applaunchflow 0.3.4 → 0.3.6

package/build/http.js

@@ -148,6 +148,20 @@ export function createHttpServer() {
             json(response, 200, { ok: true, service: "applaunchflow-mcp" });
             return;
         }
+        if (request.method === "GET" &&
+            url.pathname === "/.well-known/openai-apps-challenge") {
+            const token = process.env.OPENAI_APPS_CHALLENGE_TOKEN?.trim();
+            if (!token) {
+                json(response, 404, { error: "Challenge token not configured" });
+                return;
+            }
+            response.writeHead(200, {
+                "content-type": "text/plain; charset=utf-8",
+                "cache-control": "no-store",
+            });
+            response.end(token);
+            return;
+        }
         if (request.method === "GET" &&
             url.pathname === "/.well-known/oauth-protected-resource") {
             json(response, 200, {

package/build/http.test.js

@@ -32,6 +32,41 @@ test("HTTP server exposes health and protected-resource metadata", async () => {
         ]);
     });
 });
+test("HTTP server exposes the configured OpenAI domain challenge", async () => {
+    const previousToken = process.env.OPENAI_APPS_CHALLENGE_TOKEN;
+    process.env.OPENAI_APPS_CHALLENGE_TOKEN = "openai-domain-challenge";
+    try {
+        await withServer(async (baseUrl) => {
+            const response = await fetch(`${baseUrl}/.well-known/openai-apps-challenge`);
+            assert.equal(response.status, 200);
+            assert.equal(response.headers.get("content-type"), "text/plain; charset=utf-8");
+            assert.equal(await response.text(), "openai-domain-challenge");
+        });
+    }
+    finally {
+        if (previousToken === undefined) {
+            delete process.env.OPENAI_APPS_CHALLENGE_TOKEN;
+        }
+        else {
+            process.env.OPENAI_APPS_CHALLENGE_TOKEN = previousToken;
+        }
+    }
+});
+test("OpenAI domain challenge returns 404 when it is not configured", async () => {
+    const previousToken = process.env.OPENAI_APPS_CHALLENGE_TOKEN;
+    delete process.env.OPENAI_APPS_CHALLENGE_TOKEN;
+    try {
+        await withServer(async (baseUrl) => {
+            const response = await fetch(`${baseUrl}/.well-known/openai-apps-challenge`);
+            assert.equal(response.status, 404);
+        });
+    }
+    finally {
+        if (previousToken !== undefined) {
+            process.env.OPENAI_APPS_CHALLENGE_TOKEN = previousToken;
+        }
+    }
+});
 test("MCP endpoint challenges unauthenticated callers with resource metadata", async () => {
     await withServer(async (baseUrl) => {
         const response = await fetch(`${baseUrl}/mcp`, {

package/build/projects.test.js

@@ -0,0 +1,103 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { toProjectSummary, toSafeProjectState } from "./tools/projects.js";
+const rawProject = {
+    id: "00000000-0000-4000-8000-000000000001",
+    user_id: "private-user-id",
+    name: "LaunchNotes Demo",
+    platform: "ios",
+    created_at: "2026-08-01T10:00:00.000Z",
+    updated_at: "2026-08-12T10:00:00.000Z",
+    metadata: {
+        appName: "LaunchNotes Demo",
+        category: "Productivity",
+        defaultDeviceType: "phone",
+        detectedLanguage: "en",
+        logoPath: "private/logo.png",
+        logoUrl: "https://storage.example/private-logo?token=secret",
+        screenshotCache: { firstMobilePath: "private/screenshot.png" },
+    },
+    aso_copy: { keywords: "private keyword payload" },
+};
+test("project summaries contain only workflow-relevant public fields", () => {
+    assert.deepEqual(toProjectSummary(rawProject), {
+        id: rawProject.id,
+        name: "LaunchNotes Demo",
+        platform: "ios",
+        updatedAt: "2026-08-12T10:00:00.000Z",
+        category: "Productivity",
+        defaultDeviceType: "phone",
+        detectedLanguage: "en",
+    });
+});
+test("safe project state removes internal records and signed asset URLs", () => {
+    const state = toSafeProjectState({
+        project: { ...rawProject, logoUrl: "https://storage.example/logo?token=secret" },
+        assets: {
+            mobileScreenshots: ["https://storage.example/one?token=secret"],
+            tabletScreenshots: [],
+            desktopScreenshots: ["https://storage.example/two?token=secret"],
+            logo: "https://storage.example/logo?token=secret",
+            qrCodes: [{ signedUrl: "https://storage.example/qr?token=secret" }],
+        },
+        content: {
+            screenshots: {
+                type: "screenshots",
+                variants: [
+                    {
+                        id: "variant-id",
+                        generation_id: "generation-id",
+                        content_type: "screenshots",
+                        label: "v1",
+                        is_active: true,
+                        created_at: "2026-08-01T10:00:00.000Z",
+                        updated_at: "2026-08-12T10:00:00.000Z",
+                        languages: ["en"],
+                        ready: true,
+                        config: { internal: true },
+                    },
+                ],
+                activeVariant: {
+                    id: "variant-id",
+                    generation_id: "generation-id",
+                    is_active: true,
+                    ready: true,
+                },
+                editUrl: "https://dashboard.applaunchflow.com/editor?id=safe",
+                variantCount: 1,
+                isReady: true,
+                translations: [{ raw: "private layout" }],
+            },
+            asoCopy: { asoCopy: { keywords: "private" } },
+            appIcon: { variants: [{ config: "private" }] },
+        },
+        progress: {
+            totalItems: 4,
+            completedItems: 1,
+            percentage: 25,
+            missingItems: ["promoVideo"],
+        },
+        readyItems: { "internal-generation-id": true },
+    });
+    assert.deepEqual(state.assets, {
+        screenshotCounts: { mobile: 1, tablet: 0, desktop: 1 },
+        hasLogo: true,
+        qrCodeCount: 1,
+    });
+    assert.deepEqual(Object.keys(state.content), ["screenshots"]);
+    const serialized = JSON.stringify(state);
+    for (const forbidden of [
+        "private-user-id",
+        "token=secret",
+        "logoPath",
+        "screenshotCache",
+        "aso_copy",
+        "translations",
+        "readyItems",
+        "created_at",
+        "content_type",
+        "config",
+    ]) {
+        assert.equal(serialized.includes(forbidden), false, forbidden);
+    }
+});

package/build/promovideo-picker.test.js

@@ -1,18 +1,18 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { buildPromoVideoCandidateRequest, buildPromoVideoEditorUrl, } from "./tools/promovideo.js";
+import { buildPromoVideoCandidateRequest, buildPromoVideoDashboardUrl, } from "./tools/promovideo.js";
 test("generate_promo_video requests three transient candidates", () => {
     assert.deepEqual(buildPromoVideoCandidateRequest({ projectId: "project", message: "fresh" }), { projectId: "project", message: "fresh", candidateCount: 3 });
 });
 test("the MCP opens the dashboard candidate picker instead of a saved variant", () => {
-    const url = new URL(buildPromoVideoEditorUrl({
+    const url = new URL(buildPromoVideoDashboardUrl({
         credentials: { baseUrl: "https://dashboard.applaunchflow.com" },
     }, {
         generationId: "11111111-1111-4111-8111-111111111111",
         candidateKey: "candidate-key",
         replaceVariantId: "22222222-2222-4222-8222-222222222222",
     }));
-    assert.equal(url.pathname, "/promovideo");
+    assert.equal(url.pathname, "/promo-video-picker");
     assert.equal(url.searchParams.get("candidateKey"), "candidate-key");
     assert.equal(url.searchParams.get("replaceVariantId"), "22222222-2222-4222-8222-222222222222");
 });

package/build/tools/projects.js

@@ -3,13 +3,143 @@ import { fail, ok } from "./utils.js";
 function stripUndefined(value) {
     return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
 }
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+function safeHttpsUrl(value) {
+    if (typeof value !== "string")
+        return undefined;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function toProjectSummary(value) {
+    const project = isRecord(value) ? value : {};
+    const metadata = isRecord(project.metadata) ? project.metadata : {};
+    return stripUndefined({
+        id: typeof project.id === "string" ? project.id : undefined,
+        name: typeof project.name === "string"
+            ? project.name
+            : typeof metadata.appName === "string"
+                ? metadata.appName
+                : undefined,
+        platform: typeof project.platform === "string"
+            ? project.platform
+            : typeof metadata.platform === "string"
+                ? metadata.platform
+                : undefined,
+        updatedAt: typeof project.updated_at === "string"
+            ? project.updated_at
+            : typeof project.updatedAt === "string"
+                ? project.updatedAt
+                : undefined,
+        category: typeof metadata.category === "string" ? metadata.category : undefined,
+        defaultDeviceType: typeof metadata.defaultDeviceType === "string"
+            ? metadata.defaultDeviceType
+            : undefined,
+        detectedLanguage: typeof metadata.detectedLanguage === "string"
+            ? metadata.detectedLanguage
+            : undefined,
+    });
+}
+function toVariantSummary(value) {
+    const variant = isRecord(value) ? value : {};
+    return stripUndefined({
+        id: typeof variant.id === "string" ? variant.id : undefined,
+        generationId: typeof variant.generation_id === "string"
+            ? variant.generation_id
+            : typeof variant.generationId === "string"
+                ? variant.generationId
+                : undefined,
+        label: typeof variant.label === "string" ? variant.label : undefined,
+        isActive: typeof variant.is_active === "boolean"
+            ? variant.is_active
+            : typeof variant.isActive === "boolean"
+                ? variant.isActive
+                : undefined,
+        updatedAt: typeof variant.updated_at === "string"
+            ? variant.updated_at
+            : typeof variant.updatedAt === "string"
+                ? variant.updatedAt
+                : undefined,
+        languages: Array.isArray(variant.languages)
+            ? variant.languages.filter((entry) => typeof entry === "string")
+            : undefined,
+        ready: typeof variant.ready === "boolean" ? variant.ready : undefined,
+    });
+}
+function toContentSummary(value) {
+    const content = isRecord(value) ? value : {};
+    const variants = asArray(content.variants).map(toVariantSummary);
+    const activeVariant = isRecord(content.activeVariant)
+        ? toVariantSummary(content.activeVariant)
+        : undefined;
+    return stripUndefined({
+        type: typeof content.type === "string" ? content.type : undefined,
+        variants,
+        activeVariant,
+        editUrl: safeHttpsUrl(content.editUrl),
+        activeLabel: typeof content.activeLabel === "string" ? content.activeLabel : undefined,
+        variantCount: typeof content.variantCount === "number"
+            ? content.variantCount
+            : variants.length,
+        isReady: typeof content.isReady === "boolean" ? content.isReady : undefined,
+        hasContent: typeof content.hasContent === "boolean" ? content.hasContent : undefined,
+        screenshotTemplateId: typeof content.screenshotTemplateId === "string"
+            ? content.screenshotTemplateId
+            : undefined,
+        socialTemplateId: typeof content.socialTemplateId === "string"
+            ? content.socialTemplateId
+            : undefined,
+    });
+}
+export function toSafeProjectState(value) {
+    const state = isRecord(value) ? value : {};
+    const assets = isRecord(state.assets) ? state.assets : {};
+    const content = isRecord(state.content) ? state.content : {};
+    const progress = isRecord(state.progress) ? state.progress : {};
+    const safeContent = Object.fromEntries(["screenshots", "socialGraphics", "promoVideo", "mockups"]
+        .filter((key) => isRecord(content[key]))
+        .map((key) => [key, toContentSummary(content[key])]));
+    return {
+        project: toProjectSummary(state.project),
+        assets: {
+            screenshotCounts: {
+                mobile: asArray(assets.mobileScreenshots).length,
+                tablet: asArray(assets.tabletScreenshots).length,
+                desktop: asArray(assets.desktopScreenshots).length,
+            },
+            hasLogo: typeof assets.logo === "string" && assets.logo.length > 0,
+            qrCodeCount: asArray(assets.qrCodes).length,
+        },
+        content: safeContent,
+        progress: stripUndefined({
+            totalItems: typeof progress.totalItems === "number" ? progress.totalItems : undefined,
+            completedItems: typeof progress.completedItems === "number"
+                ? progress.completedItems
+                : undefined,
+            percentage: typeof progress.percentage === "number" ? progress.percentage : undefined,
+            missingItems: Array.isArray(progress.missingItems)
+                ? progress.missingItems.filter((entry) => typeof entry === "string")
+                : undefined,
+        }),
+    };
+}
 export function registerProjectTools(server, client) {
     server.registerTool("list_projects", {
         title: "List Projects",
         description: "List AppLaunchFlow projects for the authenticated user",
     }, async () => {
         try {
-            return ok(await client.listProjects(), "Fetched projects");
+            const result = await client.listProjects();
+            return ok({ projects: asArray(result.projects).map(toProjectSummary) }, "Fetched projects");
         }
         catch (error) {
             return fail(error);
@@ -23,7 +153,7 @@ export function registerProjectTools(server, client) {
         },
     }, async ({ projectId }) => {
         try {
-            return ok(await client.getProject(projectId), "Fetched project");
+            return ok(toSafeProjectState(await client.getProject(projectId)), "Fetched project");
         }
         catch (error) {
             return fail(error);
@@ -88,7 +218,7 @@ export function registerProjectTools(server, client) {
             });
             const created = await client.createProject(requestBody);
             return ok({
-                project: created.project,
+                project: toProjectSummary(created.project),
                 nextRecommendedStep: "upload_screenshots",
             }, "Created project");
         }

package/build/tools/promovideo.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { createHostedReadReceipt, createReadReceiptStore, fail, hostedMcpEnabled, ok, openUrl, verifyHostedReadReceipt, } from "./utils.js";
 const promoReceiptKey = (generationId, variantId) => ["promo-video", generationId, variantId || "active"].join("::");
-export function buildPromoVideoEditorUrl(client, args) {
+export function buildPromoVideoDashboardUrl(client, args) {
     const params = new URLSearchParams({ projectId: args.generationId });
     if (args.variantId) {
         params.set("variantId", args.variantId);
@@ -12,7 +12,10 @@ export function buildPromoVideoEditorUrl(client, args) {
     if (args.replaceVariantId) {
         params.set("replaceVariantId", args.replaceVariantId);
     }
-    return `${client.credentials.baseUrl}/promovideo?${params.toString()}`;
+    const pathname = args.candidateKey
+        ? "/promo-video-picker"
+        : "/promovideo";
+    return `${client.credentials.baseUrl}${pathname}?${params.toString()}`;
 }
 export function buildPromoVideoCandidateRequest(args) {
     return { ...args, candidateCount: 3 };
@@ -53,26 +56,26 @@ export function registerPromoVideoTools(server, client) {
             if (!result?.candidateKey || result?.candidates?.length !== 3) {
                 throw new Error("Promo video generation did not return a reusable three-option picker");
             }
-            const editorUrl = buildPromoVideoEditorUrl(client, {
+            const pickerUrl = buildPromoVideoDashboardUrl(client, {
                 generationId: args.projectId,
                 candidateKey: result.candidateKey,
                 replaceVariantId: args.replaceVariantId,
             });
-            await openUrl(server, editorUrl, "Compare three personalized promo-video candidates and choose which one to create.", { signal: extra.signal });
+            await openUrl(server, pickerUrl, "Compare three personalized promo-video candidates and choose which one to create.", { signal: extra.signal });
             return {
                 content: [
                     {
                         type: "text",
                         text: [
                             "Prepared three personalized promo-video candidates without creating a saved variant yet.",
-                            `Candidate picker URL: ${editorUrl}`,
+                            `Candidate picker URL: ${pickerUrl}`,
                             "The dashboard picker previews all three options. Choosing one creates that variant and opens it in the promo-video editor.",
                         ].join("\n"),
                     },
                 ],
                 structuredContent: {
                     success: true,
-                    data: { ...result, editorUrl },
+                    data: { ...result, editorUrl: pickerUrl },
                     message: "Prepared promo video candidates",
                 },
             };
@@ -92,7 +95,7 @@ export function registerPromoVideoTools(server, client) {
     }, async ({ generationId, variantId }) => {
         try {
             const result = await client.getPromoVideo(generationId, variantId);
-            const editorUrl = buildPromoVideoEditorUrl(client, {
+            const editorUrl = buildPromoVideoDashboardUrl(client, {
                 generationId,
                 variantId,
             });
@@ -168,7 +171,7 @@ export function registerPromoVideoTools(server, client) {
             const { readReceipt: _readReceipt, ...updateArgs } = args;
             const result = await client.updatePromoVideo(updateArgs);
             promoVideoReadReceipts.consume(receiptArgs);
-            const editorUrl = buildPromoVideoEditorUrl(client, {
+            const editorUrl = buildPromoVideoDashboardUrl(client, {
                 generationId: args.projectId,
                 variantId: args.variantId,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "applaunchflow",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Hosted OAuth MCP connector for AppLaunchFlow.",
   "license": "MIT",
   "repository": {