@itm-platform/mcp-server 1.0.0 → 1.0.2

package/README.md

@@ -1,193 +1,225 @@
-# ITM.MCP
+# ITM Platform MCP Server
 
-> For cross-cutting documentation (debugging, database schema, environments, API versioning, build commands), see the [parent README](../README.md#documentation-index).
+Connect ITM Platform to AI assistants through the [Model Context Protocol](https://modelcontextprotocol.io). The ITM Platform MCP server lets MCP-compatible clients search projects, inspect budgets, summarize portfolio health, create tasks, log risks and issues, and update project details using your ITM Platform permissions.
 
-MCP (Model Context Protocol) server for ITM Platform. Exposes project management data to AI assistants -- Claude, ChatGPT, VS Code Copilot, Cursor, JetBrains -- through a universal open protocol.
+It works with Claude, VS Code, Cursor, OpenAI Codex, Windsurf, JetBrains AI Assistant, and any other client that supports MCP.
 
-**Status:** Phase 2 in progress -- 20 tools (15 read + 5 write), 6 resources, 4 prompts. OAuth scope enforcement, audit logging, and token exchange in place. 137 unit tests, 23 E2E tests.
+- Public docs: [developers.itmplatform.com/mcp](https://developers.itmplatform.com/mcp/)
+- npm package: [@itm-platform/mcp-server](https://www.npmjs.com/package/@itm-platform/mcp-server)
+- Hosted MCP URL: `https://api.itmplatform.com/v2/_/mcp/`
 
-See [House Rules](../House-rules.md) for coding conventions.
+## Quick Start
 
-## How it works
+### Hosted connection with OAuth
 
-MCP is a JSON-RPC 2.0 protocol that lets AI assistants discover and call tools on external servers. The server supports two transports:
+Use the hosted server if your AI client supports remote MCP servers. There is nothing to install: add the URL, sign in with your ITM Platform account, and approve the requested access.
 
-- **HTTP + OAuth (recommended)** -- AI clients connect to a hosted URL and authenticate via OAuth 2.1 (PKCE). No local install needed.
-- **stdio** -- AI clients spawn the server as a local child process. Auth via API key.
-
-```
-AI Client (Claude, Cursor, VS Code, Codex...)
-  |
-  |  HTTP (remote) or stdio (local)
-  v
-ITM.MCP Server
-  |  authenticates as the user, calls ITM APIs
-  v
-ITM.API Gateway --> DataMart (GraphQL) + v2 REST (users, reference data)
+```bash
+claude mcp add --scope user --transport http itm-platform https://api.itmplatform.com/v2/_/mcp/
 ```
 
-**Key point:** The AI model never sees user credentials. Auth is handled by the MCP server. The model only sees tool names, descriptions, and results.
+For other MCP clients, use this remote URL:
 
-### Three MCP primitives
+```text
+https://api.itmplatform.com/v2/_/mcp/
+```
 
-| Primitive | Who controls it | What it does | Example |
-|-----------|----------------|--------------|---------|
-| **Tools** | AI model decides when to call | Executable read/write operations | `search_projects`, `get_project_budget` |
-| **Resources** | Client app loads as context | Read-only reference data (schemas, docs) | `itm://schema/component` |
-| **Prompts** | User triggers a workflow template | Pre-composed multi-tool request | `/project_status` fetches project + tasks + risks + budget in one shot |
+OAuth is the recommended setup for most users because your AI client never sees your ITM Platform password or API key.
 
-## Quick start
+### Local connection with an API key
+
+Use the npm package if you prefer to run the server locally, work behind a firewall, or need to connect to a self-hosted ITM Platform instance.
 
 ```bash
-npm install
-cp .env.sample .env   # edit with your credentials
-npm test              # unit tests (124 tests)
-npm run build         # compile TypeScript to dist/
-npm run dev           # HTTP dev server on port 6170 (for testing with curl)
-npm run test:e2e      # E2E tests (requires local ITM.API + DataMart)
+npx @itm-platform/mcp-server
 ```
 
-## End-user setup
+Your MCP client must pass these environment variables to the server:
+
+| Variable | Value |
+|----------|-------|
+| `ITM_API_URL` | `https://api.itmplatform.com` |
+| `ITM_COMPANY` | Your company/account slug |
+| `ITM_API_KEY` | Your personal API key from ITM Platform |
+
+Example stdio configuration:
+
+```json
+{
+  "mcpServers": {
+    "itm-platform": {
+      "command": "npx",
+      "args": ["@itm-platform/mcp-server"],
+      "env": {
+        "ITM_API_URL": "https://api.itmplatform.com",
+        "ITM_COMPANY": "{your-account}",
+        "ITM_API_KEY": "your-api-key"
+      }
+    }
+  }
+}
+```
 
-For end-user setup instructions (OAuth, per-client configuration, npm package), see the [APIDocs site](APIDocs/).
+To create an API key, log in to ITM Platform, open **My Profile**, and generate a key from the **API Key** section.
 
-**Quick connect (OAuth):**
+## What You Can Ask
 
-```bash
-claude mcp add --scope user --transport http itm-platform https://api.itmplatform.com/v2/_/mcp/
-```
+Once connected, your AI assistant can use ITM Platform data in normal conversation:
 
-**Quick connect (npm, local):**
+> "Which projects are behind schedule?"
 
-```bash
-claude mcp add --scope user itm-platform -- npx @itm-platform/mcp-server
-```
+> "Give me a budget summary for the Digital Transformation program."
 
-## Server configuration (development / deployment)
+> "Create a high-priority task in Project Alpha due next Friday."
 
-| Variable | Stdio | HTTP+OAuth | Description |
-|----------|-------|------------|-------------|
-| `ITM_API_URL` | Required | Required | ITM.API base URL |
-| `ITM_COMPANY` | Required | -- | Company/tenant slug |
-| `ITM_API_KEY` | Required* | -- | Per-user API key (generate from My Profile) |
-| `ITM_TOKEN` | Required* | -- | Session token (alternative to API key) |
-| `PORT` | -- | Required | HTTP listen port |
-| `ITM_AUTH_URL` | -- | Required | Internal OAuth authorization server URL (used for token exchange) |
-| `ITM_AUTH_PUBLIC_URL` | -- | Required* | Public OAuth URL advertised to AI clients. Falls back to `ITM_AUTH_URL` |
-| `MCP_SERVER_URL` | -- | Required | MCP server public URL (OAuth audience) |
-| `LOG_LEVEL` | Optional | Optional | Pino log level: `debug`, `info`, `warn`, `error` (default: `info`) |
-| `ITM_AUDIT_ENABLED` | Optional | Optional | Enable audit logging to ITM backend |
+> "What open risks exist across my portfolio?"
 
-\* One of `ITM_API_KEY` or `ITM_TOKEN` is required for stdio mode.
+The MCP server authenticates as you, calls ITM Platform APIs, and returns only the data your ITM Platform account is allowed to access.
 
-In HTTP mode, if both `ITM_AUTH_URL` and `MCP_SERVER_URL` are set, OAuth is mandatory and every session must provide a Bearer token. If either is missing, the server runs in dev mode using the startup identity.
+## Capabilities
 
-On deployed environments, `ITM_AUTH_URL` points to `localhost` for internal server-to-server token exchange. `ITM_AUTH_PUBLIC_URL` must be set to the public URL so AI clients can discover the OAuth authorization server.
+The server exposes 20 MCP tools, 6 resources, and 4 prompt templates.
 
-## Tools (Phase 1 -- read-only)
+### Read Tools
 
-### DataMart-backed (fast, single-query reads)
+| Tool | What it does |
+|------|--------------|
+| `search_projects` | Find projects by name, status, type, or date range |
+| `get_project` | Retrieve project details, including optional tasks, risks, issues, budget, purchases, and revenues |
+| `search_services` | Find services by name, status, type, or date range |
+| `get_service` | Retrieve service details |
+| `list_project_tasks` | List tasks for a project |
+| `get_project_budget` | Get budget, actuals, revenue, cost, and margin information |
+| `get_project_purchases` | List purchase orders for a project |
+| `get_project_revenues` | List revenue items for a project |
+| `get_project_risks` | List project risks |
+| `get_project_issues` | List project issues |
+| `aggregate_portfolio` | Group and summarize portfolio data |
+| `query_datamart` | Run validated DataMart queries for advanced analysis |
+| `search_users` | Find users and team members |
+| `get_user` | Retrieve user details |
+| `get_reference_data` | Retrieve statuses, types, priorities, and other reference lists |
 
-| Tool | Description |
-|------|-------------|
-| `search_projects` | Find projects by name, status, type, date range |
-| `search_services` | Find services by name, status, type, date range |
-| `get_project` | Full project details with optional subcomponents (tasks, risks, budget, etc.) |
-| `get_service` | Full service details with optional subcomponents |
-| `list_project_tasks` | Tasks for a project |
-| `get_project_risks` | Risks for a project |
-| `get_project_issues` | Issues for a project |
-| `get_project_budget` | Budget summary (top-down, bottom-up, actual, period-end close) |
-| `get_project_purchases` | Purchase orders for a project |
-| `get_project_revenues` | Revenue items for a project |
-| `aggregate_portfolio` | Portfolio analytics -- group, count, sum, avg across all projects |
-| `query_datamart` | Raw DataMart query for advanced analysis (validated, safe operators only) |
+### Write Tools
 
-### v2 REST-backed (users, reference data)
+| Tool | What it does |
+|------|--------------|
+| `create_task` | Add a task to a project |
+| `update_task` | Update task fields such as status, dates, assignee, and progress |
+| `create_risk` | Log a project risk |
+| `create_issue` | Log a project issue |
+| `update_project` | Update project fields such as name, status, dates, and priority |
 
-| Tool | Description |
-|------|-------------|
-| `search_users` | Find team members |
-| `get_user` | User details |
-| `get_reference_data` | Status lists, types, priorities for any entity |
+Write operations confirm the saved state from the ITM Platform REST API. DataMart-backed search results may take up to 60 seconds to reflect recent writes.
 
-### Write tools (Phase 2 -- v2 REST-backed)
+### Resources and Prompts
 
-| Tool | Description |
-|------|-------------|
-| `create_task` | Create a new task in a project |
-| `update_task` | PATCH task fields (status, dates, assignee, progress) |
-| `create_risk` | Log a new risk in a project |
-| `create_issue` | Log a new issue in a project |
-| `update_project` | PATCH project fields (name, status, dates, priority) |
+Resources give AI clients read-only context such as DataMart schemas and project calendars. Prompt templates provide guided workflows for common analysis tasks:
 
-Write tools return confirmed state from v2 REST (source of truth). Subsequent DataMart reads may lag 5-60 seconds due to eventual consistency -- this is noted in every write response.
+| Prompt | What it helps with |
+|--------|--------------------|
+| `/project_status` | Summarize health, tasks, risks, issues, and budget for one project |
+| `/portfolio_overview` | Analyze portfolio status, methodology, budget, and delivery patterns |
+| `/team_workload` | Review assignments and workload patterns |
+| `/risk_analysis` | Assess risk exposure, issues, and budget impact |
 
-## Prompts
+## Authentication and Permissions
 
-Workflow templates the user can trigger. The MCP server returns a pre-composed message that instructs the AI to call the right tools.
+The MCP server uses the same identity and permission model as ITM Platform.
 
-| Prompt | What it does |
-|--------|-------------|
-| `/project_status` | Fetches project + tasks + risks + budget, asks AI to summarize |
-| `/portfolio_overview` | Aggregates projects by status/methodology/budget, asks AI for health overview |
-| `/team_workload` | Fetches users + assignments, asks AI for workload analysis |
-| `/risk_analysis` | Fetches risks + issues + budget, asks AI for risk assessment |
+| Connection method | Authentication | Best for |
+|-------------------|----------------|----------|
+| Hosted HTTP | OAuth 2.1 with PKCE | Most users and managed AI clients |
+| Local stdio | ITM Platform API key | Local execution, firewalled networks, self-hosted environments |
 
-## Architecture
+OAuth sessions use scopes:
 
-```
-src/
-  server.ts                # MCP server bootstrap (stdio + HTTP, per-session auth)
-  instrument-server.ts     # Tool-call logging + audit wrapper (wraps registerTool)
-  logger.ts                # Pino logger factory (stderr + rotating file in logs/mcp.log)
-  auth/
-    effective-user-context.ts  # User identity type
-    api-key-auth.ts            # API key auth, calls /resolve/identity
-    license-resolver.ts        # License type -> access level
-    oauth-auth.ts              # Phase 2: OAuth token exchange
-    oauth-metadata.ts          # Phase 2: /.well-known/oauth-protected-resource
-    token-extraction.ts        # Bearer token extraction from headers
-  clients/
-    datamart-client.ts     # DataMart GraphQL through gateway
-    rest-client.ts         # v2 REST through gateway (GET, POST, PATCH)
-    audit-client.ts        # Phase 2: audit logging (fire-and-forget)
-  tools/                   # One file per tool group
-    write-tools.ts         # Phase 2: create/update tools (task, risk, issue, project)
-  resources/               # Schema + calendar resources
-  prompts/                 # Workflow templates
-  validation/
-    query-validator.ts     # Allowlist of safe MongoDB operators
-```
+| Scope | Allows |
+|-------|--------|
+| `mcp:read` | Read-only tools such as search, get, list, aggregate, and query |
+| `mcp:write` | Read tools plus create and update tools |
+
+API key sessions use the full permissions of the ITM Platform user who generated the key.
+
+License access:
+
+| License | MCP access |
+|---------|------------|
+| Company Admin | Full read and write access |
+| Full User | Full read and write access |
+| Project Manager | Not yet available |
+| Team Member | Blocked |
 
-## Access control
+Your AI assistant does not receive your ITM Platform password or API key. Project data is returned to the AI client you choose, so the AI provider's data-handling policy applies to any data it processes.
 
-| License type | Access |
-|-------------|--------|
-| CompanyAdmin | Full |
-| FullUser | Full |
-| ProjectManager | Blocked in Phase 1 (requires gateway PM-scope injection -- Phase 2) |
-| TeamMember | Blocked |
+## Client Setup
 
-**OAuth scope enforcement:** OAuth sessions respect granted scopes. Sessions with `mcp:read` only see 15 read tools; `mcp:write` is required to see and use write tools. API-key/stdio sessions get all tools unconditionally (backward compatible).
+Use the public docs for client-specific setup:
 
-## Logging
+- [Claude Code, Claude Desktop, VS Code, Cursor, Codex, Windsurf, and JetBrains](https://developers.itmplatform.com/mcp/#ai-clients)
+- [Connect with OAuth](https://developers.itmplatform.com/mcp/#setup-oauth)
+- [Connect with an API key](https://developers.itmplatform.com/mcp/#setup-stdio)
+- [Troubleshooting](https://developers.itmplatform.com/mcp/#troubleshooting)
 
-Uses [Pino](https://getpino.io/) (same as DataMart and MSTeamsBot). Logs go to two destinations:
+For any MCP-compatible client, the two connection values are:
 
-- **stderr** -- pretty-printed, colorized (stdout is reserved for the MCP JSON-RPC protocol)
-- **`logs/mcp.log`** -- rotating file relative to the MCP application root, 10 MB max, keeps 5 old files (skipped in test)
+| Method | Value |
+|--------|-------|
+| Remote URL | `https://api.itmplatform.com/v2/_/mcp/` |
+| Local command | `npx @itm-platform/mcp-server` |
+
+## Self-Hosting
+
+For a local stdio server, configure `ITM_API_URL`, `ITM_COMPANY`, and either `ITM_API_KEY` or `ITM_TOKEN`.
+
+For an HTTP server with OAuth, configure:
+
+| Variable | Description |
+|----------|-------------|
+| `ITM_API_URL` | ITM Platform API gateway URL |
+| `PORT` | HTTP listen port |
+| `ITM_AUTH_URL` | OAuth authorization server URL used for token exchange |
+| `ITM_AUTH_PUBLIC_URL` | Public OAuth URL advertised to AI clients |
+| `MCP_SERVER_URL` | Public MCP server URL used as the OAuth audience |
+| `LOG_LEVEL` | Optional Pino log level: `debug`, `info`, `warn`, or `error` |
+| `ITM_AUDIT_ENABLED` | Enables server-side audit logging when set to `true` |
+
+When deployed behind a reverse proxy, `ITM_AUTH_URL` can point to a server-to-server address while `ITM_AUTH_PUBLIC_URL` must be reachable by AI clients.
+
+## Development
+
+Requirements:
+
+- Node.js 20 or later
+- npm
+
+Install dependencies, run tests, and build:
+
+```bash
+npm install
+npm test
+npm run build
+```
+
+Run the HTTP development server:
+
+```bash
+cp .env.sample .env
+npm run dev
+```
 
-Set `LOG_LEVEL` in `.env` to control verbosity (`debug`, `info`, `warn`, `error`; default: `info`). All log entries include `{ service: 'mcp', app: 'ITM.MCP' }` base fields and ISO timestamps.
+The package entry point is `dist/server.js`; the npm executable is `mcp-server`.
 
-HTTP clients (DataMart, REST) log at `debug` level on success (with duration in ms) and `error` on failure.
+## Troubleshooting
 
-**Tool-call logging:** Every MCP tool invocation is logged at `info` level with tool name, userId, and aiClientId. Completion is logged at `debug` with duration in ms. Failures are logged at `error`.
+If tools do not appear in your AI client, confirm that the server configuration is in the correct file for that client, restart the client, and check that `npx @itm-platform/mcp-server` runs successfully for local setups.
 
-**Audit:** When `ITM_AUDIT_ENABLED=true`, every tool call (read and write) sends an audit entry to the ITM backend (`/v2/{company}/mcp/audit`). Audit is fire-and-forget -- failures do not affect tool execution. Each entry includes: timestamp, userId, accountId, toolName, parametersHash (SHA-256), success, error (if any), aiClientId, durationMs.
+If authentication fails, regenerate your API key or reconnect the OAuth server so your client receives a fresh token.
 
-## Specification
+If a write succeeds but a later search shows old data, wait up to 60 seconds. Writes are confirmed from the REST API immediately, while DataMart search indexes update asynchronously.
 
-Full design, architecture decisions, phased rollout, and E2E test details:
+## More Help
 
-- [SPEC_MCP_SERVER.md](zz_Specifications/SPEC_MCP_SERVER.md)
+- MCP docs: [modelcontextprotocol.io](https://modelcontextprotocol.io)
+- ITM Platform help: [help.itmplatform.com](https://help.itmplatform.com)
+- ITM Platform developer docs: [developers.itmplatform.com/documentation](https://developers.itmplatform.com/documentation)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itm-platform/mcp-server",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "MCP server for ITM Platform",
   "type": "module",
   "main": "dist/server.js",
@@ -22,7 +22,7 @@
   ],
   "scripts": {
     "dev": "cross-env PORT=6170 node --env-file=.env --import tsx src/server.ts",
-    "build": "tsc",
+    "build": "node scripts/increase-package-version.mjs && tsc",
     "start": "node dist/server.js",
     "test": "vitest run",
     "test:integration": "vitest run --config vitest.integration.config.ts",

package/dist/src/auth/api-key-auth.d.ts

@@ -1,3 +0,0 @@
-import { EffectiveUserContext } from './effective-user-context.js';
-export declare function resolveIdentity(): Promise<EffectiveUserContext>;
-//# sourceMappingURL=api-key-auth.d.ts.map

package/dist/src/auth/api-key-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/api-key-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AA0BnE,wBAAsB,eAAe,IAAI,OAAO,CAAC,oBAAoB,CAAC,CA6CrE"}

package/dist/src/auth/api-key-auth.js

@@ -1,53 +0,0 @@
-import { resolveLicenseAccess } from './license-resolver.js';
-function resolveAuthHeaders() {
-    const apiKey = process.env.ITM_API_KEY;
-    const token = process.env.ITM_TOKEN;
-    if (apiKey) {
-        return { source: 'api-key', headers: { 'Authorization': `Bearer ${apiKey}` } };
-    }
-    if (token) {
-        return { source: 'token', headers: { 'Token': token } };
-    }
-    throw new Error('Missing required environment variable: ITM_API_KEY or ITM_TOKEN');
-}
-export async function resolveIdentity() {
-    const apiUrl = process.env.ITM_API_URL;
-    const company = process.env.ITM_COMPANY;
-    if (!apiUrl)
-        throw new Error('Missing required environment variable: ITM_API_URL');
-    if (!company)
-        throw new Error('Missing required environment variable: ITM_COMPANY');
-    const { source, headers: authHeaders } = resolveAuthHeaders();
-    const url = `${apiUrl}/v2/${company}/resolve/identity`;
-    const response = await fetch(url, {
-        method: 'POST',
-        headers: {
-            ...authHeaders,
-            'Content-Type': 'application/json',
-        },
-    });
-    if (!response.ok) {
-        throw new Error(`Identity resolution failed: ${response.status} ${response.statusText}`);
-    }
-    const identity = await response.json();
-    const { dataMartAccess, pmScopeUserId } = resolveLicenseAccess(identity.licenseTypeIds, identity.userId);
-    if (dataMartAccess === 'pm-scoped') {
-        throw new Error('PM-only access is not yet available for MCP. It will arrive with hosted MCP (Phase 2) or gateway scope injection.');
-    }
-    if (dataMartAccess === 'none') {
-        throw new Error('Team Member access is not available for MCP.');
-    }
-    return {
-        source,
-        company,
-        accountId: identity.accountId,
-        userId: identity.userId,
-        languageId: identity.languageId,
-        email: identity.email,
-        licenseTypeIds: identity.licenseTypeIds,
-        dataMartAccess,
-        pmScopeUserId,
-        authHeaders,
-    };
-}
-//# sourceMappingURL=api-key-auth.js.map

package/dist/src/auth/api-key-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-key-auth.js","sourceRoot":"","sources":["../../../src/auth/api-key-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAY7D,SAAS,kBAAkB;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAEpC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAEpF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAE9D,MAAM,GAAG,GAAG,GAAG,MAAM,OAAO,OAAO,mBAAmB,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,WAAW;YACd,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAqB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzG,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,cAAc;QACd,aAAa;QACb,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/src/auth/effective-user-context.d.ts

@@ -1,16 +0,0 @@
-export interface EffectiveUserContext {
-    source: 'api-key' | 'token';
-    company: string;
-    accountId: number;
-    userId: number;
-    languageId: number;
-    email: string;
-    licenseTypeIds: number[];
-    dataMartAccess: 'full' | 'pm-scoped' | 'none';
-    pmScopeUserId?: number;
-    authHeaders: Record<string, string>;
-    grantedScopes?: string[];
-}
-export declare const WRITE_TOOL_NAMES: Set<string>;
-export declare function hasScope(ctx: EffectiveUserContext, scope: string): boolean;
-//# sourceMappingURL=effective-user-context.d.ts.map

package/dist/src/auth/effective-user-context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"effective-user-context.d.ts","sourceRoot":"","sources":["../../../src/auth/effective-user-context.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,gBAAgB,aAE3B,CAAC;AAEH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG1E"}

package/dist/src/auth/effective-user-context.js

@@ -1,9 +0,0 @@
-export const WRITE_TOOL_NAMES = new Set([
-    'create_task', 'update_task', 'create_risk', 'create_issue', 'update_project',
-]);
-export function hasScope(ctx, scope) {
-    if (!ctx.grantedScopes)
-        return true;
-    return ctx.grantedScopes.includes(scope);
-}
-//# sourceMappingURL=effective-user-context.js.map

package/dist/src/auth/effective-user-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"effective-user-context.js","sourceRoot":"","sources":["../../../src/auth/effective-user-context.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB;CAC9E,CAAC,CAAC;AAEH,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,KAAa;IAC/D,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC"}

package/dist/src/auth/license-resolver.d.ts

@@ -1,6 +0,0 @@
-export interface LicenseAccessResult {
-    dataMartAccess: 'full' | 'pm-scoped' | 'none';
-    pmScopeUserId?: number;
-}
-export declare function resolveLicenseAccess(licenseTypeIds: number[], userId: number): LicenseAccessResult;
-//# sourceMappingURL=license-resolver.d.ts.map

package/dist/src/auth/license-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"license-resolver.d.ts","sourceRoot":"","sources":["../../../src/auth/license-resolver.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAQlG"}

package/dist/src/auth/license-resolver.js

@@ -1,12 +0,0 @@
-const FULL_ACCESS_TYPES = new Set([0, 1]);
-const PM_TYPE = 2;
-export function resolveLicenseAccess(licenseTypeIds, userId) {
-    if (licenseTypeIds.some(id => FULL_ACCESS_TYPES.has(id))) {
-        return { dataMartAccess: 'full' };
-    }
-    if (licenseTypeIds.includes(PM_TYPE)) {
-        return { dataMartAccess: 'pm-scoped', pmScopeUserId: userId };
-    }
-    return { dataMartAccess: 'none' };
-}
-//# sourceMappingURL=license-resolver.js.map

package/dist/src/auth/license-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"license-resolver.js","sourceRoot":"","sources":["../../../src/auth/license-resolver.ts"],"names":[],"mappings":"AAKA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,OAAO,GAAG,CAAC,CAAC;AAElB,MAAM,UAAU,oBAAoB,CAAC,cAAwB,EAAE,MAAc;IAC3E,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/src/auth/oauth-auth.d.ts

@@ -1,22 +0,0 @@
-import type { Logger } from 'pino';
-import type { EffectiveUserContext } from './effective-user-context.js';
-export interface TokenExchangeResult {
-    sessionToken: string;
-    userId: number;
-    accountId: number;
-    company: string;
-    email: string;
-    languageId: number;
-    licenseTypeIds: number[];
-    dataMartAccess: 'full' | 'pm-scoped' | 'none';
-    pmScopeUserId?: number;
-    expiresAt: string;
-    scope: string;
-}
-export interface OAuthConfig {
-    tokenExchangeUrl: string;
-    audience: string;
-}
-export declare function exchangeToken(oauthToken: string, config: OAuthConfig, log?: Logger): Promise<TokenExchangeResult>;
-export declare function buildEffectiveUserContextFromExchange(result: TokenExchangeResult): EffectiveUserContext;
-//# sourceMappingURL=oauth-auth.d.ts.map

package/dist/src/auth/oauth-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CAoB9B;AAED,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,CAcvG"}

package/dist/src/auth/oauth-auth.js

@@ -1,34 +0,0 @@
-export async function exchangeToken(oauthToken, config, log) {
-    log?.debug({ url: config.tokenExchangeUrl }, 'Token exchange request');
-    const response = await fetch(config.tokenExchangeUrl, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'Authorization': `Bearer ${oauthToken}`,
-        },
-        body: JSON.stringify({ audience: config.audience }),
-    });
-    if (!response.ok) {
-        log?.error({ status: response.status }, 'Token exchange failed');
-        throw new Error(`Token exchange failed: ${response.status} ${response.statusText}`);
-    }
-    const result = await response.json();
-    log?.info({ userId: result.userId, company: result.company }, 'Token exchange succeeded');
-    return result;
-}
-export function buildEffectiveUserContextFromExchange(result) {
-    return {
-        source: 'token',
-        company: result.company,
-        accountId: result.accountId,
-        userId: result.userId,
-        languageId: result.languageId,
-        email: result.email,
-        licenseTypeIds: result.licenseTypeIds,
-        dataMartAccess: result.dataMartAccess,
-        pmScopeUserId: result.pmScopeUserId,
-        grantedScopes: result.scope.split(' ').filter(Boolean),
-        authHeaders: { 'Token': result.sessionToken },
-    };
-}
-//# sourceMappingURL=oauth-auth.js.map

package/dist/src/auth/oauth-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-auth.js","sourceRoot":"","sources":["../../../src/auth/oauth-auth.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,MAAmB,EACnB,GAAY;IAEZ,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,wBAAwB,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU,UAAU,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;IAC5D,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,MAA2B;IAC/E,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE;KAC9C,CAAC;AACJ,CAAC"}

package/dist/src/auth/oauth-metadata.d.ts

@@ -1,10 +0,0 @@
-export interface ProtectedResourceMetadata {
-    resource: string;
-    authorization_servers: string[];
-    scopes_supported: string[];
-}
-export declare function buildProtectedResourceMetadata(config: {
-    mcpServerUrl: string;
-    authorizationServerUrl: string;
-}): ProtectedResourceMetadata;
-//# sourceMappingURL=oauth-metadata.d.ts.map

package/dist/src/auth/oauth-metadata.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-metadata.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-metadata.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;CAChC,GAAG,yBAAyB,CAM5B"}

package/dist/src/auth/oauth-metadata.js

@@ -1,8 +0,0 @@
-export function buildProtectedResourceMetadata(config) {
-    return {
-        resource: config.mcpServerUrl,
-        authorization_servers: [config.authorizationServerUrl],
-        scopes_supported: ['mcp:read', 'mcp:write'],
-    };
-}
-//# sourceMappingURL=oauth-metadata.js.map

package/dist/src/auth/oauth-metadata.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-metadata.js","sourceRoot":"","sources":["../../../src/auth/oauth-metadata.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,8BAA8B,CAAC,MAG9C;IACC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,YAAY;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC;QACtD,gBAAgB,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/src/auth/token-extraction.d.ts

@@ -1,2 +0,0 @@
-export declare function extractBearerToken(headers: Record<string, string | undefined>): string | undefined;
-//# sourceMappingURL=token-extraction.d.ts.map

package/dist/src/auth/token-extraction.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-extraction.d.ts","sourceRoot":"","sources":["../../../src/auth/token-extraction.ts"],"names":[],"mappings":"AAAA,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAIlG"}