@starasia/task-management-mcp 1.0.0

package/README.md

@@ -0,0 +1,230 @@
+# Task Management MCP
+
+MCP server for Star Perkasa Technology Task Management API.
+
+The server exposes read tools, dry-run-first write tools, and monitoring/reporting tools for spaces, projects, and tasks. It does **not** store a global user token in environment variables. Authorization is session-based: the AI agent must ask the active user for their bearer token, user id, and organization id, then call `set_auth_context` before using task tools.
+
+## Requirements
+
+- Node.js 20+
+- Running `task-management-api`
+- A user-provided auth context at runtime:
+  - bearer token
+  - user id
+  - organization id
+
+## Package
+
+Published package name:
+
+```text
+@starasia/task-management-mcp
+```
+
+Install from npm after a release lands on `main`:
+
+```bash
+npm install -g @starasia/task-management-mcp
+```
+
+## Install from source
+
+```bash
+npm install
+npm run build
+```
+
+## Runtime configuration
+
+Only non-user runtime settings should be configured as environment variables:
+
+```text
+TASK_MANAGEMENT_API_BASE_URL=http://localhost:3000
+TASK_MANAGEMENT_TIMEOUT_MS=30000
+TASK_MANAGEMENT_MAX_BULK_SIZE=50
+TASK_MANAGEMENT_AUTH_TTL_MS=28800000
+```
+
+Do **not** configure these as server env values:
+
+```text
+TASK_MANAGEMENT_API_TOKEN
+TASK_MANAGEMENT_USER_ID
+TASK_MANAGEMENT_ORGANIZATION_ID
+```
+
+Those values are user identity and permission context. The AI agent must request them from the user at runtime and call `set_auth_context`. `userId` is derived from the bearer token JWT `sub` claim, so it should not be configured as a server env value.
+
+## Hermes stdio config
+
+```yaml
+mcp_servers:
+  task_management_dev:
+    command: "npx"
+    args: ["-y", "@starasia/task-management-mcp"]
+    env:
+      TASK_MANAGEMENT_API_BASE_URL: "https://dev-task-management-api.example.com"
+
+  task_management_prod:
+    command: "npx"
+    args: ["-y", "@starasia/task-management-mcp"]
+    env:
+      TASK_MANAGEMENT_API_BASE_URL: "https://task-management-api.example.com"
+```
+
+With two MCP instances, tools are clearly separated by environment. The exact rendered tool names depend on the host. Hermes usually prefixes them by server name; Claude Code and Codex use their own MCP tool naming conventions.
+
+## Claude Code / Codex MCP config
+
+Use the same stdio command shape. Example:
+
+```json
+{
+  "mcpServers": {
+    "task-management-dev": {
+      "command": "npx",
+      "args": ["-y", "@starasia/task-management-mcp"],
+      "env": {
+        "TASK_MANAGEMENT_API_BASE_URL": "https://dev-task-management-api.example.com"
+      }
+    },
+    "task-management-prod": {
+      "command": "npx",
+      "args": ["-y", "@starasia/task-management-mcp"],
+      "env": {
+        "TASK_MANAGEMENT_API_BASE_URL": "https://task-management-api.example.com"
+      }
+    }
+  }
+}
+```
+
+## Auth flow for AI agents
+
+Before calling any task/space/project tool, the agent should:
+
+1. Call `get_auth_context_status`.
+2. If `configured` is false, ask the active user for:
+   - bearer token
+   - organization id
+3. Call `set_auth_context`:
+
+```json
+{
+  "bearerToken": "user-supplied-jwt-access-token",
+  "organizationId": "organization-id",
+  "environment": "dev",
+  "validate": true
+}
+```
+
+`set_auth_context` decodes the bearer token JWT payload and uses the `sub` claim as `userId`. If the token is not a JWT or does not contain a string `sub`, pass `userId` explicitly as an override:
+
+```json
+{
+  "bearerToken": "user-supplied-token",
+  "userId": "explicit-user-id",
+  "organizationId": "organization-id",
+  "validate": true
+}
+```
+
+`set_auth_context` validates the token with `GET /spaces` by default, stores the context only in the MCP process memory, and returns a masked status. It never returns the token. The context expires after `TASK_MANAGEMENT_AUTH_TTL_MS` milliseconds, default 8 hours.
+
+Important security note: for broad Claude Code / Codex compatibility, the bearer token is passed as a tool argument. That means it may transit the host application's conversation or debug surface before it reaches the MCP. Users should only provide tokens in trusted local agent sessions, prefer short-lived tokens, and call `clear_auth_context` when done.
+
+For separate dev/prod MCP instances, call `set_auth_context` separately on each instance because each process has its own in-memory session.
+
+When the user is done, call:
+
+```text
+clear_auth_context
+```
+
+If a tool is called before auth is configured, the MCP returns an error instructing the agent to ask the user for bearer token and organization id, then call `set_auth_context`. `userId` is derived from the token JWT `sub` claim unless an explicit override is provided.
+
+## Tools
+
+### Auth/session
+
+- `set_auth_context`
+- `get_auth_context_status`
+- `clear_auth_context`
+
+### Read-only
+
+- `list_spaces`
+- `list_projects`
+- `get_project`
+- `list_statuses`
+- `list_project_members`
+- `list_tasks`
+- `get_task`
+- `summarize_my_tasks`
+- `summarize_project_progress`
+
+### Write tools
+
+Write tools default to `dryRun: true`. Set `dryRun: false` to execute.
+
+- `create_task`
+- `bulk_create_tasks`
+- `update_task`
+- `change_task_status`
+- `assign_task` — add assignees using numeric `ProjectMember.id` values
+- `unassign_task` — remove one assignee using numeric `ProjectMember.id`
+- `replace_task_assignees` — make the assignee set exactly match the provided `projectMemberIds`
+
+`create_task.createdBy`, `assign_task.assignedBy`, and `replace_task_assignees.assignedBy` default to the active auth `userId` when omitted.
+
+### Monitoring/reporting
+
+- `monitor_overdue_tasks`
+- `monitor_stale_tasks`
+- `workload_by_user`
+- `generate_work_report`
+
+## API assumptions found from `task-management-api`
+
+- Spaces are exposed at `GET /spaces`.
+- Projects are scoped by space: `/spaces/:spaceId/projects`.
+- Tasks are scoped by project: `/projects/:projectId/tasks`.
+- Cross-project task list is `GET /my-tasks` with `scope=me|all`.
+- The MCP forwards `Authorization`, `X-User-Id`, and `X-Organization-Id` from the active auth context.
+- Task creation currently requires `createdBy`; assignment uses numeric `ProjectMember.id` values.
+
+## Safety model
+
+- User identity and bearer token are supplied at runtime, not baked into env.
+- Auth context is held in process memory only and expires by `TASK_MANAGEMENT_AUTH_TTL_MS`.
+- `get_auth_context_status` masks the token and only returns `hasToken: true/false`.
+- The API URL cannot be overridden by `set_auth_context`; it comes from the MCP instance env to avoid bearer-token exfiltration to arbitrary hosts.
+- For compatibility with Claude Code and Codex, the token is passed through the MCP tool call surface. Use trusted local sessions and short-lived tokens where possible.
+- Read tools require an active auth context.
+- Write tools are dry-run by default.
+- Bulk create has a configurable limit (`TASK_MANAGEMENT_MAX_BULK_SIZE`, default 50).
+- `bulk_create_tasks` can skip existing tasks by exact normalized title (`idempotency: "title"`).
+- The MCP does not bypass application permissions; it only calls HTTP endpoints with the active user's auth context.
+
+## Development
+
+```bash
+npm run typecheck
+npm run lint
+npm test
+npm run build
+npm run pack:check
+```
+
+## CI/CD
+
+- `CI` runs on pull requests to `main`/`dev`, pushes to `dev`, and manual dispatch.
+- `CI` uses GitHub Environment `development` for Discord notification only.
+- `Release and Notify` runs on pushes to `main` and manual dispatch.
+- Release workflow validates typecheck, lint, test, build, and `npm pack --dry-run` before publishing.
+- Publish is skipped when the package version already exists on npm.
+- Required development secrets:
+  - `DISCORD_WEBHOOK_URL`
+- Required production secrets:
+  - `NPM_TOKEN`
+  - `DISCORD_WEBHOOK_URL` (notification)

package/dist/api.d.ts

@@ -0,0 +1,37 @@
+import type { RuntimeConfig } from "./config.js";
+import type { PaginationMeta } from "./types.js";
+export interface RequestContext {
+    userId: string;
+    organizationId: string;
+    bearerToken: string;
+}
+export declare class TaskManagementApiError extends Error {
+    readonly status: number;
+    readonly payload: unknown;
+    constructor(message: string, status: number, payload: unknown);
+}
+export declare class TaskManagementApi {
+    private readonly config;
+    constructor(config: RuntimeConfig);
+    get<T>(path: string, query?: Record<string, unknown>, context?: RequestContext): Promise<{
+        data: T;
+        meta?: PaginationMeta;
+        message?: string;
+    }>;
+    post<T>(path: string, body?: unknown, query?: Record<string, unknown>, context?: RequestContext): Promise<{
+        data: T;
+        meta?: PaginationMeta;
+        message?: string;
+    }>;
+    put<T>(path: string, body?: unknown, query?: Record<string, unknown>, context?: RequestContext): Promise<{
+        data: T;
+        meta?: PaginationMeta;
+        message?: string;
+    }>;
+    delete<T>(path: string, body?: unknown, query?: Record<string, unknown>, context?: RequestContext): Promise<{
+        data: T;
+        meta?: PaginationMeta;
+        message?: string;
+    }>;
+    private request;
+}

package/dist/api.js

@@ -0,0 +1,124 @@
+export class TaskManagementApiError extends Error {
+    status;
+    payload;
+    constructor(message, status, payload) {
+        super(message);
+        this.status = status;
+        this.payload = payload;
+        this.name = "TaskManagementApiError";
+    }
+}
+function normalizeBearerToken(token) {
+    const trimmed = token.trim();
+    if (!trimmed)
+        throw new Error("Bearer token cannot be empty.");
+    if (/[\r\n]/.test(trimmed)) {
+        throw new Error("Bearer token cannot contain newline characters.");
+    }
+    return trimmed.toLowerCase().startsWith("bearer ")
+        ? trimmed
+        : `Bearer ${trimmed}`;
+}
+export class TaskManagementApi {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async get(path, query, context) {
+        return this.request("GET", path, undefined, query, context);
+    }
+    async post(path, body, query, context) {
+        return this.request("POST", path, body, query, context);
+    }
+    async put(path, body, query, context) {
+        return this.request("PUT", path, body, query, context);
+    }
+    async delete(path, body, query, context) {
+        return this.request("DELETE", path, body, query, context);
+    }
+    async request(method, path, body, query, context) {
+        if (!context?.bearerToken || !context.userId || !context.organizationId) {
+            throw new Error("Authentication context is not configured. Ask the user for bearerToken and organizationId, then call set_auth_context first. userId is derived from the token JWT sub claim unless explicitly provided.");
+        }
+        const url = new URL(path, this.config.TASK_MANAGEMENT_API_BASE_URL.replace(/\/$/, "") + "/");
+        for (const [key, value] of Object.entries(query ?? {})) {
+            if (value === undefined || value === null || value === "")
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value)
+                    url.searchParams.append(key, String(item));
+            }
+            else {
+                url.searchParams.set(key, String(value));
+            }
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.config.TASK_MANAGEMENT_TIMEOUT_MS);
+        try {
+            const headers = {
+                Accept: "application/json",
+                "X-Organization-Id": context.organizationId,
+                "X-User-Id": context.userId,
+                Authorization: normalizeBearerToken(context.bearerToken),
+            };
+            if (body !== undefined)
+                headers["Content-Type"] = "application/json";
+            const response = await fetch(url, {
+                method,
+                headers,
+                body: body === undefined ? undefined : JSON.stringify(body),
+                signal: controller.signal,
+            });
+            const text = await response.text();
+            const payload = parsePayload(text);
+            if (!response.ok) {
+                throw new TaskManagementApiError(extractErrorMessage(payload, response.statusText), response.status, payload);
+            }
+            if (isEnvelope(payload)) {
+                return {
+                    data: payload.data,
+                    meta: payload.meta,
+                    message: payload.message,
+                };
+            }
+            return { data: payload };
+        }
+        catch (error) {
+            if (error instanceof TaskManagementApiError)
+                throw error;
+            if (error instanceof Error && error.name === "AbortError") {
+                throw new TaskManagementApiError("Task management API request timed out", 408, undefined);
+            }
+            throw error;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+function isEnvelope(payload) {
+    return Boolean(payload &&
+        typeof payload === "object" &&
+        "status" in payload &&
+        "message" in payload &&
+        "data" in payload);
+}
+function parsePayload(text) {
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { message: text };
+    }
+}
+function extractErrorMessage(payload, fallback) {
+    if (payload &&
+        typeof payload === "object" &&
+        "message" in payload &&
+        typeof payload.message === "string")
+        return payload.message;
+    return fallback;
+}
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGpC;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,OAAgB;QAEzB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAS;QAGzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAChD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,KAA+B,EAC/B,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,IAAY,EACZ,IAAc,EACd,KAA+B,EAC/B,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,IAAc,EACd,KAA+B,EAC/B,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAY,EACZ,IAAc,EACd,KAA+B,EAC/B,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,KAA+B,EAC/B,OAAwB;QAExB,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,yMAAyM,CAC1M,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,IAAI,EACJ,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAClE,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,IAAI,IAAI,KAAK;oBAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,MAAM,CAAC,0BAA0B,CACvC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,MAAM,EAAE,kBAAkB;gBAC1B,mBAAmB,EAAE,OAAO,CAAC,cAAc;gBAC3C,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,aAAa,EAAE,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC;aACzD,CAAC;YACF,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAErE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,sBAAsB,CAC9B,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EACjD,QAAQ,CAAC,MAAM,EACf,OAAO,CACR,CAAC;YACJ,CAAC;YAED,IAAI,UAAU,CAAI,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAY,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB;gBAAE,MAAM,KAAK,CAAC;YACzD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,MAAM,IAAI,sBAAsB,CAC9B,uCAAuC,EACvC,GAAG,EACH,SAAS,CACV,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CAAI,OAAgB;IACrC,OAAO,OAAO,CACZ,OAAO;QACP,OAAO,OAAO,KAAK,QAAQ;QAC3B,QAAQ,IAAI,OAAO;QACnB,SAAS,IAAI,OAAO;QACpB,MAAM,IAAI,OAAO,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,QAAgB;IAC7D,IACE,OAAO;QACP,OAAO,OAAO,KAAK,QAAQ;QAC3B,SAAS,IAAI,OAAO;QACpB,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QAEnC,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+declare const envSchema: z.ZodObject<{
+    TASK_MANAGEMENT_API_BASE_URL: z.ZodDefault<z.ZodString>;
+    TASK_MANAGEMENT_TIMEOUT_MS: z.ZodDefault<z.ZodNumber>;
+    TASK_MANAGEMENT_MAX_BULK_SIZE: z.ZodDefault<z.ZodNumber>;
+    TASK_MANAGEMENT_AUTH_TTL_MS: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    TASK_MANAGEMENT_API_BASE_URL: string;
+    TASK_MANAGEMENT_TIMEOUT_MS: number;
+    TASK_MANAGEMENT_MAX_BULK_SIZE: number;
+    TASK_MANAGEMENT_AUTH_TTL_MS: number;
+}, {
+    TASK_MANAGEMENT_API_BASE_URL?: string | undefined;
+    TASK_MANAGEMENT_TIMEOUT_MS?: number | undefined;
+    TASK_MANAGEMENT_MAX_BULK_SIZE?: number | undefined;
+    TASK_MANAGEMENT_AUTH_TTL_MS?: number | undefined;
+}>;
+export type RuntimeConfig = z.infer<typeof envSchema>;
+export declare function loadConfig(env?: NodeJS.ProcessEnv): RuntimeConfig;
+export {};

package/dist/config.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+const envSchema = z.object({
+    TASK_MANAGEMENT_API_BASE_URL: z
+        .string()
+        .url()
+        .default("http://localhost:3000"),
+    TASK_MANAGEMENT_TIMEOUT_MS: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(30_000),
+    TASK_MANAGEMENT_MAX_BULK_SIZE: z.coerce.number().int().positive().default(50),
+    TASK_MANAGEMENT_AUTH_TTL_MS: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(8 * 60 * 60 * 1000),
+});
+export function loadConfig(env = process.env) {
+    return envSchema.parse(env);
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,4BAA4B,EAAE,CAAC;SAC5B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,OAAO,CAAC,uBAAuB,CAAC;IACnC,0BAA0B,EAAE,CAAC,CAAC,MAAM;SACjC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,MAAM,CAAC;IAClB,6BAA6B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,2BAA2B,EAAE,CAAC,CAAC,MAAM;SAClC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;CAC/B,CAAC,CAAC;AAIH,MAAM,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { loadConfig } from "./config.js";
+import { TaskManagementApi } from "./api.js";
+import { registerTools } from "./tools.js";
+const config = loadConfig();
+const server = new McpServer({
+    name: "task-management-mcp",
+    version: "0.1.0",
+});
+registerTools(server, new TaskManagementApi(config), config.TASK_MANAGEMENT_MAX_BULK_SIZE, config.TASK_MANAGEMENT_AUTH_TTL_MS);
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAC5B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,qBAAqB;IAC3B,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,aAAa,CACX,MAAM,EACN,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAC7B,MAAM,CAAC,6BAA6B,EACpC,MAAM,CAAC,2BAA2B,CACnC,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/schemas.d.ts

@@ -0,0 +1,10 @@
+import { z } from "zod";
+export declare const paginationSchema: {
+    page: z.ZodDefault<z.ZodNumber>;
+    perPage: z.ZodDefault<z.ZodNumber>;
+};
+export declare const prioritySchema: z.ZodEnum<["Low", "Normal", "High", "Urgent"]>;
+export declare const categorySchema: z.ZodEnum<["ToDo", "InProgress", "Complete"]>;
+export declare const dryRunSchema: {
+    dryRun: z.ZodDefault<z.ZodBoolean>;
+};

package/dist/schemas.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+export const paginationSchema = {
+    page: z.number().int().positive().default(1),
+    perPage: z.number().int().positive().max(100).default(30),
+};
+export const prioritySchema = z.enum(["Low", "Normal", "High", "Urgent"]);
+export const categorySchema = z.enum(["ToDo", "InProgress", "Complete"]);
+export const dryRunSchema = {
+    dryRun: z
+        .boolean()
+        .default(true)
+        .describe("When true, validate and preview without writing. Set false to execute."),
+};
+//# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1D,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,wEAAwE,CACzE;CACJ,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,3 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { TaskManagementApi } from "./api.js";
+export declare function registerTools(server: McpServer, api: TaskManagementApi, maxBulkSize: number, authTtlMs: number): void;