# Phase 2 — hosted magic-link path (parked)

These files are the **hosted** REEF-with-MCP path, built first then deprioritised
when recon showed the Phase-1 dogfood targets (cver, pajicomic) are native
sitetile sites whose content SSOT is a git repo, not the Heroku backend. See
`docs/PLAN-reef-with-mcp.md` §5.8 and memory `feelreef-native-site-canon`.

- `endpoints.js` — REEF backend origins + `/login/email`, `/auth/magic` shapes.
- `auth.js` — magic-link login: request → paste link → spend it → hold `mf_session`.
- `index.heroku-login.js` — MCP server wiring the login tools.

**What this path is for:** editing a *remote* site owner's Card / external-mode
blog through the live Heroku backend, once (a) the v3204 slug lock lifts so a
backend agent-auth endpoint can ship, and (b) the backend native build-deploy
pipeline exists. Until then, Phase 1 edits the site's git-repo IR locally.

**Reactivation notes:** these still import the generic `../http.js` / `../state.js`
(kept at src/ for reuse). Verified facts to trust (no re-probe): login endpoint
lives on `reef.cver.net` (feelreef.com 404s it); JSON body `{email, turnstileToken:"",
lang}`; Turnstile gate off in prod today; session cookie `mf_session` (4h).