          },
+          {
+            type: "object",
+            properties: {
+              status: {
+                type: "string",
+                enum: ["confirm_required"]
+              },
+              email: {
+                type: "string",
+                example: "user@example.com"
+              }
+            },
+            required: ["status", "email"]
+          },
+          {
+            type: "object",
+            properties: {
+              status: {
+                type: "string",
+                enum: ["expired", "used", "invalid", "malformed"]
+              }
+            },
+            required: ["status"]
+          }
+        ]
+      },
+      VerifyRequest: {
+        type: "object",
+        properties: {
+          token: {
+            type: "string",
+            minLength: 1
+          },
+          redirect_to: {
+            type: "string",
+            example: "/dashboard"
+          },
+          confirm: {
+            type: "boolean"
+          }
+        },
+        required: ["token"]
+      },
       WhoamiResponse: {
         type: "object",
         properties: {
@@ -8172,10 +8272,46 @@ var spec_default = {
       }
     },
     "/api/auth/verify": {
+      post: {
+        tags: ["Auth"],
+        summary: "Redeem magic link token",
+        description: "Redeem a magic link token and create an authenticated session. Redeems immediately when the browser-nonce cookie from the magic-link request matches; otherwise answers confirm_required and expects a follow-up call with confirm: true.",
+        requestBody: {
+          content: {
+            "application/json": {
+              schema: {
+                $ref: "#/components/schemas/VerifyRequest"
+              }
+            }
+          }
+        },
+        responses: {
+          "200": {
+            description: "Redemption result. status=ok sets the session cookie and carries the redirect target.",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/VerifyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            description: "Validation error",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      },
       get: {
         tags: ["Auth"],
-        summary: "Verify magic link token",
-        description: "Verify a magic link token and create an authenticated session. Redirects to the specified URL or home page.",
+        summary: "Legacy magic link entry point",
+        description: "Side-effect-free redirector to the /auth/verify page for links minted before the page-URL change. Never consumes the token; redemption happens via POST.",
         parameters: [
           {
             schema: {
@@ -8202,8 +8338,8 @@ var spec_default = {
           }
         ],
         responses: {
-          "302": {
-            description: "Redirect to target URL with session cookie set"
+          "307": {
+            description: "Redirect to the /auth/verify page with the token forwarded"
           }
         }
       }
@@ -17631,6 +17767,7 @@ import {
   getPreview,
   createPreview,
   deletePreview,
+  regrantPreview,
   listSecrets,
   createSecret,
   updateSecret,
@@ -17700,11 +17837,14 @@ var HttpToolClient = class {
     return getPreview(options);
   }
   async createPreview(options) {
-    return createPreview(options);
+    return createPreview({ ...options, url: options.url ?? options.siteUrl });
   }
   async deletePreview(options) {
     return deletePreview(options);
   }
+  async regrantPreview(options) {
+    return regrantPreview(options);
+  }
   async listSecrets(options) {
     return listSecrets(options);
   }