vibo-mcp 1.3.2 → 1.4.0

package/dist/client.js

@@ -4,9 +4,17 @@ import { loadDotenvSafely, readEnvVar, McpToolError, SessionNotAuthenticatedErro
 import { loadSession, saveSession } from './session-store.js';
 // Load .env for local dev; silently skip if dotenv is unavailable (e.g. the
 // mcpb bundle, which externalizes dotenv). `override: false` means a
-// host-provided env var always wins over .env.
-const __dirname = dirname(fileURLToPath(import.meta.url));
-await loadDotenvSafely({ path: join(__dirname, '..', '.env'), override: false });
+// host-provided env var always wins over .env. The try/catch additionally
+// guards the Cloudflare Worker runtime (src/worker.ts): there `import.meta.url`
+// is undefined and `fileURLToPath(undefined)` would otherwise throw at module
+// init (Worker startup validation) — there is no filesystem / .env there anyway.
+try {
+    const __dirname = dirname(fileURLToPath(import.meta.url));
+    await loadDotenvSafely({ path: join(__dirname, '..', '.env'), override: false });
+}
+catch {
+    /* v8 ignore next -- only reached in a non-Node runtime (Workers): no .env to load */
+}
 const DEFAULT_API_URL = 'https://api.vibodj.com/v2/graphql';
 const SERVICE = 'Vibo';
 const SIGN_IN_HOST = 'https://web.vibodj.com';
@@ -32,48 +40,47 @@ const REFRESH = `
 // Error codes Vibo (and conventional GraphQL servers) use for an expired /
 // missing session — these should trigger a token refresh + replay.
 const AUTH_ERROR_CODES = new Set(['UNAUTHORIZED', 'UNAUTHENTICATED', 'FORBIDDEN']);
-/**
- * Thin GraphQL client for the Vibo consumer API.
- *
- * Vibo authenticates with custom `x-token` / `x-refresh-token` headers (not
- * `Authorization: Bearer`), so this is a hand-written client rather than
- * `createApiClient`. Two credential paths are supported:
- *
- *   - VIBO_EMAIL + VIBO_PASSWORD  → server-side `signIn` mutation (preferred)
- *   - VIBO_ACCESS_TOKEN [+ VIBO_REFRESH_TOKEN] → use a captured token directly
- *     (for accounts that only sign in via Apple/Google/Facebook SSO)
- *
- * The config error is deferred: the constructor never throws, so the server
- * still boots and answers the host's install-time `tools/list` probe when no
- * credentials are set. The error surfaces on the first tool call.
- */
 export class ViboClient {
     apiUrl;
     email;
     password;
     // Not readonly: cleared by setTokens() after a browser capture seeds a session.
-    configError;
+    configError = null;
     accessToken;
     refreshTokenValue;
+    // The constructor is PURE — it does no filesystem / homedir / async-I/O /
+    // random op — so it is safe to run at Worker global scope (where the
+    // module-level `export const client` singleton below is constructed). The
+    // saved-session fallback and the config-error determination both touch
+    // homedir()/the filesystem via loadSession(), so they are deferred to the
+    // first request through `ensureConfigResolved()`. No effect on the stdio path.
+    configResolved = false;
     // Single-flight guards so concurrent tool calls never race two logins /
     // refreshes against each other (à la mcp-utils' TokenManager).
     loginInFlight = null;
     reauthInFlight = null;
-    constructor() {
-        this.apiUrl = readEnvVar('VIBO_API_URL') ?? DEFAULT_API_URL;
-        const email = readEnvVar('VIBO_EMAIL');
-        const password = readEnvVar('VIBO_PASSWORD');
-        const accessToken = readEnvVar('VIBO_ACCESS_TOKEN');
-        const refreshToken = readEnvVar('VIBO_REFRESH_TOKEN');
-        this.email = email ?? null;
-        this.password = password ?? null;
-        this.accessToken = accessToken ?? null;
-        this.refreshTokenValue = refreshToken ?? null;
-        const haveLogin = Boolean(email && password);
+    constructor(opts = {}) {
+        this.apiUrl = opts.apiUrl ?? readEnvVar('VIBO_API_URL') ?? DEFAULT_API_URL;
+        this.email = opts.email ?? readEnvVar('VIBO_EMAIL') ?? null;
+        this.password = opts.password ?? readEnvVar('VIBO_PASSWORD') ?? null;
+        this.accessToken = opts.accessToken ?? readEnvVar('VIBO_ACCESS_TOKEN') ?? null;
+        this.refreshTokenValue = opts.refreshToken ?? readEnvVar('VIBO_REFRESH_TOKEN') ?? null;
+    }
+    /**
+     * Resolve the saved-session fallback and the deferred config error on first
+     * use. Kept out of the constructor so construction is pure (Worker-safe):
+     * `loadSession()` reads homedir()/the filesystem, which the Workers runtime
+     * forbids at global scope. Runs its body at most once.
+     */
+    ensureConfigResolved() {
+        if (this.configResolved)
+            return;
+        this.configResolved = true;
+        const haveLogin = Boolean(this.email && this.password);
         // Fall back to a previously browser-captured session (SSO accounts) ONLY
-        // when there's no env token AND no email/password. Email/password is the
-        // documented preferred path and must win over a (possibly stale) saved
-        // session — otherwise an old session.json would silently shadow it.
+        // when there's no env/injected token AND no email/password. Email/password
+        // is the documented preferred path and must win over a (possibly stale)
+        // saved session — otherwise an old session.json would silently shadow it.
         if (!this.accessToken && !haveLogin) {
             const saved = loadSession();
             if (saved) {
@@ -89,9 +96,6 @@ export class ViboClient {
                     'token from your signed-in web.vibodj.com browser tab (Apple/Google/Facebook accounts).',
             });
         }
-        else {
-            this.configError = null;
-        }
     }
     /**
      * Adopt a browser-captured token pair (from vibo_capture_session) for
@@ -111,6 +115,7 @@ export class ViboClient {
     }
     /** Run a GraphQL operation, transparently authenticating + retrying once on token expiry. */
     async gql(query, variables = {}) {
+        this.ensureConfigResolved();
         if (this.configError)
             throw this.configError;
         const token = await this.ensureAccessToken();
@@ -124,47 +129,40 @@ export class ViboClient {
     }
     /**
      * Run a GraphQL operation that uploads one or more files (the `Upload` scalar),
-     * using the graphql-multipart-request spec. `fileMap` maps a dotted variable
-     * path (e.g. "variables.photo" or "variables.payload.answer.images.0") to a
-     * local file path; `variables` must carry `null` at each of those positions.
-     * Same auth + single-retry-on-expiry behavior as `gql`.
+     * using the graphql-multipart-request spec. `files` maps a dotted variable
+     * path (e.g. "variables.photo" or "variables.payload.answer.images.0") to an
+     * in-memory {@link UploadFile} (blob + filename); `variables` must carry
+     * `null` at each of those positions. The bytes arrive already resolved (from
+     * a local file on stdio, or inline base64 on the hosted connector — see
+     * src/upload-source.ts), so this method never touches the filesystem and runs
+     * unchanged in the Workers runtime (`FormData`/`Blob`/`fetch` are all
+     * available there). Same auth + single-retry-on-expiry behavior as `gql`.
      */
-    async gqlUpload(query, variables, fileMap) {
+    async gqlUpload(query, variables, files) {
+        this.ensureConfigResolved();
         if (this.configError)
             throw this.configError;
         const token = await this.ensureAccessToken();
-        let res = await this.postMultipart(query, variables, fileMap, token);
+        let res = await this.postMultipart(query, variables, files, token);
         if (this.isAuthError(res.status, res.body.errors)) {
             const fresh = await this.reauthenticate();
-            res = await this.postMultipart(query, variables, fileMap, fresh);
+            res = await this.postMultipart(query, variables, files, fresh);
         }
         return this.unwrap(res.status, res.body);
     }
-    async postMultipart(query, variables, fileMap, token) {
-        const { openAsBlob } = await import('node:fs');
-        const { basename } = await import('node:path');
+    async postMultipart(query, variables, files, token) {
         const form = new FormData();
         form.append('operations', JSON.stringify({ query, variables }));
         // map: { "0": ["variables.photo"], "1": ["variables.payload.answer.images.0"] }
-        const paths = Object.keys(fileMap);
+        const paths = Object.keys(files);
         const map = {};
         paths.forEach((varPath, i) => {
             map[String(i)] = [varPath];
         });
         form.append('map', JSON.stringify(map));
         for (let i = 0; i < paths.length; i++) {
-            const filePath = fileMap[paths[i]];
-            let blob;
-            try {
-                blob = await openAsBlob(filePath);
-            }
-            catch (err) {
-                throw new McpToolError(`Could not read file for upload: ${filePath}`, {
-                    hint: 'Provide an absolute path to a readable local file.',
-                    cause: err,
-                });
-            }
-            form.append(String(i), blob, basename(filePath));
+            const file = files[paths[i]];
+            form.append(String(i), file.blob, file.filename);
         }
         const headers = { 'apollo-require-preflight': 'true' };
         if (token)

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { runMcp } from '@chrischall/mcp-utils';
 import { VERSION } from './version.js';
+import { client } from './client.js';
 import { registerProfileTools } from './tools/profile.js';
 import { registerEventTools } from './tools/events.js';
 import { registerSectionTools } from './tools/sections.js';
@@ -25,6 +26,10 @@ await runMcp({
     name: 'vibo-mcp',
     version: VERSION,
     banner: '[vibo-mcp] This project was developed and is maintained by AI (Claude Code). Use at your own discretion.',
+    // runMcp invokes each registrar as `register(server, deps)`, threading this
+    // singleton so the tool modules import only the ViboClient TYPE. Same client
+    // as before — just passed in rather than imported by each module.
+    deps: client,
     tools: [
         registerProfileTools,
         registerEventTools,

package/dist/tools/collaboration.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { LIST_EVENT_USERS, INVITE_USERS, CHANGE_USER_ROLE, REMOVE_USER } from '../gql.js';
 import { limitSchema, skipSchema, pagination, previewResult } from './shared.js';
-export function registerCollaborationTools(server) {
+export function registerCollaborationTools(server, client) {
     server.registerTool('vibo_list_event_users', {
         description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page.",
         annotations: toolAnnotations({ title: 'List Vibo event users', readOnly: true }),

package/dist/tools/comments.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { CREATE_SONG_COMMENT, DELETE_SONG_COMMENT, CREATE_SECTION_COMMENT, DELETE_SECTION_COMMENT, } from '../gql.js';
 import { previewResult } from './shared.js';
-export function registerCommentTools(server) {
+export function registerCommentTools(server, client) {
     server.registerTool('vibo_comment_on_song', {
         description: 'Leave a comment / note for the DJ on a specific song. Confirm-gated.',
         annotations: toolAnnotations({ title: 'Comment on Vibo song', readOnly: false }),

package/dist/tools/events.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm, McpToolError } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { LIST_UPCOMING_EVENTS, LIST_HISTORY_EVENTS, GET_EVENT, JOIN_EVENT_BY_DEEP_LINK, JOIN_EVENT_BY_HASH, LEAVE_EVENT, CREATE_EVENT_CONTACT, } from '../gql.js';
 import { limitSchema, skipSchema, pagination, previewResult } from './shared.js';
-export function registerEventTools(server) {
+export function registerEventTools(server, client) {
     server.registerTool('vibo_list_events', {
         description: "List the events you're part of (as host or guest). Defaults to upcoming events; pass past:true for events that have already happened. Optionally filter by a search query.",
         annotations: toolAnnotations({ title: 'List Vibo events', readOnly: true }),

package/dist/tools/ideas.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { LIST_SECTION_SONG_IDEAS, LIST_SONG_IDEAS_SONGS } from '../gql.js';
 import { limitSchema, skipSchema, pagination } from './shared.js';
-export function registerIdeasTools(server) {
+export function registerIdeasTools(server, client) {
     server.registerTool('vibo_list_section_song_ideas', {
         description: "List the DJ's suggested song-idea collections for a section (each with a title, songsCount and _id). Use a song-ideas _id with vibo_list_song_ideas_songs to see the suggested songs, then add the ones you like with vibo_add_song_to_section.",
         annotations: toolAnnotations({ title: 'List Vibo section song ideas', readOnly: true }),

package/dist/tools/imports.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { IMPORT_PLAYLIST_TO_SECTION } from '../gql.js';
 import { previewResult } from './shared.js';
-export function registerImportTools(server) {
+export function registerImportTools(server, client) {
     server.registerTool('vibo_import_playlist_to_section', {
         description: 'Import selected tracks from a connected Spotify/Apple Music playlist into a section. Returns counts of added/existing/ignored. Confirm-gated.',
         annotations: toolAnnotations({ title: 'Import playlist to section', readOnly: false }),

package/dist/tools/notifications.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm, McpToolError } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { GET_NOTIFICATIONS, GET_NOTIFICATIONS_COUNT, MARK_AS_READ } from '../gql.js';
 import { limitSchema, skipSchema, pagination, previewResult } from './shared.js';
-export function registerNotificationTools(server) {
+export function registerNotificationTools(server, client) {
     server.registerTool('vibo_list_notifications', {
         description: 'List your Vibo notifications (song additions, comments, DJ updates, etc.) with read state and linked event/section ids.',
         annotations: toolAnnotations({ title: 'List Vibo notifications', readOnly: true }),

package/dist/tools/playlists.js

@@ -1,12 +1,11 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { GET_PLAYLISTS, GET_PLAYLIST_SONGS, EXPORT_EVENT_TO_SPOTIFY, EXPORT_EVENT_TO_APPLE_MUSIC, } from '../gql.js';
 import { limitSchema, skipSchema, pagination, previewResult } from './shared.js';
 const sourceSchema = z
     .enum(['spotify', 'appleMusic'])
     .describe('Streaming source — must be connected to your Vibo account.');
-export function registerPlaylistTools(server) {
+export function registerPlaylistTools(server, client) {
     server.registerTool('vibo_get_playlists', {
         description: "List your playlists from a connected streaming service (Spotify or Apple Music) so you can import songs from them. Requires that source to be connected (see vibo_get_me).",
         annotations: toolAnnotations({ title: 'List connected playlists', readOnly: true }),

package/dist/tools/profile.js

@@ -1,7 +1,6 @@
 import { textResult, toolAnnotations } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { GET_ME } from '../gql.js';
-export function registerProfileTools(server) {
+export function registerProfileTools(server, client) {
     server.registerTool('vibo_get_me', {
         description: "Get the signed-in Vibo user's profile (id, name, email, phone, locale, and whether Spotify/Apple Music are connected). Use the returned _id to recognize your own songs/contacts.",
         annotations: toolAnnotations({ title: 'Get my Vibo profile', readOnly: true }),

package/dist/tools/questions.js

@@ -1,9 +1,14 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm, McpToolError } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { LIST_SECTION_QUESTIONS, ANSWER_SECTION_QUESTION } from '../gql.js';
-import { previewResult } from './shared.js';
-export function registerQuestionTools(server) {
+import { nodeUploadResolver } from '../upload-source.js';
+import { previewResult, inlineFileSchema } from './shared.js';
+/**
+ * `resolveUpload` is the injectable file-source seam for photo/file answers:
+ * stdio uses the default `nodeUploadResolver` (local `*Paths`), the hosted
+ * connector passes `inlineUploadResolver` (inline base64 `images`/`files`).
+ */
+export function registerQuestionTools(server, client, resolveUpload = nodeUploadResolver) {
     server.registerTool('vibo_list_section_questions', {
         description: "List the DJ's planning questions for a section, with each question's type (text/radio/checkbox/select/link/header), available options, whether it's answered, the current answer, and overall progress. Use the question _id (and option _ids) with vibo_answer_question.",
         annotations: toolAnnotations({ title: 'List Vibo section questions', readOnly: true }),
@@ -19,7 +24,7 @@ export function registerQuestionTools(server) {
         return textResult(data.getEventSectionQuestionsV2);
     });
     server.registerTool('vibo_answer_question', {
-        description: "Answer a section planning question. Provide the field matching the question's type: `text` for a text question, `selectedOptions` (array of option _ids from vibo_list_section_questions) for radio/checkbox/select, or `link` (array of URLs) for a link question. Use `otherOptionTitle` with the question's \"other\" option. For photo/file questions, pass `imagePaths` / `filePaths` (absolute local paths). Confirm-gated.",
+        description: "Answer a section planning question. Provide the field matching the question's type: `text` for a text question, `selectedOptions` (array of option _ids from vibo_list_section_questions) for radio/checkbox/select, or `link` (array of URLs) for a link question. Use `otherOptionTitle` with the question's \"other\" option. For photo/file questions, pass local paths (`imagePaths`/`filePaths`) on the stdio server, or inline base64 bytes (`images`/`files`) on the hosted connector. Confirm-gated.",
         annotations: toolAnnotations({ title: 'Answer Vibo question', readOnly: false }),
         inputSchema: {
             eventId: z.string().describe('Event id.'),
@@ -38,21 +43,40 @@ export function registerQuestionTools(server) {
             imagePaths: z
                 .array(z.string())
                 .optional()
-                .describe('Absolute local image file paths, for a photo question.'),
+                .describe('Absolute local image file paths, for a photo question (local/stdio server only).'),
             filePaths: z
                 .array(z.string())
                 .optional()
-                .describe('Absolute local file paths, for a file-attachment question.'),
+                .describe('Absolute local file paths, for a file-attachment question (local/stdio server only).'),
+            images: z
+                .array(inlineFileSchema)
+                .optional()
+                .describe('Inline base64 images, for a photo question (used by the hosted connector, which has no filesystem).'),
+            files: z
+                .array(inlineFileSchema)
+                .optional()
+                .describe('Inline base64 files, for a file-attachment question (used by the hosted connector).'),
             confirm: schemaConfirm,
         },
-    }, async ({ eventId, sectionId, questionId, text, selectedOptions, link, otherOptionTitle, imagePaths, filePaths, confirm }) => {
-        const hasImages = (imagePaths?.length ?? 0) > 0;
-        const hasFiles = (filePaths?.length ?? 0) > 0;
+    }, async ({ eventId, sectionId, questionId, text, selectedOptions, link, otherOptionTitle, imagePaths, filePaths, images, files, confirm }) => {
+        // Merge local-path and inline-byte file refs (in that order) into one list
+        // per slot. stdio supplies paths; the hosted connector supplies inline
+        // bytes; the injected resolver turns each ref into an in-memory blob.
+        const imageRefs = [
+            ...(imagePaths ?? []).map((path) => ({ path })),
+            ...(images ?? []).map((f) => ({ data: f.data, filename: f.filename })),
+        ];
+        const fileRefs = [
+            ...(filePaths ?? []).map((path) => ({ path })),
+            ...(files ?? []).map((f) => ({ data: f.data, filename: f.filename })),
+        ];
+        const hasImages = imageRefs.length > 0;
+        const hasFiles = fileRefs.length > 0;
         // Require at least one PRIMARY answer field. otherOptionTitle is only a
         // modifier for selectedOptions — on its own it is not a valid answer.
         if (text === undefined && selectedOptions === undefined && link === undefined && !hasImages && !hasFiles) {
-            throw new McpToolError('Provide an answer: text, selectedOptions, link, imagePaths, or filePaths.', {
-                hint: "Match the question's type — text → `text`, radio/checkbox/select → `selectedOptions`, link → `link`, photo/file → `imagePaths`/`filePaths`.",
+            throw new McpToolError('Provide an answer: text, selectedOptions, link, imagePaths/images, or filePaths/files.', {
+                hint: "Match the question's type — text → `text`, radio/checkbox/select → `selectedOptions`, link → `link`, photo/file → `imagePaths`/`filePaths` (stdio) or `images`/`files` (hosted connector).",
             });
         }
         const answer = {};
@@ -67,17 +91,29 @@ export function registerQuestionTools(server) {
         // File answers route through a multipart upload (the Upload scalar).
         if (hasImages || hasFiles) {
             if (hasImages)
-                answer.images = imagePaths.map(() => null);
+                answer.images = imageRefs.map(() => null);
             if (hasFiles)
-                answer.files = filePaths.map(() => null);
+                answer.files = fileRefs.map(() => null);
             const payload = { answer };
-            const fileMap = {};
-            (imagePaths ?? []).forEach((p, i) => (fileMap[`variables.payload.answer.images.${i}`] = p));
-            (filePaths ?? []).forEach((p, i) => (fileMap[`variables.payload.answer.files.${i}`] = p));
+            const previewUploads = {};
+            imageRefs.forEach((ref, i) => {
+                previewUploads[`variables.payload.answer.images.${i}`] = ref.path ?? '(inline bytes)';
+            });
+            fileRefs.forEach((ref, i) => {
+                previewUploads[`variables.payload.answer.files.${i}`] = ref.path ?? '(inline bytes)';
+            });
             if (!confirm) {
-                return previewResult('answerEventSectionQuestionV2', { eventId, sectionId, questionId, payload, uploads: fileMap });
+                return previewResult('answerEventSectionQuestionV2', { eventId, sectionId, questionId, payload, uploads: previewUploads });
+            }
+            // Resolve each ref to an in-memory blob keyed by its dotted var path.
+            const resolvedFiles = {};
+            for (let i = 0; i < imageRefs.length; i++) {
+                resolvedFiles[`variables.payload.answer.images.${i}`] = await resolveUpload(imageRefs[i]);
+            }
+            for (let i = 0; i < fileRefs.length; i++) {
+                resolvedFiles[`variables.payload.answer.files.${i}`] = await resolveUpload(fileRefs[i]);
             }
-            const data = await client.gqlUpload(ANSWER_SECTION_QUESTION, { eventId, sectionId, questionId, payload }, fileMap);
+            const data = await client.gqlUpload(ANSWER_SECTION_QUESTION, { eventId, sectionId, questionId, payload }, resolvedFiles);
             return textResult(data.answerEventSectionQuestionV2);
         }
         const payload = { answer };

package/dist/tools/section-edit.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm, McpToolError } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { UPDATE_SECTION } from '../gql.js';
 import { previewResult } from './shared.js';
-export function registerSectionEditTools(server) {
+export function registerSectionEditTools(server, client) {
     server.registerTool('vibo_update_section', {
         description: "Edit a timeline section's name, time, note, or description. Subject to the section's host-edit permissions. Confirm-gated.",
         annotations: toolAnnotations({ title: 'Update Vibo section', readOnly: false }),

package/dist/tools/sections.js

@@ -1,8 +1,7 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { LIST_SECTIONS } from '../gql.js';
-export function registerSectionTools(server) {
+export function registerSectionTools(server, client) {
     server.registerTool('vibo_list_sections', {
         description: "List an event's timeline sections (e.g. Ceremony, First Dance, Dinner, Dancing) with each section's id, name, scheduled time, note, song count and progress. Use a section _id with vibo_get_section_songs / vibo_add_song_to_section.",
         annotations: toolAnnotations({ title: 'List Vibo event sections', readOnly: true }),

package/dist/tools/session.js

@@ -1,9 +1,12 @@
 import { textResult, toolAnnotations } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { captureViboSession } from '../auth.js';
 import { saveSession } from '../session-store.js';
 import { GET_ME } from '../gql.js';
-export function registerSessionTools(server) {
+// NB: this registrar is STDIO-ONLY — it is deliberately NOT wired into the
+// hosted Cloudflare connector (src/worker.ts). vibo_capture_session needs the
+// fetchproxy browser bridge + a signed-in browser tab, neither of which exists
+// in the serverless Worker runtime.
+export function registerSessionTools(server, client) {
     server.registerTool('vibo_capture_session', {
         description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via the fetchproxy bridge — for accounts that sign in with Apple/Google/Facebook (no password). Requires the fetchproxy browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
         annotations: toolAnnotations({ title: 'Capture Vibo session (SSO)', readOnly: false }),

package/dist/tools/shared.js

@@ -18,6 +18,15 @@ export const skipSchema = z
 export function pagination(limit, skip) {
     return { skip: skip ?? 0, limit: limit ?? 20 };
 }
+/**
+ * One inline file (base64 bytes + optional filename) for the hosted connector,
+ * which has no filesystem. Mirrors the local-path upload inputs so a tool can
+ * accept either a filesystem path (stdio) or inline bytes (Worker).
+ */
+export const inlineFileSchema = z.object({
+    data: z.string().describe('Base64-encoded file bytes (a `data:` URL prefix is allowed).'),
+    filename: z.string().optional().describe('Filename to send with this file.'),
+});
 /**
  * Dry-run response for a confirm-gated write. Returned WITHOUT making any
  * network call when `confirm` is not `true`, so the caller can see exactly what

package/dist/tools/song-management.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm, McpToolError } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { REMOVE_SECTION_SONGS, UPDATE_SECTION_SONGS, MOVE_SECTION_SONGS, REORDER_SONGS } from '../gql.js';
 import { previewResult } from './shared.js';
-export function registerSongManagementTools(server) {
+export function registerSongManagementTools(server, client) {
     server.registerTool('vibo_remove_song_from_section', {
         description: 'Remove one or more songs from a section. Confirm-gated.',
         annotations: toolAnnotations({ title: 'Remove songs from Vibo section', readOnly: false }),

package/dist/tools/songs.js

@@ -1,9 +1,8 @@
 import { z } from 'zod';
 import { textResult, toolAnnotations, schemaConfirm } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
 import { GET_SECTION_SONGS, SEARCH_SONGS, ADD_SONG_TO_SECTION, TOGGLE_LIKE } from '../gql.js';
 import { limitSchema, skipSchema, pagination, previewResult } from './shared.js';
-export function registerSongTools(server) {
+export function registerSongTools(server, client) {
     server.registerTool('vibo_get_section_songs', {
         description: "List the songs requested in a section, with who added each, like counts, must-play / do-not-play flags, comments, and streaming links. Sort by likesCount, createdAt, or title.",
         annotations: toolAnnotations({ title: 'Get Vibo section songs', readOnly: true }),

package/dist/tools/uploads.js

@@ -1,20 +1,37 @@
 import { z } from 'zod';
-import { textResult, toolAnnotations, schemaConfirm } from '@chrischall/mcp-utils';
-import { client } from '../client.js';
+import { textResult, toolAnnotations, schemaConfirm, McpToolError } from '@chrischall/mcp-utils';
 import { UPLOAD_USER_PHOTO } from '../gql.js';
+import { nodeUploadResolver } from '../upload-source.js';
 import { previewResult } from './shared.js';
-export function registerUploadTools(server) {
+/**
+ * `resolveUpload` is the injectable file-source seam: the stdio server uses the
+ * default `nodeUploadResolver` (reads a local `path`), while the hosted
+ * Cloudflare connector (src/worker.ts) passes `inlineUploadResolver` so the same
+ * tool works from base64 `fileData` with no filesystem.
+ */
+export function registerUploadTools(server, client, resolveUpload = nodeUploadResolver) {
     server.registerTool('vibo_set_profile_photo', {
-        description: 'Set your Vibo profile photo from a local image file. Returns the uploaded image URL. Confirm-gated.',
+        description: 'Set your Vibo profile photo from an image. On the local (stdio) server pass a local file `path`; on the hosted connector pass the image bytes as base64 `fileData`. Returns the uploaded image URL. Confirm-gated.',
         annotations: toolAnnotations({ title: 'Set Vibo profile photo', readOnly: false }),
         inputSchema: {
-            path: z.string().describe('Absolute path to a local image file (jpg/png).'),
+            path: z.string().optional().describe('Absolute path to a local image file (jpg/png). Local/stdio server only.'),
+            fileData: z
+                .string()
+                .optional()
+                .describe('Base64-encoded image bytes (a `data:` URL prefix is allowed). Used by the hosted connector, which has no filesystem.'),
+            filename: z.string().optional().describe('Filename for the image when using fileData (default "photo.jpg").'),
             confirm: schemaConfirm,
         },
-    }, async ({ path, confirm }) => {
+    }, async ({ path, fileData, filename, confirm }) => {
+        if (!path && !fileData) {
+            throw new McpToolError('Provide an image: a local file `path` or inline base64 `fileData`.', {
+                hint: 'On the local server pass `path`; on the hosted connector pass `fileData` (base64).',
+            });
+        }
         if (!confirm)
-            return previewResult('uploadUserPhoto', { photo: path });
-        const data = await client.gqlUpload(UPLOAD_USER_PHOTO, { photo: null }, { 'variables.photo': path });
+            return previewResult('uploadUserPhoto', { photo: path ?? '(inline bytes)' });
+        const file = await resolveUpload({ path, data: fileData, filename: filename ?? 'photo.jpg' });
+        const data = await client.gqlUpload(UPLOAD_USER_PHOTO, { photo: null }, { 'variables.photo': file });
         return textResult(data.uploadUserPhoto);
     });
 }

package/dist/upload-source.js

@@ -0,0 +1,79 @@
+// Injectable file-source boundary for multipart uploads.
+//
+// The Vibo upload tools (`vibo_set_profile_photo`, `vibo_answer_question` with
+// photo/file answers) send local media through the GraphQL `Upload` scalar.
+// The stdio server reads those bytes from a local file path; the hosted
+// Cloudflare Worker has NO filesystem, so it receives the bytes inline as
+// base64 instead. Both paths converge on an in-memory {@link UploadFile} that
+// `ViboClient.gqlUpload` streams into a `FormData` — the client itself never
+// touches `node:fs`, which keeps it loadable in the Workers runtime.
+//
+// A tool hands the resolver a {@link FileRef} (a local `path`, or inline base64
+// `data`) and gets back a `Blob` + filename. `nodeUploadResolver` (stdio)
+// resolves either; `inlineUploadResolver` (Worker) resolves only inline bytes
+// and throws an actionable error for a filesystem path.
+import { McpToolError } from '@chrischall/mcp-utils';
+const DEFAULT_FILENAME = 'upload';
+/** Decode base64 (optionally a `data:` URL) into an {@link UploadFile}. */
+function blobFromBase64(data, filename) {
+    // Strip a leading `data:<mime>;base64,` prefix if present.
+    const base64 = data.includes(',') && data.startsWith('data:') ? data.slice(data.indexOf(',') + 1) : data;
+    let binary;
+    try {
+        binary = atob(base64.trim());
+    }
+    catch (err) {
+        throw new McpToolError('Could not decode inline file data — expected base64.', {
+            hint: 'Pass the file bytes as a base64 string in `fileData` (a `data:` URL prefix is allowed).',
+            cause: err,
+        });
+    }
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return { blob: new Blob([bytes]), filename: filename ?? DEFAULT_FILENAME };
+}
+/**
+ * stdio resolver: reads a local file path via `node:fs` `openAsBlob` (streamed,
+ * not buffered), or decodes inline base64 if that's what the caller supplied.
+ * This is the byte-for-byte-unchanged local-path upload path.
+ */
+export const nodeUploadResolver = async (ref) => {
+    if (ref.path) {
+        const { openAsBlob } = await import('node:fs');
+        const { basename } = await import('node:path');
+        let blob;
+        try {
+            blob = await openAsBlob(ref.path);
+        }
+        catch (err) {
+            throw new McpToolError(`Could not read file for upload: ${ref.path}`, {
+                hint: 'Provide an absolute path to a readable local file.',
+                cause: err,
+            });
+        }
+        return { blob, filename: ref.filename ?? basename(ref.path) };
+    }
+    if (ref.data)
+        return blobFromBase64(ref.data, ref.filename);
+    throw new McpToolError('No file provided for upload.', {
+        hint: 'Pass a local file `path` (or inline base64 `fileData`).',
+    });
+};
+/**
+ * Hosted-connector resolver: the Worker has no filesystem, so it accepts ONLY
+ * inline base64 bytes. A filesystem path draws an actionable error rather than
+ * a runtime crash.
+ */
+export const inlineUploadResolver = async (ref) => {
+    if (ref.data)
+        return blobFromBase64(ref.data, ref.filename);
+    if (ref.path) {
+        throw new McpToolError('Local file paths are not available on the hosted Vibo connector.', {
+            hint: 'The hosted connector has no filesystem — pass the file bytes as base64 in `fileData` instead of a `path`.',
+        });
+    }
+    throw new McpToolError('No file provided for upload.', {
+        hint: 'Pass the file bytes as base64 in `fileData`.',
+    });
+};

package/dist/version.js

@@ -2,4 +2,4 @@
 // literal on the line carrying the release marker; every manifest and the MCP
 // server banner import VERSION from here, so there is exactly one place to keep
 // in sync (and one release-please extra-files entry).
-export const VERSION = '1.3.2'; // x-release-please-version
+export const VERSION = '1.4.0'; // x-release-please-version