@practicemakes/mcp 26.823.1 → 26.823.2

package/README.md

@@ -55,7 +55,7 @@ Versioned on the monorepo's calendar scheme (`26.MMDD.patch`). Scoped public pac
 yarn workspace @practicemakes/mcp publish   # runs prepublishOnly (clean + build) first
 ```
 
-## Tools (v1, read-only)
+## Tools (read)
 
 | Tool | What it returns |
 |---|---|
@@ -69,7 +69,7 @@ yarn workspace @practicemakes/mcp publish   # runs prepublishOnly (clean + build
 | `get_task` | One task by UUID |
 | `list_workflows` | Your Planner workflows |
 | `get_workflow` | One workflow, hydrated with run state |
-| `get_billing_config` | Billing/entitlement config for your org |
+| `get_billing_config` | Billing/entitlement config for your org (takes a required `platform`) |
 | `list_servers` | Monitored servers + both identifiers the tools below need |
 | `get_server` | One server's config, including its maintenance windows |
 | `list_server_statuses` | Live status of **all** your servers (is anything down now) |
@@ -89,8 +89,43 @@ one returns a 404 that reads like a missing server. `list_servers` returns both:
 
 Neither is a UUID — `serverId` is the operator-assigned id (e.g. `web-01`).
 
+## Tools (write)
+
+Every write tool asks you to confirm the exact request before it sends anything.
+
+| Tool | What it does |
+|---|---|
+| `create_task` | Creates a Planner task in your current org context (needs ADMIN there) |
+| `complete_task` | Sets `completedAt` on a task — the tool that closes the Planner-driven-dev loop |
+| `switch_org_context` | Switches your active org context (SYSADMIN → any org, otherwise invite-only) |
+
+### Read this before enabling write tools
+
+**These tools run as you, with all of your permissions.** Authentication is a per-user Firebase
+ID token, not a service account — there is no read-only role, no separate service identity, and
+no server-side allow-list behind them. If your account is SYSADMIN, a write tool can write across
+every tenant on the platform. The tool list and the confirmation prompt are the entire safety
+boundary.
+
+**Confirmation needs client support.** The gate uses MCP *elicitation*. If your client did not
+advertise elicitation support during the handshake, there is no channel to ask you on, and every
+write tool **refuses and sends nothing** — it will not fall back to writing unconfirmed. The
+error names the mutation it declined to perform. This is deliberate: silently proceeding would
+disable the guardrail for exactly the clients that never agreed to be asked.
+
+**`switch_org_context` is session-global.** It mutates your profile, so it changes what *every
+later read tool* returns for the rest of the session — not just the next call.
+
+**`complete_task` is a read-modify-write.** There is no dedicated completion endpoint; the tool
+reads the task, sets `completedAt`, and re-posts it, carrying the read's `ETag` back as
+`If-Match` so a concurrent edit is not silently clobbered.
+
+`yarn smoke` is unaffected — it issues three fixed read-only requests and never touches the tool
+registry, so no write can reach production through it.
+
 ## Roadmap
 
-- **Write tools** (complete/create a task, switch org context, admin actions) with per-call confirmation.
+- **Admin actions** (e.g. the ARCH-153 org/user purge) — blocked: no executable endpoint exists
+  yet, only a `GET .../data-inventory` that reports what a purge *would* do and deletes nothing.
 - **OpenAPI-driven** tool generation from the backend's grouped specs (the monorepo already uses `openapi-typescript` in `packages/core`).
 - **Hosted remote server** (streamable-HTTP + per-user OAuth) so users connect to a URL with nothing to install.

package/dist/pmClient.d.ts

@@ -13,6 +13,18 @@ export declare class PmClient {
     private tokens;
     constructor(baseUrl: string, tokens: TokenManager);
     get(path: string): Promise<unknown>;
-    post(path: string, body: unknown): Promise<unknown>;
+    /**
+     * A GET that also surfaces the response's `ETag`.
+     *
+     * The concurrency token travels in headers only: the backend's `ConcurrencyGuard` documents
+     * that a body's `updatedAt` serializes at second precision and so cannot reproduce the
+     * millisecond token. A read-modify-write therefore has no other way to obtain the `If-Match`
+     * value it has to send back.
+     */
+    getWithEtag(path: string): Promise<{
+        data: unknown;
+        etag: string | null;
+    }>;
+    post(path: string, body?: unknown, headers?: Record<string, string>): Promise<unknown>;
     private request;
 }

package/dist/pmClient.js

@@ -24,12 +24,23 @@ export class PmClient {
         this.tokens = tokens;
     }
     async get(path) {
+        return (await this.request("GET", path)).data;
+    }
+    /**
+     * A GET that also surfaces the response's `ETag`.
+     *
+     * The concurrency token travels in headers only: the backend's `ConcurrencyGuard` documents
+     * that a body's `updatedAt` serializes at second precision and so cannot reproduce the
+     * millisecond token. A read-modify-write therefore has no other way to obtain the `If-Match`
+     * value it has to send back.
+     */
+    async getWithEtag(path) {
         return this.request("GET", path);
     }
-    async post(path, body) {
-        return this.request("POST", path, body);
+    async post(path, body, headers) {
+        return (await this.request("POST", path, body, headers)).data;
     }
-    async request(method, path, body) {
+    async request(method, path, body, headers) {
         const idToken = await this.tokens.getIdToken();
         const res = await fetch(`${this.baseUrl}${path}`, {
             method,
@@ -37,6 +48,7 @@ export class PmClient {
                 Authorization: `Bearer ${idToken}`,
                 Accept: "application/json",
                 ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+                ...(headers ?? {}),
             },
             body: body !== undefined ? JSON.stringify(body) : undefined,
             signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -45,10 +57,14 @@ export class PmClient {
         if (!res.ok) {
             throw new PmApiError(res.status, text, method, path);
         }
+        const etag = res.headers.get("etag");
         if (!text)
-            return null;
+            return { data: null, etag };
         const contentType = res.headers.get("content-type") ?? "";
-        return contentType.includes("application/json") ? JSON.parse(text) : text;
+        return {
+            data: contentType.includes("application/json") ? JSON.parse(text) : text,
+            etag,
+        };
     }
 }
 //# sourceMappingURL=pmClient.js.map

package/dist/pmClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"pmClient.js","sourceRoot":"","sources":["../src/pmClient.ts"],"names":[],"mappings":"AAEA,mGAAmG;AACnG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,8FAA8F;AAC9F,MAAM,OAAO,UAAW,SAAQ,KAAK;IAE1B;IACA;IACA;IACA;IAJT,YACS,MAAc,EACd,QAAgB,EAChB,MAAc,EACd,IAAY;QAEnB,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAL5D,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAGnB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,OAAO,QAAQ;IAET;IACA;IAFV,YACU,OAAe,EACf,MAAoB;QADpB,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAc;IAC3B,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,IAAc;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,EAAE;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE;YACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;CACF"}
+{"version":3,"file":"pmClient.js","sourceRoot":"","sources":["../src/pmClient.ts"],"names":[],"mappings":"AAEA,mGAAmG;AACnG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,8FAA8F;AAC9F,MAAM,OAAO,UAAW,SAAQ,KAAK;IAE1B;IACA;IACA;IACA;IAJT,YACS,MAAc,EACd,QAAgB,EAChB,MAAc,EACd,IAAY;QAEnB,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAL5D,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAGnB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,OAAO,QAAQ;IAET;IACA;IAFV,YACU,OAAe,EACf,MAAoB;QADpB,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAc;IAC3B,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAc,EAAE,OAAgC;QACvE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,OAAgC;QAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,EAAE;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;aACnB;YACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACxE,IAAI;SACL,CAAC;IACJ,CAAC;CACF"}

package/dist/tools/billing.js

@@ -1,9 +1,27 @@
+import { z } from "zod";
 import { runTool } from "./shared.js";
 export function registerBillingTools(server, client) {
     server.registerTool("get_billing_config", {
         title: "Get billing config",
-        description: "Fetch the billing/entitlement configuration for your current organization context (products, entitlements, plan state).",
-        inputSchema: {},
-    }, async () => runTool(() => client.get("/api/billing/config")));
+        description: "Fetch the billing/entitlement configuration for your current organization context (products, entitlements, plan state). Billing config is per-platform, so the platform must be named.",
+        inputSchema: {
+            // `platform` is a REQUIRED query param on GET /api/billing/config (operation
+            // `getConfig` in the committed spec). This tool used to declare no inputs and call
+            // the bare path, so every call was malformed.
+            platform: z
+                .string()
+                .min(1)
+                .describe("Store platform the config is for, e.g. 'ios', 'android', 'web'."),
+            useTestStore: z
+                .boolean()
+                .optional()
+                .describe("Read the store's sandbox/test catalogue instead of production."),
+        },
+    }, async ({ platform, useTestStore }) => {
+        const query = new URLSearchParams({ platform });
+        if (useTestStore !== undefined)
+            query.set("useTestStore", String(useTestStore));
+        return runTool(() => client.get(`/api/billing/config?${query.toString()}`));
+    });
 }
 //# sourceMappingURL=billing.js.map

package/dist/tools/billing.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/tools/billing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAgB;IACtE,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,yHAAyH;QAC3H,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../src/tools/billing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAgB;IACtE,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,wLAAwL;QAC1L,WAAW,EAAE;YACX,6EAA6E;YAC7E,mFAAmF;YACnF,8CAA8C;YAC9C,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,YAAY,EAAE,CAAC;iBACZ,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,gEAAgE,CAAC;SAC9E;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChD,IAAI,YAAY,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/confirm.d.ts

@@ -0,0 +1,25 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** The mutation a write tool intends to perform, rendered for a human to accept or reject. */
+export interface WriteIntent {
+    /** Imperative one-liner, e.g. `Complete Planner task "Ship ARCH-173"`. */
+    summary: string;
+    /** The exact request issued on accept — this is what the human is agreeing to. */
+    request: {
+        method: "POST";
+        path: string;
+        body?: unknown;
+    };
+}
+/**
+ * Runs [perform] only after the human accepts [buildIntent]'s description of it.
+ *
+ * When the client cannot be asked, the write is refused rather than performed. That is the
+ * deliberate call: the alternative — proceeding unconfirmed — turns the ticket's one hard
+ * requirement off for exactly the clients that never opted into being asked.
+ */
+export declare function withConfirmation(server: McpServer, toolName: string, buildIntent: () => WriteIntent | Promise<WriteIntent>, perform: (intent: WriteIntent) => Promise<unknown>): Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+}>;

package/dist/tools/confirm.js

@@ -0,0 +1,69 @@
+import { errorResult, jsonResult, runTool } from "./shared.js";
+/**
+ * Per-call confirmation for write tools (ARCH-173).
+ *
+ * Why this exists at all: authentication is a per-user Firebase ID token, not a service
+ * account, so a write tool inherits everything the connected human can do — up to
+ * cross-tenant SYSADMIN. There is no read-only role and no server-side allow-list behind
+ * this. The tool list plus this gate are the entire safety boundary.
+ */
+/** How much of a request body to show in the prompt before truncating. */
+const MAX_BODY_PREVIEW = 1200;
+/**
+ * The SDK gates `elicitInput` on `elicitation.form` and *throws* when it is absent
+ * (`server/index.js`: "Client does not support form elicitation"). It does not silently
+ * no-op. Reading the same flag first lets the refusal name the write that was blocked
+ * instead of surfacing a bare SDK message.
+ */
+function supportsFormElicitation(server) {
+    const elicitation = server.server.getClientCapabilities()?.elicitation;
+    return Boolean(elicitation?.form);
+}
+function renderRequest(intent) {
+    const line = `${intent.request.method} ${intent.request.path}`;
+    if (intent.request.body === undefined)
+        return line;
+    const body = JSON.stringify(intent.request.body, null, 2);
+    const shown = body.length > MAX_BODY_PREVIEW ? `${body.slice(0, MAX_BODY_PREVIEW)}\n… (truncated)` : body;
+    return `${line}\n${shown}`;
+}
+/**
+ * Runs [perform] only after the human accepts [buildIntent]'s description of it.
+ *
+ * When the client cannot be asked, the write is refused rather than performed. That is the
+ * deliberate call: the alternative — proceeding unconfirmed — turns the ticket's one hard
+ * requirement off for exactly the clients that never opted into being asked.
+ */
+export async function withConfirmation(server, toolName, buildIntent, perform) {
+    let intent;
+    try {
+        intent = await buildIntent();
+    }
+    catch (err) {
+        return errorResult(err);
+    }
+    if (!supportsFormElicitation(server)) {
+        return errorResult(new Error(`${toolName} performs a write and requires per-call confirmation, but this MCP client ` +
+            `did not advertise elicitation support, so there is no way to ask you.\n\n` +
+            `Intended mutation:\n${intent.summary}\n${renderRequest(intent)}\n\n` +
+            `No request was sent.`));
+    }
+    let outcome;
+    try {
+        outcome = await server.server.elicitInput({
+            message: `${toolName} wants to write to PracticeMakes.\n\n` +
+                `${intent.summary}\n\n${renderRequest(intent)}\n\n` +
+                `This runs as your own account, with your own permissions. Approve?`,
+            requestedSchema: { type: "object", properties: {} },
+        });
+    }
+    catch (err) {
+        // Transport/protocol failure while asking. Nothing was sent, and it must stay that way.
+        return errorResult(err);
+    }
+    if (outcome.action !== "accept") {
+        return jsonResult(`${toolName}: ${outcome.action} — no request was sent.`);
+    }
+    return runTool(() => perform(intent));
+}
+//# sourceMappingURL=confirm.js.map

package/dist/tools/confirm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm.js","sourceRoot":"","sources":["../../src/tools/confirm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/D;;;;;;;GAOG;AAEH,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAU9B;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,MAAiB;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAE9C,CAAC;IACd,OAAO,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACxC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GACT,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,OAAO,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAiB,EACjB,QAAgB,EAChB,WAAqD,EACrD,OAAkD;IAElD,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,WAAW,CAChB,IAAI,KAAK,CACP,GAAG,QAAQ,4EAA4E;YACrF,2EAA2E;YAC3E,uBAAuB,MAAM,CAAC,OAAO,KAAK,aAAa,CAAC,MAAM,CAAC,MAAM;YACrE,sBAAsB,CACzB,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;YACxC,OAAO,EACL,GAAG,QAAQ,uCAAuC;gBAClD,GAAG,MAAM,CAAC,OAAO,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM;gBACnD,oEAAoE;YACtE,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wFAAwF;QACxF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,GAAG,QAAQ,KAAK,OAAO,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/tools/organizations.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { withConfirmation } from "./confirm.js";
 import { runTool } from "./shared.js";
 export function registerOrganizationTools(server, client) {
     server.registerTool("list_organizations", {
@@ -13,5 +14,17 @@ export function registerOrganizationTools(server, client) {
             organizationId: z.string().uuid().describe("Organization UUID"),
         },
     }, async ({ organizationId }) => runTool(() => client.get(`/api/organization/${organizationId}`)));
+    server.registerTool("switch_org_context", {
+        title: "Switch organization context",
+        description: "Switch your active organization context. WRITE: this mutates your profile, so it changes what EVERY subsequent read tool returns for the rest of the session, not just the next call. Prompts you for confirmation before sending. A SYSADMIN can switch into any organization; everyone else needs an invite to the target.",
+        inputSchema: {
+            organizationId: z.string().uuid().describe("Organization UUID to switch into"),
+        },
+    }, async ({ organizationId }) => withConfirmation(server, "switch_org_context", () => ({
+        summary: `Switch your active organization context to ${organizationId}. ` +
+            `Every later read tool in this session will return that org's data.`,
+        // The endpoint takes no request body — the id is the path variable.
+        request: { method: "POST", path: `/api/organization/context/${organizationId}` },
+    }), () => client.post(`/api/organization/context/${organizationId}`)));
 }
 //# sourceMappingURL=organizations.js.map

package/dist/tools/organizations.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/tools/organizations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAgB;IAC3E,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,gJAAgJ;QAClJ,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAC/D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SAChE;KACF,EACD,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAC3B,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,cAAc,EAAE,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/tools/organizations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAgB;IAC3E,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,gJAAgJ;QAClJ,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAC/D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,0CAA0C;QACvD,WAAW,EAAE;YACX,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SAChE;KACF,EACD,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAC3B,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,cAAc,EAAE,CAAC,CAAC,CACnE,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,8TAA8T;QAChU,WAAW,EAAE;YACX,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;SAC/E;KACF,EACD,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAC3B,gBAAgB,CACd,MAAM,EACN,oBAAoB,EACpB,GAAG,EAAE,CAAC,CAAC;QACL,OAAO,EACL,8CAA8C,cAAc,IAAI;YAChE,oEAAoE;QACtE,oEAAoE;QACpE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,cAAc,EAAE,EAAE;KACjF,CAAC,EACF,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,cAAc,EAAE,CAAC,CACjE,CACJ,CAAC;AACJ,CAAC"}

package/dist/tools/planner.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
-import { runTool } from "./shared.js";
+import { withConfirmation } from "./confirm.js";
+import { errorResult, jsonResult, runTool } from "./shared.js";
 export function registerPlannerTools(server, client) {
     server.registerTool("get_my_planner_tasks", {
         title: "Get my Planner tasks",
@@ -46,5 +47,85 @@ export function registerPlannerTools(server, client) {
             workflowId: z.string().uuid().describe("Workflow UUID"),
         },
     }, async ({ workflowId }) => runTool(() => client.get(`/api/workflow/${workflowId}`)));
+    server.registerTool("create_task", {
+        title: "Create Planner task",
+        description: "Create a new Planner task in your current organization context. WRITE: prompts you for confirmation before sending, and runs as your own account with your own permissions. Requires ADMIN in the active org context.",
+        inputSchema: {
+            name: z.string().min(1).describe("Task name — what the task is."),
+            dueAt: z
+                .string()
+                .datetime()
+                .optional()
+                .describe("ISO-8601 due timestamp, e.g. 2026-09-01T17:00:00Z."),
+            priorityValue: z
+                .number()
+                .int()
+                .optional()
+                .describe("Backlog priority; ascending, so a lower value sorts higher."),
+            durationEstimate: z.number().int().optional().describe("Estimated duration, in minutes."),
+            requiresCompletion: z
+                .boolean()
+                .optional()
+                .describe("Whether the task must be completed rather than expiring."),
+        },
+    }, async ({ name, dueAt, priorityValue, durationEstimate, requiresCompletion }) => {
+        // `tags` and `taskLinks` are non-nullable on the Task schema, so a create has to send
+        // them even when empty; omitting them fails validation before it reaches the funnel.
+        const body = {
+            name,
+            tags: [],
+            taskLinks: [],
+            ...(dueAt !== undefined ? { dueAt } : {}),
+            ...(priorityValue !== undefined ? { priorityValue } : {}),
+            ...(durationEstimate !== undefined ? { durationEstimate } : {}),
+            ...(requiresCompletion !== undefined ? { requiresCompletion } : {}),
+        };
+        return withConfirmation(server, "create_task", () => ({
+            summary: `Create Planner task "${name}" in your current organization context.`,
+            request: { method: "POST", path: "/api/task", body },
+        }), 
+        // A create has no prior version, so the backend does not consult If-Match here.
+        () => client.post("/api/task", body));
+    });
+    server.registerTool("complete_task", {
+        title: "Complete Planner task",
+        description: "Mark a Planner task complete by setting its completedAt. This is the tool that closes the Planner-driven-dev loop. WRITE: prompts you for confirmation before sending, and runs as your own account with your own permissions.",
+        inputSchema: {
+            taskId: z.string().uuid().describe("Task UUID"),
+        },
+    }, async ({ taskId }) => {
+        // Completion is a read-modify-write over POST /api/task — there is no dedicated
+        // complete endpoint. The ETag from this read is the If-Match token for the write.
+        let fetched;
+        try {
+            fetched = await client.getWithEtag(`/api/task/${taskId}`);
+        }
+        catch (err) {
+            return errorResult(err);
+        }
+        const task = fetched.data;
+        if (!task) {
+            return errorResult(new Error(`Task ${taskId} was not found.`));
+        }
+        if (task.completedAt) {
+            // Nothing to change: re-posting would spend a confirmation to rewrite the same row.
+            return jsonResult(`Task ${taskId} is already complete (completedAt ${String(task.completedAt)}). No write needed.`);
+        }
+        // Echo the whole read back rather than patching {id, completedAt}. POST /api/task is a
+        // full-representation update: SafeWriteService copies every field on its writable list
+        // across unconditionally, so anything omitted here is blanked on the stored row — and
+        // requireClearingWasRequested rejects a body that drops a non-empty collection outright
+        // rather than silently detaching it (ARCH-416). The server-managed fields that ride along
+        // are inert: `id` is what routes this to an update instead of a create, and the rest are
+        // absent from the writable list, so the funnel ignores them.
+        const body = { ...task, completedAt: new Date().toISOString() };
+        return withConfirmation(server, "complete_task", () => ({
+            summary: `Complete Planner task "${String(task.name ?? taskId)}".`,
+            request: { method: "POST", path: "/api/task", body },
+        }), () => client.post("/api/task", body, 
+        // Without this the backend's ConcurrencyGuard records a MISSING_TOKEN stale
+        // write to Sentry on every call, and would reject it once enforcement is on.
+        fetched.etag ? { "If-Match": fetched.etag } : undefined));
+    });
 }
 //# sourceMappingURL=planner.js.map

package/dist/tools/planner.js.map

@@ -1 +1 @@
-{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../src/tools/planner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAgB;IACtE,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,6UAA6U;QAC/U,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CACnD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,4OAA4O;QAC9O,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;YAC7F,YAAY,EAAE,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,uBAAuB,CAAC;YACpC,UAAU,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;iBAC1D,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,4DAA4D,CAAC;YACzE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACxE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SACnF;KACF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAC3E,OAAO,CAAC,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC9B,UAAU;QACV,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;QACrC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE;KACrD,CAAC,CACH,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,sCAAsC;QACnD,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;SAChD;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CACvE,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,uFAAuF;QACpG,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CACvD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,uIAAuI;QACzI,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;SACxD;KACF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAC,CACnF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../src/tools/planner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAgB;IACtE,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,6UAA6U;QAC/U,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CACnD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,4OAA4O;QAC9O,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;YAC7F,YAAY,EAAE,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,uBAAuB,CAAC;YACpC,UAAU,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;iBAC1D,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,4DAA4D,CAAC;YACzE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACxE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;SACnF;KACF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAC3E,OAAO,CAAC,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC9B,UAAU;QACV,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;QACrC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE;KACrD,CAAC,CACH,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,sCAAsC;QACnD,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;SAChD;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CACvE,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,uFAAuF;QACpG,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CACvD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,uIAAuI;QACzI,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;SACxD;KACF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAC,CACnF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,uNAAuN;QACzN,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YACjE,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,oDAAoD,CAAC;YACjE,aAAa,EAAE,CAAC;iBACb,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,CAAC,6DAA6D,CAAC;YAC1E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACzF,kBAAkB,EAAE,CAAC;iBAClB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,0DAA0D,CAAC;SACxE;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAC7E,sFAAsF;QACtF,qFAAqF;QACrF,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,IAAI,EAAE,EAAE;YACR,SAAS,EAAE,EAAE;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;QAEF,OAAO,gBAAgB,CACrB,MAAM,EACN,aAAa,EACb,GAAG,EAAE,CAAC,CAAC;YACL,OAAO,EAAE,wBAAwB,IAAI,yCAAyC;YAC9E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;SACrD,CAAC;QACF,gFAAgF;QAChF,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CACrC,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,gOAAgO;QAClO,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;SAChD;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,gFAAgF;QAChF,kFAAkF;QAClF,IAAI,OAA+C,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAsC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,MAAM,iBAAiB,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,oFAAoF;YACpF,OAAO,UAAU,CACf,QAAQ,MAAM,qCAAqC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,qBAAqB,CACjG,CAAC;QACJ,CAAC;QAED,uFAAuF;QACvF,uFAAuF;QACvF,sFAAsF;QACtF,wFAAwF;QACxF,0FAA0F;QAC1F,yFAAyF;QACzF,6DAA6D;QAC7D,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAEhE,OAAO,gBAAgB,CACrB,MAAM,EACN,eAAe,EACf,GAAG,EAAE,CAAC,CAAC;YACL,OAAO,EAAE,0BAA0B,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;YAClE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;SACrD,CAAC,EACF,GAAG,EAAE,CACH,MAAM,CAAC,IAAI,CACT,WAAW,EACX,IAAI;QACJ,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CACxD,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@practicemakes/mcp",
-  "version": "26.823.1",
+  "version": "26.823.2",
   "description": "MCP server exposing PracticeMakes prod data (read-only) to Claude, authenticated as the calling user's own Firebase identity.",
   "license": "UNLICENSED",
   "type": "module",