formlab-mcp 0.4.2 → 0.5.1

package/README.md

@@ -39,7 +39,7 @@ Ask Claude (or another MCP client) things like:
 | `get_batch` | Full record + actual composition + samples + blend lineage |
 | `list_samples` | Filtered list of physical specimens |
 | `get_sample` | Full record + canonical variant + test reports + blend lineage |
-| `list_test_results` | Filtered list of test reports |
+| `list_test_results` | Filtered list of test reports (by sample, parameter, **measured-value range** (`value_min`/`value_max`), date, or lab) |
 | `get_test_result` | Full record + every measurement value |
 | `get_doe_matrix` | Pivot matrix (CSV by default) — rows × ingredients × parameters |
 | `find_failures` | Pareto-style: parameters that fail acceptance most often |
@@ -93,23 +93,22 @@ The MCP server watches the file — re-export from FormLab and the next tool cal
 Instead of an export file, point the server at your **live cloud workspace** so it's always current.
 
 1. In FormLab (Pro): **Settings → Account → AI tools (MCP) → Connect…**
-2. Copy the generated config and paste it into Claude Desktop (it merges with the file-mode example below).
+2. Click **Create token**, copy the generated config, and paste it into Claude Desktop.
 
-The config sets these env vars (which switch the server into cloud mode):
+The config sets a single env var, which switches the server into cloud mode:
 
 | Env var | Value |
 |---|---|
-| `FORMLAB_SUPABASE_URL` | your Supabase project URL (public) |
-| `FORMLAB_SUPABASE_ANON_KEY` | publishable/anon key (public) |
-| `FORMLAB_REFRESH_TOKEN` | your session refresh token — **a credential** |
-| `FORMLAB_WORKSPACE_ID` | (optional) workspace to read; defaults to your own |
+| `FORMLAB_MCP_TOKEN` | a dedicated, **read-only**, revocable token (`flmcp_…`) |
+| `FORMLAB_SUPABASE_URL` | (optional) override the backend URL — defaults to production |
+| `FORMLAB_SUPABASE_ANON_KEY` | (optional) override the publishable key — defaults to production |
 | `FORMLAB_REFRESH_SECONDS` | (optional) poll interval, default `60` |
 
-When `FORMLAB_REFRESH_TOKEN` + URL + key are present, the server reads the workspace directly (RLS-scoped to you), re-fetching every `FORMLAB_REFRESH_SECONDS`. It's **read-only**.
+When `FORMLAB_MCP_TOKEN` is present, the server POSTs it to FormLab's `mcp-data` Edge Function, which returns your workspace scoped to you by row-level security and re-fetches every `FORMLAB_REFRESH_SECONDS`. It's **read-only** — enforced at the database (a dedicated `mcp_readonly` Postgres role with `SELECT`-only grants), not by trust.
 
-> ⚠ **Security.** The refresh token grants read access to your account — treat the config like a password (don't share or commit it). To revoke: FormLab → Account → *Sign out of all devices*. A dedicated, revocable, **read-only** MCP token is the planned hardening (needs a small backend: a tokens table + an Edge Function to mint/validate).
+> **Security.** The token grants **read-only** access to one workspace and holds **no account session** — only a SHA-256 hash is stored server-side, and it never rotates. Treat the config like a password (don't share or commit it). **Revoke or re-mint any time** from *Settings → Account → AI tools (MCP) → Connect*.
 
-Cloud mode needs `@supabase/supabase-js` (a normal dependency) — `npm install` in this folder, or `npx -y formlab-mcp` pulls it automatically.
+Cloud mode has no extra dependency — it's a plain `fetch`.
 
 ## Wire it up to Claude Desktop
 

package/cloud.js

@@ -1,133 +1,77 @@
 // ============================================================
-// CLOUD MODE — read the LIVE FormLab workspace from Supabase instead of a
-// static export file. The tools are unchanged: we assemble the same `db` shape
-// (each synced table stores the full record in a `data` JSONB column) and set it
-// via data.js setStoreFromDb, then re-fetch on an interval so it stays "live".
+// CLOUD MODE — read the LIVE FormLab workspace via the `mcp-data` Edge Function.
+// ------------------------------------------------------------
+// v2 (formlab-mcp ≥0.5.0). The old v1 flow authenticated with the user's account
+// REFRESH TOKEN directly against Supabase — which was broken by design: the
+// refresh token is the full account session AND Supabase rotates it on every
+// use, so the browser and this server fought over one rotation chain and the
+// configured token worked exactly once ("Server disconnected" on the next start).
 //
-// v1 auth: the user's session REFRESH TOKEN (from FormLab's "Connect to MCP"
-// panel). Read-only by usage; RLS scopes every query to the user's own
-// workspaces. The refresh token is the full account session, though — a
-// dedicated, revocable, read-only MCP token is the planned hardening (needs a
-// small backend: a tokens table + an Edge Function to mint/validate).
+// Now we send a dedicated, revocable, READ-ONLY token (`flmcp_…`, minted from
+// FormLab → Connect to MCP) to the `mcp-data` Edge Function, which:
+//   * connects to Postgres as the SELECT-only `mcp_readonly` role (read-only
+//     enforced by the DB, not by trust),
+//   * authenticates the token and scopes every query to the bound workspace via
+//     the existing RLS,
+//   * returns the same `db` shape we then feed to setStoreFromDb.
+//
+// The token is STATIC — it never rotates — so there is nothing to persist and no
+// way for this server to invalidate itself. Revoke it from FormLab if needed.
 // ============================================================
 
-import { createClient } from '@supabase/supabase-js';
 import { setStoreFromDb } from './data.js';
-// Supabase rotates the refresh token on every use, and this client runs with
-// persistSession:false — see token-store.js for why we bank the rotated token
-// ourselves and what breaks when we don't.
-import { readStoredToken as _readStoredToken, saveToken as _saveToken } from './token-store.js';
-
-// Supabase table → db array key (mirrors the app's ENT.ENTITIES + db.js arrays).
-// Safety/regulatory ride the ingredient record's `data`, so they come for free.
-const TABLES = [
-  ['projects',            'projects'],
-  ['ingredients',         'ingredients'],
-  ['formulations',        'formulations'],
-  ['batches',             'batches'],
-  ['samples',             'samples'],
-  ['test_results',        'testResults'],
-  ['templates',           'templates'],
-  ['procedure_templates', 'procedureTemplates'],
-  ['parameters',          'parameters'],
-  ['equipment',           'equipment'],
-  ['stock_movements',     'stockMovements'],
-  ['lots',                'lots'],
-  ['formula_versions',    'formulaVersions'],
-  ['attachments',         'attachments'],
-  ['notebook_entries',    'notebookEntries'],
-];
-
-const PAGE = 1000;
-
-async function _fetchAll(supabase, table, workspaceId) {
-  const out = [];
-  for (let from = 0; ; from += PAGE) {
-    const { data, error } = await supabase
-      .from(table)
-      .select('data')
-      .eq('workspace_id', workspaceId)
-      .is('deleted_at', null)
-      .range(from, from + PAGE - 1);
-    if (error) {
-      // A table the backend hasn't migrated yet shouldn't sink the whole load.
-      if (/relation|does not exist|schema cache|find the table/i.test(error.message || '')) return out;
-      throw new Error(`${table}: ${error.message}`);
-    }
-    const rows = data || [];
-    for (const r of rows) if (r && r.data) out.push(r.data);
-    if (rows.length < PAGE) break;
-  }
-  return out;
-}
-
-async function _resolveWorkspace(supabase, userId, preferred) {
-  if (preferred) return preferred;
-  const { data, error } = await supabase
-    .from('workspace_members')
-    .select('workspace_id, role')
-    .eq('user_id', userId);
-  if (error) throw new Error(`workspace_members: ${error.message}`);
-  const rows = data || [];
-  if (!rows.length) throw new Error('No workspaces found for this account.');
-  const owned = rows.find(r => r.role === 'owner');
-  return (owned || rows[0]).workspace_id;   // default to your OWN workspace
-}
 
-async function _loadDb(supabase, workspaceId) {
-  const db = {};
-  for (const [table, key] of TABLES) db[key] = await _fetchAll(supabase, table, workspaceId);
-  return db;
-}
+// Public defaults — same values the app ships in its client (js/supabase.js).
+// Overridable via env for a self-hosted / preview backend.
+export const DEFAULT_SUPABASE_URL = 'https://ufizhypibwqqpavhxdwt.supabase.co';
+export const DEFAULT_ANON_KEY = 'sb_publishable_z83O_XZCXsHo9wghb4o3aw_6Qf4ikMP';
 
-// Bootstrap a session from the refresh token, do an initial load, then refresh on
-// an interval. Returns { workspaceId, userId, refresh, stop }.
-export async function startCloud({ url, anonKey, refreshToken, workspaceId, refreshSeconds = 60, onReload } = {}) {
-  if (!url || !anonKey || !refreshToken) {
-    throw new Error('Cloud mode needs FORMLAB_SUPABASE_URL, FORMLAB_SUPABASE_ANON_KEY and FORMLAB_REFRESH_TOKEN (copy them from FormLab → Connect to MCP).');
+// One fetch of the workspace `db` from the Edge Function.
+async function _fetchDb({ url, anonKey, token }) {
+  const endpoint = `${url.replace(/\/+$/, '')}/functions/v1/mcp-data`;
+  let res;
+  try {
+    res = await fetch(endpoint, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        // The gateway still wants a project apikey; OUR credential is the token
+        // in the body, which the function checks itself (deployed --no-verify-jwt).
+        'apikey': anonKey,
+        'Authorization': `Bearer ${anonKey}`,
+      },
+      body: JSON.stringify({ token }),
+    });
+  } catch (e) {
+    throw new Error(`could not reach the FormLab MCP endpoint (${endpoint}): ${e.message}`);
   }
-  const supabase = createClient(url, anonKey, {
-    auth: { persistSession: false, autoRefreshToken: true, detectSessionInUrl: false },
-  });
-
-  // refreshSession with a bare refresh token mints a fresh session and sets it on
-  // the client, so all subsequent queries carry the user's JWT (→ RLS).
-  //
-  // Try the PERSISTED token first (the live end of the rotation chain from our
-  // last run), then fall back to the configured one. The fallback matters: after
-  // the user reconnects from FormLab, the env token is the fresh one and any
-  // stored descendant is dead.
-  const stored = _readStoredToken(refreshToken);
-  const candidates = stored && stored !== refreshToken ? [stored, refreshToken] : [refreshToken];
-  let sess = null, lastErr = null;
-  for (const token of candidates) {
-    const { data, error } = await supabase.auth.refreshSession({ refresh_token: token });
-    if (!error && data && data.session && data.session.user) { sess = data; break; }
-    lastErr = error;
+  let body = null;
+  try { body = await res.json(); } catch { /* non-JSON error page */ }
+  if (res.status === 401) {
+    throw new Error('the MCP token was rejected (missing, revoked, or malformed). Reconnect from FormLab → Settings → Account → AI tools (MCP) → Connect, and paste the new FORMLAB_MCP_TOKEN.');
   }
-  if (!sess) {
-    throw new Error(`auth failed: ${(lastErr && lastErr.message) || 'could not start a session from the refresh token'} — the refresh token is single-use and may already be spent. Reconnect from FormLab → Settings → Account → AI tools (MCP) → Connect, and paste the new FORMLAB_REFRESH_TOKEN into your MCP config.`);
+  if (!res.ok || !body || body.ok !== true || !body.db) {
+    throw new Error(`MCP endpoint error (HTTP ${res.status})${body && body.error ? ': ' + body.error : ''}`);
   }
-  // Bank the rotated token so the NEXT start has a live one.
-  _saveToken(sess.session.refresh_token, refreshToken);
-  // autoRefreshToken keeps rotating while we run — persist each new one too, so a
-  // long-running server still leaves a usable token behind when it exits.
-  try {
-    supabase.auth.onAuthStateChange((event, session) => {
-      if (event === 'TOKEN_REFRESHED' && session && session.refresh_token) {
-        _saveToken(session.refresh_token, refreshToken);
-      }
-    });
-  } catch (_) {}
+  return body;
+}
 
-  const userId = sess.session.user.id;
-  const ws = await _resolveWorkspace(supabase, userId, workspaceId);
+// Bootstrap: one load up front, then refresh on an interval. Returns
+// { workspaceId, refresh, stop } to mirror the old v1 signature.
+export async function startCloud({ url, anonKey, token, refreshSeconds = 60, onReload } = {}) {
+  url = url || DEFAULT_SUPABASE_URL;
+  anonKey = anonKey || DEFAULT_ANON_KEY;
+  if (!token) {
+    throw new Error('Cloud mode needs FORMLAB_MCP_TOKEN (mint it from FormLab → Connect to MCP).');
+  }
 
+  let workspaceId = null;
   const refresh = async () => {
-    const db = await _loadDb(supabase, ws);
-    setStoreFromDb(db, { source: 'cloud', workspaceId: ws, schemaName: 'formlab-live', loadedAt: new Date().toISOString() });
-    if (onReload) { try { onReload(db); } catch (_) {} }
-    return db;
+    const body = await _fetchDb({ url, anonKey, token });
+    workspaceId = body.workspaceId || workspaceId;
+    setStoreFromDb(body.db, { source: 'cloud', workspaceId, schemaName: 'formlab-live', loadedAt: body.loadedAt || new Date().toISOString() });
+    if (onReload) { try { onReload(body.db); } catch (_) {} }
+    return body.db;
   };
 
   await refresh();   // initial synchronous load before tools accept calls
@@ -137,7 +81,7 @@ export async function startCloud({ url, anonKey, refreshToken, workspaceId, refr
     timer = setInterval(() => {
       refresh().catch(e => process.stderr.write(`[formlab-mcp] cloud refresh failed: ${e.message}\n`));
     }, refreshSeconds * 1000);
-    if (timer.unref) timer.unref();   // don't keep the process alive just for the timer
+    if (timer.unref) timer.unref();
   }
-  return { workspaceId: ws, userId, refresh, stop: () => { if (timer) clearInterval(timer); } };
+  return { workspaceId, refresh, stop: () => { if (timer) clearInterval(timer); } };
 }

package/index.js

@@ -35,17 +35,18 @@ import * as projects     from './tools/projects.js';
 import * as notebook     from './tools/notebook.js';
 
 // ----- Data source: LIVE cloud workspace OR a static export file -----
-// Cloud mode kicks in when the Supabase env vars are present (copy them from
-// FormLab → Connect to MCP). Otherwise we fall back to the export-file mode.
-const CLOUD = process.env.FORMLAB_REFRESH_TOKEN && process.env.FORMLAB_SUPABASE_URL && process.env.FORMLAB_SUPABASE_ANON_KEY;
+// Cloud mode kicks in when a dedicated read-only MCP token is present (mint it
+// from FormLab → Connect to MCP). Otherwise we fall back to export-file mode.
+// FORMLAB_SUPABASE_URL / _ANON_KEY are optional overrides — cloud.js defaults to
+// the public production values, so the config only NEEDS FORMLAB_MCP_TOKEN.
+const CLOUD = !!process.env.FORMLAB_MCP_TOKEN;
 
 if (CLOUD) {
   try {
     const h = await startCloud({
-      url:           process.env.FORMLAB_SUPABASE_URL,
-      anonKey:       process.env.FORMLAB_SUPABASE_ANON_KEY,
-      refreshToken:  process.env.FORMLAB_REFRESH_TOKEN,
-      workspaceId:   process.env.FORMLAB_WORKSPACE_ID || null,
+      url:            process.env.FORMLAB_SUPABASE_URL || undefined,
+      anonKey:        process.env.FORMLAB_SUPABASE_ANON_KEY || undefined,
+      token:          process.env.FORMLAB_MCP_TOKEN,
       refreshSeconds: Number(process.env.FORMLAB_REFRESH_SECONDS || 60),
     });
     const s = getStore();
@@ -61,12 +62,12 @@ if (CLOUD) {
   const filePath = process.argv[2] || process.env.FORMLAB_EXPORT;
   if (!filePath) {
     process.stderr.write([
-      'Usage: formlab-mcp <path-to-export.json>           (file mode)',
-      '   or: set FORMLAB_SUPABASE_URL / FORMLAB_SUPABASE_ANON_KEY /',
-      '       FORMLAB_REFRESH_TOKEN (+ optional FORMLAB_WORKSPACE_ID)   (LIVE cloud mode)',
+      'Usage: formlab-mcp <path-to-export.json>   (file mode)',
+      '   or: set FORMLAB_MCP_TOKEN               (LIVE cloud mode)',
       '',
       'File mode: export via Settings → Import / Export → Export.',
-      'Cloud mode: copy the values from FormLab → Connect to MCP.',
+      'Cloud mode: mint a read-only token in FormLab → Settings → Account →',
+      '            AI tools (MCP) → Connect, and set it as FORMLAB_MCP_TOKEN.',
       '',
     ].join('\n'));
     process.exit(1);
@@ -113,7 +114,7 @@ const TOOLS = [
 ];
 
 const server = new Server(
-  { name: 'formlab-mcp', version: '0.4.2' },
+  { name: 'formlab-mcp', version: '0.5.1' },
   { capabilities: { tools: {} } }
 );
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "formlab-mcp",
-  "version": "0.4.2",
+  "version": "0.5.1",
   "mcpName": "io.github.juliu1980/formlab-mcp",
-  "description": "Read-only Model Context Protocol server for FormLab — lets Claude (and other MCP clients) read and analyze your FormLab data, from a local export file OR your live cloud workspace.",
+  "description": "Read-only Model Context Protocol server for FormLab \u2014 lets Claude (and other MCP clients) read and analyze your FormLab data, from a local export file OR your live cloud workspace.",
   "type": "module",
   "bin": {
     "formlab-mcp": "./index.js"
@@ -16,8 +16,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.4",
-    "@supabase/supabase-js": "^2.45.0"
+    "@modelcontextprotocol/sdk": "^1.0.4"
   },
   "optionalDependencies": {
     "@rdkit/rdkit": "^2024.9.1"
@@ -39,4 +38,4 @@
     "url": "https://github.com/juliu1980/FormLab",
     "directory": "mcp"
   }
-}
+}

package/server.json

@@ -1,9 +1,9 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.juliu1980/formlab-mcp",
-  "description": "Read-only MCP for FormLab — talk to your local lab notebook via Claude. Data stays local.",
-  "version": "0.1.7",
-  "websiteUrl": "https://formvix.com",
+  "description": "Read-only MCP for FormLab — let Claude query your formulation lab. Free reads a local export; Pro connects to your live cloud workspace with a dedicated read-only token.",
+  "version": "0.5.1",
+  "websiteUrl": "https://formvix.com/mcp",
   "repository": {
     "url": "https://github.com/juliu1980/FormLab",
     "source": "github",
@@ -13,7 +13,7 @@
     {
       "registryType": "npm",
       "identifier": "formlab-mcp",
-      "version": "0.1.7",
+      "version": "0.5.1",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -22,11 +22,19 @@
         {
           "type": "positional",
           "name": "exportPath",
-          "description": "Absolute path to a FormLab export JSON file (Data → Export JSON in the FormLab UI).",
-          "isRequired": true,
+          "description": "File mode: absolute path to a FormLab export JSON (Data → Export JSON). Omit when using cloud mode (set FORMLAB_MCP_TOKEN instead).",
+          "isRequired": false,
           "format": "filepath",
           "value": "/path/to/formlab-export.json"
         }
+      ],
+      "environmentVariables": [
+        {
+          "name": "FORMLAB_MCP_TOKEN",
+          "description": "Cloud mode: a dedicated read-only, revocable token (flmcp_…) minted in FormLab → Settings → Account → AI tools (MCP) → Connect. Reads your live workspace, scoped to you by row-level security. Omit for file mode.",
+          "isRequired": false,
+          "isSecret": true
+        }
       ]
     }
   ]

package/tools/analytics.js

@@ -40,12 +40,14 @@ function _trimMeasurement(m) {
 const list_test_results = {
   definition: {
     name: 'list_test_results',
-    description: 'List test result reports, optionally filtered by sample, parameter, date range, or lab. Returns metadata + parameters tested. Use get_test_result for full measurement values.',
+    description: 'List test result reports, optionally filtered by sample, parameter, measured-value range, date range, or lab. Combine parameter + value_min/value_max to find reports whose measurement is in range (the "find by results" query, e.g. parameter="Viscosity", value_min=800, value_max=3000). Returns metadata + parameters tested; use get_test_result for full measurement values.',
     inputSchema: {
       type: 'object',
       properties: {
         sample_id: { type: 'string', description: 'Filter to results for this sample (id or UID).' },
         parameter: { type: 'string', description: 'Filter to results that include this parameter (case-insensitive substring).' },
+        value_min: { type: 'number', description: 'Only reports where the parameter (above) measured >= this value. Use with `parameter`; applies to any measurement if `parameter` is omitted.' },
+        value_max: { type: 'number', description: 'Only reports where the parameter (above) measured <= this value. Use with `parameter`; applies to any measurement if `parameter` is omitted.' },
         since_date: { type: 'string', description: 'ISO date — only reports on/after this date.' },
         until_date: { type: 'string', description: 'ISO date — only reports on/before this date.' },
         lab: { type: 'string', description: 'Filter by lab name (case-insensitive substring).' },
@@ -69,8 +71,19 @@ const list_test_results = {
       if (args.since_date && (t.testDate || '') < args.since_date) return false;
       if (args.until_date && (t.testDate || '') > args.until_date) return false;
       if (args.lab && !norm(t.lab).includes(norm(args.lab))) return false;
-      if (args.parameter) {
-        const found = (t.measurements || []).some(m => norm(m.parameter).includes(norm(args.parameter)));
+      const hasRange = args.value_min != null || args.value_max != null;
+      if (args.parameter || hasRange) {
+        const pn = norm(args.parameter);
+        const found = (t.measurements || []).some(m => {
+          if (args.parameter && !norm(m.parameter).includes(pn)) return false;
+          if (hasRange) {
+            const v = parseFloat(m.value);
+            if (!Number.isFinite(v)) return false;
+            if (args.value_min != null && v < args.value_min) return false;
+            if (args.value_max != null && v > args.value_max) return false;
+          }
+          return true;
+        });
         if (!found) return false;
       }
       return true;

package/tools/library.js

@@ -176,7 +176,7 @@ const list_test_methods = {
 const get_test_method = {
   definition: {
     name: 'get_test_method',
-    description: 'Get one Test Method by UID (e.g. PARAM-001) or id — full definition including SOP / sample prep / equipment / calculation / acceptance spec, plus sibling methods that share its analyte (the same property measured at other conditions).',
+    description: 'Get one Test Method by UID (e.g. PARAM-001) or id — full definition including SOP / sample prep / equipment / calculation / acceptance spec, plus sibling methods that share its analyte (the same property measured at other conditions) and the Test Panels that use this method.',
     inputSchema: {
       type: 'object',
       properties: { id: { type: 'string', description: 'Test Method UID or internal id.' } },
@@ -191,7 +191,13 @@ const get_test_method = {
     const siblings = an
       ? (db.parameters || []).filter(x => x.id !== p.id && _norm(x.analyte) === an).map(x => x.uid || x.name).slice(0, 20)
       : [];
-    return { ...(_trimMethod(p, { full: true })), analyteSiblings: siblings };
+    // Reverse usage: which Test Panels reference this method (by id, else by name).
+    const nm = _norm(p.name);
+    const usingPanels = (db.templates || []).filter(t => (t.parameters || []).some(row =>
+      (row.parameterId && row.parameterId === p.id) ||
+      (!row.parameterId && _norm(row.parameter || row.name) === nm)
+    )).map(t => t.uid || t.name).slice(0, 40);
+    return { ...(_trimMethod(p, { full: true })), analyteSiblings: siblings, usingPanels };
   },
 };
 
@@ -278,8 +284,10 @@ function _trimPanelParam(row, db) {
     parameterId: row.parameterId || null,
     methodUid: method ? (method.uid || null) : null,
     unit: row.unit || (method && method.defaultUnit) || '',
-    ...(row.spec ? { spec: row.spec } : {}),
+    ...(row.spec || row.specRaw ? { spec: row.spec || row.specRaw } : {}),
     ...(row.method ? { method: row.method } : {}),
+    ...(row.required ? { required: true } : {}),
+    ...(row.minReps && row.minReps > 1 ? { minReps: row.minReps } : {}),
   };
 }
 

package/token-store.js

@@ -1,58 +0,0 @@
-// ============================================================
-// ROTATED-REFRESH-TOKEN STORE
-// ------------------------------------------------------------
-// Supabase ROTATES the refresh token on every use: refreshSession() invalidates
-// the token you passed and issues a new one. cloud.js creates its client with
-// persistSession:false, so before this module existed that new token only lived
-// in memory — and the next process start re-read the SAME (now spent) token from
-// the env and died with "auth failed", which Claude Desktop surfaces as
-// "Server disconnected". Net effect: the configured token worked exactly ONCE.
-//
-// So we bank the rotated token and prefer it on the next start. Entries are keyed
-// by a fingerprint of the ENV token: when the user reconnects from FormLab and
-// pastes a new token, the fingerprint changes and we drop the stale chain rather
-// than clinging to a dead descendant of the old one.
-//
-// The file holds a live account session — the same sensitivity as the Desktop
-// config that already stores it in plaintext — so it lives under the user's home,
-// dir 0700 / file 0600. Never log the token itself.
-// ============================================================
-
-import { createHash } from 'node:crypto';
-import { homedir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
-
-export const tokenFile = () => join(homedir(), '.formlab-mcp', 'session.json');
-
-// Short, non-reversible tag for "which configured token is this chain from".
-export const fingerprint = (t) => createHash('sha256').update(String(t || '')).digest('hex').slice(0, 16);
-
-// The live end of the rotation chain for `envToken`, or null when there isn't a
-// usable one (no file, unreadable, or it belongs to a different env token).
-export function readStoredToken(envToken) {
-  try {
-    const s = JSON.parse(readFileSync(tokenFile(), 'utf8'));
-    if (!s || !s.refreshToken) return null;
-    if (s.source !== fingerprint(envToken)) return null;
-    return s.refreshToken;
-  } catch (_) { return null; }
-}
-
-// Persistence is an optimisation, not a hard requirement: a read-only home must
-// not take the server down — worst case we're back to single-use behaviour.
-export function saveToken(refreshToken, envToken) {
-  if (!refreshToken) return false;
-  try {
-    const f = tokenFile();
-    mkdirSync(dirname(f), { recursive: true, mode: 0o700 });
-    writeFileSync(f, JSON.stringify({
-      refreshToken, source: fingerprint(envToken), updatedAt: new Date().toISOString(),
-    }, null, 2), { mode: 0o600 });
-    chmodSync(f, 0o600);   // enforce even if the file already existed
-    return true;
-  } catch (e) {
-    process.stderr.write(`[formlab-mcp] could not persist refresh token: ${e.message}\n`);
-    return false;
-  }
-}