@practicemakes/mcp 26.710.3

package/README.md

@@ -0,0 +1,78 @@
+# @practicemakes/mcp
+
+A small [MCP](https://modelcontextprotocol.io) server that exposes **PracticeMakes** production data (read-only) to Claude for admin and development work — and surfaces your **Planner backlog** so your own task list can drive development.
+
+It authenticates as **your own platform identity** (your Firebase user), so every result is scoped to your real role and organization by the backend. A SYSADMIN sees the whole platform; a regular user sees only their org. That's what lets the same server be handed to other users on the platform.
+
+## How it works
+
+```
+Claude  ──stdio──▶  @practicemakes/mcp  ──HTTPS Bearer──▶  https://api.practicemakes.io/api/...
+                    (refreshes your Firebase ID token)      (existing authz + business logic)
+```
+
+No backend changes and no secret credentials — the Firebase Web API key it uses is a **public** client value (baked in as a default), so each user supplies only a credential for **their own** account. Read-only.
+
+## Use it (published package)
+
+Once published to npm, any platform user connects with one line — nothing to clone or build:
+
+```sh
+claude mcp add practicemakes \
+  --env FIREBASE_REFRESH_TOKEN=<your-refresh-token> \
+  -- npx -y @practicemakes/mcp
+```
+
+Point at a local backend during development with `--env PM_API_BASE_URL=http://localhost:9090`.
+
+### Getting a refresh token
+
+- **Password account:** create `.env` (see `.env.example`) with `PM_EMAIL` / `PM_PASSWORD`, run `yarn workspace @practicemakes/mcp login` — it prints a `FIREBASE_REFRESH_TOKEN=...` line to use.
+- **Google/Apple sign-in:** log into the web app, open DevTools → Application → IndexedDB → `firebaseLocalStorage` → the auth user record, and copy `stsTokenManager.refreshToken`.
+
+## Develop (from the monorepo)
+
+```sh
+yarn install                                   # at repo root, links the workspace
+yarn workspace @practicemakes/mcp build
+cp packages/mcp/.env.example packages/mcp/.env # then fill in a credential
+yarn workspace @practicemakes/mcp smoke        # end-to-end check against prod
+```
+
+`smoke` prints who you're authenticated as, how many orgs are visible, and your Planner backlog. To run the local build directly in Claude instead of the published package:
+
+```sh
+claude mcp add practicemakes \
+  --env FIREBASE_REFRESH_TOKEN=... \
+  -- node /Users/johnfonte/IdeaProjects/common-frontend/packages/mcp/dist/index.js
+```
+
+## Publish
+
+Versioned on the monorepo's calendar scheme (`26.MMDD.patch`). Scoped public package:
+
+```sh
+yarn workspace @practicemakes/mcp publish   # runs prepublishOnly (clean + build) first
+```
+
+## Tools (v1, read-only)
+
+| Tool | What it returns |
+|---|---|
+| `list_organizations` | Orgs visible to you (SYSADMIN → all) |
+| `get_organization` | One org by UUID |
+| `get_my_profile` | Your profile + entitlements/roles/org context |
+| `list_profiles` | Profiles (SYSADMIN → all, ADMIN → your org) |
+| `get_profile` | One profile by UUID |
+| `get_my_planner_tasks` | Your Planner backlog (drives development) |
+| `search_tasks` | Search tasks; reveal completed/deleted/snoozed via `showFields` |
+| `get_task` | One task by UUID |
+| `list_workflows` | Your Planner workflows |
+| `get_workflow` | One workflow, hydrated with run state |
+| `get_billing_config` | Billing/entitlement config for your org |
+
+## Roadmap
+
+- **Write tools** (complete/create a task, switch org context, admin actions) with per-call confirmation.
+- **OpenAPI-driven** tool generation from the backend's grouped specs (the monorepo already uses `openapi-typescript` in `packages/core`).
+- **Hosted remote server** (streamable-HTTP + per-user OAuth) so users connect to a URL with nothing to install.

package/dist/auth.d.ts

@@ -0,0 +1,25 @@
+import type { Config } from "./config.js";
+/** Exchange an email/password for Firebase tokens (password accounts only). */
+export declare function signInWithPassword(apiKey: string, email: string, password: string): Promise<{
+    idToken: string;
+    refreshToken: string;
+    expiresInSeconds: number;
+}>;
+/**
+ * Holds the caller's Firebase identity and hands out a valid ID token on demand,
+ * transparently refreshing before expiry. Networks are only touched lazily on the
+ * first token request, so an invalid credential surfaces on the first tool call,
+ * not at process start.
+ */
+export declare class TokenManager {
+    private apiKey;
+    private refreshToken?;
+    private email?;
+    private password?;
+    private cachedIdToken?;
+    private expiresAtMs;
+    private inFlight?;
+    constructor(config: Config);
+    getIdToken(): Promise<string>;
+    private fetchFreshToken;
+}

package/dist/auth.js

@@ -0,0 +1,92 @@
+const IDENTITY_TOOLKIT = "https://identitytoolkit.googleapis.com/v1";
+const SECURE_TOKEN = "https://securetoken.googleapis.com/v1";
+/** Abort a Firebase auth request that hangs longer than this so token refresh can't wedge a tool call. */
+const AUTH_TIMEOUT_MS = 15_000;
+/** Exchange an email/password for Firebase tokens (password accounts only). */
+export async function signInWithPassword(apiKey, email, password) {
+    const res = await fetch(`${IDENTITY_TOOLKIT}/accounts:signInWithPassword?key=${apiKey}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email, password, returnSecureToken: true }),
+        signal: AbortSignal.timeout(AUTH_TIMEOUT_MS),
+    });
+    const body = (await res.json());
+    if (!res.ok) {
+        throw new Error(`Firebase sign-in failed (${res.status}): ${body?.error?.message ?? JSON.stringify(body)}`);
+    }
+    return {
+        idToken: body.idToken,
+        refreshToken: body.refreshToken,
+        expiresInSeconds: Number(body.expiresIn),
+    };
+}
+/** Exchange a refresh token for a fresh ID token (provider-agnostic). */
+async function refreshIdToken(apiKey, refreshToken) {
+    const res = await fetch(`${SECURE_TOKEN}/token?key=${apiKey}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken }),
+        signal: AbortSignal.timeout(AUTH_TIMEOUT_MS),
+    });
+    const body = (await res.json());
+    if (!res.ok) {
+        throw new Error(`Firebase token refresh failed (${res.status}): ${body?.error?.message ?? JSON.stringify(body)}`);
+    }
+    return {
+        idToken: body.id_token,
+        refreshToken: body.refresh_token,
+        expiresInSeconds: Number(body.expires_in),
+    };
+}
+/**
+ * Holds the caller's Firebase identity and hands out a valid ID token on demand,
+ * transparently refreshing before expiry. Networks are only touched lazily on the
+ * first token request, so an invalid credential surfaces on the first tool call,
+ * not at process start.
+ */
+export class TokenManager {
+    apiKey;
+    refreshToken;
+    email;
+    password;
+    cachedIdToken;
+    expiresAtMs = 0;
+    inFlight;
+    constructor(config) {
+        this.apiKey = config.firebaseApiKey;
+        this.refreshToken = config.refreshToken;
+        this.email = config.email;
+        this.password = config.password;
+    }
+    async getIdToken() {
+        // 60s safety buffer so a token never expires mid-request.
+        if (this.cachedIdToken && Date.now() < this.expiresAtMs - 60_000) {
+            return this.cachedIdToken;
+        }
+        // Coalesce concurrent refreshes into one network call.
+        if (!this.inFlight) {
+            this.inFlight = this.fetchFreshToken().finally(() => {
+                this.inFlight = undefined;
+            });
+        }
+        return this.inFlight;
+    }
+    async fetchFreshToken() {
+        let result;
+        if (this.refreshToken) {
+            result = await refreshIdToken(this.apiKey, this.refreshToken);
+        }
+        else if (this.email && this.password) {
+            // Bootstrap from password once; thereafter we have a refresh token to reuse.
+            result = await signInWithPassword(this.apiKey, this.email, this.password);
+        }
+        else {
+            throw new Error("No Firebase credential available to obtain an ID token.");
+        }
+        this.refreshToken = result.refreshToken;
+        this.cachedIdToken = result.idToken;
+        this.expiresAtMs = Date.now() + result.expiresInSeconds * 1000;
+        return result.idToken;
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,2CAA2C,CAAC;AACrE,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D,0GAA0G;AAC1G,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAAa,EACb,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,gBAAgB,oCAAoC,MAAM,EAAE,EAAE;QACvF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QAClE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;IACvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,YAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,cAAc,MAAM,EAAE,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;IACvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,CAAS;IACf,YAAY,CAAU;IACtB,KAAK,CAAU;IACf,QAAQ,CAAU;IAElB,aAAa,CAAU;IACvB,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,CAAmB;IAEnC,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,0DAA0D;QAC1D,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,MAAM,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;QACD,uDAAuD;QACvD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAClD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,MAAM,CAAC;QACX,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,6EAA6E;YAC7E,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/D,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF"}

package/dist/config.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Loads and validates configuration from the environment.
+ *
+ * Auth is per-user: the server acts as whoever the supplied Firebase credential
+ * belongs to. All data access is therefore scoped to that user's real role and
+ * organization by the backend (a SYSADMIN sees everything; a regular user sees
+ * only their org). This is what lets the same server be handed to other users.
+ */
+export interface Config {
+    apiBaseUrl: string;
+    firebaseApiKey: string;
+    /** Provider-agnostic refresh token (preferred). */
+    refreshToken?: string;
+    /** Password-account bootstrap (used only if no refresh token is present). */
+    email?: string;
+    password?: string;
+}
+export declare function loadConfig(): Config;

package/dist/config.js

@@ -0,0 +1,19 @@
+/**
+ * Public Firebase Web API key for the "practicemakes-sports" project. This is a
+ * client-side identifier (it ships in the web/mobile bundles), not a secret —
+ * baking it in means users only need to supply their own account credential.
+ * Overridable via FIREBASE_API_KEY for other environments.
+ */
+const DEFAULT_FIREBASE_API_KEY = "AIzaSyB-Ipn44LycKj7GFbKP124htwIKnLqeia0";
+export function loadConfig() {
+    const apiBaseUrl = (process.env.PM_API_BASE_URL ?? "https://api.practicemakes.io").replace(/\/+$/, "");
+    const firebaseApiKey = process.env.FIREBASE_API_KEY?.trim() || DEFAULT_FIREBASE_API_KEY;
+    const refreshToken = process.env.FIREBASE_REFRESH_TOKEN?.trim() || undefined;
+    const email = process.env.PM_EMAIL?.trim() || undefined;
+    const password = process.env.PM_PASSWORD || undefined;
+    if (!refreshToken && !(email && password)) {
+        throw new Error("No credential provided. Set FIREBASE_REFRESH_TOKEN, or PM_EMAIL + PM_PASSWORD.");
+    }
+    return { apiBaseUrl, firebaseApiKey, refreshToken, email, password };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkBA;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,yCAAyC,CAAC;AAE3E,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,8BAA8B,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvG,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,wBAAwB,CAAC;IACxF,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC;IAEtD,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACvE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadConfig } from "./config.js";
+import { TokenManager } from "./auth.js";
+import { PmClient } from "./pmClient.js";
+import { registerOrganizationTools } from "./tools/organizations.js";
+import { registerProfileTools } from "./tools/profiles.js";
+import { registerPlannerTools } from "./tools/planner.js";
+import { registerBillingTools } from "./tools/billing.js";
+async function main() {
+    const config = loadConfig();
+    const tokens = new TokenManager(config);
+    const client = new PmClient(config.apiBaseUrl, tokens);
+    const server = new McpServer({
+        name: "practicemakes-mcp",
+        version: "0.1.0",
+    });
+    registerOrganizationTools(server, client);
+    registerProfileTools(server, client);
+    registerPlannerTools(server, client);
+    registerBillingTools(server, client);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // stdout is the MCP transport; log to stderr only.
+    console.error(`practicemakes-mcp connected (base=${config.apiBaseUrl})`);
+}
+main().catch((err) => {
+    console.error("Fatal:", err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,mDAAmD;IACnD,OAAO,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/login.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/login.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * One-time helper for password accounts: exchange PM_EMAIL + PM_PASSWORD for a
+ * Firebase refresh token you can paste into FIREBASE_REFRESH_TOKEN.
+ *
+ * Run: npm run login   (loads .env)
+ *
+ * OAuth (Google/Apple) accounts have no password — grab a refresh token from the
+ * web app instead (see README).
+ */
+import { loadConfig } from "./config.js";
+import { signInWithPassword } from "./auth.js";
+async function main() {
+    const cfg = loadConfig();
+    if (!cfg.email || !cfg.password) {
+        throw new Error("Set PM_EMAIL and PM_PASSWORD in your .env to use `npm run login`.");
+    }
+    const { refreshToken } = await signInWithPassword(cfg.firebaseApiKey, cfg.email, cfg.password);
+    console.log("\nSuccess. Add this to your .env and remove PM_EMAIL / PM_PASSWORD:\n");
+    console.log(`FIREBASE_REFRESH_TOKEN=${refreshToken}\n`);
+}
+main().catch((err) => {
+    console.error("Login failed:", err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,0BAA0B,YAAY,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/pmClient.d.ts

@@ -0,0 +1,18 @@
+import type { TokenManager } from "./auth.js";
+/** Raised on any non-2xx response; carries status + body for surfacing to the tool caller. */
+export declare class PmApiError extends Error {
+    status: number;
+    bodyText: string;
+    method: string;
+    path: string;
+    constructor(status: number, bodyText: string, method: string, path: string);
+}
+/** Thin authenticated fetch wrapper over the PracticeMakes REST API. */
+export declare class PmClient {
+    private baseUrl;
+    private tokens;
+    constructor(baseUrl: string, tokens: TokenManager);
+    get(path: string): Promise<unknown>;
+    post(path: string, body: unknown): Promise<unknown>;
+    private request;
+}

package/dist/pmClient.js

@@ -0,0 +1,54 @@
+/** Abort an API request that hangs longer than this so a stuck backend can't wedge a tool call. */
+const REQUEST_TIMEOUT_MS = 15_000;
+/** Raised on any non-2xx response; carries status + body for surfacing to the tool caller. */
+export class PmApiError extends Error {
+    status;
+    bodyText;
+    method;
+    path;
+    constructor(status, bodyText, method, path) {
+        super(`${method} ${path} -> ${status}: ${bodyText.slice(0, 800)}`);
+        this.status = status;
+        this.bodyText = bodyText;
+        this.method = method;
+        this.path = path;
+        this.name = "PmApiError";
+    }
+}
+/** Thin authenticated fetch wrapper over the PracticeMakes REST API. */
+export class PmClient {
+    baseUrl;
+    tokens;
+    constructor(baseUrl, tokens) {
+        this.baseUrl = baseUrl;
+        this.tokens = tokens;
+    }
+    async get(path) {
+        return this.request("GET", path);
+    }
+    async post(path, body) {
+        return this.request("POST", path, body);
+    }
+    async request(method, path, body) {
+        const idToken = await this.tokens.getIdToken();
+        const res = await fetch(`${this.baseUrl}${path}`, {
+            method,
+            headers: {
+                Authorization: `Bearer ${idToken}`,
+                Accept: "application/json",
+                ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+            },
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            throw new PmApiError(res.status, text, method, path);
+        }
+        if (!text)
+            return null;
+        const contentType = res.headers.get("content-type") ?? "";
+        return contentType.includes("application/json") ? JSON.parse(text) : text;
+    }
+}
+//# sourceMappingURL=pmClient.js.map

package/dist/pmClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pmClient.js","sourceRoot":"","sources":["../src/pmClient.ts"],"names":[],"mappings":"AAEA,mGAAmG;AACnG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,8FAA8F;AAC9F,MAAM,OAAO,UAAW,SAAQ,KAAK;IAE1B;IACA;IACA;IACA;IAJT,YACS,MAAc,EACd,QAAgB,EAChB,MAAc,EACd,IAAY;QAEnB,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAL5D,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAGnB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,OAAO,QAAQ;IAET;IACA;IAFV,YACU,OAAe,EACf,MAAoB;QADpB,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAc;IAC3B,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,IAAc;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,EAAE;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE;YACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;CACF"}

package/dist/smoke.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/smoke.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+/**
+ * End-to-end smoke test: authenticate and hit a couple of read-only endpoints,
+ * printing what came back. Confirms the Firebase credential + backend authz work
+ * before wiring the server into Claude. Run: npm run smoke
+ */
+import { loadConfig } from "./config.js";
+import { TokenManager } from "./auth.js";
+import { PmClient } from "./pmClient.js";
+async function main() {
+    const config = loadConfig();
+    const client = new PmClient(config.apiBaseUrl, new TokenManager(config));
+    console.log(`Base URL: ${config.apiBaseUrl}\n`);
+    console.log("→ GET /api/profile (who am I?)");
+    const profile = (await client.get("/api/profile"));
+    console.log(`   ${profile?.emailAddress ?? profile?.email ?? "?"} — roles: ${JSON.stringify(profile?.roles ?? profile?.authorities ?? "?")}\n`);
+    console.log("→ GET /api/organization/all");
+    const orgs = (await client.get("/api/organization/all"));
+    console.log(`   ${Array.isArray(orgs) ? orgs.length : 0} organization(s) visible\n`);
+    console.log("→ GET /api/task (my Planner backlog)");
+    const tasks = (await client.get("/api/task"));
+    console.log(`   ${Array.isArray(tasks) ? tasks.length : 0} task(s)`);
+    if (Array.isArray(tasks)) {
+        for (const t of tasks.slice(0, 5))
+            console.log(`   - [${t.priorityValue ?? "?"}] ${t.name}`);
+    }
+    console.log("\n✓ Smoke test passed.");
+}
+main().catch((err) => {
+    console.error("\n✗ Smoke test failed:", err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=smoke.js.map

package/dist/smoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke.js","sourceRoot":"","sources":["../src/smoke.ts"],"names":[],"mappings":";AACA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAQ,CAAC;IAC1D,OAAO,CAAC,GAAG,CACT,MAAM,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,KAAK,IAAI,GAAG,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,WAAW,IAAI,GAAG,CAAC,IAAI,CACnI,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAU,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAErF,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAU,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,aAAa,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AACxC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tools/billing.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { PmClient } from "../pmClient.js";
+export declare function registerBillingTools(server: McpServer, client: PmClient): void;

package/dist/tools/billing.js

@@ -0,0 +1,9 @@
+import { runTool } from "./shared.js";
+export function registerBillingTools(server, client) {
+    server.registerTool("get_billing_config", {
+        title: "Get billing config",
+        description: "Fetch the billing/entitlement configuration for your current organization context (products, entitlements, plan state).",
+        inputSchema: {},
+    }, async () => runTool(() => client.get("/api/billing/config")));
+}
+//# sourceMappingURL=billing.js.map

package/dist/tools/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/tools/billing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAgB;IACtE,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,yHAAyH;QAC3H,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC"}

package/dist/tools/organizations.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { PmClient } from "../pmClient.js";
+export declare function registerOrganizationTools(server: McpServer, client: PmClient): void;

package/dist/tools/organizations.js

@@ -0,0 +1,17 @@
+import { z } from "zod";
+import { runTool } from "./shared.js";
+export function registerOrganizationTools(server, client) {
+    server.registerTool("list_organizations", {
+        title: "List organizations",
+        description: "List organizations visible to your identity. A SYSADMIN sees every organization on the platform; other users see only the orgs they belong to.",
+        inputSchema: {},
+    }, async () => runTool(() => client.get("/api/organization/all")));
+    server.registerTool("get_organization", {
+        title: "Get organization",
+        description: "Fetch a single organization by its UUID.",
+        inputSchema: {
+            organizationId: z.string().uuid().describe("Organization UUID"),
+        },
+    }, async ({ organizationId }) => runTool(() => client.get(`/api/organization/${organizationId}`)));
+}
+//# sourceMappingURL=organizations.js.map

package/dist/tools/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/tools/organizations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAgB;IAC3E,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,gJAAgJ;QAClJ,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAC/D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SAChE;KACF,EACD,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAC3B,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,cAAc,EAAE,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC"}

package/dist/tools/planner.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { PmClient } from "../pmClient.js";
+export declare function registerPlannerTools(server: McpServer, client: PmClient): void;

package/dist/tools/planner.js

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import { runTool } from "./shared.js";
+export function registerPlannerTools(server, client) {
+    server.registerTool("get_my_planner_tasks", {
+        title: "Get my Planner tasks",
+        description: "Your personal Planner backlog: active tasks for your profile in your current organization context, filtered to your enabled tags. Ordered by priorityValue (ascending = higher on the backlog). Status is derived from timestamps — completedAt/deletedAt/snoozeUntil being null means active. This is the list meant to drive development.",
+        inputSchema: {},
+    }, async () => runTool(() => client.get("/api/task")));
+    server.registerTool("search_tasks", {
+        title: "Search Planner tasks",
+        description: "Search your Planner tasks (Elasticsearch when available, otherwise your full task list). Use showFields to include normally-hidden tasks: pass any of 'completedAt', 'deletedAt', 'snoozeUntil' to reveal completed/deleted/snoozed tasks.",
+        inputSchema: {
+            searchTerm: z.string().default("").describe("Free-text query; empty returns your task list."),
+            selectedTags: z
+                .array(z.string())
+                .default([])
+                .describe("Tag IDs to filter by."),
+            showFields: z
+                .array(z.enum(["completedAt", "deletedAt", "snoozeUntil"]))
+                .default([])
+                .describe("Reveal otherwise-hidden tasks (completed/deleted/snoozed)."),
+            sortField: z.string().default("createdAt").describe("Field to sort by."),
+            sortDirection: z.enum(["Asc", "Desc"]).default("Desc").describe("Sort direction."),
+        },
+    }, async ({ searchTerm, selectedTags, showFields, sortField, sortDirection }) => runTool(() => client.post("/api/task/search", {
+        searchTerm,
+        filters: { showFields, selectedTags },
+        sort: { field: sortField, direction: sortDirection },
+    })));
+    server.registerTool("get_task", {
+        title: "Get Planner task",
+        description: "Fetch a single Planner task by UUID.",
+        inputSchema: {
+            taskId: z.string().uuid().describe("Task UUID"),
+        },
+    }, async ({ taskId }) => runTool(() => client.get(`/api/task/${taskId}`)));
+    server.registerTool("list_workflows", {
+        title: "List workflows",
+        description: "List your Planner workflows (reusable task templates that spawn tasks through steps).",
+        inputSchema: {},
+    }, async () => runTool(() => client.get("/api/workflow")));
+    server.registerTool("get_workflow", {
+        title: "Get workflow",
+        description: "Fetch a workflow by UUID, hydrated with its current run state: active tasks, pending/scheduled tasks, run events, and archived tasks.",
+        inputSchema: {
+            workflowId: z.string().uuid().describe("Workflow UUID"),
+        },
+    }, async ({ workflowId }) => runTool(() => client.get(`/api/workflow/${workflowId}`)));
+}
+//# sourceMappingURL=planner.js.map

package/dist/tools/planner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../src/tools/planner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAgB;IACtE,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,6UAA6U;QAC/U,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CACnD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,4OAA4O;QAC9O,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;YAC7F,YAAY,EAAE,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,uBAAuB,CAAC;YACpC,UAAU,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;iBAC1D,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,4DAA4D,CAAC;YACzE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACxE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SACnF;KACF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAC3E,OAAO,CAAC,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC9B,UAAU;QACV,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;QACrC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE;KACrD,CAAC,CACH,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,sCAAsC;QACnD,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;SAChD;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CACvE,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,uFAAuF;QACpG,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CACvD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,uIAAuI;QACzI,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;SACxD;KACF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAC,CACnF,CAAC;AACJ,CAAC"}

package/dist/tools/profiles.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { PmClient } from "../pmClient.js";
+export declare function registerProfileTools(server: McpServer, client: PmClient): void;

package/dist/tools/profiles.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { runTool } from "./shared.js";
+export function registerProfileTools(server, client) {
+    server.registerTool("get_my_profile", {
+        title: "Get my profile",
+        description: "Fetch the authenticated user's own profile, including computed entitlements, roles, current organization context, and account status.",
+        inputSchema: {},
+    }, async () => runTool(() => client.get("/api/profile")));
+    server.registerTool("list_profiles", {
+        title: "List profiles",
+        description: "List user profiles. A SYSADMIN sees all profiles across every org; an ADMIN sees profiles within their organization only.",
+        inputSchema: {},
+    }, async () => runTool(() => client.get("/api/profile/all")));
+    server.registerTool("get_profile", {
+        title: "Get profile",
+        description: "Fetch a single profile by UUID (includes computed entitlements/status). SYSADMIN can view any profile; ADMIN only within their org.",
+        inputSchema: {
+            profileId: z.string().uuid().describe("Profile UUID"),
+        },
+    }, async ({ profileId }) => runTool(() => client.get(`/api/profile/profile/${profileId}`)));
+}
+//# sourceMappingURL=profiles.js.map

package/dist/tools/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/tools/profiles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAgB;IACtE,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,uIAAuI;QACzI,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CACtD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,2HAA2H;QAC7H,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAC1D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,aAAa;QACpB,WAAW,EACT,qIAAqI;QACvI,WAAW,EAAE;YACX,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;SACtD;KACF,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC,CACxF,CAAC;AACJ,CAAC"}

package/dist/tools/shared.d.ts

@@ -0,0 +1,22 @@
+/** MCP tool result carrying pretty-printed JSON. */
+export declare function jsonResult(data: unknown): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+};
+/** MCP error result — surfaces HTTP status/body so the caller understands scope/auth failures. */
+export declare function errorResult(err: unknown): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+};
+/** Wraps a tool body so every tool reports errors uniformly instead of throwing. */
+export declare function runTool(fn: () => Promise<unknown>): Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+}>;

package/dist/tools/shared.js

@@ -0,0 +1,30 @@
+import { PmApiError } from "../pmClient.js";
+/** MCP tool result carrying pretty-printed JSON. */
+export function jsonResult(data) {
+    const text = typeof data === "string" ? data : JSON.stringify(data, null, 2);
+    return { content: [{ type: "text", text }] };
+}
+/** MCP error result — surfaces HTTP status/body so the caller understands scope/auth failures. */
+export function errorResult(err) {
+    let text;
+    if (err instanceof PmApiError) {
+        const hint = err.status === 401 || err.status === 403
+            ? " (your identity may lack the role/org access for this data)"
+            : "";
+        text = `PracticeMakes API error ${err.status}${hint}: ${err.bodyText.slice(0, 1000)}`;
+    }
+    else {
+        text = err instanceof Error ? err.message : String(err);
+    }
+    return { content: [{ type: "text", text }], isError: true };
+}
+/** Wraps a tool body so every tool reports errors uniformly instead of throwing. */
+export async function runTool(fn) {
+    try {
+        return jsonResult(await fn());
+    }
+    catch (err) {
+        return errorResult(err);
+    }
+}
+//# sourceMappingURL=shared.js.map

package/dist/tools/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/tools/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,oDAAoD;AACpD,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACtC,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,GAAG,2BAA2B,GAAG,CAAC,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;AAChF,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAA0B;IACtD,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@practicemakes/mcp",
+  "version": "26.710.3",
+  "description": "MCP server exposing PracticeMakes prod data (read-only) to Claude, authenticated as the calling user's own Firebase identity.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "practicemakes-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rimraf dist",
+    "clean-build": "yarn clean && yarn build",
+    "start": "node dist/index.js",
+    "smoke": "node --env-file=.env dist/smoke.js",
+    "login": "node --env-file=.env dist/login.js",
+    "prepublishOnly": "yarn clean && yarn build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "rimraf": "4.1.2",
+    "typescript": "6.0.3"
+  },
+  "engines": {
+    "node": ">=20.6.0"
+  }
+}