applaunchflow 0.3.5 → 0.3.6

package/build/http.js

@@ -148,6 +148,20 @@ export function createHttpServer() {
             json(response, 200, { ok: true, service: "applaunchflow-mcp" });
             return;
         }
+        if (request.method === "GET" &&
+            url.pathname === "/.well-known/openai-apps-challenge") {
+            const token = process.env.OPENAI_APPS_CHALLENGE_TOKEN?.trim();
+            if (!token) {
+                json(response, 404, { error: "Challenge token not configured" });
+                return;
+            }
+            response.writeHead(200, {
+                "content-type": "text/plain; charset=utf-8",
+                "cache-control": "no-store",
+            });
+            response.end(token);
+            return;
+        }
         if (request.method === "GET" &&
             url.pathname === "/.well-known/oauth-protected-resource") {
             json(response, 200, {

package/build/http.test.js

@@ -32,6 +32,41 @@ test("HTTP server exposes health and protected-resource metadata", async () => {
         ]);
     });
 });
+test("HTTP server exposes the configured OpenAI domain challenge", async () => {
+    const previousToken = process.env.OPENAI_APPS_CHALLENGE_TOKEN;
+    process.env.OPENAI_APPS_CHALLENGE_TOKEN = "openai-domain-challenge";
+    try {
+        await withServer(async (baseUrl) => {
+            const response = await fetch(`${baseUrl}/.well-known/openai-apps-challenge`);
+            assert.equal(response.status, 200);
+            assert.equal(response.headers.get("content-type"), "text/plain; charset=utf-8");
+            assert.equal(await response.text(), "openai-domain-challenge");
+        });
+    }
+    finally {
+        if (previousToken === undefined) {
+            delete process.env.OPENAI_APPS_CHALLENGE_TOKEN;
+        }
+        else {
+            process.env.OPENAI_APPS_CHALLENGE_TOKEN = previousToken;
+        }
+    }
+});
+test("OpenAI domain challenge returns 404 when it is not configured", async () => {
+    const previousToken = process.env.OPENAI_APPS_CHALLENGE_TOKEN;
+    delete process.env.OPENAI_APPS_CHALLENGE_TOKEN;
+    try {
+        await withServer(async (baseUrl) => {
+            const response = await fetch(`${baseUrl}/.well-known/openai-apps-challenge`);
+            assert.equal(response.status, 404);
+        });
+    }
+    finally {
+        if (previousToken !== undefined) {
+            process.env.OPENAI_APPS_CHALLENGE_TOKEN = previousToken;
+        }
+    }
+});
 test("MCP endpoint challenges unauthenticated callers with resource metadata", async () => {
     await withServer(async (baseUrl) => {
         const response = await fetch(`${baseUrl}/mcp`, {

package/build/projects.test.js

@@ -0,0 +1,103 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { toProjectSummary, toSafeProjectState } from "./tools/projects.js";
+const rawProject = {
+    id: "00000000-0000-4000-8000-000000000001",
+    user_id: "private-user-id",
+    name: "LaunchNotes Demo",
+    platform: "ios",
+    created_at: "2026-08-01T10:00:00.000Z",
+    updated_at: "2026-08-12T10:00:00.000Z",
+    metadata: {
+        appName: "LaunchNotes Demo",
+        category: "Productivity",
+        defaultDeviceType: "phone",
+        detectedLanguage: "en",
+        logoPath: "private/logo.png",
+        logoUrl: "https://storage.example/private-logo?token=secret",
+        screenshotCache: { firstMobilePath: "private/screenshot.png" },
+    },
+    aso_copy: { keywords: "private keyword payload" },
+};
+test("project summaries contain only workflow-relevant public fields", () => {
+    assert.deepEqual(toProjectSummary(rawProject), {
+        id: rawProject.id,
+        name: "LaunchNotes Demo",
+        platform: "ios",
+        updatedAt: "2026-08-12T10:00:00.000Z",
+        category: "Productivity",
+        defaultDeviceType: "phone",
+        detectedLanguage: "en",
+    });
+});
+test("safe project state removes internal records and signed asset URLs", () => {
+    const state = toSafeProjectState({
+        project: { ...rawProject, logoUrl: "https://storage.example/logo?token=secret" },
+        assets: {
+            mobileScreenshots: ["https://storage.example/one?token=secret"],
+            tabletScreenshots: [],
+            desktopScreenshots: ["https://storage.example/two?token=secret"],
+            logo: "https://storage.example/logo?token=secret",
+            qrCodes: [{ signedUrl: "https://storage.example/qr?token=secret" }],
+        },
+        content: {
+            screenshots: {
+                type: "screenshots",
+                variants: [
+                    {
+                        id: "variant-id",
+                        generation_id: "generation-id",
+                        content_type: "screenshots",
+                        label: "v1",
+                        is_active: true,
+                        created_at: "2026-08-01T10:00:00.000Z",
+                        updated_at: "2026-08-12T10:00:00.000Z",
+                        languages: ["en"],
+                        ready: true,
+                        config: { internal: true },
+                    },
+                ],
+                activeVariant: {
+                    id: "variant-id",
+                    generation_id: "generation-id",
+                    is_active: true,
+                    ready: true,
+                },
+                editUrl: "https://dashboard.applaunchflow.com/editor?id=safe",
+                variantCount: 1,
+                isReady: true,
+                translations: [{ raw: "private layout" }],
+            },
+            asoCopy: { asoCopy: { keywords: "private" } },
+            appIcon: { variants: [{ config: "private" }] },
+        },
+        progress: {
+            totalItems: 4,
+            completedItems: 1,
+            percentage: 25,
+            missingItems: ["promoVideo"],
+        },
+        readyItems: { "internal-generation-id": true },
+    });
+    assert.deepEqual(state.assets, {
+        screenshotCounts: { mobile: 1, tablet: 0, desktop: 1 },
+        hasLogo: true,
+        qrCodeCount: 1,
+    });
+    assert.deepEqual(Object.keys(state.content), ["screenshots"]);
+    const serialized = JSON.stringify(state);
+    for (const forbidden of [
+        "private-user-id",
+        "token=secret",
+        "logoPath",
+        "screenshotCache",
+        "aso_copy",
+        "translations",
+        "readyItems",
+        "created_at",
+        "content_type",
+        "config",
+    ]) {
+        assert.equal(serialized.includes(forbidden), false, forbidden);
+    }
+});

package/build/tools/projects.js

@@ -3,13 +3,143 @@ import { fail, ok } from "./utils.js";
 function stripUndefined(value) {
     return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
 }
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+function safeHttpsUrl(value) {
+    if (typeof value !== "string")
+        return undefined;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function toProjectSummary(value) {
+    const project = isRecord(value) ? value : {};
+    const metadata = isRecord(project.metadata) ? project.metadata : {};
+    return stripUndefined({
+        id: typeof project.id === "string" ? project.id : undefined,
+        name: typeof project.name === "string"
+            ? project.name
+            : typeof metadata.appName === "string"
+                ? metadata.appName
+                : undefined,
+        platform: typeof project.platform === "string"
+            ? project.platform
+            : typeof metadata.platform === "string"
+                ? metadata.platform
+                : undefined,
+        updatedAt: typeof project.updated_at === "string"
+            ? project.updated_at
+            : typeof project.updatedAt === "string"
+                ? project.updatedAt
+                : undefined,
+        category: typeof metadata.category === "string" ? metadata.category : undefined,
+        defaultDeviceType: typeof metadata.defaultDeviceType === "string"
+            ? metadata.defaultDeviceType
+            : undefined,
+        detectedLanguage: typeof metadata.detectedLanguage === "string"
+            ? metadata.detectedLanguage
+            : undefined,
+    });
+}
+function toVariantSummary(value) {
+    const variant = isRecord(value) ? value : {};
+    return stripUndefined({
+        id: typeof variant.id === "string" ? variant.id : undefined,
+        generationId: typeof variant.generation_id === "string"
+            ? variant.generation_id
+            : typeof variant.generationId === "string"
+                ? variant.generationId
+                : undefined,
+        label: typeof variant.label === "string" ? variant.label : undefined,
+        isActive: typeof variant.is_active === "boolean"
+            ? variant.is_active
+            : typeof variant.isActive === "boolean"
+                ? variant.isActive
+                : undefined,
+        updatedAt: typeof variant.updated_at === "string"
+            ? variant.updated_at
+            : typeof variant.updatedAt === "string"
+                ? variant.updatedAt
+                : undefined,
+        languages: Array.isArray(variant.languages)
+            ? variant.languages.filter((entry) => typeof entry === "string")
+            : undefined,
+        ready: typeof variant.ready === "boolean" ? variant.ready : undefined,
+    });
+}
+function toContentSummary(value) {
+    const content = isRecord(value) ? value : {};
+    const variants = asArray(content.variants).map(toVariantSummary);
+    const activeVariant = isRecord(content.activeVariant)
+        ? toVariantSummary(content.activeVariant)
+        : undefined;
+    return stripUndefined({
+        type: typeof content.type === "string" ? content.type : undefined,
+        variants,
+        activeVariant,
+        editUrl: safeHttpsUrl(content.editUrl),
+        activeLabel: typeof content.activeLabel === "string" ? content.activeLabel : undefined,
+        variantCount: typeof content.variantCount === "number"
+            ? content.variantCount
+            : variants.length,
+        isReady: typeof content.isReady === "boolean" ? content.isReady : undefined,
+        hasContent: typeof content.hasContent === "boolean" ? content.hasContent : undefined,
+        screenshotTemplateId: typeof content.screenshotTemplateId === "string"
+            ? content.screenshotTemplateId
+            : undefined,
+        socialTemplateId: typeof content.socialTemplateId === "string"
+            ? content.socialTemplateId
+            : undefined,
+    });
+}
+export function toSafeProjectState(value) {
+    const state = isRecord(value) ? value : {};
+    const assets = isRecord(state.assets) ? state.assets : {};
+    const content = isRecord(state.content) ? state.content : {};
+    const progress = isRecord(state.progress) ? state.progress : {};
+    const safeContent = Object.fromEntries(["screenshots", "socialGraphics", "promoVideo", "mockups"]
+        .filter((key) => isRecord(content[key]))
+        .map((key) => [key, toContentSummary(content[key])]));
+    return {
+        project: toProjectSummary(state.project),
+        assets: {
+            screenshotCounts: {
+                mobile: asArray(assets.mobileScreenshots).length,
+                tablet: asArray(assets.tabletScreenshots).length,
+                desktop: asArray(assets.desktopScreenshots).length,
+            },
+            hasLogo: typeof assets.logo === "string" && assets.logo.length > 0,
+            qrCodeCount: asArray(assets.qrCodes).length,
+        },
+        content: safeContent,
+        progress: stripUndefined({
+            totalItems: typeof progress.totalItems === "number" ? progress.totalItems : undefined,
+            completedItems: typeof progress.completedItems === "number"
+                ? progress.completedItems
+                : undefined,
+            percentage: typeof progress.percentage === "number" ? progress.percentage : undefined,
+            missingItems: Array.isArray(progress.missingItems)
+                ? progress.missingItems.filter((entry) => typeof entry === "string")
+                : undefined,
+        }),
+    };
+}
 export function registerProjectTools(server, client) {
     server.registerTool("list_projects", {
         title: "List Projects",
         description: "List AppLaunchFlow projects for the authenticated user",
     }, async () => {
         try {
-            return ok(await client.listProjects(), "Fetched projects");
+            const result = await client.listProjects();
+            return ok({ projects: asArray(result.projects).map(toProjectSummary) }, "Fetched projects");
         }
         catch (error) {
             return fail(error);
@@ -23,7 +153,7 @@ export function registerProjectTools(server, client) {
         },
     }, async ({ projectId }) => {
         try {
-            return ok(await client.getProject(projectId), "Fetched project");
+            return ok(toSafeProjectState(await client.getProject(projectId)), "Fetched project");
         }
         catch (error) {
             return fail(error);
@@ -88,7 +218,7 @@ export function registerProjectTools(server, client) {
             });
             const created = await client.createProject(requestBody);
             return ok({
-                project: created.project,
+                project: toProjectSummary(created.project),
                 nextRecommendedStep: "upload_screenshots",
             }, "Created project");
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "applaunchflow",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Hosted OAuth MCP connector for AppLaunchFlow.",
   "license": "MIT",
   "repository": {