@starasia/task-management-mcp 1.0.1 → 1.1.0

package/README.md

@@ -4,7 +4,7 @@ MCP server for Star Perkasa Technology Task Management.
 
 Package ini membantu AI agent membaca, membuat, memperbarui, memantau, dan merangkum task melalui Task Management API dengan permission sesuai user aktif.
 
-Server ini tidak menyimpan token global. Akses API memakai auth context runtime yang diberikan oleh user aktif melalui tool MCP.
+Server ini menyimpan auth context secara aman di runtime/persistent local store agar agent tidak perlu meminta login berulang selama token masih valid. Token tidak pernah dikembalikan ke output tool.
 
 ## Requirements
 
@@ -98,6 +98,11 @@ Untuk client lain yang memakai format JSON `mcpServers`:
 
 ### Auth/session
 
+- `sso_login`
+- `select_sso_organization`
+- `start_web_sso_login`
+- `check_web_sso_login`
+- `cancel_web_sso_login`
 - `set_auth_context`
 - `get_auth_context_status`
 - `clear_auth_context`
@@ -137,11 +142,45 @@ Assignee tools use project member ids from `list_project_members`.
 
 ## Auth model
 
-Before using task tools, the agent should check whether an auth context is configured. If not, it should ask the active user for the required runtime credentials and call `set_auth_context`.
+Before using task tools, the agent should check whether an auth context is configured. If not, prefer SSO login instead of asking for a raw bearer token.
 
-The MCP keeps auth context in process memory only, returns masked auth status, and never returns the bearer token from any tool.
+Recommended flow for chat-based agents:
 
-Call `clear_auth_context` when the session is done.
+1. Call `get_auth_context_status`.
+2. If not configured, prefer `start_web_sso_login` and present the returned login URL/button to the user.
+3. The user enters email/password in the browser form, not in chat.
+4. Poll or call `check_web_sso_login` with the returned session id.
+5. When completed, the MCP activates and persists the auth context without returning the token.
+6. Use the task tools.
+
+CLI/local fallback flow:
+
+1. Call `sso_login` with the user's SSO email/password only when the platform can handle secrets safely.
+2. If `sso_login` returns multiple organizations, present organization **names** in a human-friendly list and ask which organization should be used. Do not ask the user to copy an organization ID.
+3. Call `select_sso_organization` with the user's typed organization name. The MCP supports normalized/fuzzy matching, so close inputs such as `star perkasa` can match `PT Star Perkasa Technology`.
+4. Use the task tools.
+
+Manual fallback remains available through `set_auth_context` when explicitly needed.
+
+The MCP stores auth context in an encrypted local store and process memory, returns masked auth status, and never returns the bearer token from any tool.
+
+Call `clear_auth_context` when the session is done; it clears process state, pending SSO sessions, web login sessions, and the persisted auth store.
+
+### SSO configuration
+
+For SSO login, provide the Task Management module client ID via environment:
+
+```bash
+TASK_MANAGEMENT_SSO_CLIENT_ID=APP-xxxxxxxx
+```
+
+Optional SSO API base URL override, mainly for local/dev testing:
+
+```bash
+TASK_MANAGEMENT_SSO_API_BASE_URL=https://api.starasia.tech/sso
+```
+
+Passwords are accepted only by `sso_login`; the resulting token stays in MCP process memory and is never returned.
 
 ## Safety notes
 

package/dist/auth-store.d.ts

@@ -0,0 +1,16 @@
+export interface StoredAuthContext {
+    bearerToken: string;
+    userId: string;
+    organizationId: string;
+    environment?: string;
+    expiresAt: string;
+}
+export declare class AuthStore {
+    private readonly storePath;
+    private readonly keyMaterial?;
+    constructor(storePath: string, keyMaterial?: string | undefined);
+    load(): StoredAuthContext | undefined;
+    save(context: StoredAuthContext): void;
+    clear(): void;
+    private resolveKeyMaterial;
+}

package/dist/auth-store.js

@@ -0,0 +1,85 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { dirname } from "node:path";
+export class AuthStore {
+    storePath;
+    keyMaterial;
+    constructor(storePath, keyMaterial) {
+        this.storePath = storePath;
+        this.keyMaterial = keyMaterial;
+    }
+    load() {
+        if (!existsSync(this.storePath))
+            return undefined;
+        try {
+            const payload = JSON.parse(readFileSync(this.storePath, "utf8"));
+            if (payload.version !== 1 || payload.algorithm !== "aes-256-gcm")
+                return undefined;
+            const decipher = createDecipheriv("aes-256-gcm", deriveKey(this.resolveKeyMaterial()), Buffer.from(payload.iv, "base64url"));
+            decipher.setAuthTag(Buffer.from(payload.tag, "base64url"));
+            const decrypted = Buffer.concat([
+                decipher.update(Buffer.from(payload.data, "base64url")),
+                decipher.final(),
+            ]).toString("utf8");
+            const context = JSON.parse(decrypted);
+            if (!isStoredAuthContext(context))
+                return undefined;
+            if (new Date(context.expiresAt).getTime() <= Date.now()) {
+                this.clear();
+                return undefined;
+            }
+            return context;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    save(context) {
+        mkdirSync(dirname(this.storePath), { recursive: true, mode: 0o700 });
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", deriveKey(this.resolveKeyMaterial()), iv);
+        const encrypted = Buffer.concat([
+            cipher.update(JSON.stringify(context), "utf8"),
+            cipher.final(),
+        ]);
+        const payload = {
+            version: 1,
+            algorithm: "aes-256-gcm",
+            iv: iv.toString("base64url"),
+            tag: cipher.getAuthTag().toString("base64url"),
+            data: encrypted.toString("base64url"),
+        };
+        writeFileSync(this.storePath, JSON.stringify(payload), { mode: 0o600 });
+    }
+    clear() {
+        rmSync(this.storePath, { force: true });
+    }
+    resolveKeyMaterial() {
+        if (this.keyMaterial)
+            return this.keyMaterial;
+        const keyPath = `${this.storePath}.key`;
+        mkdirSync(dirname(keyPath), { recursive: true, mode: 0o700 });
+        if (existsSync(keyPath))
+            return readFileSync(keyPath, "utf8");
+        const generatedKey = randomBytes(32).toString("base64url");
+        writeFileSync(keyPath, generatedKey, { mode: 0o600 });
+        return generatedKey;
+    }
+}
+function deriveKey(keyMaterial) {
+    return createHash("sha256").update(keyMaterial).digest();
+}
+function isStoredAuthContext(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return Boolean(typeof candidate.bearerToken === "string" &&
+        candidate.bearerToken &&
+        typeof candidate.userId === "string" &&
+        candidate.userId &&
+        typeof candidate.organizationId === "string" &&
+        candidate.organizationId &&
+        typeof candidate.expiresAt === "string" &&
+        candidate.expiresAt);
+}
+//# sourceMappingURL=auth-store.js.map

package/dist/auth-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../src/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBpC,MAAM,OAAO,SAAS;IAED;IACA;IAFnB,YACmB,SAAiB,EACjB,WAAoB;QADpB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAS;IACpC,CAAC;IAEJ,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CACjB,CAAC;YACtB,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,KAAK,aAAa;gBAC9D,OAAO,SAAS,CAAC;YACnB,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CACrC,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACvD,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;YAC3D,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACxD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAA0B;QAC7B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAC3B,aAAa,EACb,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EACpC,EAAE,CACH,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAC9C,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,OAAO,GAAqB;YAChC,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,aAAa;YACxB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC9C,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;SACtC,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK;QACH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,MAAM,CAAC;QACxC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,YAAY,CAAC;IACtB,CAAC;CACF;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAmC,CAAC;IACtD,OAAO,OAAO,CACZ,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,SAAS,CAAC,WAAW;QACrB,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QACpC,SAAS,CAAC,MAAM;QAChB,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ;QAC5C,SAAS,CAAC,cAAc;QACxB,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,SAAS,CAAC,SAAS,CACpB,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -4,16 +4,43 @@ declare const envSchema: z.ZodObject<{
     TASK_MANAGEMENT_TIMEOUT_MS: z.ZodDefault<z.ZodNumber>;
     TASK_MANAGEMENT_MAX_BULK_SIZE: z.ZodDefault<z.ZodNumber>;
     TASK_MANAGEMENT_AUTH_TTL_MS: z.ZodDefault<z.ZodNumber>;
+    TASK_MANAGEMENT_SSO_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    TASK_MANAGEMENT_SSO_API_BASE_URL: z.ZodDefault<z.ZodString>;
+    TASK_MANAGEMENT_HRIS_API_BASE_URL: z.ZodOptional<z.ZodString>;
+    TASK_MANAGEMENT_AUTH_STORE_PATH: z.ZodDefault<z.ZodString>;
+    TASK_MANAGEMENT_AUTH_STORE_KEY: z.ZodOptional<z.ZodString>;
+    TASK_MANAGEMENT_WEB_LOGIN_HOST: z.ZodDefault<z.ZodString>;
+    TASK_MANAGEMENT_WEB_LOGIN_PORT: z.ZodDefault<z.ZodNumber>;
+    TASK_MANAGEMENT_WEB_LOGIN_PUBLIC_BASE_URL: z.ZodOptional<z.ZodString>;
+    TASK_MANAGEMENT_WEB_LOGIN_TTL_MS: z.ZodDefault<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     TASK_MANAGEMENT_API_BASE_URL: string;
     TASK_MANAGEMENT_TIMEOUT_MS: number;
     TASK_MANAGEMENT_MAX_BULK_SIZE: number;
     TASK_MANAGEMENT_AUTH_TTL_MS: number;
+    TASK_MANAGEMENT_SSO_API_BASE_URL: string;
+    TASK_MANAGEMENT_AUTH_STORE_PATH: string;
+    TASK_MANAGEMENT_WEB_LOGIN_HOST: string;
+    TASK_MANAGEMENT_WEB_LOGIN_PORT: number;
+    TASK_MANAGEMENT_WEB_LOGIN_TTL_MS: number;
+    TASK_MANAGEMENT_SSO_CLIENT_ID?: string | undefined;
+    TASK_MANAGEMENT_HRIS_API_BASE_URL?: string | undefined;
+    TASK_MANAGEMENT_AUTH_STORE_KEY?: string | undefined;
+    TASK_MANAGEMENT_WEB_LOGIN_PUBLIC_BASE_URL?: string | undefined;
 }, {
     TASK_MANAGEMENT_API_BASE_URL?: string | undefined;
     TASK_MANAGEMENT_TIMEOUT_MS?: number | undefined;
     TASK_MANAGEMENT_MAX_BULK_SIZE?: number | undefined;
     TASK_MANAGEMENT_AUTH_TTL_MS?: number | undefined;
+    TASK_MANAGEMENT_SSO_CLIENT_ID?: string | undefined;
+    TASK_MANAGEMENT_SSO_API_BASE_URL?: string | undefined;
+    TASK_MANAGEMENT_HRIS_API_BASE_URL?: string | undefined;
+    TASK_MANAGEMENT_AUTH_STORE_PATH?: string | undefined;
+    TASK_MANAGEMENT_AUTH_STORE_KEY?: string | undefined;
+    TASK_MANAGEMENT_WEB_LOGIN_HOST?: string | undefined;
+    TASK_MANAGEMENT_WEB_LOGIN_PORT?: number | undefined;
+    TASK_MANAGEMENT_WEB_LOGIN_PUBLIC_BASE_URL?: string | undefined;
+    TASK_MANAGEMENT_WEB_LOGIN_TTL_MS?: number | undefined;
 }>;
 export type RuntimeConfig = z.infer<typeof envSchema>;
 export declare function loadConfig(env?: NodeJS.ProcessEnv): RuntimeConfig;

package/dist/config.js

@@ -1,9 +1,15 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { z } from "zod";
+import { BUILD_TASK_MANAGEMENT_API_BASE_URL } from "./generated-config.js";
+const DEFAULT_TASK_MANAGEMENT_API_BASE_URL = BUILD_TASK_MANAGEMENT_API_BASE_URL || "http://localhost:3000";
+const DEFAULT_TASK_MANAGEMENT_SSO_API_BASE_URL = "https://api.starasia.tech/sso";
+const DEFAULT_AUTH_STORE_PATH = join(homedir(), ".starasia", "task-management-mcp", "auth-context.enc");
 const envSchema = z.object({
     TASK_MANAGEMENT_API_BASE_URL: z
         .string()
         .url()
-        .default("http://localhost:3000"),
+        .default(DEFAULT_TASK_MANAGEMENT_API_BASE_URL),
     TASK_MANAGEMENT_TIMEOUT_MS: z.coerce
         .number()
         .int()
@@ -15,6 +21,25 @@ const envSchema = z.object({
         .int()
         .positive()
         .default(8 * 60 * 60 * 1000),
+    TASK_MANAGEMENT_SSO_CLIENT_ID: z.string().min(1).optional(),
+    TASK_MANAGEMENT_SSO_API_BASE_URL: z
+        .string()
+        .url()
+        .default(DEFAULT_TASK_MANAGEMENT_SSO_API_BASE_URL),
+    TASK_MANAGEMENT_HRIS_API_BASE_URL: z.string().url().optional(),
+    TASK_MANAGEMENT_AUTH_STORE_PATH: z
+        .string()
+        .min(1)
+        .default(DEFAULT_AUTH_STORE_PATH),
+    TASK_MANAGEMENT_AUTH_STORE_KEY: z.string().min(1).optional(),
+    TASK_MANAGEMENT_WEB_LOGIN_HOST: z.string().min(1).default("127.0.0.1"),
+    TASK_MANAGEMENT_WEB_LOGIN_PORT: z.coerce.number().int().min(0).default(0),
+    TASK_MANAGEMENT_WEB_LOGIN_PUBLIC_BASE_URL: z.string().url().optional(),
+    TASK_MANAGEMENT_WEB_LOGIN_TTL_MS: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(5 * 60 * 1000),
 });
 export function loadConfig(env = process.env) {
     return envSchema.parse(env);

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,4BAA4B,EAAE,CAAC;SAC5B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,OAAO,CAAC,uBAAuB,CAAC;IACnC,0BAA0B,EAAE,CAAC,CAAC,MAAM;SACjC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,MAAM,CAAC;IAClB,6BAA6B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,2BAA2B,EAAE,CAAC,CAAC,MAAM;SAClC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;CAC/B,CAAC,CAAC;AAIH,MAAM,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAE3E,MAAM,oCAAoC,GACxC,kCAAkC,IAAI,uBAAuB,CAAC;AAChE,MAAM,wCAAwC,GAC5C,+BAA+B,CAAC;AAClC,MAAM,uBAAuB,GAAG,IAAI,CAClC,OAAO,EAAE,EACT,WAAW,EACX,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,4BAA4B,EAAE,CAAC;SAC5B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,OAAO,CAAC,oCAAoC,CAAC;IAChD,0BAA0B,EAAE,CAAC,CAAC,MAAM;SACjC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,MAAM,CAAC;IAClB,6BAA6B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,2BAA2B,EAAE,CAAC,CAAC,MAAM;SAClC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9B,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,gCAAgC,EAAE,CAAC;SAChC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,OAAO,CAAC,wCAAwC,CAAC;IACpD,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9D,+BAA+B,EAAE,CAAC;SAC/B,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,uBAAuB,CAAC;IACnC,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACtE,8BAA8B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,yCAAyC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtE,gCAAgC,EAAE,CAAC,CAAC,MAAM;SACvC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;CAC1B,CAAC,CAAC;AAIH,MAAM,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/generated-config.d.ts

@@ -0,0 +1 @@
+export declare const BUILD_TASK_MANAGEMENT_API_BASE_URL = "https://api.starasia.tech/task-management";

package/dist/generated-config.js

@@ -0,0 +1,4 @@
+// This file is generated by scripts/generate-build-config.mjs.
+// BUILD_TASK_MANAGEMENT_API_BASE_URL is injected by CI for published builds.
+export const BUILD_TASK_MANAGEMENT_API_BASE_URL = "https://api.starasia.tech/task-management";
+//# sourceMappingURL=generated-config.js.map

package/dist/generated-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-config.js","sourceRoot":"","sources":["../src/generated-config.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kCAAkC,GAAG,2CAA2C,CAAC"}

package/dist/hris-api.d.ts

@@ -0,0 +1,10 @@
+import type { SsoOrganizationOption } from "./sso-api.js";
+export declare class HrisApi {
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    constructor(baseUrl: string | undefined, timeoutMs: number);
+    listSwitchOrganizations(input: {
+        bearerToken: string;
+    }): Promise<SsoOrganizationOption[]>;
+    private request;
+}

package/dist/hris-api.js

@@ -0,0 +1,108 @@
+import { SsoApiError } from "./sso-api.js";
+export class HrisApi {
+    baseUrl;
+    timeoutMs;
+    constructor(baseUrl, timeoutMs) {
+        this.baseUrl = baseUrl;
+        this.timeoutMs = timeoutMs;
+    }
+    async listSwitchOrganizations(input) {
+        if (!this.baseUrl) {
+            throw new Error("TASK_MANAGEMENT_HRIS_API_BASE_URL is not configured. Set it to the HRIS API base URL so MCP can fetch user organizations server-side.");
+        }
+        const rows = await this.request("GET", "admin/switch-organizations", undefined, { status: "active", perPage: 100 }, input.bearerToken);
+        const seen = new Set();
+        const organizations = [];
+        for (const row of rows) {
+            const id = typeof row.id === "string" ? row.id.trim() : "";
+            const name = typeof row.name === "string" ? row.name.trim() : "";
+            if (!id || !name || seen.has(id))
+                continue;
+            seen.add(id);
+            organizations.push({
+                id,
+                name,
+                isActive: typeof row.isActive === "boolean" ? row.isActive : undefined,
+            });
+        }
+        return organizations;
+    }
+    async request(method, path, body, query, bearerToken) {
+        const url = new URL(path, this.baseUrl.replace(/\/$/, "") + "/");
+        for (const [key, value] of Object.entries(query ?? {})) {
+            if (value === undefined || value === null || value === "")
+                continue;
+            url.searchParams.set(key, String(value));
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const headers = { Accept: "application/json" };
+            if (body !== undefined)
+                headers["Content-Type"] = "application/json";
+            if (bearerToken)
+                headers.Authorization = normalizeBearerToken(bearerToken);
+            const response = await fetch(url, {
+                method,
+                headers,
+                body: body === undefined ? undefined : JSON.stringify(body),
+                signal: controller.signal,
+            });
+            const text = await response.text();
+            const payload = parsePayload(text);
+            if (!response.ok) {
+                throw new SsoApiError(extractErrorMessage(payload, response.statusText), response.status, payload);
+            }
+            if (isEnvelope(payload))
+                return payload.data;
+            return payload;
+        }
+        catch (error) {
+            if (error instanceof SsoApiError)
+                throw error;
+            if (error instanceof Error && error.name === "AbortError") {
+                throw new SsoApiError("HRIS API request timed out", 408, undefined);
+            }
+            throw error;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+function isEnvelope(payload) {
+    return Boolean(payload && typeof payload === "object" && "data" in payload);
+}
+function parsePayload(text) {
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { message: text };
+    }
+}
+function extractErrorMessage(payload, fallback) {
+    if (payload &&
+        typeof payload === "object" &&
+        "message" in payload &&
+        typeof payload.message === "string")
+        return payload.message;
+    if (payload &&
+        typeof payload === "object" &&
+        "error" in payload &&
+        payload.error &&
+        typeof payload.error === "object" &&
+        "message" in payload.error &&
+        typeof payload.error.message === "string")
+        return payload.error.message;
+    return fallback;
+}
+function normalizeBearerToken(token) {
+    const trimmed = token.trim();
+    return trimmed.toLowerCase().startsWith("bearer ")
+        ? trimmed
+        : `Bearer ${trimmed}`;
+}
+//# sourceMappingURL=hris-api.js.map

package/dist/hris-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hris-api.js","sourceRoot":"","sources":["../src/hris-api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAgB3C,MAAM,OAAO,OAAO;IAEC;IACA;IAFnB,YACmB,OAA2B,EAC3B,SAAiB;QADjB,YAAO,GAAP,OAAO,CAAoB;QAC3B,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ,KAAK,CAAC,uBAAuB,CAAC,KAE7B;QACC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,uIAAuI,CACxI,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,KAAK,EACL,4BAA4B,EAC5B,SAAS,EACT,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAClC,KAAK,CAAC,WAAW,CAClB,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,aAAa,GAA4B,EAAE,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,aAAa,CAAC,IAAI,CAAC;gBACjB,EAAE;gBACF,IAAI;gBACJ,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,KAA+B,EAC/B,WAAoB;QAEpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACvE,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACrE,IAAI,WAAW;gBAAE,OAAO,CAAC,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;YAE3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,WAAW,CACnB,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EACjD,QAAQ,CAAC,MAAM,EACf,OAAO,CACR,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,CAAI,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC;YAChD,OAAO,OAAY,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,WAAW;gBAAE,MAAM,KAAK,CAAC;YAC9C,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,MAAM,IAAI,WAAW,CAAC,4BAA4B,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CAAI,OAAgB;IACrC,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,QAAgB;IAC7D,IACE,OAAO;QACP,OAAO,OAAO,KAAK,QAAQ;QAC3B,SAAS,IAAI,OAAO;QACpB,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QAEnC,OAAO,OAAO,CAAC,OAAO,CAAC;IACzB,IACE,OAAO;QACP,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,IAAI,OAAO;QAClB,OAAO,CAAC,KAAK;QACb,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,SAAS,IAAI,OAAO,CAAC,KAAK;QAC1B,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ;QAEzC,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC/B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAChD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC;AAC1B,CAAC"}

package/dist/index.js

@@ -3,13 +3,27 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { loadConfig } from "./config.js";
 import { TaskManagementApi } from "./api.js";
+import { HrisApi } from "./hris-api.js";
+import { SsoApi } from "./sso-api.js";
+import { AuthStore } from "./auth-store.js";
 import { registerTools } from "./tools.js";
 const config = loadConfig();
 const server = new McpServer({
     name: "task-management-mcp",
     version: "0.1.0",
 });
-registerTools(server, new TaskManagementApi(config), config.TASK_MANAGEMENT_MAX_BULK_SIZE, config.TASK_MANAGEMENT_AUTH_TTL_MS);
+registerTools(server, new TaskManagementApi(config), new SsoApi(config.TASK_MANAGEMENT_SSO_API_BASE_URL, config.TASK_MANAGEMENT_TIMEOUT_MS), new HrisApi(config.TASK_MANAGEMENT_HRIS_API_BASE_URL, config.TASK_MANAGEMENT_TIMEOUT_MS), {
+    maxBulkSize: config.TASK_MANAGEMENT_MAX_BULK_SIZE,
+    authTtlMs: config.TASK_MANAGEMENT_AUTH_TTL_MS,
+    defaultSsoClientId: config.TASK_MANAGEMENT_SSO_CLIENT_ID,
+    authStore: new AuthStore(config.TASK_MANAGEMENT_AUTH_STORE_PATH, config.TASK_MANAGEMENT_AUTH_STORE_KEY),
+    webLogin: {
+        host: config.TASK_MANAGEMENT_WEB_LOGIN_HOST,
+        port: config.TASK_MANAGEMENT_WEB_LOGIN_PORT,
+        publicBaseUrl: config.TASK_MANAGEMENT_WEB_LOGIN_PUBLIC_BASE_URL,
+        ttlMs: config.TASK_MANAGEMENT_WEB_LOGIN_TTL_MS,
+    },
+});
 const transport = new StdioServerTransport();
 await server.connect(transport);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAC5B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,qBAAqB;IAC3B,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,aAAa,CACX,MAAM,EACN,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAC7B,MAAM,CAAC,6BAA6B,EACpC,MAAM,CAAC,2BAA2B,CACnC,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAC5B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,qBAAqB;IAC3B,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,aAAa,CACX,MAAM,EACN,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAC7B,IAAI,MAAM,CACR,MAAM,CAAC,gCAAgC,EACvC,MAAM,CAAC,0BAA0B,CAClC,EACD,IAAI,OAAO,CACT,MAAM,CAAC,iCAAiC,EACxC,MAAM,CAAC,0BAA0B,CAClC,EACD;IACE,WAAW,EAAE,MAAM,CAAC,6BAA6B;IACjD,SAAS,EAAE,MAAM,CAAC,2BAA2B;IAC7C,kBAAkB,EAAE,MAAM,CAAC,6BAA6B;IACxD,SAAS,EAAE,IAAI,SAAS,CACtB,MAAM,CAAC,+BAA+B,EACtC,MAAM,CAAC,8BAA8B,CACtC;IACD,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC,8BAA8B;QAC3C,IAAI,EAAE,MAAM,CAAC,8BAA8B;QAC3C,aAAa,EAAE,MAAM,CAAC,yCAAyC;QAC/D,KAAK,EAAE,MAAM,CAAC,gCAAgC;KAC/C;CACF,CACF,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/sso-api.d.ts

@@ -0,0 +1,78 @@
+export interface SsoApplicationOption {
+    id?: string;
+    name?: string;
+    clientId?: string;
+}
+export interface SsoRoleOption {
+    id?: string;
+    name?: string;
+    key?: string;
+}
+export interface SsoOrganizationOption {
+    id: string;
+    name: string;
+    isActive?: boolean;
+    application?: SsoApplicationOption | null;
+    role?: SsoRoleOption | null;
+}
+export interface SsoLoginResult {
+    authToken?: string;
+    redirectUri?: string;
+    requirePasswordChange?: boolean;
+    resetToken?: string;
+}
+export interface SsoHandoffResult {
+    status: "pending" | "completed";
+    authToken?: string;
+    userId?: string;
+    organizationId?: string;
+    organizationName?: string;
+    expiresAt?: string;
+}
+export interface SsoAccessTokenResult {
+    accessToken: string;
+    idToken?: string;
+    refreshToken?: string;
+    tokenType?: string;
+    expiresIn?: number;
+    userId?: string;
+    organization?: SsoOrganizationOption | null;
+    requireOrganizationSetup?: boolean;
+}
+export declare class SsoApiError extends Error {
+    readonly status: number;
+    readonly payload: unknown;
+    constructor(message: string, status: number, payload: unknown);
+}
+export declare class SsoApi {
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    constructor(baseUrl: string, timeoutMs: number);
+    login(input: {
+        email: string;
+        password: string;
+        clientId: string;
+        mode?: string;
+    }): Promise<SsoLoginResult>;
+    listUserOrganizations(input: {
+        userId: string;
+        clientId: string;
+        bearerToken: string;
+    }): Promise<SsoOrganizationOption[]>;
+    consumeTaskManagementMcpHandoff(input: {
+        sessionId: string;
+        secret: string;
+    }): Promise<SsoHandoffResult>;
+    completeTaskManagementMcpHandoff(input: {
+        sessionId: string;
+        secret: string;
+        authToken: string;
+    }): Promise<SsoHandoffResult>;
+    exchangeTaskManagementMcpAccessToken(input: {
+        sessionId: string;
+        secret: string;
+        clientId: string;
+        organizationId: string;
+    }): Promise<SsoAccessTokenResult>;
+    private request;
+}