zola-mcp 1.4.0 → 1.4.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "Zola wedding planning tools for Claude Code",
-    "version": "1.4.0"
+    "version": "1.4.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Zola",
       "source": "./",
       "description": "Zola wedding planning tools for Claude — vendors, budget, guests, seating, events, registry, inquiries, and more via MCP",
-      "version": "1.4.0",
+      "version": "1.4.2",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "zola",
   "displayName": "Zola",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Zola wedding planning tools for Claude — vendors, budget, guests, seating, events, registry, inquiries, and more via MCP",
   "author": {
     "name": "Chris Chall",

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Hall
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,9 @@
 # Zola MCP
 
+[![CI](https://github.com/chrischall/zola-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/chrischall/zola-mcp/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/zola-mcp)](https://www.npmjs.com/package/zola-mcp)
+[![license](https://img.shields.io/npm/l/zola-mcp)](LICENSE)
+
 A [Model Context Protocol](https://modelcontextprotocol.io) server that connects Claude to [Zola](https://www.zola.com), giving you natural-language access to your wedding vendors, budget, guest list, seating chart, events, registry, inquiries, and more.
 
 > [!WARNING]
@@ -301,3 +305,4 @@ Releases are automated via GitHub Actions:
 ## License
 
 MIT
+

package/dist/auth.js

@@ -1,60 +1,63 @@
 // ────────────────────────────────────────────────────────────────────────────
-// Auth resolution — Pattern A template
+// Auth resolution — createAuthResolver (shared skeleton from mcp-utils)
 // ────────────────────────────────────────────────────────────────────────────
 //
-// Mirrors the canonical "browser-bootstrap + Node-direct" shape from
-// ofw-mcp/src/auth.ts. Other MCPs in this family (resy-mcp, opentable-mcp,
-// signupgenius-mcp, …) use the same selector — keep the structure flat,
-// the path-selection explicit, and the error messages actionable.
+// The canonical three-path "browser-bootstrap + Node-direct" resolver, now the
+// shared `createAuthResolver` skeleton from `@chrischall/mcp-utils` (0.7.0+):
 //
-// THE THREE PATHS, in priority order:
+//   1. Env-var credential — ZOLA_REFRESH_TOKEN set → used directly. This is
+//      the ~1-year JWT that doubles as the `usr` cookie on zola.com. Reads go
+//      through the hardened `readEnvVar` (blank / 'undefined' / 'null' /
+//      unexpanded `${VAR}` treated as unset).
 //
-//   1. Env-var credential (existing behavior)
-//      ZOLA_REFRESH_TOKEN set → use it directly. This is the ~1-year JWT
-//      that doubles as the `usr` cookie on zola.com. Legacy users keep
-//      working without action.
+//   2. fetchproxy fallback — unless ZOLA_DISABLE_FETCHPROXY is truthy
+//      ('1'/'true'/'yes'/'on' via `parseBoolEnv` inside the resolver), lift
+//      the HttpOnly `usr` cookie out of the user's signed-in zola.com tab via
+//      `@fetchproxy/bootstrap` (one-shot WebSocket bridge; `chrome.cookies.get`
+//      sees HttpOnly cookies). All subsequent Zola API calls go direct to
+//      mobile-api.zola.com from Node — fetchproxy is NOT in the hot path.
+//      Bridge-down errors surface the FetchproxyBridgeDownError `.hint`
+//      verbatim (handled inside createAuthResolver since 0.7.0); a signed-out
+//      tab raises SessionNotAuthenticatedError naming Zola + zola.com.
 //
-//   2. fetchproxy fallback (new)
-//      When no token is set, lift the user's session out of their
-//      signed-in zola.com browser tab via the fetchproxy 0.3.0 extension.
-//      The `@fetchproxy/bootstrap` helper spins up a one-shot WebSocket
-//      bridge, asks the extension for the HttpOnly `usr` cookie via
-//      `chrome.cookies.get`, then closes the bridge. From there, all
-//      Zola API calls go out via plain Node `fetch()` to
-//      mobile-api.zola.com — fetchproxy is NOT in the hot path.
+//   3. Error — nothing configured: an actionable message naming
+//      ZOLA_REFRESH_TOKEN, the browser sign-in fallback, and
+//      ZOLA_DISABLE_FETCHPROXY.
 //
-//      Users opt out with ZOLA_DISABLE_FETCHPROXY=1 (anyone who wants the
-//      old behavior of "fail loudly when creds are missing").
-//
-//   3. Error
-//      Nothing to authenticate with. We throw a message that tells the
-//      user exactly what to do: set the env var, OR install the extension
-//      and sign in.
-//
-// Why fetchproxy is only a one-shot read:
-//   The bootstrap call snapshots the `usr` cookie and returns. The MCP
-//   then operates from Node with direct fetch — latency and reliability
-//   are not coupled to the browser bridge for normal tool calls. The
-//   captured refresh token is fed into the existing
-//   `POST /v3/sessions/refresh` flow which mints 30-min session tokens
-//   (also in pure Node).
-//
-// Testability:
-//   - `@fetchproxy/bootstrap` is mocked at the module boundary in tests.
-//   - This module exposes a single async `resolveRefreshToken()` that
-//     returns the JWT plus the source — callers (the client) treat the
-//     return value as opaque credentials.
+// Testability: `@fetchproxy/bootstrap` is mocked at the module boundary in
+// tests, exactly as before. This module still exposes a single async
+// `resolveRefreshToken()` returning the JWT plus the source — callers (the
+// client) treat the return value as opaque credentials.
 import { bootstrap } from '@fetchproxy/bootstrap';
-import { classifyBridgeError } from '@chrischall/mcp-utils/fetchproxy';
-import { readEnvVar } from '@chrischall/mcp-utils';
+import { createAuthResolver } from '@chrischall/mcp-utils';
 import pkg from '../package.json' with { type: 'json' };
-/** True if the user has explicitly disabled the fetchproxy fallback. */
-function fetchproxyDisabled() {
-    const raw = readEnvVar('ZOLA_DISABLE_FETCHPROXY');
-    if (raw === undefined)
-        return false;
-    return ['1', 'true', 'yes', 'on'].includes(raw.toLowerCase());
-}
+const resolveAuth = createAuthResolver({
+    envVar: 'ZOLA_REFRESH_TOKEN',
+    disableEnvVar: 'ZOLA_DISABLE_FETCHPROXY',
+    // The real bootstrap has a narrower opts type than the injected boundary;
+    // the cast keeps the heavy bridge dep out of the shared module's types.
+    bootstrap: bootstrap,
+    bootstrapOptions: {
+        serverName: pkg.name,
+        version: pkg.version,
+        // Zola serves www.zola.com (web app) and mobile-api.zola.com (API).
+        // The `usr` cookie lives on the web app's apex domain; the extension
+        // matches on suffix so listing the apex covers any subdomain.
+        domains: ['zola.com'],
+        declare: {
+            // `usr` is HttpOnly → invisible to page JS, but fetchproxy's
+            // read_cookies uses `chrome.cookies.get` which DOES see HttpOnly
+            // cookies. The value IS the ~1-year refresh JWT.
+            cookies: ['usr'],
+            localStorage: [],
+            sessionStorage: [],
+            captureHeaders: [],
+        },
+    },
+    parseTokens: (session) => session.cookies['usr'],
+    serviceName: 'Zola',
+    signInHost: 'zola.com',
+});
 /**
  * Resolve the Zola refresh token using the three-path priority described
  * above. Throws with an actionable error message when no path succeeds.
@@ -64,58 +67,6 @@ function fetchproxyDisabled() {
  * logging / future cache-keying only.
  */
 export async function resolveRefreshToken() {
-    // ── Path 1: env-var refresh token (unchanged from pre-fetchproxy behavior).
-    const envToken = readEnvVar('ZOLA_REFRESH_TOKEN');
-    if (envToken) {
-        return { token: envToken, source: 'env' };
-    }
-    // ── Path 2: fetchproxy fallback (new).
-    if (!fetchproxyDisabled()) {
-        try {
-            const session = await bootstrap({
-                serverName: pkg.name,
-                version: pkg.version,
-                // Zola serves www.zola.com (web app) and mobile-api.zola.com (API).
-                // The `usr` cookie lives on the web app's apex domain; the extension
-                // matches on suffix so listing the apex covers any subdomain.
-                domains: ['zola.com'],
-                declare: {
-                    // `usr` is HttpOnly → invisible to page JS, but fetchproxy 0.3.0's
-                    // read_cookies uses `chrome.cookies.get` which DOES see HttpOnly
-                    // cookies. The value IS the ~1-year refresh JWT.
-                    cookies: ['usr'],
-                    localStorage: [],
-                    sessionStorage: [],
-                    captureHeaders: [],
-                },
-            });
-            const token = session.cookies['usr'];
-            if (!token) {
-                throw new Error('zola: no `usr` cookie found. ' +
-                    'Sign into zola.com in your browser (with the fetchproxy extension installed) and retry.');
-            }
-            return { token, source: 'fetchproxy' };
-        }
-        catch (e) {
-            // 0.8.0+ typed-error discrimination. The fetchproxy server already
-            // retries once on SW eviction (bridgeReviveDelayMs=2000 default), so
-            // a thrown FetchproxyBridgeDownError means the retry also failed —
-            // the extension's service worker is genuinely down and the user
-            // needs to wake it. The `.hint` is the actionable copy
-            // ("click the extension toolbar icon...") that we'd otherwise have
-            // to hand-write here. Surface it verbatim so users in path 2 get
-            // the same self-service guidance as path 3.
-            if (classifyBridgeError(e) === 'bridge_down') {
-                const downErr = e;
-                throw new Error(`Zola auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`);
-            }
-            const msg = e instanceof Error ? e.message : String(e);
-            throw new Error(`Zola auth: no ZOLA_REFRESH_TOKEN set, and fetchproxy fallback failed: ${msg}`);
-        }
-    }
-    // ── Path 3: nothing configured. Surface both fixes side-by-side so the
-    //    user can pick whichever fits their setup.
-    throw new Error('Zola auth: set ZOLA_REFRESH_TOKEN, ' +
-        'or install the fetchproxy extension and sign into zola.com ' +
-        '(unset ZOLA_DISABLE_FETCHPROXY if it is set).');
+    const { credential, source } = await resolveAuth();
+    return { token: credential, source };
 }

package/dist/bundle.js

@@ -34680,24 +34680,52 @@ async function runMcp(opts) {
   return server;
 }
 
-// node_modules/@chrischall/mcp-utils/dist/response/index.js
-function textResult(data) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-  };
-}
-function imageResult(base643, mimeType) {
-  return {
-    content: [{ type: "image", data: base643, mimeType }]
-  };
-}
-
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var DEFAULT_ERROR_MESSAGE_MAX = 500;
+var McpToolError = class extends Error {
+  /** Actionable remediation text, when one applies. */
+  hint;
+  constructor(message, opts) {
+    super(message, opts?.cause !== void 0 ? { cause: opts.cause } : void 0);
+    this.name = "McpToolError";
+    if (opts?.hint !== void 0)
+      this.hint = opts.hint;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var SessionNotAuthenticatedError = class extends McpToolError {
+  constructor(service, signInHost) {
+    const name = service ?? "the service";
+    const where = signInHost ? `Open ${signInHost} in your browser and sign in, then try again.` : "Sign in in your browser, then try again.";
+    super(`Not signed in to ${name}. ${where} Saved searches, saved homes, and other account data require a signed-in session.`, { hint: where });
+    this.name = "SessionNotAuthenticatedError";
+  }
+};
+function createHelpfulError(message, opts) {
+  return new McpToolError(message, opts);
+}
 var BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
 var JWT_RE = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/g;
+var BASIC_AUTH_RE = /(authorization\s*:\s*basic\s+)[A-Za-z0-9+/=_-]{6,}/gi;
+var SET_COOKIE_RE = /(\bset-cookie\s*:\s*)([^=;,\s]+)=[^;,\s]*/gi;
+var COOKIE_HEADER_RE = /((?<!set-)\bcookie\s*:\s*)((?:[^=;,\s]+=[^;,\s]*)(?:;\s*[^=;,\s]+=[^;,\s]*)*)/gi;
+var API_KEY_RE = new RegExp([
+  "sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])",
+  // OpenAI / Anthropic (incl. sk-ant-…)
+  "gh[pousr]_[A-Za-z0-9]{36,}\\b",
+  // GitHub ghp_/gho_/ghu_/ghs_/ghr_
+  "xox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])",
+  // Slack
+  "AIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])",
+  // Google API key (39 chars total)
+  "AKIA[0-9A-Z]{16}\\b",
+  // AWS access key id (20 chars total)
+  "whsec_[A-Za-z0-9]{16,}\\b"
+  // webhook signing secret (Stripe-style)
+].map((p) => `\\b${p}`).join("|"), "g");
+var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
@@ -34707,6 +34735,18 @@ function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   return `${redacted.slice(0, max)}\u2026 [truncated]`;
 }
 
+// node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
+function imageResult(base643, mimeType) {
+  return {
+    content: [{ type: "image", data: base643, mimeType }]
+  };
+}
+
 // node_modules/@chrischall/mcp-utils/dist/config/index.js
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
@@ -34720,6 +34760,20 @@ function readEnvVar(key, opts = {}) {
   }
   return opts.default;
 }
+var TRUE_TOKENS = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var FALSE_TOKENS = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
+function parseBoolEnv(key, opts = {}) {
+  const fallback = opts.default ?? false;
+  const raw = readEnvVar(key, { env: opts.env });
+  if (raw === void 0)
+    return fallback;
+  const token = raw.toLowerCase();
+  if (TRUE_TOKENS.has(token))
+    return true;
+  if (FALSE_TOKENS.has(token))
+    return false;
+  return fallback;
+}
 async function loadDotenvSafely(opts = {}) {
   try {
     const mod = await import(
@@ -34738,6 +34792,15 @@ async function loadDotenvSafely(opts = {}) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
+function buildOptionalBody(args, optionalFields) {
+  const body = {};
+  for (const field of optionalFields) {
+    if (args[field] !== void 0) {
+      body[field] = args[field];
+    }
+  }
+  return body;
+}
 function formatApiError(status, method, path, errorText, opts = {}) {
   const service = opts.service ?? "API";
   const head = `${service} error ${status} for ${method.toUpperCase()} ${path}`;
@@ -34796,6 +34859,47 @@ var pageSchema = {
   page_size: external_exports.number().int().min(1).max(200).default(50).describe("Number of items per page (1-200).")
 };
 
+// node_modules/@chrischall/mcp-utils/dist/auth/index.js
+function bridgeDownHintOf(err) {
+  if (err instanceof Error && err.name === "FetchproxyBridgeDownError") {
+    const hint = err.hint;
+    if (typeof hint === "string" && hint.length > 0)
+      return hint;
+  }
+  return void 0;
+}
+function createAuthResolver(opts) {
+  const { envVar, disableEnvVar, bootstrap: bootstrap2, bootstrapOptions, parseTokens, serviceName, signInHost, env } = opts;
+  return async function resolveAuth2() {
+    const envCredential = readEnvVar(envVar, env ? { env } : {});
+    if (envCredential) {
+      return { credential: envCredential, source: "env" };
+    }
+    const disabled = disableEnvVar !== void 0 && parseBoolEnv(disableEnvVar, env ? { env } : {});
+    if (!disabled) {
+      let session;
+      try {
+        session = await bootstrap2(bootstrapOptions);
+      } catch (e) {
+        const bridgeHint = bridgeDownHintOf(e);
+        if (bridgeHint !== void 0) {
+          throw createHelpfulError(`Auth: no ${envVar} set, and the fetchproxy bridge is down (extension service worker unreachable). ${bridgeHint}`, { hint: bridgeHint });
+        }
+        throw createHelpfulError(`Auth: no ${envVar} set, and fetchproxy fallback failed: ${truncateErrorMessage(messageOf(e))}`, { hint: `Set ${envVar}, or sign in in your browser and retry.` });
+      }
+      const credential = parseTokens(session);
+      if (credential) {
+        return { credential, source: "fetchproxy" };
+      }
+      throw new SessionNotAuthenticatedError(serviceName, signInHost);
+    }
+    throw createHelpfulError(`Auth: set ${envVar}${signInHost ? `, or sign in at ${signInHost} in your browser` : ", or sign in in your browser"}${disableEnvVar ? ` (unset ${disableEnvVar} if it is set)` : ""}.`, { hint: `Set ${envVar} or sign in in your browser.` });
+  };
+}
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
 // src/client.ts
 import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
@@ -37980,7 +38084,7 @@ var BootstrapDisabledError = class extends Error {
 // package.json
 var package_default = {
   name: "zola-mcp",
-  version: "1.4.0",
+  version: "1.4.2",
   mcpName: "io.github.chrischall/zola-mcp",
   description: "Zola wedding MCP server for Claude",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38026,7 +38130,7 @@ var package_default = {
     "test:watch": "vitest"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.5.2",
+    "@chrischall/mcp-utils": "^0.7.0",
     "@fetchproxy/bootstrap": "^1.3.0",
     "@fetchproxy/server": "^1.3.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -38043,58 +38147,36 @@ var package_default = {
 };
 
 // src/auth.ts
-function fetchproxyDisabled() {
-  const raw = readEnvVar("ZOLA_DISABLE_FETCHPROXY");
-  if (raw === void 0) return false;
-  return ["1", "true", "yes", "on"].includes(raw.toLowerCase());
-}
-async function resolveRefreshToken() {
-  const envToken = readEnvVar("ZOLA_REFRESH_TOKEN");
-  if (envToken) {
-    return { token: envToken, source: "env" };
-  }
-  if (!fetchproxyDisabled()) {
-    try {
-      const session = await bootstrap({
-        serverName: package_default.name,
-        version: package_default.version,
-        // Zola serves www.zola.com (web app) and mobile-api.zola.com (API).
-        // The `usr` cookie lives on the web app's apex domain; the extension
-        // matches on suffix so listing the apex covers any subdomain.
-        domains: ["zola.com"],
-        declare: {
-          // `usr` is HttpOnly → invisible to page JS, but fetchproxy 0.3.0's
-          // read_cookies uses `chrome.cookies.get` which DOES see HttpOnly
-          // cookies. The value IS the ~1-year refresh JWT.
-          cookies: ["usr"],
-          localStorage: [],
-          sessionStorage: [],
-          captureHeaders: []
-        }
-      });
-      const token = session.cookies["usr"];
-      if (!token) {
-        throw new Error(
-          "zola: no `usr` cookie found. Sign into zola.com in your browser (with the fetchproxy extension installed) and retry."
-        );
-      }
-      return { token, source: "fetchproxy" };
-    } catch (e) {
-      if (classifyBridgeError(e) === "bridge_down") {
-        const downErr = e;
-        throw new Error(
-          `Zola auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`
-        );
-      }
-      const msg = e instanceof Error ? e.message : String(e);
-      throw new Error(
-        `Zola auth: no ZOLA_REFRESH_TOKEN set, and fetchproxy fallback failed: ${msg}`
-      );
+var resolveAuth = createAuthResolver({
+  envVar: "ZOLA_REFRESH_TOKEN",
+  disableEnvVar: "ZOLA_DISABLE_FETCHPROXY",
+  // The real bootstrap has a narrower opts type than the injected boundary;
+  // the cast keeps the heavy bridge dep out of the shared module's types.
+  bootstrap,
+  bootstrapOptions: {
+    serverName: package_default.name,
+    version: package_default.version,
+    // Zola serves www.zola.com (web app) and mobile-api.zola.com (API).
+    // The `usr` cookie lives on the web app's apex domain; the extension
+    // matches on suffix so listing the apex covers any subdomain.
+    domains: ["zola.com"],
+    declare: {
+      // `usr` is HttpOnly → invisible to page JS, but fetchproxy's
+      // read_cookies uses `chrome.cookies.get` which DOES see HttpOnly
+      // cookies. The value IS the ~1-year refresh JWT.
+      cookies: ["usr"],
+      localStorage: [],
+      sessionStorage: [],
+      captureHeaders: []
     }
-  }
-  throw new Error(
-    "Zola auth: set ZOLA_REFRESH_TOKEN, or install the fetchproxy extension and sign into zola.com (unset ZOLA_DISABLE_FETCHPROXY if it is set)."
-  );
+  },
+  parseTokens: (session) => session.cookies["usr"],
+  serviceName: "Zola",
+  signInHost: "zola.com"
+});
+async function resolveRefreshToken() {
+  const { credential, source } = await resolveAuth();
+  return { token: credential, source };
 }
 
 // src/client.ts
@@ -38247,7 +38329,7 @@ var ZolaClient = class {
     if (!response.ok) {
       const text = await response.text();
       throw new Error(
-        `Zola session refresh failed (${response.status}): ${text}
+        `Zola session refresh failed (${response.status}): ${truncateErrorMessage(text)}
 To fix: set ZOLA_REFRESH_TOKEN, or install the fetchproxy extension and sign into zola.com.`
       );
     }
@@ -38266,11 +38348,7 @@ function imageResult2(bytes, mimeType) {
   return imageResult(Buffer.from(bytes).toString("base64"), mimeType);
 }
 function pickDefined(base, args, keys) {
-  const body = { ...base };
-  for (const key of keys) {
-    if (args[key] !== void 0) body[key] = args[key];
-  }
-  return body;
+  return { ...base, ...buildOptionalBody(args, keys) };
 }
 
 // src/tools/vendors.ts
@@ -40225,7 +40303,7 @@ function registerEventInvitationTools(server) {
 }
 
 // src/index.ts
-var VERSION = "1.4.0";
+var VERSION = "1.4.2";
 await runMcp({
   name: "zola-mcp",
   version: VERSION,

package/dist/client.js

@@ -1,6 +1,6 @@
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
-import { readEnvVar, loadDotenvSafely, decodeJwtExp, decodeJwtSessionId, formatApiError, } from '@chrischall/mcp-utils';
+import { readEnvVar, loadDotenvSafely, decodeJwtExp, decodeJwtSessionId, formatApiError, truncateErrorMessage, } from '@chrischall/mcp-utils';
 import { resolveRefreshToken } from './auth.js';
 // Load `.env` next to the compiled entry point. `loadDotenvSafely` is a
 // no-throw loader: in bundled mode (no resolvable `dotenv`) it returns false
@@ -159,7 +159,10 @@ export class ZolaClient {
         });
         if (!response.ok) {
             const text = await response.text();
-            throw new Error(`Zola session refresh failed (${response.status}): ${text}\n` +
+            // The refresh request body carries the refresh JWT — an echoing upstream
+            // or proxy could reflect it in the error body, so redact + truncate the
+            // untrusted body before it can reach a tool result.
+            throw new Error(`Zola session refresh failed (${response.status}): ${truncateErrorMessage(text)}\n` +
                 'To fix: set ZOLA_REFRESH_TOKEN, or install the fetchproxy extension and sign into zola.com.');
         }
         const result = (await response.json());

package/dist/index.js

@@ -12,7 +12,7 @@ import { registerWebsiteThemeTools } from './tools/website-theme.js';
 import { registerRegistryItemTools } from './tools/registry-items.js';
 import { registerInvitationTools } from './tools/invitations.js';
 import { registerEventInvitationTools } from './tools/event-invitations.js';
-const VERSION = '1.4.0'; // x-release-please-version
+const VERSION = '1.4.2'; // x-release-please-version
 await runMcp({
     name: 'zola-mcp',
     version: VERSION,

package/dist/types.js

@@ -1,4 +1,4 @@
-import { textResult, imageResult as imageResultBase64 } from '@chrischall/mcp-utils';
+import { buildOptionalBody, textResult, imageResult as imageResultBase64 } from '@chrischall/mcp-utils';
 /**
  * Wrap any value as the standard MCP text-content tool result with pretty-printed JSON.
  * Re-exported from `@chrischall/mcp-utils` (`textResult`) under the repo's
@@ -16,12 +16,9 @@ export function imageResult(bytes, mimeType) {
 /**
  * Build a partial-update body containing only keys from `args` that are not undefined.
  * Used by tools that send PATCH-style updates where omitting a key means "leave unchanged".
+ * The undefined-dropping is the shared `buildOptionalBody` from `@chrischall/mcp-utils`;
+ * this wrapper just merges the always-present `base` fields in front.
  */
 export function pickDefined(base, args, keys) {
-    const body = { ...base };
-    for (const key of keys) {
-        if (args[key] !== undefined)
-            body[key] = args[key];
-    }
-    return body;
+    return { ...base, ...buildOptionalBody(args, keys) };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zola-mcp",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "mcpName": "io.github.chrischall/zola-mcp",
   "description": "Zola wedding MCP server for Claude",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -46,7 +46,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.5.2",
+    "@chrischall/mcp-utils": "^0.7.0",
     "@fetchproxy/bootstrap": "^1.3.0",
     "@fetchproxy/server": "^1.3.0",
     "@modelcontextprotocol/sdk": "^1.29.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/zola-mcp",
     "source": "github"
   },
-  "version": "1.4.0",
+  "version": "1.4.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "zola-mcp",
-      "version": "1.4.0",
+      "version": "1.4.2",
       "transport": {
         "type": "stdio"
       },