vibo-mcp 1.5.3 → 1.5.5

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
-    "version": "1.5.3"
+    "version": "1.5.5"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Vibo",
       "source": "./",
       "description": "MCP server for Vibo — browse & manage events, timeline, songs, the DJ song ideas/questions, guests, and exports to Spotify/Apple Music",
-      "version": "1.5.3",
+      "version": "1.5.5",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vibo-mcp",
   "displayName": "Vibo",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -31000,53 +31000,6 @@ var StdioServerTransport = class {
   }
 };
 
-// node_modules/@chrischall/mcp-utils/dist/server/index.js
-async function createMcpServer(opts) {
-  const server = new McpServer({ name: opts.name, version: opts.version });
-  if (opts.banner !== void 0) {
-    console.error(opts.banner);
-  }
-  const deps = opts.deps;
-  for (const register of opts.tools) {
-    await register(server, deps);
-  }
-  return server;
-}
-function withGracefulShutdown(server, opts = {}) {
-  const shouldExit = opts.exit ?? true;
-  let shuttingDown = false;
-  const handler = (signal) => {
-    if (shuttingDown)
-      return;
-    shuttingDown = true;
-    void (async () => {
-      try {
-        if (opts.onSignal)
-          await opts.onSignal(signal);
-        await server.close();
-      } catch (err) {
-        console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
-      } finally {
-        if (shouldExit)
-          process.exit(0);
-      }
-    })();
-  };
-  process.on("SIGINT", () => handler("SIGINT"));
-  process.on("SIGTERM", () => handler("SIGTERM"));
-}
-async function runMcp(opts) {
-  const server = await createMcpServer(opts);
-  const shutdown = opts.shutdown ?? true;
-  if (shutdown !== false) {
-    withGracefulShutdown(server, shutdown === true ? {} : shutdown);
-  }
-  const spec = opts.transport ?? "stdio";
-  const transport = spec === "stdio" ? new StdioServerTransport() : spec;
-  await server.connect(transport);
-  return server;
-}
-
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var DEFAULT_ERROR_MESSAGE_MAX = 500;
 var McpToolError = class extends Error {
@@ -31109,6 +31062,81 @@ function textResult(data) {
     content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
   };
 }
+function errorResult(message) {
+  return {
+    content: [{ type: "text", text: redactSecrets(message) }],
+    isError: true
+  };
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/index.js
+function hintResultOrRethrow(err) {
+  if (err instanceof McpToolError && err.hint) {
+    return errorResult(`${err.message}
+
+Hint: ${err.hint}`);
+  }
+  throw err;
+}
+function surfaceToolHints(server) {
+  const register = server.registerTool.bind(server);
+  server.registerTool = (name, config2, cb) => register(name, config2, (...args) => {
+    let result;
+    try {
+      result = cb(...args);
+    } catch (err) {
+      return hintResultOrRethrow(err);
+    }
+    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+  });
+}
+async function createMcpServer(opts) {
+  const server = new McpServer({ name: opts.name, version: opts.version });
+  if (opts.surfaceHints !== false)
+    surfaceToolHints(server);
+  if (opts.banner !== void 0) {
+    console.error(opts.banner);
+  }
+  const deps = opts.deps;
+  for (const register of opts.tools) {
+    await register(server, deps);
+  }
+  return server;
+}
+function withGracefulShutdown(server, opts = {}) {
+  const shouldExit = opts.exit ?? true;
+  let shuttingDown = false;
+  const handler = (signal) => {
+    if (shuttingDown)
+      return;
+    shuttingDown = true;
+    void (async () => {
+      try {
+        if (opts.onSignal)
+          await opts.onSignal(signal);
+        await server.close();
+      } catch (err) {
+        console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
+      } finally {
+        if (shouldExit)
+          process.exit(0);
+      }
+    })();
+  };
+  process.on("SIGINT", () => handler("SIGINT"));
+  process.on("SIGTERM", () => handler("SIGTERM"));
+}
+async function runMcp(opts) {
+  const server = await createMcpServer(opts);
+  const shutdown = opts.shutdown ?? true;
+  if (shutdown !== false) {
+    withGracefulShutdown(server, shutdown === true ? {} : shutdown);
+  }
+  const spec = opts.transport ?? "stdio";
+  const transport = spec === "stdio" ? new StdioServerTransport() : spec;
+  await server.connect(transport);
+  return server;
+}
 
 // node_modules/@chrischall/mcp-utils/dist/config/index.js
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
@@ -31168,7 +31196,7 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "1.5.3";
+var VERSION = "1.5.5";
 
 // src/client.ts
 import { dirname as dirname2, join as join2 } from "path";
@@ -31402,7 +31430,7 @@ var ViboClient = class {
   /**
    * Resolve the saved-session fallback and the deferred config error on first
    * use. Kept out of the constructor so construction is pure (Worker-safe):
-   * `loadSession()` reads homedir()/the filesystem, which the Workers runtime
+   * `loadSession()` reads homedir()/the filesystem, which a sandboxed runtime
    * forbids at global scope. Runs its body at most once.
    */
   ensureConfigResolved() {
@@ -31460,10 +31488,9 @@ var ViboClient = class {
    * path (e.g. "variables.photo" or "variables.payload.answer.images.0") to an
    * in-memory {@link UploadFile} (blob + filename); `variables` must carry
    * `null` at each of those positions. The bytes arrive already resolved (from
-   * a local file on stdio, or inline base64 on the hosted connector — see
-   * src/upload-source.ts), so this method never touches the filesystem and runs
-   * unchanged in the Workers runtime (`FormData`/`Blob`/`fetch` are all
-   * available there). Same auth + single-retry-on-expiry behavior as `gql`.
+   * a local file, or inline base64 when the caller has no filesystem to name —
+   * see src/upload-source.ts), so this method never touches the filesystem
+   * itself. Same auth + single-retry-on-expiry behavior as `gql`.
    */
   async gqlUpload(query, variables, files) {
     this.ensureConfigResolved();
@@ -32579,7 +32606,7 @@ function registerQuestionTools(server, client2, resolveUpload = nodeUploadResolv
   server.registerTool(
     "vibo_answer_question",
     {
-      description: "Answer a section planning question. Provide the field matching the question's type: `text` for a text question, `selectedOptions` (array of option _ids from vibo_list_section_questions) for radio/checkbox/select, or `link` (array of URLs) for a link question. Use `otherOptionTitle` with the question's \"other\" option. For photo/file questions, pass local paths (`imagePaths`/`filePaths`) on the stdio server, or inline base64 bytes (`images`/`files`) on the hosted connector. Confirm-gated.",
+      description: "Answer a section planning question. Provide the field matching the question's type: `text` for a text question, `selectedOptions` (array of option _ids from vibo_list_section_questions) for radio/checkbox/select, or `link` (array of URLs) for a link question. Use `otherOptionTitle` with the question's \"other\" option. For photo/file questions, pass local paths (`imagePaths`/`filePaths`) when the server can read your disk, or inline base64 bytes (`images`/`files`) otherwise. Confirm-gated.",
       annotations: toolAnnotations({ title: "Answer Vibo question", readOnly: false }),
       inputSchema: {
         eventId: external_exports.string().describe("Event id."),
@@ -32591,8 +32618,8 @@ function registerQuestionTools(server, client2, resolveUpload = nodeUploadResolv
         otherOptionTitle: external_exports.string().optional().describe(`Free-text value when selecting the question's "other" option.`),
         imagePaths: external_exports.array(external_exports.string()).optional().describe("Absolute local image file paths, for a photo question (local/stdio server only)."),
         filePaths: external_exports.array(external_exports.string()).optional().describe("Absolute local file paths, for a file-attachment question (local/stdio server only)."),
-        images: external_exports.array(inlineFileSchema).optional().describe("Inline base64 images, for a photo question (used by the hosted connector, which has no filesystem)."),
-        files: external_exports.array(inlineFileSchema).optional().describe("Inline base64 files, for a file-attachment question (used by the hosted connector)."),
+        images: external_exports.array(inlineFileSchema).optional().describe("Inline base64 images, for a photo question \u2014 use these when the server cannot read your filesystem."),
+        files: external_exports.array(inlineFileSchema).optional().describe("Inline base64 files, for a file-attachment question \u2014 use these when the server cannot read your filesystem."),
         confirm: schemaConfirm
       }
     },
@@ -32609,7 +32636,7 @@ function registerQuestionTools(server, client2, resolveUpload = nodeUploadResolv
       const hasFiles = fileRefs.length > 0;
       if (text === void 0 && selectedOptions === void 0 && link === void 0 && !hasImages && !hasFiles) {
         throw new McpToolError("Provide an answer: text, selectedOptions, link, imagePaths/images, or filePaths/files.", {
-          hint: "Match the question's type \u2014 text \u2192 `text`, radio/checkbox/select \u2192 `selectedOptions`, link \u2192 `link`, photo/file \u2192 `imagePaths`/`filePaths` (stdio) or `images`/`files` (hosted connector)."
+          hint: "Match the question's type \u2014 text \u2192 `text`, radio/checkbox/select \u2192 `selectedOptions`, link \u2192 `link`, photo/file \u2192 `imagePaths`/`filePaths` for local files, or `images`/`files` for inline base64."
         });
       }
       const answer = {};
@@ -33054,11 +33081,11 @@ function registerUploadTools(server, client2, resolveUpload = nodeUploadResolver
   server.registerTool(
     "vibo_set_profile_photo",
     {
-      description: "Set your Vibo profile photo from an image. On the local (stdio) server pass a local file `path`; on the hosted connector pass the image bytes as base64 `fileData`. Returns the uploaded image URL. Confirm-gated.",
+      description: "Set your Vibo profile photo from an image. Pass a local file `path` if the server shares your filesystem; otherwise pass the image bytes as base64 `fileData`. Returns the uploaded image URL. Confirm-gated.",
       annotations: toolAnnotations({ title: "Set Vibo profile photo", readOnly: false }),
       inputSchema: {
         path: external_exports.string().optional().describe("Absolute path to a local image file (jpg/png). Local/stdio server only."),
-        fileData: external_exports.string().optional().describe("Base64-encoded image bytes (a `data:` URL prefix is allowed). Used by the hosted connector, which has no filesystem."),
+        fileData: external_exports.string().optional().describe("Base64-encoded image bytes (a `data:` URL prefix is allowed). Use this when the server cannot read your filesystem."),
         filename: external_exports.string().optional().describe('Filename for the image when using fileData (default "photo.jpg").'),
         confirm: schemaConfirm
       }
@@ -33066,7 +33093,7 @@ function registerUploadTools(server, client2, resolveUpload = nodeUploadResolver
     async ({ path, fileData, filename, confirm }) => {
       if (!path && !fileData) {
         throw new McpToolError("Provide an image: a local file `path` or inline base64 `fileData`.", {
-          hint: "On the local server pass `path`; on the hosted connector pass `fileData` (base64)."
+          hint: "Pass `path` for a local file, or `fileData` (base64) if the server cannot read your filesystem."
         });
       }
       if (!confirm) return previewResult("uploadUserPhoto", { photo: path ?? "(inline bytes)" });

package/dist/client.js

@@ -5,7 +5,7 @@ import { loadSession, saveSession } from './session-store.js';
 // Load .env for local dev; silently skip if dotenv is unavailable (e.g. the
 // mcpb bundle, which externalizes dotenv). `override: false` means a
 // host-provided env var always wins over .env. The try/catch additionally
-// guards the Cloudflare Worker runtime (src/worker.ts): there `import.meta.url`
+// guards non-Node runtimes, where `import.meta.url`
 // is undefined and `fileURLToPath(undefined)` would otherwise throw at module
 // init (Worker startup validation) — there is no filesystem / .env there anyway.
 try {
@@ -69,7 +69,7 @@ export class ViboClient {
     /**
      * Resolve the saved-session fallback and the deferred config error on first
      * use. Kept out of the constructor so construction is pure (Worker-safe):
-     * `loadSession()` reads homedir()/the filesystem, which the Workers runtime
+     * `loadSession()` reads homedir()/the filesystem, which a sandboxed runtime
      * forbids at global scope. Runs its body at most once.
      */
     ensureConfigResolved() {
@@ -133,10 +133,9 @@ export class ViboClient {
      * path (e.g. "variables.photo" or "variables.payload.answer.images.0") to an
      * in-memory {@link UploadFile} (blob + filename); `variables` must carry
      * `null` at each of those positions. The bytes arrive already resolved (from
-     * a local file on stdio, or inline base64 on the hosted connector — see
-     * src/upload-source.ts), so this method never touches the filesystem and runs
-     * unchanged in the Workers runtime (`FormData`/`Blob`/`fetch` are all
-     * available there). Same auth + single-retry-on-expiry behavior as `gql`.
+     * a local file, or inline base64 when the caller has no filesystem to name —
+     * see src/upload-source.ts), so this method never touches the filesystem
+     * itself. Same auth + single-retry-on-expiry behavior as `gql`.
      */
     async gqlUpload(query, variables, files) {
         this.ensureConfigResolved();

package/dist/tools/questions.js

@@ -6,7 +6,7 @@ import { previewResult, inlineFileSchema } from './shared.js';
 /**
  * `resolveUpload` is the injectable file-source seam for photo/file answers:
  * stdio uses the default `nodeUploadResolver` (local `*Paths`), the hosted
- * connector passes `inlineUploadResolver` (inline base64 `images`/`files`).
+ * remote caller sends inline base64 (`images`/`files`) instead.
  */
 export function registerQuestionTools(server, client, resolveUpload = nodeUploadResolver) {
     server.registerTool('vibo_list_section_questions', {
@@ -24,7 +24,7 @@ export function registerQuestionTools(server, client, resolveUpload = nodeUpload
         return textResult(data.getEventSectionQuestionsV2);
     });
     server.registerTool('vibo_answer_question', {
-        description: "Answer a section planning question. Provide the field matching the question's type: `text` for a text question, `selectedOptions` (array of option _ids from vibo_list_section_questions) for radio/checkbox/select, or `link` (array of URLs) for a link question. Use `otherOptionTitle` with the question's \"other\" option. For photo/file questions, pass local paths (`imagePaths`/`filePaths`) on the stdio server, or inline base64 bytes (`images`/`files`) on the hosted connector. Confirm-gated.",
+        description: "Answer a section planning question. Provide the field matching the question's type: `text` for a text question, `selectedOptions` (array of option _ids from vibo_list_section_questions) for radio/checkbox/select, or `link` (array of URLs) for a link question. Use `otherOptionTitle` with the question's \"other\" option. For photo/file questions, pass local paths (`imagePaths`/`filePaths`) when the server can read your disk, or inline base64 bytes (`images`/`files`) otherwise. Confirm-gated.",
         annotations: toolAnnotations({ title: 'Answer Vibo question', readOnly: false }),
         inputSchema: {
             eventId: z.string().describe('Event id.'),
@@ -51,16 +51,16 @@ export function registerQuestionTools(server, client, resolveUpload = nodeUpload
             images: z
                 .array(inlineFileSchema)
                 .optional()
-                .describe('Inline base64 images, for a photo question (used by the hosted connector, which has no filesystem).'),
+                .describe('Inline base64 images, for a photo question — use these when the server cannot read your filesystem.'),
             files: z
                 .array(inlineFileSchema)
                 .optional()
-                .describe('Inline base64 files, for a file-attachment question (used by the hosted connector).'),
+                .describe('Inline base64 files, for a file-attachment question — use these when the server cannot read your filesystem.'),
             confirm: schemaConfirm,
         },
     }, async ({ eventId, sectionId, questionId, text, selectedOptions, link, otherOptionTitle, imagePaths, filePaths, images, files, confirm }) => {
         // Merge local-path and inline-byte file refs (in that order) into one list
-        // per slot. stdio supplies paths; the hosted connector supplies inline
+        // per slot. A local caller supplies paths; a remote one supplies inline
         // bytes; the injected resolver turns each ref into an in-memory blob.
         const imageRefs = [
             ...(imagePaths ?? []).map((path) => ({ path })),
@@ -76,7 +76,7 @@ export function registerQuestionTools(server, client, resolveUpload = nodeUpload
         // modifier for selectedOptions — on its own it is not a valid answer.
         if (text === undefined && selectedOptions === undefined && link === undefined && !hasImages && !hasFiles) {
             throw new McpToolError('Provide an answer: text, selectedOptions, link, imagePaths/images, or filePaths/files.', {
-                hint: "Match the question's type — text → `text`, radio/checkbox/select → `selectedOptions`, link → `link`, photo/file → `imagePaths`/`filePaths` (stdio) or `images`/`files` (hosted connector).",
+                hint: "Match the question's type — text → `text`, radio/checkbox/select → `selectedOptions`, link → `link`, photo/file → `imagePaths`/`filePaths` for local files, or `images`/`files` for inline base64.",
             });
         }
         const answer = {};

package/dist/tools/session.js

@@ -2,10 +2,9 @@ import { textResult, toolAnnotations } from '@chrischall/mcp-utils';
 import { captureViboSession } from '../auth.js';
 import { saveSession } from '../session-store.js';
 import { GET_ME } from '../gql.js';
-// NB: this registrar is STDIO-ONLY — it is deliberately NOT wired into the
-// hosted Cloudflare connector (src/worker.ts). vibo_capture_session needs the
-// fetchproxy browser bridge + a signed-in browser tab, neither of which exists
-// in the serverless Worker runtime.
+// NB: vibo_capture_session needs the fetchproxy browser bridge and a signed-in
+// browser tab on the same machine, so this registrar is only useful where both
+// exist — a deployment without them should not wire it in.
 export function registerSessionTools(server, client) {
     server.registerTool('vibo_capture_session', {
         description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via the fetchproxy bridge — for accounts that sign in with Apple/Google/Facebook (no password). Requires the fetchproxy browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",

package/dist/tools/shared.js

@@ -19,9 +19,9 @@ export function pagination(limit, skip) {
     return { skip: skip ?? 0, limit: limit ?? 20 };
 }
 /**
- * One inline file (base64 bytes + optional filename) for the hosted connector,
- * which has no filesystem. Mirrors the local-path upload inputs so a tool can
- * accept either a filesystem path (stdio) or inline bytes (Worker).
+ * One inline file (base64 bytes + optional filename) for callers with no
+ * filesystem to name — a hosted deployment reaches the server's disk, not the
+ * user's. Mirrors the local-path upload inputs so a tool can accept either.
  */
 export const inlineFileSchema = z.object({
     data: z.string().describe('Base64-encoded file bytes (a `data:` URL prefix is allowed).'),

package/dist/tools/uploads.js

@@ -5,27 +5,27 @@ import { nodeUploadResolver } from '../upload-source.js';
 import { previewResult } from './shared.js';
 /**
  * `resolveUpload` is the injectable file-source seam: the stdio server uses the
- * default `nodeUploadResolver` (reads a local `path`), while the hosted
- * Cloudflare connector (src/worker.ts) passes `inlineUploadResolver` so the same
- * tool works from base64 `fileData` with no filesystem.
+ * default `nodeUploadResolver`, which resolves either a local `path` or inline
+ * base64 `fileData`. A caller that shares no filesystem with the server sends
+ * the bytes inline, and the same tool works unchanged.
  */
 export function registerUploadTools(server, client, resolveUpload = nodeUploadResolver) {
     server.registerTool('vibo_set_profile_photo', {
-        description: 'Set your Vibo profile photo from an image. On the local (stdio) server pass a local file `path`; on the hosted connector pass the image bytes as base64 `fileData`. Returns the uploaded image URL. Confirm-gated.',
+        description: 'Set your Vibo profile photo from an image. Pass a local file `path` if the server shares your filesystem; otherwise pass the image bytes as base64 `fileData`. Returns the uploaded image URL. Confirm-gated.',
         annotations: toolAnnotations({ title: 'Set Vibo profile photo', readOnly: false }),
         inputSchema: {
             path: z.string().optional().describe('Absolute path to a local image file (jpg/png). Local/stdio server only.'),
             fileData: z
                 .string()
                 .optional()
-                .describe('Base64-encoded image bytes (a `data:` URL prefix is allowed). Used by the hosted connector, which has no filesystem.'),
+                .describe('Base64-encoded image bytes (a `data:` URL prefix is allowed). Use this when the server cannot read your filesystem.'),
             filename: z.string().optional().describe('Filename for the image when using fileData (default "photo.jpg").'),
             confirm: schemaConfirm,
         },
     }, async ({ path, fileData, filename, confirm }) => {
         if (!path && !fileData) {
             throw new McpToolError('Provide an image: a local file `path` or inline base64 `fileData`.', {
-                hint: 'On the local server pass `path`; on the hosted connector pass `fileData` (base64).',
+                hint: 'Pass `path` for a local file, or `fileData` (base64) if the server cannot read your filesystem.',
             });
         }
         if (!confirm)

package/dist/upload-source.js

@@ -2,16 +2,14 @@
 //
 // The Vibo upload tools (`vibo_set_profile_photo`, `vibo_answer_question` with
 // photo/file answers) send local media through the GraphQL `Upload` scalar.
-// The stdio server reads those bytes from a local file path; the hosted
-// Cloudflare Worker has NO filesystem, so it receives the bytes inline as
-// base64 instead. Both paths converge on an in-memory {@link UploadFile} that
-// `ViboClient.gqlUpload` streams into a `FormData` — the client itself never
-// touches `node:fs`, which keeps it loadable in the Workers runtime.
+// A caller that shares a filesystem with the server names a local path; one
+// that does not — anything reaching this server remotely — sends the bytes
+// inline as base64 instead. Both converge on an in-memory {@link UploadFile}
+// that `ViboClient.gqlUpload` streams into a `FormData`.
 //
 // A tool hands the resolver a {@link FileRef} (a local `path`, or inline base64
-// `data`) and gets back a `Blob` + filename. `nodeUploadResolver` (stdio)
-// resolves either; `inlineUploadResolver` (Worker) resolves only inline bytes
-// and throws an actionable error for a filesystem path.
+// `data`) and gets back a `Blob` + filename; `nodeUploadResolver` resolves
+// either.
 import { McpToolError } from '@chrischall/mcp-utils';
 const DEFAULT_FILENAME = 'upload';
 /** Decode base64 (optionally a `data:` URL) into an {@link UploadFile}. */
@@ -60,20 +58,3 @@ export const nodeUploadResolver = async (ref) => {
         hint: 'Pass a local file `path` (or inline base64 `fileData`).',
     });
 };
-/**
- * Hosted-connector resolver: the Worker has no filesystem, so it accepts ONLY
- * inline base64 bytes. A filesystem path draws an actionable error rather than
- * a runtime crash.
- */
-export const inlineUploadResolver = async (ref) => {
-    if (ref.data)
-        return blobFromBase64(ref.data, ref.filename);
-    if (ref.path) {
-        throw new McpToolError('Local file paths are not available on the hosted Vibo connector.', {
-            hint: 'The hosted connector has no filesystem — pass the file bytes as base64 in `fileData` instead of a `path`.',
-        });
-    }
-    throw new McpToolError('No file provided for upload.', {
-        hint: 'Pass the file bytes as base64 in `fileData`.',
-    });
-};

package/dist/version.js

@@ -2,4 +2,4 @@
 // literal on the line carrying the release marker; every manifest and the MCP
 // server banner import VERSION from here, so there is exactly one place to keep
 // in sync (and one release-please extra-files entry).
-export const VERSION = '1.5.3'; // x-release-please-version
+export const VERSION = '1.5.5'; // x-release-please-version

package/mint.yaml

@@ -0,0 +1,65 @@
+version: 1
+name: Vibo
+slug: vibo
+summary: >-
+  Plan and manage your event music in Vibo (vibodj.com) — events, timeline,
+  song requests, the DJ's song ideas and planning questions,
+  must-play/do-not-play, comments, guests, and exports to Spotify/Apple
+  Music, via natural language.
+#
+# Hosting note (a comment, not user-facing summary text): this is a
+# BROWSER-BRIDGE MCP — it reaches its site through the user's signed-in
+# tab via the fetchproxy bridge. A bridged registration also needs runtime
+# `fly-shared`, `bridge: true` and a `bridgePortEnv`, which are registration
+# fields this manifest has no schema for (set them over the control API).
+# `state.dataDir` below is required for `bridge`.
+env:
+  - name: VIBO_EMAIL
+    required: false
+    help: >-
+      Vibo account email (or use VIBO_ACCESS_TOKEN for SSO accounts)
+  - name: VIBO_PASSWORD
+    secret: true
+    required: false
+    help: >-
+      Vibo account password
+  - name: VIBO_ACCESS_TOKEN
+    secret: true
+    required: false
+    help: >-
+      Captured x-token from a signed-in web.vibodj.com session (SSO alternative)
+  - name: VIBO_REFRESH_TOKEN
+    secret: true
+    required: false
+    help: >-
+      Matching x-refresh-token so the session can renew
+  - name: VIBO_API_URL
+    required: false
+    help: >-
+      Overrides the upstream API base URL. Leave unset for the default; if you
+      change it, update egress.allow to match.
+  - name: VIBO_SESSION_FILE
+    required: false
+    help: >-
+      Filesystem path/flag for saved state or output. Relates to state.dataDir;
+      leave unset for the default.
+state:
+  dataDir: true
+  reason: >-
+    The fetchproxy identity lives at $HOME/.fetchproxy/identity/<name>.json
+    and the pair code derives from it. Without a persistent $HOME every cold
+    start mints a fresh identity and re-prompts pairing in the browser; the
+    API refuses bridge without it.
+egress:
+  allow:
+    # Only hosts the SERVER process actually fetches. Hosts that appear
+    # solely in a URL this server BUILDS and returns are excluded.
+    #
+    # Every mode (email/password signIn, captured token, refresh, uploads)
+    # POSTs to the GraphQL endpoint from the process itself
+    # (src/client.ts DEFAULT_API_URL); no redirect hop. `vibo_capture_session`
+    # lifts x-token/x-refresh-token from the signed-in web.vibodj.com tab over
+    # the fetchproxy bridge — that is the browser's dial, not the process's, so
+    # web.vibodj.com and vibodj.com are NOT listed. A VIBO_API_URL override
+    # names a host this list cannot know; add it here if you set one.
+    - api.vibodj.com

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibo-mcp",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "mcpName": "io.github.chrischall/vibo-mcp",
   "description": "Vibo (vibodj.com) MCP server for Claude — host/couple event music planning & management. Developed and maintained by AI (Claude Code).",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -33,38 +33,30 @@
     ".claude-plugin",
     "skills",
     ".mcp.json",
-    "server.json"
+    "server.json",
+    "mint.yaml"
   ],
   "scripts": {
     "build": "tsc && npm run bundle",
     "bundle": "esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --external:@fetchproxy/bootstrap --outfile=dist/bundle.js",
     "dev": "node dist/index.js",
-    "test": "vitest run",
+    "test": "npm run typecheck && vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "worker:dev": "wrangler dev",
-    "worker:deploy": "wrangler deploy",
-    "worker:typecheck": "tsc --noEmit -p tsconfig.worker.json",
-    "worker:test": "vitest run --config vitest.workers.config.ts"
+    "test:coverage": "npm run typecheck && vitest run --coverage",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.14.0",
+    "@chrischall/mcp-utils": "^0.15.0",
     "@fetchproxy/bootstrap": "^2.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.0",
     "zod": "^4.4.2"
   },
   "devDependencies": {
-    "@chrischall/mcp-connector": "^1.0.0",
-    "@cloudflare/vitest-pool-workers": "^0.20.1",
-    "@cloudflare/workers-oauth-provider": "^0.8.1",
-    "@cloudflare/workers-types": "^5.20260708.1",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.2",
-    "agents": "^0.19.0",
     "esbuild": "^0.28.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.2",
-    "wrangler": "^4.110.0"
+    "vitest": "^4.1.2"
   }
 }

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/vibo-mcp",
     "source": "github"
   },
-  "version": "1.5.3",
+  "version": "1.5.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "vibo-mcp",
-      "version": "1.5.3",
+      "version": "1.5.5",
       "transport": {
         "type": "stdio"
       },

package/dist/vibo-auth.js

@@ -1,34 +0,0 @@
-import { ViboClient } from './client.js';
-import { GET_ME } from './gql.js';
-/**
- * `ConnectorAuth` for the Vibo remote connector: the login page collects the
- * user's Vibo email + password, VERIFIES them by constructing a `ViboClient`
- * with the injected creds and forcing a `signIn` + `me` read (a bad
- * email/password makes the mutation throw here, surfaced back on the login
- * page), and stores `{ email, password }` as the OAuth props that `worker.ts`'s
- * `buildClient` turns into a per-user client.
- *
- * SSO-only accounts (Apple/Google/Facebook, no password) are NOT supported on
- * the hosted connector — they have no password to sign in with. Use a Vibo
- * account with an email + password, or the local stdio server's
- * `vibo_capture_session` browser-capture flow instead.
- */
-export const viboAuth = {
-    service: 'Vibo',
-    accent: '#5B2AE0',
-    privacyNote: 'Your Vibo email and password are stored encrypted and used only to sign into Vibo (vibodj.com) on your behalf to mint short-lived access tokens. SSO-only Apple/Google/Facebook accounts are not supported — use an account with a password.',
-    fields: [
-        { name: 'email', label: 'Vibo email', type: 'text' },
-        { name: 'password', label: 'Vibo password', type: 'password' },
-    ],
-    async login(fields) {
-        // Verify the creds up front: build a client with the injected email +
-        // password and force a server-side signIn by hitting a cheap authenticated
-        // read. Bad creds make `signIn` (and thus this call) throw here — surfaced
-        // back on the login page. The response is discarded; the per-user client is
-        // built fresh from the stored props by buildClient.
-        const client = new ViboClient({ email: fields.email, password: fields.password });
-        await client.gql(GET_ME);
-        return { email: fields.email, password: fields.password };
-    },
-};