@wirl/mcp 0.2.3 → 0.2.4

package/bin.js

@@ -2463,7 +2463,7 @@ var init_manifest = __esm({
     };
     CREATABLE_CONNECTION_KINDS = CONNECTION_KINDS.filter((kind) => !(kind in UNDELIVERED_KINDS));
     needsNoKey = (kind) => kind === "none";
-    ACCENTS = ["blue", "green", "sun", "purple", "red", "sky", "orange", "lime"];
+    ACCENTS = ["blue", "green", "sun", "purple", "red", "sky", "orange", "lime", "mint", "butter", "blush", "lilac"];
     SCHEDULE_LIMITS = {
       perApp: 10,
       minTimeoutMs: 3e4,
@@ -2923,7 +2923,11 @@ var init_retention = __esm({
        * The counts settle a "why was my app paused" question and the claims
        * ration the mail; neither is worth anything two months on.
        */
-      flowDayRowsDays: 60
+      flowDayRowsDays: 60,
+      /** A row of the AI call ledger is kept this long, then removed. */
+      aiCallDays: 90,
+      /** An AI monthly total (the rows the caps read) is kept this long, 24 months. */
+      aiMonthDays: 730
     };
   }
 });
@@ -2956,6 +2960,7 @@ own live deploy and a person's yes. Declare a host under \`connections\`, then \
 wirl attaches the key. An undeclared host is refused; a public API needing no key uses \`"kind": "none"\`.
 Declaring one deploys before anyone approves it; the deploy says per connection whether it is usable now or
 waiting on an admin. A vendor has 60 seconds to answer, whole, unless it streams: ask a model for a stream.
+Models: \`https://ai.wirl/<vendor>/\u2026\` (openrouter, openai, anthropic, google) with the vendor's own API and no key; OpenRouter works out of the box on wirl's allowance, an org's own key lifts it. See Models.
 
 Six headers say who is asking: \`x-wirl-user-id\`, \`x-wirl-user-email\`, \`x-wirl-user-name\`,
 \`x-wirl-role\`, \`x-wirl-app-id\`, \`x-wirl-org\`. Read the name with
@@ -3008,7 +3013,7 @@ var init_version = __esm({
   "packages/core/src/version.ts"() {
     "use strict";
     WORKSPACE_VERSION = "0.0.0";
-    BUILT_VERSION = true ? "0.2.3" : null;
+    BUILT_VERSION = true ? "0.2.4" : null;
   }
 });
 
@@ -5195,11 +5200,12 @@ company email domain; in any other org, including a personal one or one
 made with \`wirl orgs create\`, it starts private. Deploys are one
 command; sharing is by email; a third-party API is declared, never pasted.`;
 var SKILL_DOCS_LINE = "Before you build, fetch https://docs.wirl.dev/llms-full.txt: every page of the docs as one Markdown file, so there is no need to read the site page by page.";
-var SKILL_RULES = `1. **Never ask for or paste an API key.** Declare the connection in \`wirl.json\` and deploy. Needs no key at all (a public API)? Declare it with "kind": "none" and its hosts. If the key is missing, the deploy prints a link to the app's keys page; show the person that link. Locally, keys live in \`.wirl/keys.json\`, which git ignores. To try a vendor call locally without the key, map its connection to a server of your own in \`.wirl/mocks.json\`, like \`{ "anthropic": "http://127.0.0.1:4010" }\`: \`wirl dev\` then sends the calls to that connection's hosts there instead (\`wirl dev --help\` has the rest).
+var SKILL_RULES = `1. **Never ask for or paste an API key.** Declare the connection in \`wirl.json\` and deploy. Needs no key at all (a public API)? Declare it with "kind": "none" and its hosts. If the key is missing, the deploy prints a link to the app's keys page; show the person that link. Locally, keys live in \`.wirl/keys.json\`, which git ignores. To try a vendor call locally without the key, map its connection to a server of your own in \`.wirl/mocks.json\`, like \`{ "anthropic": "http://127.0.0.1:4010" }\`: \`wirl dev\` then sends the calls to that connection's hosts there instead (\`wirl dev --help\` has the rest). Models need no key either: call https://ai.wirl/<vendor>/\u2026 (see Models).
 2. **Call third-party APIs by their real URL** (\`fetch("https://api.hubspot.com/...")\`). wirl attaches the key on the way out, deployed and under \`wirl dev\` alike.
-3. If a command names several organisations and asks which, ask the person; pass \`--org\` or put \`"org"\` in \`wirl.json\`.
-4. To keep a file out of the deploy, list it in a \`.wirlignore\` at the project root (gitignore-style lines; no \`!\` negation).
-5. **A file that can lose data waits for a person.** A deploy that would apply a destructive file (one wirl.json's \`"destructive"\` list must name) to the live database stops and names the page where a person approves each one. Show the person those pages, and deploy again once they say they approved. If \`${WIRL_BIN} deploy\` asks you to type a file's name, stop it and show the page instead, or deploy with \`--json\`, which never asks. Never type the name yourself or send the confirmation: that is the person's, and no flag skips it.`;
+3. **Asked to connect an app to Slack, or to receive events from any outside service:** follow the pattern on https://docs.wirl.dev/models (public path with "verify": "slack", a connection of kind http_bearer for the bot token and one of kind webhook_secret for the signing secret, the Slack app manifest you give the person to create the app with). Never ask for the token or secret in chat: the person pastes them on the app's Connections page, and you say which two values.
+4. If a command names several organisations and asks which, ask the person; pass \`--org\` or put \`"org"\` in \`wirl.json\`.
+5. To keep a file out of the deploy, list it in a \`.wirlignore\` at the project root (gitignore-style lines; no \`!\` negation).
+6. **A file that can lose data waits for a person.** A deploy that would apply a destructive file (one wirl.json's \`"destructive"\` list must name) to the live database stops and names the page where a person approves each one. Show the person those pages, and deploy again once they say they approved. If \`${WIRL_BIN} deploy\` asks you to type a file's name, stop it and show the page instead, or deploy with \`--json\`, which never asks. Never type the name yourself or send the confirmation: that is the person's, and no flag skips it.`;
 var SKILL_MANIFEST_EXAMPLE = `\`\`\`json
 { "app": "crm-sync", "server": "server.mjs", "connections": [{ "slug": "hubspot", "hosts": ["api.hubspot.com"] }] }
 \`\`\``;
@@ -5250,37 +5256,59 @@ ${FLOWS_CONTRACT}
 init_src();
 var SUGGESTIONS = [
   {
-    title: "Rename it to something we'd actually use",
-    prompt: `Rename this noticeboard to something my team would actually use. Ask me what we would use it for, suggest three names, and when I pick one, change the page's title and heading and the description in wirl.json to match. Keep "app" in wirl.json as it is: a new name there would make a second app at a new address. Then deploy it with wirl deploy.`
+    number: 1,
+    title: "Summarise the week",
+    capability: "A model comes with every app. Your agent just uses it; nothing to sign up for or paste.",
+    prompt: `Add a "Summarise this week" button above the notes. When pressed, send this week's notes to a language model and show a three-line summary at the top of the page. Try it with wirl dev, then deploy it with wirl deploy. Keep the latest summary so everyone who opens the page sees it.`,
+    youGet: "a summary card above the notes."
   },
   {
-    title: "Try a new look in a preview first",
-    prompt: "Give the noticeboard a warmer look: pinned notes as coloured cards, and tags as small coloured labels. Put it up with wirl preview first and give me the preview's address to check. Deploy it with wirl deploy only after I say it looks right."
+    number: 2,
+    title: "Give notes a due date",
+    capability: "The database is yours. Changing its shape is one migration file and one deploy; wirl applies it before the new version goes live, and the Data page on the dashboard shows the result.",
+    prompt: "Add an optional due date to notes. Add the column in a new migration file with the next number, and never edit a migration that has already been applied. Let people set the date when they post or edit a note, show it on each note, and put notes due soonest at the top. Try it with wirl dev, then deploy it with wirl deploy.",
+    youGet: "a date on each note, the soonest first, and a new column on the Data page."
   },
   {
-    title: "Add a due date to notes",
-    prompt: "Add an optional due date to notes on the noticeboard. Add the column in a new file, migrations/0002_due_date.sql, and never edit 0001. Let people set the date when they post or edit a note, show it on each note, and put notes due soonest at the top. Try it with wirl dev, then deploy it with wirl deploy."
+    number: 3,
+    title: "Pull in something from outside",
+    capability: "Every call out goes through wirl. The agent declares the host as a connection; a public API needs no key, and one that does gets its key on the dashboard, never in the code.",
+    prompt: `Show today's weather under the notes for our city (ask me which city if you don't know), from a public weather API that needs no key. Declare the API's host as a connection in wirl.json with "kind": "none". Try it with wirl dev, then deploy it with wirl deploy. If the deploy says the connection is waiting on an admin, show me the link it prints.`,
+    youGet: "a weather line under the notes, and the host listed on the app's Connections page."
   },
   {
-    title: "Show the weather from a public API",
-    prompt: `Show today's weather for our office at the top of the noticeboard, from Open-Meteo, a public weather API that needs no key. Ask me which city our office is in. Add this entry to "connections" in wirl.json: {"slug": "open-meteo", "kind": "none", "hosts": ["api.open-meteo.com"]}. Fetch Open-Meteo's own URL from server.mjs, and deploy it with wirl deploy. If the deploy says open-meteo is waiting, the connection needs approving, which your sign-in cannot do: tell me to approve it on the app's Connections page on app.wirl.dev, or to ask an admin of our organisation to. The weather shows once it is approved.`
+    number: 4,
+    title: "Try a new look before anyone sees it",
+    // The mock says "Previews are free."; the starter carries no price words (its test forbids "free").
+    capability: "Previews are a safe place to try. A preview gets its own address and its own database, so you can look at a change with a colleague before it goes live.",
+    prompt: "Give the noticeboard a calmer look: more space between notes, a softer background, the newest note set apart at the top. Put it up as a preview called new-look with wirl preview and give me the link. Don't deploy it yet. Keep the change on a branch and don't run wirl deploy until I say deploy it.",
+    youGet: 'a second address to open next to this one. Say "deploy it" when you like it.'
   },
   {
-    title: "Change when the tidy-up runs",
-    prompt: "Change the noticeboard's nightly tidy-up: archive notes after 14 days instead of 30, and run it at 6pm on weekdays in my time zone (ask me which). Change the schedule in wirl.json and the number in server.mjs, deploy it with wirl deploy, then run it once with wirl run tidy and tell me what it said."
-  },
-  {
-    title: "Find out what happened from the logs",
-    prompt: "Read this app's logs with wirl logs and tell me, in a few lines, what people did on the noticeboard today and whether anything failed."
+    number: 5,
+    title: "Share it with a colleague",
+    capability: "Company sign-in is already on. Anyone you name opens the link with their work account; the Access page shows who can, and you can take it back any time.",
+    prompt: "Help me share this app with a colleague: tell me how to give them access and the link they open.",
+    youGet: "their name on the Access page, and a link they open with their work account."
   },
   {
-    title: "Share it with a colleague",
-    prompt: `Help me share this noticeboard with a colleague. Sharing is done by me, not by a deploy: tell me to share it from the app's Access page on app.wirl.dev (the "Who can open it" row on the noticeboard links to it), where I add their email address. Then tell me what they will see when they open the address.`
+    number: 6,
+    title: "Connect it to Slack",
+    capability: "Apps can reach the tools your company already uses. Your agent knows wirl's Slack pattern: it gives you a Slack app to create in one click, you paste two values on the app's Connections page, and the noticeboard starts a DM with you. Ask it about the notes, or tell it to add one, from Slack.",
+    prompt: "Connect this noticeboard to Slack so it DMs me this week's summary and I can chat with it there: ask it about the notes, or tell it to add or change one. Give me the Slack app manifest to create the app with, and tell me which two values to paste on the app's Connections page.",
+    youGet: "a DM from the noticeboard in Slack. Everything above works without it.",
+    optional: true
   }
 ];
+var splitCapability = (capability) => {
+  const stop = capability.indexOf(". ");
+  return [capability.slice(0, stop + 1), capability.slice(stop + 2)];
+};
 var SUGGESTIONS_SOURCE = [
   "const SUGGESTIONS = [",
-  ...SUGGESTIONS.map(({ title, prompt }) => `  { title: ${JSON.stringify(title)}, prompt: ${JSON.stringify(prompt)} },`),
+  ...SUGGESTIONS.map(
+    ({ number, title, capability, prompt, youGet, optional }) => `  { number: ${String(number)}, title: ${JSON.stringify(title)}, capability: ${JSON.stringify(capability)}, prompt: ${JSON.stringify(prompt)}, youGet: ${JSON.stringify(youGet)}${optional ? ", optional: true" : ""} },`
+  ),
   "];"
 ].join("\n");
 var SERVER_HEAD = String.raw`/**
@@ -5288,9 +5316,9 @@ var SERVER_HEAD = String.raw`/**
  *
  * Your team posts short notes here, tags them, pins the ones everyone should
  * see, and edits or removes their own. Every night a schedule archives old
- * notes nobody pinned. The page also explains itself: a "How this works on
- * wirl" panel, one row per feature, each linking to that page of the app on
- * app.wirl.dev, and a few changes to ask your coding agent for next.
+ * notes nobody pinned. Below the notes, "Make it yours": six prompts to
+ * paste to your coding agent, in order, each saying what wirl gives the app
+ * and what you get. Under them, the app's pages on app.wirl.dev.
  *
  * The whole app is this one file:
  * - The page is HTML this module returns: plain forms, no script.
@@ -5461,8 +5489,9 @@ async function page(request, url, me, env) {
     "<p class='dim'>Your first app on wirl. Signed in as <b>" + escape(me.name) + "</b>" + (me.role ? " (" + escape(me.role) + ")" : "") + ".</p></header>",
     shown,
     "<ul class='notes'>" + (notes.length === 0 ? "<li class='dim'>Nothing here yet.</li>" : notes.map((note) => card(note, me, archived)).join("")) + "</ul>",
-    panel(request, me, lastRun),
-    suggestions(),
+    "<p class='dim'>Nightly tidy-up, which archives notes older than " + ARCHIVE_AFTER_DAYS + " days that nobody pinned: " +
+      (lastRun ? "last run " + escape(lastRun.ran_at.slice(0, 16)) + " UTC: " + escape(lastRun.note) : "Not run yet.") + "</p>",
+    prompts(request),
     "</main>",
     "</html>",
   ].join("\n");
@@ -5507,50 +5536,54 @@ function card(note, me, archived) {
   );
 }
 
-// The app's page on the dashboard, from the address it was opened at:
+// The app's pages on the dashboard, from the address it was opened at:
 // <org>--<app>.wirl.run, or <org>--<app>--<preview>.wirl.run for a preview.
 // Under wirl dev the address is 127.0.0.1, which names no app: null.
 function dashboard(request) {
   const label = new URL(request.url).hostname.split(".")[0];
   const parts = label.split("--");
   if (parts.length < 2) return null;
-  const org = request.headers.get("x-wirl-org") || parts[0];
-  return DASHBOARD + "/apps/" + encodeURIComponent(org) + "/" + encodeURIComponent(parts[1]);
+  const org = encodeURIComponent(request.headers.get("x-wirl-org") || parts[0]);
+  return { app: DASHBOARD + "/apps/" + org + "/" + encodeURIComponent(parts[1]), org: DASHBOARD + "/orgs/" + org };
 }
 
-function panel(request, me, lastRun) {
-  const base = dashboard(request);
-  const last = lastRun ? "Last run " + lastRun.ran_at.slice(0, 16) + " UTC: " + lastRun.note : "Not run yet.";
-  // One row per feature: what it is, what it does in this app, and its page.
-  const rows = [
-    ["Who can open it", "wirl signed you in before this page loaded and tells the app who you are, in headers: here you are " + me.name + (me.role ? ", " + me.role : "") + ". The app has no sign-in code of its own. It started private to you; choose who else can open it on Access.", "/access", "Access"],
-    ["Your data", "Notes are rows in this app's own SQLite database. Its tables are in migrations/0001_init.sql, and a deploy applies each new file in migrations/ before it goes live.", "/deployments", "Deployments"],
-    ["A schedule", "tidy runs every night at 02:00 UTC and archives notes older than " + ARCHIVE_AFTER_DAYS + " days that nobody pinned. " + last + " Run it now from Overview.", "", "Overview"],
-    ["Logs", "Each request writes a line with console.log, and so does each change to a note. Read them on Logs, or ask your agent to run wirl logs.", "/logs", "Logs"],
-    ["Versions", "Each wirl deploy is a new version, and the earlier ones stay: going back to one takes a click.", "/deployments", "Deployments"],
-    ["Previews", "wirl preview puts a change up at an address of its own, with its own database, and nothing goes live until you deploy. Open previews are listed on Overview.", "", "Overview"],
-    ["Outside APIs", "Declare a connection in wirl.json and fetch the service's own URL: wirl adds the key on the way out, so it never reaches this code or a chat.", "/connections", "Connections"],
-    ["Settings", "Describe the app for your team's list of tools, hand it to someone else, or delete it.", "/settings", "Settings"],
+// The onboarding path: each prompt whole, visible and ready to select and
+// copy, with what wirl gives the app and what you get. Then what the app
+// already uses, and its pages on the dashboard.
+function prompts(request) {
+  const where = dashboard(request);
+  const pages = [
+    ["Overview", "app", ""],
+    ["Data", "app", "/data"],
+    ["Access", "app", "/access"],
+    ["Logs", "app", "/logs"],
+    ["Deployments", "app", "/deployments"],
+    ["Models", "org", "/models"],
+    ["Connections", "app", "/connections"],
+    ["Settings", "app", "/settings"],
   ];
+  const link = ([label, of, path]) =>
+    where === null ? "<span class='dim'>" + label + "</span>" : "<a href='" + escape(where[of] + path) + "'>" + label + "</a>";
+  const step = (each) => {
+    const stop = each.capability.indexOf(". ");
+    return (
+      "<li class='step" + (each.optional ? " optional" : "") + "'>" +
+      "<h3><span class='number'>" + each.number + "</span> " + escape(each.title) +
+      (each.optional ? " <span class='badge'>Optional. The big one.</span>" : "") + "</h3>" +
+      "<p class='dim'><b>" + escape(each.capability.slice(0, stop + 1)) + "</b> " + escape(each.capability.slice(stop + 2)) + "</p>" +
+      "<pre>" + escape(each.prompt) + "</pre>" +
+      "<p class='dim'>You get: " + escape(each.youGet) + "</p>" +
+      "</li>"
+    );
+  };
   return [
-    "<section><h2>How this works on wirl</h2>",
-    "<table>",
-    ...rows.map(([feature, what, path, label]) =>
-      "<tr><td>" + feature + "</td><td>" + escape(what) + "</td><td>" +
-      (base === null ? "<span class='dim'>" + label + "</span>" : "<a href='" + escape(base + path) + "'>" + label + "</a>") +
-      "</td></tr>",
-    ),
-    "</table>",
-    base === null ? "<p class='dim'>Running under wirl dev, so these pages are not linked here: they open on app.wirl.dev once it is deployed.</p>" : "",
-    "</section>",
-  ].join("\n");
-}
-
-function suggestions() {
-  return [
-    "<section><h2>Ask your agent for a first change</h2>",
-    "<p class='dim'>Each of these is a whole prompt. Open one, copy it, and paste it to the coding agent that made this app.</p>",
-    ...SUGGESTIONS.map((each) => "<details><summary>" + escape(each.title) + "</summary><pre>" + escape(each.prompt) + "</pre></details>"),
+    "<section id='prompts'><h2>Make it yours</h2>",
+    "<p>This app is live, at a link your team can open. Everything below is a whole prompt. Copy one, paste it to the coding agent that made this app, and the feature appears here on the next deploy. Go in order or skip around; the last one is the big one.</p>",
+    "<ol class='steps'>",
+    ...SUGGESTIONS.map(step),
+    "</ol>",
+    "<p class='dim uses'>This app already uses a database, a nightly schedule, company sign-in and logs. Each has a page on the dashboard: " + pages.map(link).join(" · ") + "</p>",
+    where === null ? "<p class='dim'>Running under wirl dev, so these pages are not linked here: they open on app.wirl.dev once it is deployed.</p>" : "",
     "</section>",
   ].join("\n");
 }
@@ -5575,10 +5608,16 @@ const STYLE = [
   ".meta, .actions { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; font-size: 13px; }",
   ".actions { margin-top: 8px; } .actions form { margin: 0; } .actions details { flex-basis: 100%; order: 3; }",
   ".tag { text-decoration: none; }",
-  "table { width: 100%; border-collapse: collapse; font-size: 14px; }",
-  "td { border-top: 1px solid var(--line); padding: 8px 6px; vertical-align: top; }",
-  "td:first-child { font-weight: 600; }",
-  "pre { white-space: pre-wrap; background: var(--card); border: 1px solid var(--line); border-radius: 6px; padding: 10px; font-size: 13px; }",
+  "ol.steps { list-style: none; padding: 0; display: grid; gap: 12px; }",
+  ".step { background: var(--card); border: 1px solid var(--line); border-radius: 8px; padding: 12px 14px; }",
+  ".step.optional { border: 2px solid var(--accent); }",
+  ".step h3 { font-size: 16px; margin: 0 0 6px; display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }",
+  ".step p { margin: 6px 0; } .step b { color: var(--accent); }",
+  ".number { font-size: 12px; background: var(--ink); color: var(--bg); padding: 2px 7px; border-radius: 5px; }",
+  ".optional .number { background: var(--accent); }",
+  ".badge { font-size: 12px; font-weight: 600; color: var(--dim); border: 1px solid var(--line); padding: 1px 8px; border-radius: 999px; }",
+  ".uses { border-top: 1px solid var(--line); padding-top: 12px; font-size: 14px; }",
+  "pre { white-space: pre-wrap; user-select: all; background: var(--bg); border: 1px solid var(--line); border-radius: 6px; padding: 10px; font-size: 13px; }",
   "details { margin: 6px 0; } summary { cursor: pointer; }",
 ].join("\n");
 
@@ -5640,7 +5679,7 @@ var README = [
   "",
   "Your first app on wirl: a board where your team posts short notes, tags them, pins the ones everyone should see, and edits or removes their own. Every night a schedule archives old notes nobody pinned.",
   "",
-  'Open it at the address `wirl deploy` prints. It starts private to you. Its page has a "How this works on wirl" panel: one row per thing wirl does for this app, each linking to that page of the app on app.wirl.dev.',
+  "Open it at the address `wirl deploy` prints. It starts private to you. Its page is the way in: six prompts to give your coding agent, each saying what wirl gives the app and what you get, and under them the app's pages on app.wirl.dev.",
   "",
   "## What is where",
   "",
@@ -5655,11 +5694,14 @@ var README = [
   "",
   "It prints the address to open, and a `curl` line that runs the nightly tidy-up now.",
   "",
-  "## Changes to ask your agent for",
+  "## Make it yours",
   "",
-  "Each is a whole prompt: paste it to your coding agent as it is.",
+  "The same six prompts as the page. Each is a whole prompt: paste it to your coding agent as it is. Go in order or skip around; the last one is the big one.",
   "",
-  ...SUGGESTIONS.flatMap(({ title, prompt }) => [`### ${title}`, "", `> ${prompt}`, ""])
+  ...SUGGESTIONS.flatMap(({ number, title, capability, prompt, youGet, optional }) => {
+    const [bold, rest] = splitCapability(capability);
+    return [`### ${String(number)}. ${title}`, "", ...optional ? ["Optional. The big one.", ""] : [], `**${bold}** ${rest}`, "", `> ${prompt}`, "", `You get: ${youGet}`, ""];
+  })
 ].join("\n");
 var STARTER_FILES = {
   "server.mjs": SERVER_MODULE,
@@ -6274,7 +6316,7 @@ async function callApiBytes(creds, path, options = {}) {
       body = {};
     }
     if (response.status === 401 || response.status === 403) {
-      throw new CliError("Not signed in, or this token cannot do that.", `Try \`${WIRL_BIN} login\`.`);
+      throw new CliError("Not signed in, or this token cannot do that.", `Try \`${WIRL_BIN} login\`.`, { code: "unauthenticated" });
     }
     if (response.status === 404) throw new CliError("Not found, or you do not have access to it.");
     throw new CliError(body.message ?? body.error ?? `Request failed (${response.status}).`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirl/mcp",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "MCP server for wirl: let your coding agent deploy what it just built, privately.",
   "keywords": [
     "mcp",