shotops-mcp 0.9.1 → 0.9.3

package/README.md

@@ -14,7 +14,7 @@ spine the Studio web app and the `mockup-mcp` CLI use, driving headless Chromium
 Ships as **two doors, one engine**: an `npx shotops-mcp` **local stdio server** that renders on
 your own machine, no account needed to preview (see [Local](#local--npx-shotops-mcp) below), and a
 **hosted** server on Vercel with an account, saved looks, and share links (see [Hosted](#hosted)
-below, or the public [`/connect`](https://shotops.dev/connect) page in the studio app).
+below, or the public [MCP docs](https://shotops.dev/docs/mcp)).
 
 ## Preview free, export store-ready with Pro
 
@@ -28,16 +28,17 @@ The two limits are independent and neither substitutes for the other:
 
 - **Entitlement** is permission to create store-ready files. One server-owned decision answers it
   for Studio, hosted and local alike, so no door can be talked into a different answer. Free and
-  anonymous callers are refused before a credit is reserved, a screenshot is read or a file is
+  anonymous callers are refused before a cloud credit is reserved, a screenshot is read or a file is
   written — a refused call costs nothing and leaves nothing behind.
-- **Credits** price compute ShotOps supplies: 0.5 per hosted preview panel, 2 per hosted
+- **Cloud credits** price compute ShotOps supplies: 1 per hosted preview panel, 4 per hosted
   full-resolution panel, plus AI. Rendering on your own machine spends none, on any plan. More
-  credits never unlock store-ready output on Free.
+  cloud credits never unlock store-ready output on Free.
 
-Free accounts get 40 credits a month and 2 synced projects. Every new account starts with a 7-day
-Pro trial; after that Pro is €9/month or €90/year. Without any account, the hosted server allows 3
-preview strips per rolling 30 days, at most 5 panels each. Call `account_status` to see exactly
-where this connection stands — it spends no credits and none of that anonymous allowance.
+Free accounts get 80 cloud credits a month and 2 synced projects. Every new account starts with a
+7-day Pro trial; after that Pro is €9/month or €90/year. Without any account, the hosted server
+allows 3 preview strips per rolling 30 days, at most 5 panels each. Call `account_status` to see
+exactly where this connection stands — it spends no cloud credits and none of that anonymous
+allowance.
 
 ## Zero-custody
 
@@ -66,7 +67,7 @@ The key is never copied, printed, or sent to ShotOps, and no release tool is ins
 | `describe_look` | Five named design presets, three named layout templates, the user-intake script, and the full styling field catalog + defaults | *(none)* |
 | `request_screenshot_upload` | Mint signed upload slots for real screenshots; every returned slot carries its semantic screenshot `variant` | `count` (1–10), `names?`, `family?`, `locale?` |
 | `import_screenshot` | Get screenshots INTO ShotOps — several per call, each from one named source (`{ url }`, `{ file }`, or local-stdio `{ path }`), returning a render-ready ref per entry in input order | `screenshots` (1–10 source entries), `file?` (the ChatGPT top-level attachment), `name?`, `locale?` |
-| `account_status` | What THIS connection may do, for free: signed-in account, plan, trial, remaining ShotOps credits, what a preview costs here, and whether store-ready output (full-resolution renders, any `emit_bundle`) is allowed — with a machine-readable `nextStep`. Spends no credits, uses none of the free anonymous preview allowance, uploads and writes nothing | *(none)* |
+| `account_status` | What THIS connection may do, for free: signed-in account, plan, trial, remaining ShotOps cloud credits, what a preview costs here, and whether store-ready output (full-resolution renders, any `emit_bundle`) is allowed — with a machine-readable `nextStep`. Spends no cloud credits, uses none of the free anonymous preview allowance, uploads and writes nothing | *(none)* |
 | `production_operation` | Reconnect to one durable paid Hosted render or rendering bundle, report persisted progress, request cooperative cancellation, or mint fresh result download grants without rerendering or charging again | `action` (`get`, `cancel`, or `result`), `operationId` |
 | `delete_assets` | Permanently delete private uploaded screenshots, rendered panels, or generated bundles owned by the signed-in account | `refs` (1–50 ShotOps refs) |
 
@@ -329,7 +330,7 @@ claude mcp add --transport http shotops http://localhost:8788/mcp \
 ```
 
 Then ask the agent to, e.g., *"render these two screenshots into a 6.9″ App Store strip and
-emit a fastlane bundle for com.acme.app."* Every request must carry the
+emit a screenshot bundle for com.acme.app."* Every request must carry the
 `Authorization: Bearer shotops_…` header; a missing, unknown, or revoked token gets a `401`
 before any tool runs.
 
@@ -364,10 +365,9 @@ claude mcp add --transport http shotops https://mcp.shotops.dev/mcp \
   --header "Authorization: Bearer shotops_…"
 ```
 
-The public [`/connect`](https://shotops.dev/connect) page in the studio
-app has the same instructions for Cursor/CI, plus a link to where to create a token — it's
-the one place an external agent user (not a repo collaborator) can find the connect story,
-since this repo is private.
+The public [MCP docs](https://shotops.dev/docs/mcp) have the same
+instructions for Cursor/CI, plus where to create a token — they're the one place an external
+agent user (not a repo collaborator) can find the connect story, since this repo is private.
 
 ### Ops (this repo's maintainer only)
 
@@ -376,8 +376,8 @@ since this repo is private.
 — the notes here are only what is specific to this package.
 
 - **Deploy:** run the repo's deploy script from the repo root; deploys run locally, and a push to
-  `main` is a production deploy. Do not hand-run a bare `vercel deploy`. Fly was retired (#68) —
-  `flyctl` is history, not the live procedure.
+  `main` is a production deploy. Do not hand-run a bare `vercel deploy`. Vercel is the only hosted
+  target — the Fly app was destroyed in #68.
 - **Runtime env** lives on the `shotops-mcp` **Vercel project**, not in this repo:
   `SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, and `MCP_PUBLIC_URL` (pins the public hostname as
   the OAuth issuer), plus `OPENAI_APPS_CHALLENGE_TOKEN` while verifying the MCP domain for public
@@ -439,7 +439,7 @@ reading an arbitrary server-side path there would be a local-file-inclusion hole
 **`emit_bundle` reads local panels off disk too** — an unsigned local server has no account, so it
 can't produce `output: "urls"` refs. Once you are signed in on a trial or Pro, pass the on-disk PNGs
 straight to `emit_bundle` (same local-only `{ path }` door as screenshots) to package a
-`fastlane deliver` zip with no upload and no credits:
+`fastlane deliver` zip with no upload and no cloud credits:
 
 ```json
 { "bundleId": "com.acme.app", "panels": [{ "path": "/abs/panel-01.png" }, { "path": "/abs/panel-02.png" }] }
@@ -447,7 +447,7 @@ straight to `emit_bundle` (same local-only `{ path }` door as screenshots) to pa
 
 `emit_bundle` and full-resolution renders are the store-ready half of the offer, so they need that
 trial or Pro even here, where the compute is yours. Preview renders need neither an account nor
-credits. `account_status` reports which side of the line this process is on.
+cloud credits. `account_status` reports which side of the line this process is on.
 
 **Saving without a token:** a new `save_project` made from local `{ path }` PNGs creates a private
 **pending claim**. It uploads only that saved project's byte-free record and raw source PNGs,
@@ -464,9 +464,9 @@ manifest through the Studio control plane, downloads only the resolved cells, an
 
 | | Local (`npx shotops-mcp`) | Hosted (`shotops_…` token) |
 |---|---|---|
-| Render compute | **your machine** ($0, no timeout, no credits on any plan) | our servers — spends your ShotOps credits: 0.5 per preview panel, 2 per full-resolution panel |
+| Render compute | **your machine** ($0, no timeout, no cloud credits on any plan) | our servers — spends your ShotOps cloud credits: 1 per preview panel, 4 per full-resolution panel |
 | Preview render | free, no account | free on an account; 3 per 30 days, ≤5 panels, without one |
-| Full-resolution render, any `emit_bundle` | trial or Pro (costs no credits) | trial or Pro, and spends credits |
+| Full-resolution render, any `emit_bundle` | trial or Pro (costs no cloud credits) | trial or Pro, and spends cloud credits |
 | Auth | none to preview; a token for account state and store-ready output | account + API token |
 | Saved looks / editable projects / project read+re-render / share links | new project: pending claim; existing/account state: token (below); share links: hosted | ✅ |
 | Screenshot input | local `{ path }` off disk | `request_screenshot_upload` → `{ ref }` |
@@ -474,7 +474,8 @@ manifest through the Studio control plane, downloads only the resolved cells, an
 ### Optional: bridge a local render into your hosted account
 
 Connect your account and `save_project` / `read_look` / `save_look` / `read_project` /
-`render_project` start working too — **rendering still happens locally and spends no credits**, and
+`render_project` start working too — **rendering still happens locally and spends no cloud
+credits**, and
 a trial or Pro account unlocks full-resolution output and `emit_bundle` on this machine. A
 deliberate save also uploads its local source PNGs privately so the project reopens with
 screenshots on another device; normal renders and exports never upload.
@@ -584,7 +585,7 @@ it sends, the postcondition it must reach, and a redacted summary — plus a por
 
 The plan hash-binds the project revision, desired bytes, normalized Fastlane inputs, Apple setup
 identity and policy version, so later approval cannot drift onto different state. Its **approval
-window is 15 minutes**; the plan itself stays readable for as long as its sealed workspace exists.
+window is one hour**; the plan itself stays readable for as long as its sealed workspace exists.
 Concurrency is per resource rather than one hash of the whole app: an unrelated App Store edit is
 reported without invalidating the plan, while a change to a resource the plan writes — or to the
 app, version or App Store state it targets — blocks before any write.
@@ -648,7 +649,7 @@ shotops-mcp/
     shareEmit.ts    emit_bundle's server-side share-link creation (reuses Phase-2 modules)
     uploads.ts      Phase 10 — upload slots, ref ownership check, output:'urls' storage
     screenshotInput.ts  Phase 10 — resolves screenshots[] (inline/ref/url/path) to base64
-    env.ts          loads ../.env.local; MCP_PORT / STUDIO_ORIGIN / MCP_PUBLIC_URL
+    env.ts          loads ../.env.local; MCP_PORT / STUDIO_ORIGIN / SHOTOPS_AUTH_ORIGIN / MCP_PUBLIC_URL
     local.ts        the LOCAL npx entry point — stdio transport, no auth required to preview
     localDeps.ts     the local ToolDeps fork — static-serve renderer, no-op/bridged persistence
     hostedBridge.ts  local→hosted bridge (a real MCP client using your shotops_ token)
@@ -657,8 +658,6 @@ shotops-mcp/
   vite.harness.config.mjs  the STATIC harness build (local mode's publish prerequisite) → harness-dist/
   build.mjs         esbuild bundle of src/local.ts (+ @engine/@api inlined) → dist/local.js
   Dockerfile        hosted image — Playwright's Chromium base + this repo's 3 npm installs
-  fly.toml          Fly app config — RETIRED (#68), kept only for the cold-deploy recipe;
-                    the running fly.dev machine is NOT a rollback
   verify-mcp.mjs    post-deploy smoke test — real MCP round-trip against a hosted URL
   verify-mcp-local.ts  local stdio smoke test (tsx src/local.ts, in-repo)
   static-parity.ts  pixel-diffs the static-serve render against the Vite-dev render (must be 0)