vibo-mcp 2.3.0 → 2.4.0

package/dist/client.js

@@ -46,6 +46,13 @@ const REFRESH = `
 const AUTH_ERROR_CODES = new Set(['UNAUTHORIZED', 'UNAUTHENTICATED']);
 // Codes for "you are signed in, but not allowed to do this".
 const PERMISSION_ERROR_CODES = new Set(['FORBIDDEN']);
+// Vibo's permission denial for a host acting where the DJ's settings forbid it
+// ("Action is not allowed for user", e.g. reordering songs in a section with
+// host ordering off — verified live) arrives without a FORBIDDEN code. Anchored
+// on Vibo's exact wording so a validation error that merely says "not allowed"
+// keeps its own message. Matched only when the
+// error carries no auth code, so an expired session is never mistaken for it.
+const PERMISSION_MESSAGE_PATTERN = /\bnot allowed for user\b/i;
 // Message fallback, consulted ONLY for an error that carries no code. Vibo's
 // expired-session text is "Not authorized. Try to log in"; the patterns are
 // anchored on session/token wording so an unrelated message that merely
@@ -382,7 +389,12 @@ export class ViboClient {
     isPermissionError(status, errors) {
         if (status === 403)
             return true;
-        return (errors ?? []).some((e) => PERMISSION_ERROR_CODES.has(e.code ?? e.extensions?.code ?? ''));
+        return (errors ?? []).some((e) => {
+            const code = e.code ?? e.extensions?.code ?? '';
+            if (PERMISSION_ERROR_CODES.has(code))
+                return true;
+            return !AUTH_ERROR_CODES.has(code) && PERMISSION_MESSAGE_PATTERN.test(e.message ?? '');
+        });
     }
     unwrap(status, body) {
         if (this.isPermissionError(status, body.errors)) {

package/dist/gql.js

@@ -86,6 +86,45 @@ export const LIST_SECTIONS = `
     }
   }
 `;
+// Section management (create / delete / reorder). Captured from the web app's
+// own documents in the web.vibodj.com bundle (Timeline "+" -> Add section,
+// the section "..." -> Delete, and the timeline drag handler) and checked
+// against live introspection. Read-before-write lookups use the lean
+// SECTIONS_FOR_WRITE / EVENT_PERMISSIONS documents so vibo_list_sections'
+// output stays unchanged.
+export const SECTIONS_FOR_WRITE = `
+  query sectionsForWrite($eventId: ID!) {
+    sections(eventId: $eventId) {
+      _id name type songsCount questionsCount answeredCount canRemove visibility
+      settings { canHostsOrderSongs canHostDeleteSection }
+    }
+  }
+`;
+export const EVENT_PERMISSIONS = `
+  query eventPermissions($eventId: ID!) {
+    event(eventId: $eventId) {
+      _id role isLocked
+      settings { canHostCreateSections canHostReorderSections sectionSongsLimit sectionMustPlayLimit }
+    }
+  }
+`;
+export const CREATE_SECTION = `
+  mutation createSection($eventId: ID!, $payload: CreateSectionInput!) {
+    createSection(eventId: $eventId, payload: $payload) {
+      _id name type time description visibility
+    }
+  }
+`;
+export const REMOVE_SECTION = `
+  mutation removeSection($eventId: ID!, $sectionId: ID!) {
+    removeSection(eventId: $eventId, sectionId: $sectionId)
+  }
+`;
+export const REORDER_SECTIONS = `
+  mutation reorderSections($eventId: ID!, $sourceSectionId: ID!, $targetSectionId: ID) {
+    reorderSections(eventId: $eventId, sourceSectionId: $sourceSectionId, targetSectionId: $targetSectionId)
+  }
+`;
 // ---- Songs ------------------------------------------------------------------
 export const GET_SECTION_SONGS = `
   query getSectionSongs($eventId: ID!, $sectionId: ID!, $filter: SectionSongsFilter, $pagination: PaginationInput, $sort: SongsSortInput) {
@@ -102,6 +141,17 @@ export const GET_SECTION_SONGS = `
     }
   }
 `;
+// The section's songs in their manual (unsorted) order, ids only — used to
+// validate ids before a remove/reorder and to confirm an add landed.
+export const SECTION_SONG_IDS = `
+  query sectionSongIds($eventId: ID!, $sectionId: ID!, $pagination: PaginationInput) {
+    getSectionSongs(eventId: $eventId, sectionId: $sectionId, pagination: $pagination) {
+      songs { _id viboSongId artist title }
+      next { skip limit }
+      totalCount
+    }
+  }
+`;
 export const SEARCH_SONGS = `
   query getSongs($eventId: ID!, $sectionId: ID!, $filter: SongsFilter!, $limit: Int!) {
     getSongs(eventId: $eventId, sectionId: $sectionId, filter: $filter, limit: $limit) {

package/dist/index.js

@@ -15,6 +15,7 @@ import { registerIdeasTools } from './tools/ideas.js';
 import { registerImportTools } from './tools/imports.js';
 import { registerCollaborationTools } from './tools/collaboration.js';
 import { registerSectionEditTools } from './tools/section-edit.js';
+import { registerSectionManageTools } from './tools/section-manage.js';
 import { registerUploadTools } from './tools/uploads.js';
 import { registerSessionTools } from './tools/session.js';
 // The ViboClient is a module-level singleton (constructed in client.ts and
@@ -44,6 +45,7 @@ await runMcp({
         registerImportTools,
         registerCollaborationTools,
         registerSectionEditTools,
+        registerSectionManageTools,
         registerUploadTools,
         registerSessionTools,
     ],

package/dist/reorder.js

@@ -0,0 +1,27 @@
+/**
+ * `order` is the current list; `sources` are moved (in the given order) to sit
+ * directly after `after`, or at the start when `after` is null. Callers
+ * validate ids first: every source and `after` must be in `order`, and
+ * `after` must not be a source.
+ */
+export function planMoves(order, sources, after) {
+    let current = [...order];
+    let anchor = after;
+    const moves = [];
+    for (const source of sources) {
+        const from = current.indexOf(source);
+        const rest = current.filter((id) => id !== source);
+        const to = anchor === null ? 0 : rest.indexOf(anchor) + 1;
+        if (to !== from) {
+            moves.push({ source, target: anchor });
+            current = [...rest.slice(0, to), source, ...rest.slice(to)];
+        }
+        anchor = source;
+    }
+    return { moves, finalOrder: current };
+}
+/** Ids from `wanted` that are not in `have`, preserving order. */
+export function missingIds(wanted, have) {
+    const set = new Set(have);
+    return wanted.filter((id) => !set.has(id));
+}

package/dist/tools/collaboration.js

@@ -1,16 +1,24 @@
 import { z } from 'zod';
-import { minifiedResult, confirmTokenParam, toolAnnotations } from '@chrischall/mcp-utils';
+import { minifiedResult, confirmTokenParam, resolveView, toolAnnotations } from '@chrischall/mcp-utils';
 import { LIST_EVENT_USERS, INVITE_USERS, CHANGE_USER_ROLE, REMOVE_USER } from '../gql.js';
 import { limitSchema, skipSchema, pagination, confirmWrite, CONFIRM_NOTE } from './shared.js';
-import { viewArg, viewResponse } from '../view.js';
+import { eventUsersViewArg, viewResponse, VIBO_VIEWS } from '../view.js';
+function membersForView(view, users) {
+    if (resolveView(view, VIBO_VIEWS) !== 'compact')
+        return users;
+    return users.map((u) => {
+        const { _id, firstName, lastName, role } = (u ?? {});
+        return { _id, firstName, lastName, role };
+    });
+}
 export function registerCollaborationTools(server, client) {
     server.registerTool('vibo_list_event_users', {
-        description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page.",
+        description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page. Default (compact) view returns each member's id, name and role only; pass view:'full' for email addresses and avatars.",
         annotations: toolAnnotations({ title: 'List Vibo event users', readOnly: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             usersType: z.enum(['host', 'guest']).optional().describe('Filter to only hosts or only guests.'),
-            view: viewArg(),
+            view: eventUsersViewArg(),
             limit: limitSchema.describe('Max items to return (default 20). Applies per group when usersType is omitted.'),
             skip: skipSchema,
         }),
@@ -22,7 +30,11 @@ export function registerCollaborationTools(server, client) {
                 usersType,
                 pagination: page,
             });
-            return viewResponse(view, { ...data.eventUsers, usersType });
+            return viewResponse(view, {
+                ...data.eventUsers,
+                users: membersForView(view, data.eventUsers.users),
+                usersType,
+            });
         }
         // The API returns nothing unless usersType is set, so fetch both groups
         // and merge for the intuitive "everyone on the event" listing.
@@ -34,8 +46,8 @@ export function registerCollaborationTools(server, client) {
         // when `usersType` is omitted — the default call — so honouring `view` on
         // only the filtered branch would leave the common path paying full price.
         return viewResponse(view, {
-            hosts: hosts.eventUsers.users,
-            guests: guests.eventUsers.users,
+            hosts: membersForView(view, hosts.eventUsers.users),
+            guests: membersForView(view, guests.eventUsers.users),
             hostsCount: hosts.eventUsers.totalCount,
             guestsCount: guests.eventUsers.totalCount,
         });

package/dist/tools/lookups.js

@@ -0,0 +1,59 @@
+import { McpToolError } from '@chrischall/mcp-utils';
+import { SECTIONS_FOR_WRITE, EVENT_PERMISSIONS, SECTION_SONG_IDS } from '../gql.js';
+/** The event's timeline, in order. */
+export async function fetchSections(client, eventId) {
+    const data = await client.gql(SECTIONS_FOR_WRITE, { eventId });
+    return data.sections ?? [];
+}
+export async function fetchEventPermissions(client, eventId) {
+    const data = await client.gql(EVENT_PERMISSIONS, { eventId });
+    return data.event;
+}
+export function findSection(sections, sectionId) {
+    const section = sections.find((s) => s._id === sectionId);
+    if (!section) {
+        throw new McpToolError(`Section ${sectionId} is not in this event's timeline.`, {
+            hint: 'Get section ids from vibo_list_sections for the same eventId.',
+        });
+    }
+    return section;
+}
+/** Every song in a section, in its manual order (no sort applied). */
+export async function fetchSectionSongs(client, eventId, sectionId) {
+    const songs = [];
+    const limit = 100;
+    // Bounded: 50 pages × 100 is far beyond Vibo's per-section song limit (999).
+    for (let page = 0; page < 50; page++) {
+        const data = await client.gql(SECTION_SONG_IDS, { eventId, sectionId, pagination: { skip: songs.length, limit } });
+        const batch = data.getSectionSongs?.songs ?? [];
+        songs.push(...batch);
+        const total = data.getSectionSongs?.totalCount;
+        if (batch.length < limit || (typeof total === 'number' && songs.length >= total))
+            break;
+    }
+    return songs;
+}
+/**
+ * Refuse, before the confirmation step, song ids that aren't in the section.
+ * Names a passed viboSongId's section-song _id, the usual mix-up.
+ */
+export function assertSongsInSection(songIds, songs) {
+    const have = new Set(songs.map((s) => s._id));
+    const missing = songIds.filter((id) => !have.has(id));
+    if (missing.length === 0)
+        return;
+    const hints = missing
+        .map((id) => {
+        const byVibo = songs.find((s) => s.viboSongId === id);
+        return byVibo ? `${id} is a viboSongId — its section-song _id is ${byVibo._id}` : null;
+    })
+        .filter(Boolean);
+    throw new McpToolError(`${missing.length} of ${songIds.length} song id(s) are not in this section: ${missing.join(', ')}. Nothing was sent.`, {
+        hint: (hints.length ? hints.join('; ') + '. ' : '') +
+            'Use the song _id values from vibo_get_section_songs for this same section.',
+    });
+}
+/** True when the caller is a host (not the DJ) — the role Vibo's host-permission toggles apply to. */
+export function isHost(perms) {
+    return perms.role === 'host';
+}

package/dist/tools/section-manage.js

@@ -0,0 +1,288 @@
+import { z } from 'zod';
+import { McpToolError, minifiedResult, confirmTokenParam, toolAnnotations } from '@chrischall/mcp-utils';
+import { CREATE_SECTION, REMOVE_SECTION, REORDER_SECTIONS, UPDATE_SECTION } from '../gql.js';
+import { planMoves, missingIds } from '../reorder.js';
+import { confirmWrite, CONFIRM_NOTE } from './shared.js';
+import { fetchSections, fetchEventPermissions, findSection, isHost, } from './lookups.js';
+/**
+ * The web app's section-name limit (`nameMustBeCharactersOrLess`, count 45).
+ * Vibo's API stores longer names (60 was accepted live), so this keeps names
+ * the web UI can still edit.
+ */
+export const SECTION_NAME_MAX = 45;
+/**
+ * The web app's "Add section" defaults (its create-form initial values), so a
+ * section made here behaves like one made in the UI.
+ */
+const DEFAULT_SECTION_SETTINGS = {
+    timeEnabled: true,
+    songsEnabled: true,
+    notesEnabled: true,
+    canHostsOrderSongs: true,
+    canHostDeleteSection: true,
+    notesVisibleForHosts: true,
+    canHostChangeSectionName: true,
+    canHostChangeSectionTime: true,
+};
+/** The UI's "Who will see this section" choices → settings, verbatim from its bundle. */
+const VISIBILITY_SETTINGS = {
+    host: { visibleForGuests: false, visibleForHosts: true }, // "Me and DJ"
+    public: { visibleForGuests: true, visibleForHosts: true }, // "Guests"
+};
+/** Section types a delete must be forced for: the DJ's built-in list and timeline dividers. */
+const PROTECTED_TYPES = new Set(['dontPlay', 'headline']);
+const TIME_PATTERN = /^(0?[1-9]|1[0-2]):([0-5]\d)\s*([ap])\.?m\.?$/i;
+/** "5:00 PM" / "05:00pm" → "05:00 pm" (the form Vibo stores); undefined when not a 12-hour time. */
+export function normalizeTime(time) {
+    const m = TIME_PATTERN.exec(time.trim());
+    if (!m)
+        return undefined;
+    return `${m[1].padStart(2, '0')}:${m[2]} ${m[3].toLowerCase()}m`;
+}
+function assertCanWriteTimeline(perms, flag, what) {
+    if (!isHost(perms))
+        return;
+    if (perms.isLocked) {
+        throw new McpToolError(`This event is locked, so hosts can't ${what}. Nothing was sent.`, {
+            hint: 'The DJ locks an event close to the date; ask them to unlock it or make the change.',
+        });
+    }
+    if (perms.settings?.[flag] === false) {
+        throw new McpToolError(`The DJ has turned off "${flag}" for this event, so hosts can't ${what}. Nothing was sent.`, {
+            hint: "It's an event setting only the DJ can change — ask them to enable it or make the change.",
+        });
+    }
+}
+const sectionLabel = (s) => ({ _id: s._id, name: s.name });
+export function registerSectionManageTools(server, client) {
+    server.registerTool('vibo_create_section', {
+        description: `Create a new timeline section. Name is required, max ${SECTION_NAME_MAX} characters (Vibo's limit, checked ` +
+            'before anything is sent). Place it with afterSectionId (directly after that section) or position ' +
+            '(0-based index; 0 = first); with neither it goes at the end of the timeline, like the web app. ' +
+            'visibility "host" (default) = "Me and DJ", "public" = visible to guests too. Vibo gives a section a host ' +
+            "creates \"hosts can order songs\" = off, which only the DJ can turn on. Returns the new section _id. " +
+            CONFIRM_NOTE,
+        annotations: toolAnnotations({ title: 'Create Vibo section', readOnly: false, destructive: false }),
+        inputSchema: z.object({
+            eventId: z.string().describe('Event id.'),
+            name: z.string().describe(`Section name, 1–${SECTION_NAME_MAX} characters.`),
+            visibility: z
+                .enum(['host', 'public'])
+                .optional()
+                .describe('"host" (default) = Me and DJ only; "public" = guests can see it too.'),
+            time: z.string().optional().describe('Scheduled time as "hh:mm am/pm", e.g. "05:30 pm".'),
+            note: z.string().optional().describe('Note to the DJ (set right after creating, via updateSection).'),
+            afterSectionId: z.string().optional().describe('Put the new section directly after this section _id.'),
+            position: z
+                .number()
+                .int()
+                .min(0)
+                .optional()
+                .describe('0-based timeline index for the new section; past the end appends. Use instead of afterSectionId.'),
+            confirmToken: confirmTokenParam,
+        }),
+    }, async ({ eventId, name, visibility, time, note, afterSectionId, position, confirmToken }, ctx) => {
+        const trimmed = name.trim();
+        if (!trimmed) {
+            throw new McpToolError('Section name is empty.', { hint: 'Pass a name of 1–45 characters.' });
+        }
+        if (trimmed.length > SECTION_NAME_MAX) {
+            throw new McpToolError(`Section name is ${trimmed.length} characters; Vibo allows at most ${SECTION_NAME_MAX}. Nothing was sent.`, { hint: `Shorten the name to ${SECTION_NAME_MAX} characters or fewer.` });
+        }
+        let normalizedTime;
+        if (time !== undefined && time.trim() !== '') {
+            normalizedTime = normalizeTime(time);
+            if (!normalizedTime) {
+                throw new McpToolError(`"${time}" is not a 12-hour time.`, { hint: 'Use "hh:mm am/pm", e.g. "05:30 pm".' });
+            }
+        }
+        if (afterSectionId !== undefined && position !== undefined) {
+            throw new McpToolError('Pass afterSectionId or position, not both.', {
+                hint: 'afterSectionId places it after a named section; position places it at a 0-based index.',
+            });
+        }
+        const [perms, sections] = await Promise.all([fetchEventPermissions(client, eventId), fetchSections(client, eventId)]);
+        assertCanWriteTimeline(perms, 'canHostCreateSections', 'add sections');
+        // Resolve placement to the one knob createSection has: insertBeforeSectionId.
+        let insertBefore;
+        let placedAfter; // null = start of the timeline
+        if (afterSectionId !== undefined) {
+            const anchor = findSection(sections, afterSectionId);
+            insertBefore = sections[sections.indexOf(anchor) + 1];
+            placedAfter = anchor;
+        }
+        else if (position !== undefined) {
+            insertBefore = sections[position];
+            placedAfter = position === 0 ? null : (sections[Math.min(position, sections.length) - 1] ?? null);
+        }
+        else {
+            placedAfter = sections[sections.length - 1] ?? null;
+        }
+        const payload = {
+            type: 'simple',
+            name: trimmed,
+            settings: {
+                ...DEFAULT_SECTION_SETTINGS,
+                ...(perms.settings?.sectionSongsLimit != null ? { songsLimit: perms.settings.sectionSongsLimit } : {}),
+                ...(perms.settings?.sectionMustPlayLimit != null ? { mustPlayLimit: perms.settings.sectionMustPlayLimit } : {}),
+                ...VISIBILITY_SETTINGS[visibility ?? 'host'],
+            },
+        };
+        if (normalizedTime)
+            payload.time = normalizedTime;
+        if (insertBefore)
+            payload.insertBeforeSectionId = insertBefore._id;
+        const willSend = { eventId, payload };
+        if (note !== undefined)
+            willSend.thenUpdateSection = { payload: { note } };
+        const gate = await confirmWrite(ctx, {
+            tool: 'vibo_create_section',
+            mutation: note !== undefined ? 'createSection, then updateSection (note)' : 'createSection',
+            message: `Review and confirm creating section "${trimmed}":`,
+            confirmToken,
+            target: eventId,
+            willSend,
+            context: { placedAfter: placedAfter ? sectionLabel(placedAfter) : 'start of timeline' },
+        });
+        if (gate)
+            return gate;
+        const created = (await client.gql(CREATE_SECTION, {
+            eventId,
+            payload,
+        })).createSection;
+        let noteResult;
+        if (note !== undefined) {
+            noteResult = (await client.gql(UPDATE_SECTION, {
+                eventId,
+                sectionId: created._id,
+                payload: { note },
+            })).updateSection?.note;
+        }
+        // Belt and braces: if Vibo ever ignores insertBeforeSectionId (it honoured
+        // it live), move the section into place. A stale re-read that doesn't show
+        // the new section yet is reported, not guessed at.
+        let placement = 'unverified';
+        const after = await fetchSections(client, eventId);
+        const order = after.map((s) => s._id);
+        if (order.includes(created._id) && (!placedAfter || order.includes(placedAfter._id))) {
+            const { moves } = planMoves(order, [created._id], placedAfter?._id ?? null);
+            for (const m of moves) {
+                await client.gql(REORDER_SECTIONS, { eventId, sourceSectionId: m.source, targetSectionId: m.target });
+            }
+            placement = moves.length ? 'fixed-by-reorder' : 'as-requested';
+        }
+        return minifiedResult({
+            ...created,
+            ...(note !== undefined ? { note: noteResult ?? note } : {}),
+            placedAfter: placedAfter ? sectionLabel(placedAfter) : null,
+            placement,
+        });
+    });
+    server.registerTool('vibo_delete_section', {
+        description: 'Delete a timeline section, with every song, answer and comment in it — this cannot be undone. The preview ' +
+            'names the section and how many songs and answered questions it holds. Sections of type "dontPlay" (the ' +
+            "DJ's do-not-play list) and \"headline\" (timeline dividers) are refused unless force:true. " +
+            CONFIRM_NOTE,
+        annotations: toolAnnotations({ title: 'Delete Vibo section', readOnly: false, destructive: true }),
+        inputSchema: z.object({
+            eventId: z.string().describe('Event id.'),
+            sectionId: z.string().describe('Section _id from vibo_list_sections.'),
+            force: z.boolean().optional().describe('Required to delete a "dontPlay" or "headline" section.'),
+            confirmToken: confirmTokenParam,
+        }),
+    }, async ({ eventId, sectionId, force, confirmToken }, ctx) => {
+        const section = findSection(await fetchSections(client, eventId), sectionId);
+        if (PROTECTED_TYPES.has(section.type) && !force) {
+            throw new McpToolError(`"${section.name}" is a ${section.type} section${section.type === 'dontPlay' ? " (the DJ's do-not-play list)" : ' (a timeline divider)'}; refusing to delete it. Nothing was sent.`, { hint: 'Pass force:true only if the user explicitly wants this section gone.' });
+        }
+        if (section.canRemove === false) {
+            throw new McpToolError(`Vibo reports you can't delete "${section.name}". Nothing was sent.`, {
+                hint: 'The DJ controls who may delete each section ("Who can delete section"); ask them to allow it or delete it.',
+            });
+        }
+        const summary = {
+            name: section.name,
+            type: section.type,
+            songsCount: section.songsCount,
+            questionsAnswered: `${section.answeredCount}/${section.questionsCount}`,
+        };
+        const vars = { eventId, sectionId };
+        const gate = await confirmWrite(ctx, {
+            tool: 'vibo_delete_section',
+            mutation: 'removeSection',
+            message: `Delete section "${section.name}"? It holds ${section.songsCount} song(s) and ` +
+                `${section.answeredCount} of ${section.questionsCount} answered question(s). This cannot be undone.`,
+            confirmToken,
+            target: sectionId,
+            willSend: vars,
+            context: summary,
+        });
+        if (gate)
+            return gate;
+        const data = await client.gql(REMOVE_SECTION, vars);
+        if (data.removeSection !== true) {
+            throw new McpToolError(`Vibo did not confirm deleting "${section.name}" (removeSection returned ${String(data.removeSection)}).`, {
+                hint: 'Re-check with vibo_list_sections before retrying.',
+            });
+        }
+        return minifiedResult({ deleted: true, section: { _id: sectionId, ...summary } });
+    });
+    server.registerTool('vibo_reorder_sections', {
+        description: 'Move one or more timeline sections to directly after targetSectionId (omit it to move them to the start), ' +
+            'keeping the given order. Mirrors vibo_reorder_songs. Sends one reorderSections call per section that ' +
+            'actually moves. ' +
+            CONFIRM_NOTE,
+        annotations: toolAnnotations({ title: 'Reorder Vibo sections', readOnly: false, destructive: false }),
+        inputSchema: z.object({
+            eventId: z.string().describe('Event id.'),
+            sourceSectionIds: z.array(z.string()).min(1).describe('Section _ids to move, in the order they should end up.'),
+            targetSectionId: z.string().optional().describe('Place the moved sections right after this section _id; omit for the start.'),
+            confirmToken: confirmTokenParam,
+        }),
+    }, async ({ eventId, sourceSectionIds, targetSectionId, confirmToken }, ctx) => {
+        if (new Set(sourceSectionIds).size !== sourceSectionIds.length) {
+            throw new McpToolError('sourceSectionIds contains a duplicate.', { hint: 'List each section once.' });
+        }
+        if (targetSectionId !== undefined && sourceSectionIds.includes(targetSectionId)) {
+            throw new McpToolError('targetSectionId is also one of the sections being moved.', {
+                hint: 'Pick a target outside sourceSectionIds (the moved sections keep their given order).',
+            });
+        }
+        const [perms, sections] = await Promise.all([fetchEventPermissions(client, eventId), fetchSections(client, eventId)]);
+        const order = sections.map((s) => s._id);
+        const missing = missingIds([...sourceSectionIds, ...(targetSectionId ? [targetSectionId] : [])], order);
+        if (missing.length) {
+            throw new McpToolError(`Not in this event's timeline: ${missing.join(', ')}. Nothing was sent.`, {
+                hint: 'Get section ids from vibo_list_sections for the same eventId.',
+            });
+        }
+        assertCanWriteTimeline(perms, 'canHostReorderSections', 'reorder sections');
+        const byId = new Map(sections.map((s) => [s._id, s]));
+        const { moves, finalOrder } = planMoves(order, sourceSectionIds, targetSectionId ?? null);
+        const after = targetSectionId ? sectionLabel(byId.get(targetSectionId)) : 'start of timeline';
+        if (moves.length === 0) {
+            return minifiedResult({ changed: false, message: 'Those sections are already in that order.', after });
+        }
+        const calls = moves.map((m) => ({ sourceSectionId: m.source, targetSectionId: m.target }));
+        const gate = await confirmWrite(ctx, {
+            tool: 'vibo_reorder_sections',
+            mutation: 'reorderSections',
+            message: `Review and confirm moving ${sourceSectionIds.length} section(s):`,
+            confirmToken,
+            target: eventId,
+            willSend: { eventId, calls },
+            context: { moving: sourceSectionIds.map((id) => byId.get(id).name), after },
+        });
+        if (gate)
+            return gate;
+        for (const c of calls) {
+            await client.gql(REORDER_SECTIONS, { eventId, ...c });
+        }
+        return minifiedResult({
+            changed: true,
+            callsSent: calls.length,
+            after,
+            newPositions: sourceSectionIds.map((id) => ({ ...sectionLabel(byId.get(id)), index: finalOrder.indexOf(id) })),
+        });
+    });
+}

package/dist/tools/session.js

@@ -7,7 +7,7 @@ import { GET_ME } from '../gql.js';
 // exist — a deployment without them should not wire it in.
 export function registerSessionTools(server, client) {
     server.registerTool('vibo_capture_session', {
-        description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via the fetchproxy bridge — for accounts that sign in with Apple/Google/Facebook (no password). Requires the fetchproxy browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
+        description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via ContextMint Bridge — for accounts that sign in with Apple/Google/Facebook (no password). Requires the ContextMint Bridge browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
         annotations: toolAnnotations({ title: 'Capture Vibo session (SSO)', readOnly: false, destructive: false }),
     }, async () => {
         const { accessToken, refreshToken } = await captureViboSession();

package/dist/tools/shared.js

@@ -37,10 +37,15 @@ export const CONFIRM_NOTE = 'Asks the user to confirm first: a confirmation prom
  * Gate a write behind a confirmation: an elicitation prompt where the client
  * can show one, else the two-phase confirm-token flow (MCP_CONFIRM_MODE).
  * `undefined` means proceed; anything else is the result to return unchanged.
- * Nothing here makes a network call, so phase 1 never writes.
+ * Nothing here makes a network call, so phase 1 never writes (a tool may READ
+ * before calling this, to validate ids or fill `context`).
  */
 export function confirmWrite(ctx, options) {
-    const preview = { action: options.mutation, willSend: options.willSend };
+    const preview = {
+        action: options.mutation,
+        willSend: options.willSend,
+        ...(options.context ? { context: options.context } : {}),
+    };
     return requireConfirmationWithFallback(ctx, confirmationFromEnv({
         action: options.tool.replace(/^vibo_/, 'vibo.'),
         message: options.message,
@@ -49,7 +54,7 @@ export function confirmWrite(ctx, options) {
         confirmToken: options.confirmToken,
         subject: () => ({
             target: options.target,
-            payload: options.payload ?? options.willSend,
+            payload: options.payload ?? (options.context ? { willSend: options.willSend, context: options.context } : options.willSend),
             preview,
         }),
     }));