shotops-mcp 0.9.0 → 0.9.1

package/dist/local.js

@@ -10375,7 +10375,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "shotops-mcp",
-      version: "0.9.0",
+      version: "0.9.1",
       private: false,
       type: "module",
       description: "The bundle-emitting MCP server over the @engine/@sync spine. Exposes ShotOps tools to ChatGPT, Claude Code, Cursor, and CI over Streamable HTTP with OAuth or personal API tokens. Hosted and MCP tool paths never accept, store, or forward a store-signing credential; the explicit local release CLI validates the user's existing key directly with Apple and records only its path. Renders via headless Playwright Chromium, the engine's native non-browser habitat (same path as mockup-mcp). Also ships as a free LOCAL stdio server (`npx shotops-mcp`) \u2014 same render, on your own machine, no account needed.",
@@ -15543,7 +15543,17 @@ var init_controlPlaneContract = __esm({
 function controlPlaneUrl() {
   return (process.env.SHOTOPS_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL).replace(/\/+$/, "");
 }
-async function callOp(token, op, args = {}) {
+function retryAfterMs(res, attempt) {
+  const header = res.headers.get("retry-after");
+  if (header) {
+    const seconds = Number(header);
+    if (Number.isFinite(seconds) && seconds >= 0) return Math.min(seconds * 1e3, 3e4);
+    const at = Date.parse(header);
+    if (Number.isFinite(at)) return Math.min(Math.max(at - Date.now(), 0), 3e4);
+  }
+  return Math.min(1e3 * 2 ** attempt, 8e3);
+}
+async function callOp(token, op, args = {}, attempt = 0) {
   const res = await fetch(controlPlaneUrl(), {
     method: "POST",
     headers: {
@@ -15564,6 +15574,15 @@ async function callOp(token, op, args = {}) {
     if (res.status === 401) {
       throw new Error("control plane rejected the token \u2014 check SHOTOPS_TOKEN, or mint a new one in ShotOps.");
     }
+    if (res.status === 429) {
+      if (attempt < RATE_LIMIT_RETRIES) {
+        await sleep(retryAfterMs(res, attempt));
+        return await callOp(token, op, args, attempt + 1);
+      }
+      throw new Error(
+        `ShotOps is refusing new requests right now (429 after ${RATE_LIMIT_RETRIES + 1} attempts). This is upstream load shedding, not your account or your token \u2014 wait a minute and run it again. A long multi-panel render is the usual trigger.`
+      );
+    }
     if (res.status === 426) {
       const minimum = parsed?.minimumVersion;
       const floor = typeof minimum === "string" && minimum.length > 0 ? ` (${minimum} or newer)` : "";
@@ -15725,7 +15744,7 @@ function connectHostedBridge(token) {
     }
   };
 }
-var DEFAULT_CONTROL_PLANE_URL, MAX_PASS_BODY_BYTES, ControlPlaneOperationError;
+var DEFAULT_CONTROL_PLANE_URL, MAX_PASS_BODY_BYTES, ControlPlaneOperationError, RATE_LIMIT_RETRIES, sleep;
 var init_hostedBridge = __esm({
   "src/hostedBridge.ts"() {
     "use strict";
@@ -15750,6 +15769,8 @@ var init_hostedBridge = __esm({
         this.requiredPlan = typeof body?.requiredPlan === "string" ? body.requiredPlan : null;
       }
     };
+    RATE_LIMIT_RETRIES = 3;
+    sleep = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shotops-mcp",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "private": false,
   "type": "module",
   "description": "The bundle-emitting MCP server over the @engine/@sync spine. Exposes ShotOps tools to ChatGPT, Claude Code, Cursor, and CI over Streamable HTTP with OAuth or personal API tokens. Hosted and MCP tool paths never accept, store, or forward a store-signing credential; the explicit local release CLI validates the user's existing key directly with Apple and records only its path. Renders via headless Playwright Chromium, the engine's native non-browser habitat (same path as mockup-mcp). Also ships as a free LOCAL stdio server (`npx shotops-mcp`) — same render, on your own machine, no account needed.",