vibo-mcp 2.3.1 → 2.4.1

package/dist/client.js

@@ -1,7 +1,8 @@
 import { createHash } from 'crypto';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
-import { loadDotenvSafely, readEnvVar, McpToolError, SessionNotAuthenticatedError, truncateErrorMessage, withAmbientCancellation, } from '@chrischall/mcp-utils';
+import { loadDotenvSafely, readEnvVar, McpToolError, SessionNotAuthenticatedError, detectEdgeBlock, EdgeBlockedError, truncateErrorMessage, withAmbientCancellation, } from '@chrischall/mcp-utils';
+import { createGraphqlClient } from '@chrischall/mcp-utils/graphql';
 import { loadSession, saveSession } from './session-store.js';
 // Load .env for local dev; silently skip if dotenv is unavailable (e.g. the
 // mcpb bundle, which externalizes dotenv). `override: false` means a
@@ -46,6 +47,13 @@ const REFRESH = `
 const AUTH_ERROR_CODES = new Set(['UNAUTHORIZED', 'UNAUTHENTICATED']);
 // Codes for "you are signed in, but not allowed to do this".
 const PERMISSION_ERROR_CODES = new Set(['FORBIDDEN']);
+// Vibo's permission denial for a host acting where the DJ's settings forbid it
+// ("Action is not allowed for user", e.g. reordering songs in a section with
+// host ordering off — verified live) arrives without a FORBIDDEN code. Anchored
+// on Vibo's exact wording so a validation error that merely says "not allowed"
+// keeps its own message. Matched only when the
+// error carries no auth code, so an expired session is never mistaken for it.
+const PERMISSION_MESSAGE_PATTERN = /\bnot allowed for user\b/i;
 // Message fallback, consulted ONLY for an error that carries no code. Vibo's
 // expired-session text is "Not authorized. Try to log in"; the patterns are
 // anchored on session/token wording so an unrelated message that merely
@@ -60,43 +68,60 @@ const AUTH_MESSAGE_PATTERN = /not authoriz|unauthoriz|unauthenticated|invalid to
  * meters it on. Measured on that fleet: claude.ai sent 101 cancellations in
  * the week to 2026-09-20.
  *
- * ONE definition for both request paths, which is not tidiness: the two are
- * the multipart upload and the plain query, they had the same seven lines
- * copied between them, and the next person to add a third path is the one
- * this saves. The `TimeoutError` checks at both call sites still name a real
- * timeout — an abort from the caller arrives as `AbortError` and falls
- * through to 'failed'.
+ * Used by the multipart UPLOAD path only. The plain JSON query path goes
+ * through mcp-utils' GraphQL client (`this.graphql`), which applies the same
+ * 30 s timeout and the caller's cancellation itself. The `TimeoutError` check
+ * in `uploadTransportError` names a real timeout — an abort from the caller
+ * arrives as `AbortError` and falls through to 'failed'.
  */
 function requestSignal() {
     return withAmbientCancellation(AbortSignal.timeout(REQUEST_TIMEOUT_MS));
 }
-/** Whether a GraphQL document is a mutation (a write with side effects). */
-function isMutation(query) {
-    return /^\s*(?:#[^\n]*\n\s*)*mutation\b/.test(query);
-}
 /**
- * The error for a request that never produced a response (timeout, dropped
- * connection, caller abort). For a READ that is safely retryable. For a WRITE
- * the outcome is unknown — Vibo may already have committed it — and a blind
- * retry repeats the side effect (a second round of invitation emails, a
- * second exported playlist, a duplicate comment or import); the confirmation
- * gate cannot stop that, because a fresh preview earns a fresh approval and
- * token. So a write says so, and asks for a state check first.
+ * The hint for a WRITE that never produced a response (timeout, dropped
+ * connection): its outcome is unknown — Vibo may already have committed it —
+ * and a blind retry repeats the side effect (a second round of invitation
+ * emails, a second exported playlist, a duplicate comment or import); the
+ * confirmation gate cannot stop that, because a fresh preview earns a fresh
+ * approval and token. So a write says so, and asks for a state check first.
+ */
+const WRITE_OUTCOME_HINT = 'Do not repeat this write blindly — check the current state before retrying: e.g. ' +
+    'vibo_list_event_users after inviting, vibo_get_section_songs after adding, importing or commenting ' +
+    'on songs, the Spotify/Apple Music account after an export. Retry only if the change is not there.';
+/**
+ * The transport error for the multipart UPLOAD path (always a write) — the one
+ * request mcp-utils' GraphQL client does not send, since it speaks JSON only.
+ * Same wording as that client's write error.
  */
-function transportError(what, err, isWrite) {
+function uploadTransportError(err) {
     const reason = err instanceof Error && err.name === 'TimeoutError' ? 'timed out' : 'failed';
-    if (isWrite) {
-        return new McpToolError(`${what} ${SERVICE} ${reason} — the change may already have been applied (outcome is unknown).`, {
-            hint: 'Do not repeat this write blindly — check the current state before retrying: e.g. ' +
-                'vibo_list_event_users after inviting, vibo_get_section_songs after adding, importing or commenting ' +
-                'on songs, the Spotify/Apple Music account after an export. Retry only if the change is not there.',
-            cause: err,
-        });
+    return new McpToolError(`Upload to ${SERVICE} ${reason} — the change may already have been applied (outcome is unknown).`, { hint: WRITE_OUTCOME_HINT, cause: err });
+}
+/**
+ * Read a multipart-upload GraphQL response body. An error status is read as text first so a
+ * CDN/WAF refusal page (CloudFront, Cloudflare, Akamai, Imperva) is named as
+ * an {@link EdgeBlockedError} — the request never reached Vibo, so neither
+ * the permission-denial copy (403) nor a sign-in prompt applies.
+ */
+async function readGraphQLBody(response) {
+    if (response.status >= 400) {
+        const text = await response.text().catch(() => '');
+        const edge = detectEdgeBlock({ body: text, headers: response.headers, status: response.status });
+        if (edge !== null)
+            throw new EdgeBlockedError(response.status, edge.vendor, { service: SERVICE });
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return {};
+        }
+    }
+    try {
+        return (await response.json());
+    }
+    catch {
+        return {};
     }
-    return new McpToolError(`${what} ${SERVICE} ${reason}.`, {
-        hint: 'The Vibo API may be unreachable — check your connection and retry.',
-        cause: err,
-    });
 }
 /** One-way fingerprint of a configured token, so session.json never holds a
  *  second copy of the pasted secret just to record where a session came from. */
@@ -125,8 +150,21 @@ export class ViboClient {
     // refreshes against each other (à la mcp-utils' TokenManager).
     loginInFlight = null;
     reauthInFlight = null;
+    // The JSON request path: mcp-utils' GraphQL transport (POST, errors[] at any
+    // status, CDN/WAF detection, timeout + the caller's cancellation, 429 retry,
+    // and a write-aware transport error judged by a real operation-kind lexer).
+    // Auth (x-token, single-flight refresh/login + one replay) and the
+    // permission/expiry classification below stay here: they are Vibo's rules.
+    // Pure to build — safe at Worker global scope.
+    graphql;
     constructor(opts = {}) {
         this.apiUrl = opts.apiUrl ?? readEnvVar('VIBO_API_URL') ?? DEFAULT_API_URL;
+        this.graphql = createGraphqlClient({
+            endpoint: this.apiUrl,
+            serviceName: SERVICE,
+            timeout: REQUEST_TIMEOUT_MS,
+            writeOutcomeHint: WRITE_OUTCOME_HINT,
+        });
         this.email = opts.email ?? readEnvVar('VIBO_EMAIL') ?? null;
         this.password = opts.password ?? readEnvVar('VIBO_PASSWORD') ?? null;
         this.accessToken = opts.accessToken ?? readEnvVar('VIBO_ACCESS_TOKEN') ?? null;
@@ -259,15 +297,9 @@ export class ViboClient {
         }
         catch (err) {
             // An upload is always a write (the multipart path only carries mutations).
-            throw transportError('Upload to', err, true);
-        }
-        let body;
-        try {
-            body = (await response.json());
-        }
-        catch {
-            body = {};
+            throw uploadTransportError(err);
         }
+        const body = await readGraphQLBody(response);
         return { status: response.status, body };
     }
     /** Returns the current access token, performing a first login if we only have email/password. */
@@ -324,8 +356,13 @@ export class ViboClient {
                         }
                     }
                 }
-                catch {
-                    // fall through to a full login
+                catch (err) {
+                    // A CDN/WAF block is not a dead refresh token: say so, rather than
+                    // falling through to a login that meets the same block or to a
+                    // "sign in again" that would not help. The stored tokens are kept.
+                    if (err instanceof EdgeBlockedError)
+                        throw err;
+                    // otherwise fall through to a full login
                 }
             }
             if (this.email && this.password) {
@@ -339,31 +376,19 @@ export class ViboClient {
         return this.reauthInFlight;
     }
     async post(query, variables, token) {
-        const headers = { 'content-type': 'application/json' };
-        if (token)
-            headers['x-token'] = token;
-        let response;
-        try {
-            response = await fetch(this.apiUrl, {
-                method: 'POST',
-                headers,
-                body: JSON.stringify({ query, variables }),
-                signal: requestSignal(),
-            });
-        }
-        catch (err) {
+        const result = await this.graphql.execute({
+            query,
+            variables,
+            ...(token ? { headers: { 'x-token': token } } : {}),
             // signIn / refreshToken are mutations too, but repeating them is harmless.
-            const isWrite = query !== SIGN_IN && query !== REFRESH && isMutation(query);
-            throw transportError('Request to', err, isWrite);
-        }
-        let body;
-        try {
-            body = (await response.json());
-        }
-        catch {
-            body = {};
-        }
-        return { status: response.status, body };
+            ...(query === SIGN_IN || query === REFRESH ? { idempotent: true } : {}),
+        });
+        const body = {};
+        if (result.data !== undefined)
+            body.data = result.data;
+        if (result.errors !== undefined)
+            body.errors = result.errors;
+        return { status: result.status, body };
     }
     /** An expired / missing session — the only case a refresh + replay can fix. */
     isAuthError(status, errors) {
@@ -382,7 +407,12 @@ export class ViboClient {
     isPermissionError(status, errors) {
         if (status === 403)
             return true;
-        return (errors ?? []).some((e) => PERMISSION_ERROR_CODES.has(e.code ?? e.extensions?.code ?? ''));
+        return (errors ?? []).some((e) => {
+            const code = e.code ?? e.extensions?.code ?? '';
+            if (PERMISSION_ERROR_CODES.has(code))
+                return true;
+            return !AUTH_ERROR_CODES.has(code) && PERMISSION_MESSAGE_PATTERN.test(e.message ?? '');
+        });
     }
     unwrap(status, body) {
         if (this.isPermissionError(status, body.errors)) {

package/dist/gql.js

@@ -86,6 +86,45 @@ export const LIST_SECTIONS = `
     }
   }
 `;
+// Section management (create / delete / reorder). Captured from the web app's
+// own documents in the web.vibodj.com bundle (Timeline "+" -> Add section,
+// the section "..." -> Delete, and the timeline drag handler) and checked
+// against live introspection. Read-before-write lookups use the lean
+// SECTIONS_FOR_WRITE / EVENT_PERMISSIONS documents so vibo_list_sections'
+// output stays unchanged.
+export const SECTIONS_FOR_WRITE = `
+  query sectionsForWrite($eventId: ID!) {
+    sections(eventId: $eventId) {
+      _id name type songsCount questionsCount answeredCount canRemove visibility
+      settings { canHostsOrderSongs canHostDeleteSection }
+    }
+  }
+`;
+export const EVENT_PERMISSIONS = `
+  query eventPermissions($eventId: ID!) {
+    event(eventId: $eventId) {
+      _id role isLocked
+      settings { canHostCreateSections canHostReorderSections sectionSongsLimit sectionMustPlayLimit }
+    }
+  }
+`;
+export const CREATE_SECTION = `
+  mutation createSection($eventId: ID!, $payload: CreateSectionInput!) {
+    createSection(eventId: $eventId, payload: $payload) {
+      _id name type time description visibility
+    }
+  }
+`;
+export const REMOVE_SECTION = `
+  mutation removeSection($eventId: ID!, $sectionId: ID!) {
+    removeSection(eventId: $eventId, sectionId: $sectionId)
+  }
+`;
+export const REORDER_SECTIONS = `
+  mutation reorderSections($eventId: ID!, $sourceSectionId: ID!, $targetSectionId: ID) {
+    reorderSections(eventId: $eventId, sourceSectionId: $sourceSectionId, targetSectionId: $targetSectionId)
+  }
+`;
 // ---- Songs ------------------------------------------------------------------
 export const GET_SECTION_SONGS = `
   query getSectionSongs($eventId: ID!, $sectionId: ID!, $filter: SectionSongsFilter, $pagination: PaginationInput, $sort: SongsSortInput) {
@@ -102,6 +141,17 @@ export const GET_SECTION_SONGS = `
     }
   }
 `;
+// The section's songs in their manual (unsorted) order, ids only — used to
+// validate ids before a remove/reorder and to confirm an add landed.
+export const SECTION_SONG_IDS = `
+  query sectionSongIds($eventId: ID!, $sectionId: ID!, $pagination: PaginationInput) {
+    getSectionSongs(eventId: $eventId, sectionId: $sectionId, pagination: $pagination) {
+      songs { _id viboSongId artist title }
+      next { skip limit }
+      totalCount
+    }
+  }
+`;
 export const SEARCH_SONGS = `
   query getSongs($eventId: ID!, $sectionId: ID!, $filter: SongsFilter!, $limit: Int!) {
     getSongs(eventId: $eventId, sectionId: $sectionId, filter: $filter, limit: $limit) {

package/dist/index.js

@@ -15,6 +15,7 @@ import { registerIdeasTools } from './tools/ideas.js';
 import { registerImportTools } from './tools/imports.js';
 import { registerCollaborationTools } from './tools/collaboration.js';
 import { registerSectionEditTools } from './tools/section-edit.js';
+import { registerSectionManageTools } from './tools/section-manage.js';
 import { registerUploadTools } from './tools/uploads.js';
 import { registerSessionTools } from './tools/session.js';
 // The ViboClient is a module-level singleton (constructed in client.ts and
@@ -44,6 +45,7 @@ await runMcp({
         registerImportTools,
         registerCollaborationTools,
         registerSectionEditTools,
+        registerSectionManageTools,
         registerUploadTools,
         registerSessionTools,
     ],

package/dist/reorder.js

@@ -0,0 +1,27 @@
+/**
+ * `order` is the current list; `sources` are moved (in the given order) to sit
+ * directly after `after`, or at the start when `after` is null. Callers
+ * validate ids first: every source and `after` must be in `order`, and
+ * `after` must not be a source.
+ */
+export function planMoves(order, sources, after) {
+    let current = [...order];
+    let anchor = after;
+    const moves = [];
+    for (const source of sources) {
+        const from = current.indexOf(source);
+        const rest = current.filter((id) => id !== source);
+        const to = anchor === null ? 0 : rest.indexOf(anchor) + 1;
+        if (to !== from) {
+            moves.push({ source, target: anchor });
+            current = [...rest.slice(0, to), source, ...rest.slice(to)];
+        }
+        anchor = source;
+    }
+    return { moves, finalOrder: current };
+}
+/** Ids from `wanted` that are not in `have`, preserving order. */
+export function missingIds(wanted, have) {
+    const set = new Set(have);
+    return wanted.filter((id) => !set.has(id));
+}

package/dist/tools/lookups.js

@@ -0,0 +1,59 @@
+import { McpToolError } from '@chrischall/mcp-utils';
+import { SECTIONS_FOR_WRITE, EVENT_PERMISSIONS, SECTION_SONG_IDS } from '../gql.js';
+/** The event's timeline, in order. */
+export async function fetchSections(client, eventId) {
+    const data = await client.gql(SECTIONS_FOR_WRITE, { eventId });
+    return data.sections ?? [];
+}
+export async function fetchEventPermissions(client, eventId) {
+    const data = await client.gql(EVENT_PERMISSIONS, { eventId });
+    return data.event;
+}
+export function findSection(sections, sectionId) {
+    const section = sections.find((s) => s._id === sectionId);
+    if (!section) {
+        throw new McpToolError(`Section ${sectionId} is not in this event's timeline.`, {
+            hint: 'Get section ids from vibo_list_sections for the same eventId.',
+        });
+    }
+    return section;
+}
+/** Every song in a section, in its manual order (no sort applied). */
+export async function fetchSectionSongs(client, eventId, sectionId) {
+    const songs = [];
+    const limit = 100;
+    // Bounded: 50 pages × 100 is far beyond Vibo's per-section song limit (999).
+    for (let page = 0; page < 50; page++) {
+        const data = await client.gql(SECTION_SONG_IDS, { eventId, sectionId, pagination: { skip: songs.length, limit } });
+        const batch = data.getSectionSongs?.songs ?? [];
+        songs.push(...batch);
+        const total = data.getSectionSongs?.totalCount;
+        if (batch.length < limit || (typeof total === 'number' && songs.length >= total))
+            break;
+    }
+    return songs;
+}
+/**
+ * Refuse, before the confirmation step, song ids that aren't in the section.
+ * Names a passed viboSongId's section-song _id, the usual mix-up.
+ */
+export function assertSongsInSection(songIds, songs) {
+    const have = new Set(songs.map((s) => s._id));
+    const missing = songIds.filter((id) => !have.has(id));
+    if (missing.length === 0)
+        return;
+    const hints = missing
+        .map((id) => {
+        const byVibo = songs.find((s) => s.viboSongId === id);
+        return byVibo ? `${id} is a viboSongId — its section-song _id is ${byVibo._id}` : null;
+    })
+        .filter(Boolean);
+    throw new McpToolError(`${missing.length} of ${songIds.length} song id(s) are not in this section: ${missing.join(', ')}. Nothing was sent.`, {
+        hint: (hints.length ? hints.join('; ') + '. ' : '') +
+            'Use the song _id values from vibo_get_section_songs for this same section.',
+    });
+}
+/** True when the caller is a host (not the DJ) — the role Vibo's host-permission toggles apply to. */
+export function isHost(perms) {
+    return perms.role === 'host';
+}