@studiometa/productive-mcp 0.8.5 → 0.9.0

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sources":["../src/oauth.ts"],"sourcesContent":["/**\n * OAuth 2.0 endpoints for Claude Desktop integration\n *\n * Implements OAuth 2.1 with PKCE as specified in the MCP authorization spec.\n * Uses stateless encrypted tokens - no server-side storage required.\n *\n * Spec: https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization\n *\n * Flow:\n * 1. Claude redirects user to /authorize with OAuth params (including PKCE)\n * 2. User enters Productive credentials in login form\n * 3. Server encrypts credentials + PKCE challenge into authorization code\n * 4. Redirects back to Claude with the code\n * 5. Claude exchanges code for access token via /token (with code_verifier)\n * 6. Server validates PKCE and returns access token\n */\n\nimport {\n  defineEventHandler,\n  getQuery,\n  readBody,\n  sendRedirect,\n  setResponseHeader,\n  type H3Event,\n} from 'h3';\nimport { createHash } from 'node:crypto';\n\nimport { createAuthToken } from './auth.js';\nimport { createAuthCode, decodeAuthCode } from './crypto.js';\n\n/**\n * OAuth metadata for discovery (RFC 8414)\n * GET /.well-known/oauth-authorization-server\n *\n * MCP clients MUST check this endpoint first for server capabilities.\n */\nexport const oauthMetadataHandler = defineEventHandler((event: H3Event) => {\n  const host = event.node.req.headers.host || 'localhost:3000';\n  const protocol = event.node.req.headers['x-forwarded-proto'] || 'http';\n  const baseUrl = `${protocol}://${host}`;\n\n  setResponseHeader(event, 'Content-Type', 'application/json');\n  setResponseHeader(event, 'Cache-Control', 'public, max-age=3600');\n\n  return {\n    // Required fields per RFC 8414\n    issuer: baseUrl,\n    authorization_endpoint: `${baseUrl}/authorize`,\n    token_endpoint: `${baseUrl}/token`,\n    response_types_supported: ['code'],\n\n    // OAuth 2.1 / MCP requirements\n    grant_types_supported: ['authorization_code', 'refresh_token'],\n    code_challenge_methods_supported: ['S256'],\n    token_endpoint_auth_methods_supported: ['none'], // Public client\n\n    // Optional but useful\n    registration_endpoint: `${baseUrl}/register`,\n    scopes_supported: ['productive'],\n    service_documentation: 'https://github.com/studiometa/productive-tools',\n  };\n});\n\n/**\n * Dynamic Client Registration endpoint (RFC 7591)\n * POST /register\n *\n * MCP servers SHOULD support DCR to allow clients to register automatically.\n * Since we use stateless tokens, we accept any registration and return\n * a generated client_id.\n */\nexport const registerHandler = defineEventHandler(async (event: H3Event) => {\n  setResponseHeader(event, 'Content-Type', 'application/json');\n\n  let body: Record<string, unknown>;\n  try {\n    body = await readBody(event);\n  } catch {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_request',\n      error_description: 'Invalid JSON body',\n    };\n  }\n\n  // Extract client metadata\n  const clientName = (body.client_name as string) || 'MCP Client';\n  const redirectUris = (body.redirect_uris as string[]) || [];\n\n  // Generate a client_id based on the registration\n  // Since we're stateless, we encode minimal info in the client_id\n  const clientId = Buffer.from(\n    JSON.stringify({\n      name: clientName,\n      ts: Date.now(),\n    }),\n  ).toString('base64url');\n\n  event.node.res.statusCode = 201;\n  return {\n    client_id: clientId,\n    client_name: clientName,\n    redirect_uris: redirectUris,\n    token_endpoint_auth_method: 'none',\n    grant_types: ['authorization_code', 'refresh_token'],\n    response_types: ['code'],\n  };\n});\n\n/**\n * Authorization endpoint - shows login form\n * GET /authorize\n */\nexport const authorizeGetHandler = defineEventHandler((event: H3Event) => {\n  const query = getQuery(event);\n\n  // Extract OAuth parameters\n  const clientId = query.client_id as string;\n  const redirectUri = query.redirect_uri as string;\n  const state = query.state as string;\n  const codeChallenge = query.code_challenge as string;\n  const codeChallengeMethod = query.code_challenge_method as string;\n  const scope = query.scope as string;\n\n  // Validate required parameters per OAuth 2.1\n  if (!redirectUri) {\n    setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n    event.node.res.statusCode = 400;\n    return renderErrorPage('Missing required parameter: redirect_uri');\n  }\n\n  // PKCE is REQUIRED for public clients per MCP spec\n  if (!codeChallenge) {\n    // Redirect back with error per OAuth spec\n    const errorUrl = new URL(redirectUri);\n    errorUrl.searchParams.set('error', 'invalid_request');\n    errorUrl.searchParams.set('error_description', 'code_challenge is required');\n    if (state) errorUrl.searchParams.set('state', state);\n    return sendRedirect(event, errorUrl.toString());\n  }\n\n  if (codeChallengeMethod && codeChallengeMethod !== 'S256') {\n    const errorUrl = new URL(redirectUri);\n    errorUrl.searchParams.set('error', 'invalid_request');\n    errorUrl.searchParams.set('error_description', 'Only S256 code_challenge_method is supported');\n    if (state) errorUrl.searchParams.set('state', state);\n    return sendRedirect(event, errorUrl.toString());\n  }\n\n  setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n\n  // Render login form\n  return renderLoginForm({\n    clientId,\n    redirectUri,\n    state,\n    codeChallenge,\n    codeChallengeMethod: codeChallengeMethod || 'S256',\n    scope,\n  });\n});\n\n/**\n * Authorization endpoint - process login\n * POST /authorize\n */\nexport const authorizePostHandler = defineEventHandler(async (event: H3Event) => {\n  const body = await readBody(event);\n\n  const { orgId, apiToken, userId, redirectUri, state, codeChallenge, codeChallengeMethod } = body;\n\n  // Validate redirect URI first (security requirement)\n  if (!redirectUri) {\n    setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n    event.node.res.statusCode = 400;\n    return renderErrorPage('Missing redirect_uri parameter');\n  }\n\n  // Validate redirect URI format (must be HTTPS or localhost)\n  try {\n    const uri = new URL(redirectUri);\n    const isLocalhost = uri.hostname === 'localhost' || uri.hostname === '127.0.0.1';\n    const isHttps = uri.protocol === 'https:';\n    if (!isLocalhost && !isHttps) {\n      event.node.res.statusCode = 400;\n      return renderErrorPage('redirect_uri must be HTTPS or localhost');\n    }\n  } catch {\n    event.node.res.statusCode = 400;\n    return renderErrorPage('Invalid redirect_uri format');\n  }\n\n  // Validate required credentials\n  if (!orgId || !apiToken) {\n    setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n    return renderLoginForm({\n      redirectUri,\n      state,\n      codeChallenge,\n      codeChallengeMethod,\n      error: 'Organization ID and API Token are required',\n    });\n  }\n\n  // Create encrypted authorization code with PKCE challenge\n  const code = createAuthCode({\n    orgId,\n    apiToken,\n    userId: userId || undefined,\n    codeChallenge,\n    codeChallengeMethod: codeChallengeMethod || 'S256',\n  });\n\n  // Build redirect URL with authorization code\n  const redirectUrl = new URL(redirectUri);\n  redirectUrl.searchParams.set('code', code);\n  if (state) {\n    redirectUrl.searchParams.set('state', state);\n  }\n\n  // Show success page with auto-redirect\n  setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n  return renderSuccessPage(redirectUrl.toString());\n});\n\n/**\n * Token endpoint - exchange code for access token\n * POST /token\n *\n * Supports:\n * - authorization_code grant (with PKCE validation)\n * - refresh_token grant\n */\nexport const tokenHandler = defineEventHandler(async (event: H3Event) => {\n  setResponseHeader(event, 'Content-Type', 'application/json');\n\n  let body: Record<string, string>;\n  const contentType = event.node.req.headers['content-type'] || '';\n\n  if (contentType.includes('application/x-www-form-urlencoded')) {\n    const rawBody = await readBody(event);\n    if (typeof rawBody === 'string') {\n      body = Object.fromEntries(new URLSearchParams(rawBody));\n    } else {\n      body = rawBody;\n    }\n  } else {\n    body = await readBody(event);\n  }\n\n  const { grant_type, code, code_verifier, refresh_token } = body;\n\n  // Handle refresh token grant\n  if (grant_type === 'refresh_token') {\n    return handleRefreshToken(event, refresh_token);\n  }\n\n  // Validate authorization code grant\n  if (grant_type !== 'authorization_code') {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'unsupported_grant_type',\n      error_description: 'Supported grant types: authorization_code, refresh_token',\n    };\n  }\n\n  if (!code) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_request',\n      error_description: 'Missing authorization code',\n    };\n  }\n\n  if (!code_verifier) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_request',\n      error_description: 'Missing code_verifier (PKCE required)',\n    };\n  }\n\n  try {\n    // Decode the authorization code\n    const payload = decodeAuthCode(code);\n\n    // Validate PKCE: SHA256(code_verifier) must equal code_challenge\n    if (payload.codeChallenge) {\n      const expectedChallenge = createS256Challenge(code_verifier);\n      if (expectedChallenge !== payload.codeChallenge) {\n        event.node.res.statusCode = 400;\n        return {\n          error: 'invalid_grant',\n          error_description: 'Invalid code_verifier',\n        };\n      }\n    }\n\n    // Create access token (base64 encoded credentials)\n    const accessToken = createAuthToken({\n      organizationId: payload.orgId,\n      apiToken: payload.apiToken,\n      userId: payload.userId,\n    });\n\n    // Create refresh token (encrypted credentials, longer expiry)\n    const refreshToken = createAuthCode(\n      {\n        orgId: payload.orgId,\n        apiToken: payload.apiToken,\n        userId: payload.userId,\n      },\n      86400 * 30, // 30 days\n    );\n\n    return {\n      access_token: accessToken,\n      token_type: 'Bearer',\n      expires_in: 3600, // 1 hour (access tokens should be short-lived)\n      refresh_token: refreshToken,\n    };\n  } catch (error) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_grant',\n      error_description: error instanceof Error ? error.message : 'Invalid authorization code',\n    };\n  }\n});\n\n/**\n * Handle refresh token grant\n */\nfunction handleRefreshToken(event: H3Event, refreshToken: string | undefined) {\n  if (!refreshToken) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_request',\n      error_description: 'Missing refresh_token',\n    };\n  }\n\n  try {\n    // Decode refresh token (it's just an encrypted auth code with longer expiry)\n    const payload = decodeAuthCode(refreshToken);\n\n    // Create new access token\n    const accessToken = createAuthToken({\n      organizationId: payload.orgId,\n      apiToken: payload.apiToken,\n      userId: payload.userId,\n    });\n\n    // Create new refresh token (rotate for security)\n    const newRefreshToken = createAuthCode(\n      {\n        orgId: payload.orgId,\n        apiToken: payload.apiToken,\n        userId: payload.userId,\n      },\n      86400 * 30, // 30 days\n    );\n\n    return {\n      access_token: accessToken,\n      token_type: 'Bearer',\n      expires_in: 3600,\n      refresh_token: newRefreshToken,\n    };\n  } catch (error) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_grant',\n      error_description: error instanceof Error ? error.message : 'Invalid refresh token',\n    };\n  }\n}\n\n/**\n * Create S256 PKCE challenge from verifier\n * SHA256(code_verifier) encoded as base64url\n */\nfunction createS256Challenge(codeVerifier: string): string {\n  return createHash('sha256').update(codeVerifier).digest('base64url');\n}\n\n/**\n * Render the login form HTML\n */\nfunction renderLoginForm(params: {\n  clientId?: string;\n  redirectUri?: string;\n  state?: string;\n  codeChallenge?: string;\n  codeChallengeMethod?: string;\n  scope?: string;\n  error?: string;\n}): string {\n  const { redirectUri, state, codeChallenge, codeChallengeMethod, error } = params;\n\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>Connect to Productive.io</title>\n  <style>\n    * {\n      box-sizing: border-box;\n      margin: 0;\n      padding: 0;\n    }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);\n      padding: 40px;\n      width: 100%;\n      max-width: 420px;\n    }\n    .logo {\n      text-align: center;\n      margin-bottom: 24px;\n    }\n    .logo svg {\n      width: 48px;\n      height: 48px;\n    }\n    h1 {\n      text-align: center;\n      color: #1a1a2e;\n      font-size: 24px;\n      margin-bottom: 8px;\n    }\n    .subtitle {\n      text-align: center;\n      color: #666;\n      font-size: 14px;\n      margin-bottom: 32px;\n    }\n    .error {\n      background: #fee2e2;\n      border: 1px solid #fecaca;\n      color: #dc2626;\n      padding: 12px 16px;\n      border-radius: 8px;\n      margin-bottom: 24px;\n      font-size: 14px;\n    }\n    .form-group {\n      margin-bottom: 20px;\n    }\n    label {\n      display: block;\n      font-size: 14px;\n      font-weight: 500;\n      color: #374151;\n      margin-bottom: 6px;\n    }\n    input {\n      width: 100%;\n      padding: 12px 16px;\n      border: 1px solid #d1d5db;\n      border-radius: 8px;\n      font-size: 16px;\n      transition: border-color 0.2s, box-shadow 0.2s;\n    }\n    input:focus {\n      outline: none;\n      border-color: #667eea;\n      box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.2);\n    }\n    input::placeholder {\n      color: #9ca3af;\n    }\n    .help-text {\n      font-size: 12px;\n      color: #6b7280;\n      margin-top: 4px;\n    }\n    button {\n      width: 100%;\n      padding: 14px 24px;\n      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);\n      color: white;\n      border: none;\n      border-radius: 8px;\n      font-size: 16px;\n      font-weight: 600;\n      cursor: pointer;\n      transition: transform 0.2s, box-shadow 0.2s;\n    }\n    button:hover {\n      transform: translateY(-1px);\n      box-shadow: 0 4px 12px rgba(102, 126, 234, 0.4);\n    }\n    button:active {\n      transform: translateY(0);\n    }\n    .footer {\n      text-align: center;\n      margin-top: 24px;\n      font-size: 12px;\n      color: #9ca3af;\n    }\n    .footer a {\n      color: #667eea;\n      text-decoration: none;\n    }\n    .footer a:hover {\n      text-decoration: underline;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <div class=\"logo\">\n      <svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n        <path d=\"M12 2L2 7L12 12L22 7L12 2Z\" stroke=\"#667eea\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n        <path d=\"M2 17L12 22L22 17\" stroke=\"#764ba2\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n        <path d=\"M2 12L12 17L22 12\" stroke=\"#667eea\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n      </svg>\n    </div>\n    <h1>Connect to Productive.io</h1>\n    <p class=\"subtitle\">Enter your Productive.io credentials to connect with Claude</p>\n    \n    ${error ? `<div class=\"error\">${escapeHtml(error)}</div>` : ''}\n    \n    <form method=\"POST\" action=\"/authorize\">\n      <input type=\"hidden\" name=\"redirectUri\" value=\"${escapeHtml(redirectUri || '')}\">\n      <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(state || '')}\">\n      <input type=\"hidden\" name=\"codeChallenge\" value=\"${escapeHtml(codeChallenge || '')}\">\n      <input type=\"hidden\" name=\"codeChallengeMethod\" value=\"${escapeHtml(codeChallengeMethod || 'S256')}\">\n      \n      <div class=\"form-group\">\n        <label for=\"orgId\">Organization ID *</label>\n        <input type=\"text\" id=\"orgId\" name=\"orgId\" required placeholder=\"e.g., 12345\">\n        <p class=\"help-text\">Found in Settings → API integrations</p>\n      </div>\n      \n      <div class=\"form-group\">\n        <label for=\"apiToken\">API Token *</label>\n        <input type=\"password\" id=\"apiToken\" name=\"apiToken\" required placeholder=\"pk_...\">\n        <p class=\"help-text\">Generate at Settings → API integrations → Generate new token</p>\n      </div>\n      \n      <div class=\"form-group\">\n        <label for=\"userId\">User ID (optional)</label>\n        <input type=\"text\" id=\"userId\" name=\"userId\" placeholder=\"e.g., 67890\">\n        <p class=\"help-text\">Required for creating time entries. Found in your profile URL.</p>\n      </div>\n      \n      <button type=\"submit\">Connect to Productive</button>\n    </form>\n    \n    <p class=\"footer\">\n      Your credentials are encrypted and sent directly to Claude.<br>\n      <a href=\"https://developer.productive.io\" target=\"_blank\">Productive.io API Documentation</a>\n    </p>\n  </div>\n</body>\n</html>`;\n}\n\n/**\n * Render success page with auto-redirect\n */\nfunction renderSuccessPage(redirectUrl: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <meta http-equiv=\"refresh\" content=\"2;url=${escapeHtml(redirectUrl)}\">\n  <title>Connected - Productive MCP</title>\n  <style>\n    * {\n      box-sizing: border-box;\n      margin: 0;\n      padding: 0;\n    }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);\n      padding: 40px;\n      width: 100%;\n      max-width: 420px;\n      text-align: center;\n    }\n    .success-icon {\n      width: 64px;\n      height: 64px;\n      margin: 0 auto 24px;\n      background: linear-gradient(135deg, #10b981 0%, #059669 100%);\n      border-radius: 50%;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n    }\n    .success-icon svg {\n      width: 32px;\n      height: 32px;\n      stroke: white;\n    }\n    h1 {\n      color: #1a1a2e;\n      font-size: 24px;\n      margin-bottom: 8px;\n    }\n    .message {\n      color: #666;\n      font-size: 14px;\n      margin-bottom: 24px;\n    }\n    .spinner {\n      width: 24px;\n      height: 24px;\n      border: 3px solid #e5e7eb;\n      border-top-color: #667eea;\n      border-radius: 50%;\n      animation: spin 1s linear infinite;\n      margin: 0 auto 16px;\n    }\n    @keyframes spin {\n      to { transform: rotate(360deg); }\n    }\n    .redirect-text {\n      color: #9ca3af;\n      font-size: 13px;\n      margin-bottom: 16px;\n    }\n    .manual-link {\n      color: #667eea;\n      text-decoration: none;\n      font-size: 14px;\n    }\n    .manual-link:hover {\n      text-decoration: underline;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <div class=\"success-icon\">\n      <svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n        <path d=\"M20 6L9 17L4 12\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n      </svg>\n    </div>\n    <h1>Successfully Connected!</h1>\n    <p class=\"message\">Your Productive.io credentials have been verified.</p>\n    <div class=\"spinner\"></div>\n    <p class=\"redirect-text\">Redirecting to Claude Desktop...</p>\n    <a href=\"${escapeHtml(redirectUrl)}\" class=\"manual-link\">Click here if not redirected automatically</a>\n  </div>\n  <script>\n    // Redirect after a short delay (backup for meta refresh)\n    setTimeout(function() {\n      window.location.href = ${JSON.stringify(redirectUrl)};\n    }, 2000);\n  </script>\n</body>\n</html>`;\n}\n\n/**\n * Render error page\n */\nfunction renderErrorPage(message: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>Error - Productive MCP</title>\n  <style>\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: #f3f4f6;\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);\n      padding: 40px;\n      text-align: center;\n      max-width: 400px;\n    }\n    h1 {\n      color: #dc2626;\n      margin-bottom: 16px;\n    }\n    p {\n      color: #6b7280;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Error</h1>\n    <p>${escapeHtml(message)}</p>\n  </div>\n</body>\n</html>`;\n}\n\n/**\n * Escape HTML special characters\n */\nfunction escapeHtml(str: string): string {\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#039;');\n}\n"],"names":[],"mappings":";;;;AAoCO,MAAM,uBAAuB,mBAAmB,CAAC,UAAmB;AACzE,QAAM,OAAO,MAAM,KAAK,IAAI,QAAQ,QAAQ;AAC5C,QAAM,WAAW,MAAM,KAAK,IAAI,QAAQ,mBAAmB,KAAK;AAChE,QAAM,UAAU,GAAG,QAAQ,MAAM,IAAI;AAErC,oBAAkB,OAAO,gBAAgB,kBAAkB;AAC3D,oBAAkB,OAAO,iBAAiB,sBAAsB;AAEhE,SAAO;AAAA;AAAA,IAEL,QAAQ;AAAA,IACR,wBAAwB,GAAG,OAAO;AAAA,IAClC,gBAAgB,GAAG,OAAO;AAAA,IAC1B,0BAA0B,CAAC,MAAM;AAAA;AAAA,IAGjC,uBAAuB,CAAC,sBAAsB,eAAe;AAAA,IAC7D,kCAAkC,CAAC,MAAM;AAAA,IACzC,uCAAuC,CAAC,MAAM;AAAA;AAAA;AAAA,IAG9C,uBAAuB,GAAG,OAAO;AAAA,IACjC,kBAAkB,CAAC,YAAY;AAAA,IAC/B,uBAAuB;AAAA,EAAA;AAE3B,CAAC;AAUM,MAAM,kBAAkB,mBAAmB,OAAO,UAAmB;AAC1E,oBAAkB,OAAO,gBAAgB,kBAAkB;AAE3D,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,SAAS,KAAK;AAAA,EAC7B,QAAQ;AACN,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,mBAAmB;AAAA,IAAA;AAAA,EAEvB;AAGA,QAAM,aAAc,KAAK,eAA0B;AACnD,QAAM,eAAgB,KAAK,iBAA8B,CAAA;AAIzD,QAAM,WAAW,OAAO;AAAA,IACtB,KAAK,UAAU;AAAA,MACb,MAAM;AAAA,MACN,IAAI,KAAK,IAAA;AAAA,IAAI,CACd;AAAA,EAAA,EACD,SAAS,WAAW;AAEtB,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO;AAAA,IACL,WAAW;AAAA,IACX,aAAa;AAAA,IACb,eAAe;AAAA,IACf,4BAA4B;AAAA,IAC5B,aAAa,CAAC,sBAAsB,eAAe;AAAA,IACnD,gBAAgB,CAAC,MAAM;AAAA,EAAA;AAE3B,CAAC;AAMM,MAAM,sBAAsB,mBAAmB,CAAC,UAAmB;AACxE,QAAM,QAAQ,SAAS,KAAK;AAGX,QAAM;AACvB,QAAM,cAAc,MAAM;AAC1B,QAAM,QAAQ,MAAM;AACpB,QAAM,gBAAgB,MAAM;AAC5B,QAAM,sBAAsB,MAAM;AACpB,QAAM;AAGpB,MAAI,CAAC,aAAa;AAChB,sBAAkB,OAAO,gBAAgB,0BAA0B;AACnE,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO,gBAAgB,0CAA0C;AAAA,EACnE;AAGA,MAAI,CAAC,eAAe;AAElB,UAAM,WAAW,IAAI,IAAI,WAAW;AACpC,aAAS,aAAa,IAAI,SAAS,iBAAiB;AACpD,aAAS,aAAa,IAAI,qBAAqB,4BAA4B;AAC3E,QAAI,MAAO,UAAS,aAAa,IAAI,SAAS,KAAK;AACnD,WAAO,aAAa,OAAO,SAAS,SAAA,CAAU;AAAA,EAChD;AAEA,MAAI,uBAAuB,wBAAwB,QAAQ;AACzD,UAAM,WAAW,IAAI,IAAI,WAAW;AACpC,aAAS,aAAa,IAAI,SAAS,iBAAiB;AACpD,aAAS,aAAa,IAAI,qBAAqB,8CAA8C;AAC7F,QAAI,MAAO,UAAS,aAAa,IAAI,SAAS,KAAK;AACnD,WAAO,aAAa,OAAO,SAAS,SAAA,CAAU;AAAA,EAChD;AAEA,oBAAkB,OAAO,gBAAgB,0BAA0B;AAGnE,SAAO,gBAAgB;AAAA,IAErB;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,uBAAuB;AAAA,EAE9C,CAAC;AACH,CAAC;AAMM,MAAM,uBAAuB,mBAAmB,OAAO,UAAmB;AAC/E,QAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAM,EAAE,OAAO,UAAU,QAAQ,aAAa,OAAO,eAAe,wBAAwB;AAG5F,MAAI,CAAC,aAAa;AAChB,sBAAkB,OAAO,gBAAgB,0BAA0B;AACnE,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO,gBAAgB,gCAAgC;AAAA,EACzD;AAGA,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,UAAM,cAAc,IAAI,aAAa,eAAe,IAAI,aAAa;AACrE,UAAM,UAAU,IAAI,aAAa;AACjC,QAAI,CAAC,eAAe,CAAC,SAAS;AAC5B,YAAM,KAAK,IAAI,aAAa;AAC5B,aAAO,gBAAgB,yCAAyC;AAAA,IAClE;AAAA,EACF,QAAQ;AACN,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO,gBAAgB,6BAA6B;AAAA,EACtD;AAGA,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,sBAAkB,OAAO,gBAAgB,0BAA0B;AACnE,WAAO,gBAAgB;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IAAA,CACR;AAAA,EACH;AAGA,QAAM,OAAO,eAAe;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,QAAQ,UAAU;AAAA,IAClB;AAAA,IACA,qBAAqB,uBAAuB;AAAA,EAAA,CAC7C;AAGD,QAAM,cAAc,IAAI,IAAI,WAAW;AACvC,cAAY,aAAa,IAAI,QAAQ,IAAI;AACzC,MAAI,OAAO;AACT,gBAAY,aAAa,IAAI,SAAS,KAAK;AAAA,EAC7C;AAGA,oBAAkB,OAAO,gBAAgB,0BAA0B;AACnE,SAAO,kBAAkB,YAAY,UAAU;AACjD,CAAC;AAUM,MAAM,eAAe,mBAAmB,OAAO,UAAmB;AACvE,oBAAkB,OAAO,gBAAgB,kBAAkB;AAE3D,MAAI;AACJ,QAAM,cAAc,MAAM,KAAK,IAAI,QAAQ,cAAc,KAAK;AAE9D,MAAI,YAAY,SAAS,mCAAmC,GAAG;AAC7D,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,QAAI,OAAO,YAAY,UAAU;AAC/B,aAAO,OAAO,YAAY,IAAI,gBAAgB,OAAO,CAAC;AAAA,IACxD,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,WAAO,MAAM,SAAS,KAAK;AAAA,EAC7B;AAEA,QAAM,EAAE,YAAY,MAAM,eAAe,kBAAkB;AAG3D,MAAI,eAAe,iBAAiB;AAClC,WAAO,mBAAmB,OAAO,aAAa;AAAA,EAChD;AAGA,MAAI,eAAe,sBAAsB;AACvC,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,mBAAmB;AAAA,IAAA;AAAA,EAEvB;AAEA,MAAI,CAAC,MAAM;AACT,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,mBAAmB;AAAA,IAAA;AAAA,EAEvB;AAEA,MAAI,CAAC,eAAe;AAClB,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,mBAAmB;AAAA,IAAA;AAAA,EAEvB;AAEA,MAAI;AAEF,UAAM,UAAU,eAAe,IAAI;AAGnC,QAAI,QAAQ,eAAe;AACzB,YAAM,oBAAoB,oBAAoB,aAAa;AAC3D,UAAI,sBAAsB,QAAQ,eAAe;AAC/C,cAAM,KAAK,IAAI,aAAa;AAC5B,eAAO;AAAA,UACL,OAAO;AAAA,UACP,mBAAmB;AAAA,QAAA;AAAA,MAEvB;AAAA,IACF;AAGA,UAAM,cAAc,gBAAgB;AAAA,MAClC,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,IAAA,CACjB;AAGD,UAAM,eAAe;AAAA,MACnB;AAAA,QACE,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,MAAA;AAAA,MAElB,QAAQ;AAAA;AAAA,IAAA;AAGV,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,YAAY;AAAA;AAAA,MACZ,eAAe;AAAA,IAAA;AAAA,EAEnB,SAAS,OAAO;AACd,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAAA;AAAA,EAEhE;AACF,CAAC;AAKD,SAAS,mBAAmB,OAAgB,cAAkC;AAC5E,MAAI,CAAC,cAAc;AACjB,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,mBAAmB;AAAA,IAAA;AAAA,EAEvB;AAEA,MAAI;AAEF,UAAM,UAAU,eAAe,YAAY;AAG3C,UAAM,cAAc,gBAAgB;AAAA,MAClC,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,IAAA,CACjB;AAGD,UAAM,kBAAkB;AAAA,MACtB;AAAA,QACE,OAAO,QAAQ;AAAA,QACf,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,MAAA;AAAA,MAElB,QAAQ;AAAA;AAAA,IAAA;AAGV,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,eAAe;AAAA,IAAA;AAAA,EAEnB,SAAS,OAAO;AACd,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO;AAAA,MACL,OAAO;AAAA,MACP,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAAA;AAAA,EAEhE;AACF;AAMA,SAAS,oBAAoB,cAA8B;AACzD,SAAO,WAAW,QAAQ,EAAE,OAAO,YAAY,EAAE,OAAO,WAAW;AACrE;AAKA,SAAS,gBAAgB,QAQd;AACT,QAAM,EAAE,aAAa,OAAO,eAAe,qBAAqB,UAAU;AAE1E,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAuIH,QAAQ,sBAAsB,WAAW,KAAK,CAAC,WAAW,EAAE;AAAA;AAAA;AAAA,uDAGX,WAAW,eAAe,EAAE,CAAC;AAAA,iDACnC,WAAW,SAAS,EAAE,CAAC;AAAA,yDACf,WAAW,iBAAiB,EAAE,CAAC;AAAA,+DACzB,WAAW,uBAAuB,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BxG;AAKA,SAAS,kBAAkB,aAA6B;AACtD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,8CAKqC,WAAW,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAyFtD,WAAW,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,+BAKP,KAAK,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAK1D;AAKA,SAAS,gBAAgB,SAAyB;AAChD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAoCA,WAAW,OAAO,CAAC;AAAA;AAAA;AAAA;AAI5B;AAKA,SAAS,WAAW,KAAqB;AACvC,SAAO,IACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,QAAQ;AAC3B;"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../src/oauth.ts"],"sourcesContent":["/**\n * OAuth 2.0 endpoints for Claude Desktop integration\n *\n * Implements OAuth 2.1 with PKCE as specified in the MCP authorization spec.\n * Uses stateless encrypted tokens - no server-side storage required.\n *\n * Spec: https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization\n *\n * Flow:\n * 1. Claude redirects user to /authorize with OAuth params (including PKCE)\n * 2. User enters Productive credentials in login form\n * 3. Server encrypts credentials + PKCE challenge into authorization code\n * 4. Redirects back to Claude with the code\n * 5. Claude exchanges code for access token via /token (with code_verifier)\n * 6. Server validates PKCE and returns access token\n */\n\nimport {\n  defineEventHandler,\n  getQuery,\n  readBody,\n  sendRedirect,\n  setResponseHeader,\n  type H3Event,\n} from 'h3';\nimport { createHash } from 'node:crypto';\n\nimport { createAuthToken } from './auth.js';\nimport { createAuthCode, decodeAuthCode } from './crypto.js';\n\n/**\n * OAuth metadata for discovery (RFC 8414)\n * GET /.well-known/oauth-authorization-server\n *\n * MCP clients MUST check this endpoint first for server capabilities.\n */\nexport const oauthMetadataHandler = defineEventHandler((event: H3Event) => {\n  const host = event.node.req.headers.host || 'localhost:3000';\n  const protocol = event.node.req.headers['x-forwarded-proto'] || 'http';\n  const baseUrl = `${protocol}://${host}`;\n\n  setResponseHeader(event, 'Content-Type', 'application/json');\n  setResponseHeader(event, 'Cache-Control', 'public, max-age=3600');\n\n  return {\n    // Required fields per RFC 8414\n    issuer: baseUrl,\n    authorization_endpoint: `${baseUrl}/authorize`,\n    token_endpoint: `${baseUrl}/token`,\n    response_types_supported: ['code'],\n\n    // OAuth 2.1 / MCP requirements\n    grant_types_supported: ['authorization_code', 'refresh_token'],\n    code_challenge_methods_supported: ['S256'],\n    token_endpoint_auth_methods_supported: ['none'], // Public client\n\n    // Optional but useful\n    registration_endpoint: `${baseUrl}/register`,\n    scopes_supported: ['productive'],\n    service_documentation: 'https://github.com/studiometa/productive-tools',\n  };\n});\n\n/**\n * Dynamic Client Registration endpoint (RFC 7591)\n * POST /register\n *\n * MCP servers SHOULD support DCR to allow clients to register automatically.\n * Since we use stateless tokens, we accept any registration and return\n * a generated client_id.\n */\nexport const registerHandler = defineEventHandler(async (event: H3Event) => {\n  setResponseHeader(event, 'Content-Type', 'application/json');\n\n  let body: Record<string, unknown>;\n  try {\n    body = await readBody(event);\n  } catch {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_request',\n      error_description: 'Invalid JSON body',\n    };\n  }\n\n  // Extract client metadata\n  const clientName = (body.client_name as string) || 'MCP Client';\n  const redirectUris = (body.redirect_uris as string[]) || [];\n\n  // Generate a client_id based on the registration\n  // Since we're stateless, we encode minimal info in the client_id\n  const clientId = Buffer.from(\n    JSON.stringify({\n      name: clientName,\n      ts: Date.now(),\n    }),\n  ).toString('base64url');\n\n  event.node.res.statusCode = 201;\n  return {\n    client_id: clientId,\n    client_name: clientName,\n    redirect_uris: redirectUris,\n    token_endpoint_auth_method: 'none',\n    grant_types: ['authorization_code', 'refresh_token'],\n    response_types: ['code'],\n  };\n});\n\n/**\n * Authorization endpoint - shows login form\n * GET /authorize\n */\nexport const authorizeGetHandler = defineEventHandler((event: H3Event) => {\n  const query = getQuery(event);\n\n  // Extract OAuth parameters\n  const clientId = query.client_id as string;\n  const redirectUri = query.redirect_uri as string;\n  const state = query.state as string;\n  const codeChallenge = query.code_challenge as string;\n  const codeChallengeMethod = query.code_challenge_method as string;\n  const scope = query.scope as string;\n\n  // Validate required parameters per OAuth 2.1\n  if (!redirectUri) {\n    setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n    event.node.res.statusCode = 400;\n    return renderErrorPage('Missing required parameter: redirect_uri');\n  }\n\n  // PKCE is REQUIRED for public clients per MCP spec\n  if (!codeChallenge) {\n    // Redirect back with error per OAuth spec\n    const errorUrl = new URL(redirectUri);\n    errorUrl.searchParams.set('error', 'invalid_request');\n    errorUrl.searchParams.set('error_description', 'code_challenge is required');\n    if (state) errorUrl.searchParams.set('state', state);\n    return sendRedirect(event, errorUrl.toString());\n  }\n\n  if (codeChallengeMethod && codeChallengeMethod !== 'S256') {\n    const errorUrl = new URL(redirectUri);\n    errorUrl.searchParams.set('error', 'invalid_request');\n    errorUrl.searchParams.set('error_description', 'Only S256 code_challenge_method is supported');\n    if (state) errorUrl.searchParams.set('state', state);\n    return sendRedirect(event, errorUrl.toString());\n  }\n\n  setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n\n  // Render login form\n  return renderLoginForm({\n    clientId,\n    redirectUri,\n    state,\n    codeChallenge,\n    codeChallengeMethod: codeChallengeMethod || 'S256',\n    scope,\n  });\n});\n\n/**\n * Authorization endpoint - process login\n * POST /authorize\n */\nexport const authorizePostHandler = defineEventHandler(async (event: H3Event) => {\n  const body = await readBody(event);\n\n  const { orgId, apiToken, userId, redirectUri, state, codeChallenge, codeChallengeMethod } = body;\n\n  // Validate redirect URI first (security requirement)\n  if (!redirectUri) {\n    setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n    event.node.res.statusCode = 400;\n    return renderErrorPage('Missing redirect_uri parameter');\n  }\n\n  // Validate redirect URI format (must be HTTPS or localhost)\n  try {\n    const uri = new URL(redirectUri);\n    const isLocalhost = uri.hostname === 'localhost' || uri.hostname === '127.0.0.1';\n    const isHttps = uri.protocol === 'https:';\n    if (!isLocalhost && !isHttps) {\n      event.node.res.statusCode = 400;\n      return renderErrorPage('redirect_uri must be HTTPS or localhost');\n    }\n  } catch {\n    event.node.res.statusCode = 400;\n    return renderErrorPage('Invalid redirect_uri format');\n  }\n\n  // Validate required credentials\n  if (!orgId || !apiToken) {\n    setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n    return renderLoginForm({\n      redirectUri,\n      state,\n      codeChallenge,\n      codeChallengeMethod,\n      error: 'Organization ID and API Token are required',\n    });\n  }\n\n  // Create encrypted authorization code with PKCE challenge\n  const code = createAuthCode({\n    orgId,\n    apiToken,\n    userId: userId || undefined,\n    codeChallenge,\n    codeChallengeMethod: codeChallengeMethod || 'S256',\n  });\n\n  // Build redirect URL with authorization code\n  const redirectUrl = new URL(redirectUri);\n  redirectUrl.searchParams.set('code', code);\n  if (state) {\n    redirectUrl.searchParams.set('state', state);\n  }\n\n  // Show success page with auto-redirect\n  setResponseHeader(event, 'Content-Type', 'text/html; charset=utf-8');\n  return renderSuccessPage(redirectUrl.toString());\n});\n\n/**\n * Token endpoint - exchange code for access token\n * POST /token\n *\n * Supports:\n * - authorization_code grant (with PKCE validation)\n * - refresh_token grant\n */\nexport const tokenHandler = defineEventHandler(async (event: H3Event) => {\n  setResponseHeader(event, 'Content-Type', 'application/json');\n\n  let body: Record<string, string>;\n  const contentType = event.node.req.headers['content-type'] || '';\n\n  if (contentType.includes('application/x-www-form-urlencoded')) {\n    const rawBody = await readBody(event);\n    if (typeof rawBody === 'string') {\n      body = Object.fromEntries(new URLSearchParams(rawBody));\n    } else {\n      body = rawBody;\n    }\n  } else {\n    body = await readBody(event);\n  }\n\n  const { grant_type, code, code_verifier, refresh_token } = body;\n\n  // Handle refresh token grant\n  if (grant_type === 'refresh_token') {\n    return handleRefreshToken(event, refresh_token);\n  }\n\n  // Validate authorization code grant\n  if (grant_type !== 'authorization_code') {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'unsupported_grant_type',\n      error_description: 'Supported grant types: authorization_code, refresh_token',\n    };\n  }\n\n  if (!code) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_request',\n      error_description: 'Missing authorization code',\n    };\n  }\n\n  if (!code_verifier) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_request',\n      error_description: 'Missing code_verifier (PKCE required)',\n    };\n  }\n\n  try {\n    // Decode the authorization code\n    const payload = decodeAuthCode(code);\n\n    // Validate PKCE: SHA256(code_verifier) must equal code_challenge\n    if (payload.codeChallenge) {\n      const expectedChallenge = createS256Challenge(code_verifier);\n      if (expectedChallenge !== payload.codeChallenge) {\n        event.node.res.statusCode = 400;\n        return {\n          error: 'invalid_grant',\n          error_description: 'Invalid code_verifier',\n        };\n      }\n    }\n\n    // Create access token (base64 encoded credentials)\n    const accessToken = createAuthToken({\n      organizationId: payload.orgId,\n      apiToken: payload.apiToken,\n      userId: payload.userId,\n    });\n\n    // Create refresh token (encrypted credentials, longer expiry)\n    const refreshToken = createAuthCode(\n      {\n        orgId: payload.orgId,\n        apiToken: payload.apiToken,\n        userId: payload.userId,\n      },\n      86400 * 30, // 30 days\n    );\n\n    return {\n      access_token: accessToken,\n      token_type: 'Bearer',\n      expires_in: 3600, // 1 hour (access tokens should be short-lived)\n      refresh_token: refreshToken,\n    };\n  } catch (error) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_grant',\n      error_description: error instanceof Error ? error.message : 'Invalid authorization code',\n    };\n  }\n});\n\n/**\n * Handle refresh token grant\n */\nfunction handleRefreshToken(event: H3Event, refreshToken: string | undefined) {\n  if (!refreshToken) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_request',\n      error_description: 'Missing refresh_token',\n    };\n  }\n\n  try {\n    // Decode refresh token (it's just an encrypted auth code with longer expiry)\n    const payload = decodeAuthCode(refreshToken);\n\n    // Create new access token\n    const accessToken = createAuthToken({\n      organizationId: payload.orgId,\n      apiToken: payload.apiToken,\n      userId: payload.userId,\n    });\n\n    // Create new refresh token (rotate for security)\n    const newRefreshToken = createAuthCode(\n      {\n        orgId: payload.orgId,\n        apiToken: payload.apiToken,\n        userId: payload.userId,\n      },\n      86400 * 30, // 30 days\n    );\n\n    return {\n      access_token: accessToken,\n      token_type: 'Bearer',\n      expires_in: 3600,\n      refresh_token: newRefreshToken,\n    };\n  } catch (error) {\n    event.node.res.statusCode = 400;\n    return {\n      error: 'invalid_grant',\n      error_description: error instanceof Error ? error.message : 'Invalid refresh token',\n    };\n  }\n}\n\n/**\n * Create S256 PKCE challenge from verifier\n * SHA256(code_verifier) encoded as base64url\n */\nfunction createS256Challenge(codeVerifier: string): string {\n  return createHash('sha256').update(codeVerifier).digest('base64url');\n}\n\n/**\n * Render the login form HTML\n */\nfunction renderLoginForm(params: {\n  clientId?: string;\n  redirectUri?: string;\n  state?: string;\n  codeChallenge?: string;\n  codeChallengeMethod?: string;\n  scope?: string;\n  error?: string;\n}): string {\n  const { redirectUri, state, codeChallenge, codeChallengeMethod, error } = params;\n\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>Connect to Productive.io</title>\n  <style>\n    * {\n      box-sizing: border-box;\n      margin: 0;\n      padding: 0;\n    }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);\n      padding: 40px;\n      width: 100%;\n      max-width: 420px;\n    }\n    .logo {\n      text-align: center;\n      margin-bottom: 24px;\n    }\n    .logo svg {\n      width: 48px;\n      height: 48px;\n    }\n    h1 {\n      text-align: center;\n      color: #1a1a2e;\n      font-size: 24px;\n      margin-bottom: 8px;\n    }\n    .subtitle {\n      text-align: center;\n      color: #666;\n      font-size: 14px;\n      margin-bottom: 32px;\n    }\n    .error {\n      background: #fee2e2;\n      border: 1px solid #fecaca;\n      color: #dc2626;\n      padding: 12px 16px;\n      border-radius: 8px;\n      margin-bottom: 24px;\n      font-size: 14px;\n    }\n    .form-group {\n      margin-bottom: 20px;\n    }\n    label {\n      display: block;\n      font-size: 14px;\n      font-weight: 500;\n      color: #374151;\n      margin-bottom: 6px;\n    }\n    input {\n      width: 100%;\n      padding: 12px 16px;\n      border: 1px solid #d1d5db;\n      border-radius: 8px;\n      font-size: 16px;\n      transition: border-color 0.2s, box-shadow 0.2s;\n    }\n    input:focus {\n      outline: none;\n      border-color: #667eea;\n      box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.2);\n    }\n    input::placeholder {\n      color: #9ca3af;\n    }\n    .help-text {\n      font-size: 12px;\n      color: #6b7280;\n      margin-top: 4px;\n    }\n    button {\n      width: 100%;\n      padding: 14px 24px;\n      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);\n      color: white;\n      border: none;\n      border-radius: 8px;\n      font-size: 16px;\n      font-weight: 600;\n      cursor: pointer;\n      transition: transform 0.2s, box-shadow 0.2s;\n    }\n    button:hover {\n      transform: translateY(-1px);\n      box-shadow: 0 4px 12px rgba(102, 126, 234, 0.4);\n    }\n    button:active {\n      transform: translateY(0);\n    }\n    .footer {\n      text-align: center;\n      margin-top: 24px;\n      font-size: 12px;\n      color: #9ca3af;\n    }\n    .footer a {\n      color: #667eea;\n      text-decoration: none;\n    }\n    .footer a:hover {\n      text-decoration: underline;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <div class=\"logo\">\n      <svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n        <path d=\"M12 2L2 7L12 12L22 7L12 2Z\" stroke=\"#667eea\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n        <path d=\"M2 17L12 22L22 17\" stroke=\"#764ba2\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n        <path d=\"M2 12L12 17L22 12\" stroke=\"#667eea\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n      </svg>\n    </div>\n    <h1>Connect to Productive.io</h1>\n    <p class=\"subtitle\">Enter your Productive.io credentials to connect with Claude</p>\n    \n    ${error ? `<div class=\"error\">${escapeHtml(error)}</div>` : ''}\n    \n    <form method=\"POST\" action=\"/authorize\">\n      <input type=\"hidden\" name=\"redirectUri\" value=\"${escapeHtml(redirectUri || '')}\">\n      <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(state || '')}\">\n      <input type=\"hidden\" name=\"codeChallenge\" value=\"${escapeHtml(codeChallenge || '')}\">\n      <input type=\"hidden\" name=\"codeChallengeMethod\" value=\"${escapeHtml(codeChallengeMethod || 'S256')}\">\n      \n      <div class=\"form-group\">\n        <label for=\"orgId\">Organization ID *</label>\n        <input type=\"text\" id=\"orgId\" name=\"orgId\" required placeholder=\"e.g., 12345\">\n        <p class=\"help-text\">Found in Settings → API integrations</p>\n      </div>\n      \n      <div class=\"form-group\">\n        <label for=\"apiToken\">API Token *</label>\n        <input type=\"password\" id=\"apiToken\" name=\"apiToken\" required placeholder=\"pk_...\">\n        <p class=\"help-text\">Generate at Settings → API integrations → Generate new token</p>\n      </div>\n      \n      <div class=\"form-group\">\n        <label for=\"userId\">User ID (optional)</label>\n        <input type=\"text\" id=\"userId\" name=\"userId\" placeholder=\"e.g., 67890\">\n        <p class=\"help-text\">Required for creating time entries. Found in your profile URL.</p>\n      </div>\n      \n      <button type=\"submit\">Connect to Productive</button>\n    </form>\n    \n    <p class=\"footer\">\n      Your credentials are encrypted and sent directly to Claude.<br>\n      <a href=\"https://developer.productive.io\" target=\"_blank\">Productive.io API Documentation</a>\n    </p>\n  </div>\n</body>\n</html>`;\n}\n\n/**\n * Render success page with auto-redirect\n */\nfunction renderSuccessPage(redirectUrl: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <meta http-equiv=\"refresh\" content=\"2;url=${escapeHtml(redirectUrl)}\">\n  <title>Connected - Productive MCP</title>\n  <style>\n    * {\n      box-sizing: border-box;\n      margin: 0;\n      padding: 0;\n    }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);\n      padding: 40px;\n      width: 100%;\n      max-width: 420px;\n      text-align: center;\n    }\n    .success-icon {\n      width: 64px;\n      height: 64px;\n      margin: 0 auto 24px;\n      background: linear-gradient(135deg, #10b981 0%, #059669 100%);\n      border-radius: 50%;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n    }\n    .success-icon svg {\n      width: 32px;\n      height: 32px;\n      stroke: white;\n    }\n    h1 {\n      color: #1a1a2e;\n      font-size: 24px;\n      margin-bottom: 8px;\n    }\n    .message {\n      color: #666;\n      font-size: 14px;\n      margin-bottom: 24px;\n    }\n    .spinner {\n      width: 24px;\n      height: 24px;\n      border: 3px solid #e5e7eb;\n      border-top-color: #667eea;\n      border-radius: 50%;\n      animation: spin 1s linear infinite;\n      margin: 0 auto 16px;\n    }\n    @keyframes spin {\n      to { transform: rotate(360deg); }\n    }\n    .redirect-text {\n      color: #9ca3af;\n      font-size: 13px;\n      margin-bottom: 16px;\n    }\n    .manual-link {\n      color: #667eea;\n      text-decoration: none;\n      font-size: 14px;\n    }\n    .manual-link:hover {\n      text-decoration: underline;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <div class=\"success-icon\">\n      <svg viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http://www.w3.org/2000/svg\">\n        <path d=\"M20 6L9 17L4 12\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/>\n      </svg>\n    </div>\n    <h1>Successfully Connected!</h1>\n    <p class=\"message\">Your Productive.io credentials have been verified.</p>\n    <div class=\"spinner\"></div>\n    <p class=\"redirect-text\">Redirecting to Claude Desktop...</p>\n    <a href=\"${escapeHtml(redirectUrl)}\" class=\"manual-link\">Click here if not redirected automatically</a>\n  </div>\n  <script>\n    // Redirect after a short delay (backup for meta refresh)\n    setTimeout(function() {\n      window.location.href = ${JSON.stringify(redirectUrl)};\n    }, 2000);\n  </script>\n</body>\n</html>`;\n}\n\n/**\n * Render error page\n */\nfunction renderErrorPage(message: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"UTF-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n  <title>Error - Productive MCP</title>\n  <style>\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n      background: #f3f4f6;\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 20px;\n    }\n    .container {\n      background: white;\n      border-radius: 16px;\n      box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);\n      padding: 40px;\n      text-align: center;\n      max-width: 400px;\n    }\n    h1 {\n      color: #dc2626;\n      margin-bottom: 16px;\n    }\n    p {\n      color: #6b7280;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Error</h1>\n    <p>${escapeHtml(message)}</p>\n  </div>\n</body>\n</html>`;\n}\n\n/**\n * Escape HTML special characters\n */\nfunction escapeHtml(str: string): string {\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#039;');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAa,uBAAuB,oBAAoB,UAAmB;CACzE,MAAM,OAAO,MAAM,KAAK,IAAI,QAAQ,QAAQ;CAE5C,MAAM,UAAU,GADC,MAAM,KAAK,IAAI,QAAQ,wBAAwB,OACpC,KAAK;AAEjC,mBAAkB,OAAO,gBAAgB,mBAAmB;AAC5D,mBAAkB,OAAO,iBAAiB,uBAAuB;AAEjE,QAAO;EAEL,QAAQ;EACR,wBAAwB,GAAG,QAAQ;EACnC,gBAAgB,GAAG,QAAQ;EAC3B,0BAA0B,CAAC,OAAO;EAGlC,uBAAuB,CAAC,sBAAsB,gBAAgB;EAC9D,kCAAkC,CAAC,OAAO;EAC1C,uCAAuC,CAAC,OAAO;EAG/C,uBAAuB,GAAG,QAAQ;EAClC,kBAAkB,CAAC,aAAa;EAChC,uBAAuB;EACxB;EACD;;;;;;;;;AAUF,MAAa,kBAAkB,mBAAmB,OAAO,UAAmB;AAC1E,mBAAkB,OAAO,gBAAgB,mBAAmB;CAE5D,IAAI;AACJ,KAAI;AACF,SAAO,MAAM,SAAS,MAAM;SACtB;AACN,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;CAIH,MAAM,aAAc,KAAK,eAA0B;CACnD,MAAM,eAAgB,KAAK,iBAA8B,EAAE;CAI3D,MAAM,WAAW,OAAO,KACtB,KAAK,UAAU;EACb,MAAM;EACN,IAAI,KAAK,KAAK;EACf,CAAC,CACH,CAAC,SAAS,YAAY;AAEvB,OAAM,KAAK,IAAI,aAAa;AAC5B,QAAO;EACL,WAAW;EACX,aAAa;EACb,eAAe;EACf,4BAA4B;EAC5B,aAAa,CAAC,sBAAsB,gBAAgB;EACpD,gBAAgB,CAAC,OAAO;EACzB;EACD;;;;;AAMF,MAAa,sBAAsB,oBAAoB,UAAmB;CACxE,MAAM,QAAQ,SAAS,MAAM;CAG7B,MAAM,WAAW,MAAM;CACvB,MAAM,cAAc,MAAM;CAC1B,MAAM,QAAQ,MAAM;CACpB,MAAM,gBAAgB,MAAM;CAC5B,MAAM,sBAAsB,MAAM;CAClC,MAAM,QAAQ,MAAM;AAGpB,KAAI,CAAC,aAAa;AAChB,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO,gBAAgB,2CAA2C;;AAIpE,KAAI,CAAC,eAAe;EAElB,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,WAAS,aAAa,IAAI,SAAS,kBAAkB;AACrD,WAAS,aAAa,IAAI,qBAAqB,6BAA6B;AAC5E,MAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,SAAO,aAAa,OAAO,SAAS,UAAU,CAAC;;AAGjD,KAAI,uBAAuB,wBAAwB,QAAQ;EACzD,MAAM,WAAW,IAAI,IAAI,YAAY;AACrC,WAAS,aAAa,IAAI,SAAS,kBAAkB;AACrD,WAAS,aAAa,IAAI,qBAAqB,+CAA+C;AAC9F,MAAI,MAAO,UAAS,aAAa,IAAI,SAAS,MAAM;AACpD,SAAO,aAAa,OAAO,SAAS,UAAU,CAAC;;AAGjD,mBAAkB,OAAO,gBAAgB,2BAA2B;AAGpE,QAAO,gBAAgB;EACrB;EACA;EACA;EACA;EACA,qBAAqB,uBAAuB;EAC5C;EACD,CAAC;EACF;;;;;AAMF,MAAa,uBAAuB,mBAAmB,OAAO,UAAmB;CAG/E,MAAM,EAAE,OAAO,UAAU,QAAQ,aAAa,OAAO,eAAe,wBAFvD,MAAM,SAAS,MAAM;AAKlC,KAAI,CAAC,aAAa;AAChB,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO,gBAAgB,iCAAiC;;AAI1D,KAAI;EACF,MAAM,MAAM,IAAI,IAAI,YAAY;EAChC,MAAM,cAAc,IAAI,aAAa,eAAe,IAAI,aAAa;EACrE,MAAM,UAAU,IAAI,aAAa;AACjC,MAAI,CAAC,eAAe,CAAC,SAAS;AAC5B,SAAM,KAAK,IAAI,aAAa;AAC5B,UAAO,gBAAgB,0CAA0C;;SAE7D;AACN,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO,gBAAgB,8BAA8B;;AAIvD,KAAI,CAAC,SAAS,CAAC,UAAU;AACvB,oBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,SAAO,gBAAgB;GACrB;GACA;GACA;GACA;GACA,OAAO;GACR,CAAC;;CAIJ,MAAM,OAAO,eAAe;EAC1B;EACA;EACA,QAAQ,UAAU,KAAA;EAClB;EACA,qBAAqB,uBAAuB;EAC7C,CAAC;CAGF,MAAM,cAAc,IAAI,IAAI,YAAY;AACxC,aAAY,aAAa,IAAI,QAAQ,KAAK;AAC1C,KAAI,MACF,aAAY,aAAa,IAAI,SAAS,MAAM;AAI9C,mBAAkB,OAAO,gBAAgB,2BAA2B;AACpE,QAAO,kBAAkB,YAAY,UAAU,CAAC;EAChD;;;;;;;;;AAUF,MAAa,eAAe,mBAAmB,OAAO,UAAmB;AACvE,mBAAkB,OAAO,gBAAgB,mBAAmB;CAE5D,IAAI;AAGJ,MAFoB,MAAM,KAAK,IAAI,QAAQ,mBAAmB,IAE9C,SAAS,oCAAoC,EAAE;EAC7D,MAAM,UAAU,MAAM,SAAS,MAAM;AACrC,MAAI,OAAO,YAAY,SACrB,QAAO,OAAO,YAAY,IAAI,gBAAgB,QAAQ,CAAC;MAEvD,QAAO;OAGT,QAAO,MAAM,SAAS,MAAM;CAG9B,MAAM,EAAE,YAAY,MAAM,eAAe,kBAAkB;AAG3D,KAAI,eAAe,gBACjB,QAAO,mBAAmB,OAAO,cAAc;AAIjD,KAAI,eAAe,sBAAsB;AACvC,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI,CAAC,MAAM;AACT,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI,CAAC,eAAe;AAClB,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI;EAEF,MAAM,UAAU,eAAe,KAAK;AAGpC,MAAI,QAAQ;OACgB,oBAAoB,cAAc,KAClC,QAAQ,eAAe;AAC/C,UAAM,KAAK,IAAI,aAAa;AAC5B,WAAO;KACL,OAAO;KACP,mBAAmB;KACpB;;;AAqBL,SAAO;GACL,cAjBkB,gBAAgB;IAClC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,QAAQ,QAAQ;IACjB,CAAC;GAcA,YAAY;GACZ,YAAY;GACZ,eAbmB,eACnB;IACE,OAAO,QAAQ;IACf,UAAU,QAAQ;IAClB,QAAQ,QAAQ;IACjB,EACD,QAAQ,GACT;GAOA;UACM,OAAO;AACd,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO;GACL,OAAO;GACP,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU;GAC7D;;EAEH;;;;AAKF,SAAS,mBAAmB,OAAgB,cAAkC;AAC5E,KAAI,CAAC,cAAc;AACjB,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO;GACL,OAAO;GACP,mBAAmB;GACpB;;AAGH,KAAI;EAEF,MAAM,UAAU,eAAe,aAAa;AAmB5C,SAAO;GACL,cAjBkB,gBAAgB;IAClC,gBAAgB,QAAQ;IACxB,UAAU,QAAQ;IAClB,QAAQ,QAAQ;IACjB,CAAC;GAcA,YAAY;GACZ,YAAY;GACZ,eAbsB,eACtB;IACE,OAAO,QAAQ;IACf,UAAU,QAAQ;IAClB,QAAQ,QAAQ;IACjB,EACD,QAAQ,GACT;GAOA;UACM,OAAO;AACd,QAAM,KAAK,IAAI,aAAa;AAC5B,SAAO;GACL,OAAO;GACP,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU;GAC7D;;;;;;;AAQL,SAAS,oBAAoB,cAA8B;AACzD,QAAO,WAAW,SAAS,CAAC,OAAO,aAAa,CAAC,OAAO,YAAY;;;;;AAMtE,SAAS,gBAAgB,QAQd;CACT,MAAM,EAAE,aAAa,OAAO,eAAe,qBAAqB,UAAU;AAE1E,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAuIH,QAAQ,sBAAsB,WAAW,MAAM,CAAC,UAAU,GAAG;;;uDAGZ,WAAW,eAAe,GAAG,CAAC;iDACpC,WAAW,SAAS,GAAG,CAAC;yDAChB,WAAW,iBAAiB,GAAG,CAAC;+DAC1B,WAAW,uBAAuB,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCzG,SAAS,kBAAkB,aAA6B;AACtD,QAAO;;;;;8CAKqC,WAAW,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAyFvD,WAAW,YAAY,CAAC;;;;;+BAKR,KAAK,UAAU,YAAY,CAAC;;;;;;;;;AAU3D,SAAS,gBAAgB,SAAyB;AAChD,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAoCA,WAAW,QAAQ,CAAC;;;;;;;;AAS7B,SAAS,WAAW,KAAqB;AACvC,QAAO,IACJ,QAAQ,MAAM,QAAQ,CACtB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,OAAO,CACrB,QAAQ,MAAM,SAAS,CACvB,QAAQ,MAAM,SAAS"}

package/dist/schema.d.ts

@@ -22,6 +22,10 @@ export declare const ResourceSchema: z.ZodEnum<{
     projects: "projects";
     people: "people";
     companies: "companies";
+    attachments: "attachments";
+    discussions: "discussions";
+    pages: "pages";
+    budgets: "budgets";
     reports: "reports";
 }>;
 export type Resource = z.infer<typeof ResourceSchema>;
@@ -34,7 +38,10 @@ export declare const ActionSchema: z.ZodEnum<{
     start: "start";
     update: "update";
     get: "get";
+    delete: "delete";
+    resolve: "resolve";
     stop: "stop";
+    reopen: "reopen";
     me: "me";
     help: "help";
 }>;
@@ -148,6 +155,10 @@ export declare const ProductiveToolInputSchema: z.ZodObject<{
         projects: "projects";
         people: "people";
         companies: "companies";
+        attachments: "attachments";
+        discussions: "discussions";
+        pages: "pages";
+        budgets: "budgets";
         reports: "reports";
     }>;
     action: z.ZodEnum<{
@@ -156,7 +167,10 @@ export declare const ProductiveToolInputSchema: z.ZodObject<{
         start: "start";
         update: "update";
         get: "get";
+        delete: "delete";
+        resolve: "resolve";
         stop: "stop";
+        reopen: "reopen";
         me: "me";
         help: "help";
     }>;
@@ -182,7 +196,10 @@ export declare const ProductiveToolInputSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     assignee_id: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
+    page_id: z.ZodOptional<z.ZodString>;
+    parent_page_id: z.ZodOptional<z.ZodString>;
     body: z.ZodOptional<z.ZodString>;
+    comment_id: z.ZodOptional<z.ZodString>;
     time_entry_id: z.ZodOptional<z.ZodString>;
     started_on: z.ZodOptional<z.ZodString>;
     ended_on: z.ZodOptional<z.ZodString>;

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAoB,KAAK,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,KAAK,CAAC;AAMlF;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;EAYzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;GAEG;AACH,eAAO,MAAM,YAAY;;;;;;;;;EASvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAY3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D;;GAEG;AACH,eAAO,MAAM,OAAO,aAIgC,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,aAAa,aAKvB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,cAAc,aAKxB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,cAAc,aAGqD,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,WAAW,aAG+C,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,cAAc,aAGuD,CAAC;AAEnF;;GAEG;AACH,eAAO,MAAM,WAAW,aAG+C,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,SAAS,aAIuC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,gBAAgB,aAKiE,CAAC;AAE/F;;GAEG;AACH,eAAO,MAAM,SAAS,2BAKiC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,YAAY,2BAMsC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,YAAY,6BAKtB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,UAAU,aAMpB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,YAAY,6BAKtB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,YAAY,yBAItB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,SAAS,aAAkD,CAAC;AAEzE;;GAEG;AACH,eAAO,MAAM,UAAU,aAIqB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,SAAS,aAGgB,CAAC;AAMvC;;GAEG;AACH,eAAO,MAAM,YAAY,uDAGsB,CAAC;AAMhD;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyDpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAErE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAE7F;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAOnF"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAoB,KAAK,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,KAAK,CAAC;AAMlF;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;EAgBzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;GAEG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;EAYvB,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAY3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D;;GAEG;AACH,eAAO,MAAM,OAAO,aAIgC,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,aAAa,aAKvB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,cAAc,aAKxB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,cAAc,aAGqD,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,WAAW,aAG+C,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,cAAc,aAGuD,CAAC;AAEnF;;GAEG;AACH,eAAO,MAAM,WAAW,aAG+C,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,SAAS,aAIuC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,gBAAgB,aAKiE,CAAC;AAE/F;;GAEG;AACH,eAAO,MAAM,SAAS,2BAKiC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,YAAY,2BAMsC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,YAAY,6BAKtB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,UAAU,aAMpB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,YAAY,6BAKtB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,YAAY,yBAItB,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,SAAS,aAAkD,CAAC;AAEzE;;GAEG;AACH,eAAO,MAAM,UAAU,aAIqB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,SAAS,aAGgB,CAAC;AAMvC;;GAEG;AACH,eAAO,MAAM,YAAY,uDAGsB,CAAC;AAMhD;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAErE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAE7F;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAOnF"}

package/dist/server.js

@@ -1,55 +1,72 @@
 #!/usr/bin/env node
+import { t as VERSION } from "./version-Dj8VXyV0.js";
+import "./handlers-BYE2INiR.js";
+import { createHttpApp } from "./http.js";
 import { toNodeListener } from "h3";
 import { createServer } from "node:http";
-import { createHttpApp } from "./http.js";
-import { V as VERSION } from "./version-BPy06P7x.js";
-const DEFAULT_PORT = 3e3;
-const DEFAULT_HOST = "0.0.0.0";
+/**
+* Productive MCP Server - HTTP Transport
+*
+* This is the remote HTTP server mode for Claude Desktop custom connectors.
+* Credentials are passed via Bearer token in the Authorization header.
+*
+* Token format: base64(organizationId:apiToken) or base64(organizationId:apiToken:userId)
+*
+* Generate your token:
+*   echo -n "YOUR_ORG_ID:YOUR_API_TOKEN:YOUR_USER_ID" | base64
+*
+* Usage:
+*   productive-mcp-server
+*   PORT=3000 productive-mcp-server
+*
+* Claude Desktop custom connector config:
+*   Name: Productive
+*   URL: https://productive.mcp.ikko.dev
+*   (No OAuth needed - uses Bearer token)
+*/
+var DEFAULT_PORT = 3e3;
+var DEFAULT_HOST = "0.0.0.0";
+/**
+* Start the HTTP server
+*/
 function startHttpServer(port = DEFAULT_PORT, host = DEFAULT_HOST) {
-  return new Promise((resolve) => {
-    const app = createHttpApp();
-    const server = createServer(toNodeListener(app));
-    server.listen(port, host, () => {
-      const displayHost = host === "0.0.0.0" ? "localhost" : host;
-      console.log(`Productive MCP server v${VERSION}`);
-      console.log(`Node.js ${process.version}`);
-      console.log("");
-      console.log(`Running at http://${displayHost}:${port}`);
-      console.log("");
-      console.log("Endpoints:");
-      console.log(`  POST http://${displayHost}:${port}/mcp - MCP JSON-RPC endpoint`);
-      console.log(`  GET  http://${displayHost}:${port}/health - Health check`);
-      console.log("");
-      console.log("OAuth 2.0 (MCP auth spec compliant):");
-      console.log(`  GET  http://${displayHost}:${port}/.well-known/oauth-authorization-server`);
-      console.log(`  POST http://${displayHost}:${port}/register - Dynamic Client Registration`);
-      console.log(`  GET  http://${displayHost}:${port}/authorize - Authorization endpoint`);
-      console.log(`  POST http://${displayHost}:${port}/token - Token endpoint`);
-      console.log("");
-      console.log("Authentication:");
-      console.log("  Option 1: OAuth flow (Claude Desktop will handle this automatically)");
-      console.log("  Option 2: Bearer token in Authorization header");
-      console.log("            Token format: base64(organizationId:apiToken:userId)");
-      console.log("");
-      if (!process.env.OAUTH_SECRET) {
-        console.log("⚠️  WARNING: OAUTH_SECRET not set. Set it in production!");
-        console.log('   export OAUTH_SECRET="your-random-secret-here"');
-        console.log("");
-      }
-      resolve(server);
-    });
-  });
-}
-const isMainModule = import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith("/productive-mcp-server") || process.argv[1]?.endsWith("\\productive-mcp-server");
-if (isMainModule) {
-  const port = Number.parseInt(process.env.PORT || String(DEFAULT_PORT), 10);
-  const host = process.env.HOST || DEFAULT_HOST;
-  startHttpServer(port, host).catch((error) => {
-    console.error("Fatal error:", error);
-    process.exit(1);
-  });
+	return new Promise((resolve) => {
+		const server = createServer(toNodeListener(createHttpApp()));
+		server.listen(port, host, () => {
+			const displayHost = host === "0.0.0.0" ? "localhost" : host;
+			console.log(`Productive MCP server v${VERSION}`);
+			console.log(`Node.js ${process.version}`);
+			console.log("");
+			console.log(`Running at http://${displayHost}:${port}`);
+			console.log("");
+			console.log("Endpoints:");
+			console.log(`  POST http://${displayHost}:${port}/mcp - MCP JSON-RPC endpoint`);
+			console.log(`  GET  http://${displayHost}:${port}/health - Health check`);
+			console.log("");
+			console.log("OAuth 2.0 (MCP auth spec compliant):");
+			console.log(`  GET  http://${displayHost}:${port}/.well-known/oauth-authorization-server`);
+			console.log(`  POST http://${displayHost}:${port}/register - Dynamic Client Registration`);
+			console.log(`  GET  http://${displayHost}:${port}/authorize - Authorization endpoint`);
+			console.log(`  POST http://${displayHost}:${port}/token - Token endpoint`);
+			console.log("");
+			console.log("Authentication:");
+			console.log("  Option 1: OAuth flow (Claude Desktop will handle this automatically)");
+			console.log("  Option 2: Bearer token in Authorization header");
+			console.log("            Token format: base64(organizationId:apiToken:userId)");
+			console.log("");
+			if (!process.env.OAUTH_SECRET) {
+				console.log("⚠️  WARNING: OAUTH_SECRET not set. Set it in production!");
+				console.log("   export OAUTH_SECRET=\"your-random-secret-here\"");
+				console.log("");
+			}
+			resolve(server);
+		});
+	});
 }
-export {
-  startHttpServer
-};
-//# sourceMappingURL=server.js.map
+if (import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith("/productive-mcp-server") || process.argv[1]?.endsWith("\\productive-mcp-server")) startHttpServer(Number.parseInt(process.env.PORT || String(DEFAULT_PORT), 10), process.env.HOST || DEFAULT_HOST).catch((error) => {
+	console.error("Fatal error:", error);
+	process.exit(1);
+});
+export { startHttpServer };
+
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sources":["../src/server.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * Productive MCP Server - HTTP Transport\n *\n * This is the remote HTTP server mode for Claude Desktop custom connectors.\n * Credentials are passed via Bearer token in the Authorization header.\n *\n * Token format: base64(organizationId:apiToken) or base64(organizationId:apiToken:userId)\n *\n * Generate your token:\n *   echo -n \"YOUR_ORG_ID:YOUR_API_TOKEN:YOUR_USER_ID\" | base64\n *\n * Usage:\n *   productive-mcp-server\n *   PORT=3000 productive-mcp-server\n *\n * Claude Desktop custom connector config:\n *   Name: Productive\n *   URL: https://productive.mcp.ikko.dev\n *   (No OAuth needed - uses Bearer token)\n */\n\nimport { toNodeListener } from 'h3';\nimport { createServer, type Server } from 'node:http';\n\nimport { createHttpApp } from './http.js';\nimport { VERSION } from './version.js';\n\nconst DEFAULT_PORT = 3000;\nconst DEFAULT_HOST = '0.0.0.0';\n\n/**\n * Start the HTTP server\n */\nexport function startHttpServer(\n  port: number = DEFAULT_PORT,\n  host: string = DEFAULT_HOST,\n): Promise<Server> {\n  return new Promise((resolve) => {\n    const app = createHttpApp();\n    const server = createServer(toNodeListener(app));\n\n    server.listen(port, host, () => {\n      const displayHost = host === '0.0.0.0' ? 'localhost' : host;\n      console.log(`Productive MCP server v${VERSION}`);\n      console.log(`Node.js ${process.version}`);\n      console.log('');\n      console.log(`Running at http://${displayHost}:${port}`);\n      console.log('');\n      console.log('Endpoints:');\n      console.log(`  POST http://${displayHost}:${port}/mcp - MCP JSON-RPC endpoint`);\n      console.log(`  GET  http://${displayHost}:${port}/health - Health check`);\n      console.log('');\n      console.log('OAuth 2.0 (MCP auth spec compliant):');\n      console.log(`  GET  http://${displayHost}:${port}/.well-known/oauth-authorization-server`);\n      console.log(`  POST http://${displayHost}:${port}/register - Dynamic Client Registration`);\n      console.log(`  GET  http://${displayHost}:${port}/authorize - Authorization endpoint`);\n      console.log(`  POST http://${displayHost}:${port}/token - Token endpoint`);\n      console.log('');\n      console.log('Authentication:');\n      console.log('  Option 1: OAuth flow (Claude Desktop will handle this automatically)');\n      console.log('  Option 2: Bearer token in Authorization header');\n      console.log('            Token format: base64(organizationId:apiToken:userId)');\n      console.log('');\n      if (!process.env.OAUTH_SECRET) {\n        console.log('⚠️  WARNING: OAUTH_SECRET not set. Set it in production!');\n        console.log('   export OAUTH_SECRET=\"your-random-secret-here\"');\n        console.log('');\n      }\n      resolve(server);\n    });\n  });\n}\n\n// Start server when run directly\nconst isMainModule =\n  import.meta.url === `file://${process.argv[1]}` ||\n  process.argv[1]?.endsWith('/productive-mcp-server') ||\n  process.argv[1]?.endsWith('\\\\productive-mcp-server');\n\nif (isMainModule) {\n  const port = Number.parseInt(process.env.PORT || String(DEFAULT_PORT), 10);\n  const host = process.env.HOST || DEFAULT_HOST;\n\n  startHttpServer(port, host).catch((error) => {\n    console.error('Fatal error:', error);\n    process.exit(1);\n  });\n}\n"],"names":[],"mappings":";;;;;AA6BA,MAAM,eAAe;AACrB,MAAM,eAAe;AAKd,SAAS,gBACd,OAAe,cACf,OAAe,cACE;AACjB,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,MAAM,cAAA;AACZ,UAAM,SAAS,aAAa,eAAe,GAAG,CAAC;AAE/C,WAAO,OAAO,MAAM,MAAM,MAAM;AAC9B,YAAM,cAAc,SAAS,YAAY,cAAc;AACvD,cAAQ,IAAI,0BAA0B,OAAO,EAAE;AAC/C,cAAQ,IAAI,WAAW,QAAQ,OAAO,EAAE;AACxC,cAAQ,IAAI,EAAE;AACd,cAAQ,IAAI,qBAAqB,WAAW,IAAI,IAAI,EAAE;AACtD,cAAQ,IAAI,EAAE;AACd,cAAQ,IAAI,YAAY;AACxB,cAAQ,IAAI,iBAAiB,WAAW,IAAI,IAAI,8BAA8B;AAC9E,cAAQ,IAAI,iBAAiB,WAAW,IAAI,IAAI,wBAAwB;AACxE,cAAQ,IAAI,EAAE;AACd,cAAQ,IAAI,sCAAsC;AAClD,cAAQ,IAAI,iBAAiB,WAAW,IAAI,IAAI,yCAAyC;AACzF,cAAQ,IAAI,iBAAiB,WAAW,IAAI,IAAI,yCAAyC;AACzF,cAAQ,IAAI,iBAAiB,WAAW,IAAI,IAAI,qCAAqC;AACrF,cAAQ,IAAI,iBAAiB,WAAW,IAAI,IAAI,yBAAyB;AACzE,cAAQ,IAAI,EAAE;AACd,cAAQ,IAAI,iBAAiB;AAC7B,cAAQ,IAAI,wEAAwE;AACpF,cAAQ,IAAI,kDAAkD;AAC9D,cAAQ,IAAI,kEAAkE;AAC9E,cAAQ,IAAI,EAAE;AACd,UAAI,CAAC,QAAQ,IAAI,cAAc;AAC7B,gBAAQ,IAAI,0DAA0D;AACtE,gBAAQ,IAAI,kDAAkD;AAC9D,gBAAQ,IAAI,EAAE;AAAA,MAChB;AACA,cAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AACH;AAGA,MAAM,eACJ,YAAY,QAAQ,UAAU,QAAQ,KAAK,CAAC,CAAC,MAC7C,QAAQ,KAAK,CAAC,GAAG,SAAS,wBAAwB,KAClD,QAAQ,KAAK,CAAC,GAAG,SAAS,yBAAyB;AAErD,IAAI,cAAc;AAChB,QAAM,OAAO,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,YAAY,GAAG,EAAE;AACzE,QAAM,OAAO,QAAQ,IAAI,QAAQ;AAEjC,kBAAgB,MAAM,IAAI,EAAE,MAAM,CAAC,UAAU;AAC3C,YAAQ,MAAM,gBAAgB,KAAK;AACnC,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACH;"}
+{"version":3,"file":"server.js","names":[],"sources":["../src/server.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * Productive MCP Server - HTTP Transport\n *\n * This is the remote HTTP server mode for Claude Desktop custom connectors.\n * Credentials are passed via Bearer token in the Authorization header.\n *\n * Token format: base64(organizationId:apiToken) or base64(organizationId:apiToken:userId)\n *\n * Generate your token:\n *   echo -n \"YOUR_ORG_ID:YOUR_API_TOKEN:YOUR_USER_ID\" | base64\n *\n * Usage:\n *   productive-mcp-server\n *   PORT=3000 productive-mcp-server\n *\n * Claude Desktop custom connector config:\n *   Name: Productive\n *   URL: https://productive.mcp.ikko.dev\n *   (No OAuth needed - uses Bearer token)\n */\n\nimport { toNodeListener } from 'h3';\nimport { createServer, type Server } from 'node:http';\n\nimport { createHttpApp } from './http.js';\nimport { VERSION } from './version.js';\n\nconst DEFAULT_PORT = 3000;\nconst DEFAULT_HOST = '0.0.0.0';\n\n/**\n * Start the HTTP server\n */\nexport function startHttpServer(\n  port: number = DEFAULT_PORT,\n  host: string = DEFAULT_HOST,\n): Promise<Server> {\n  return new Promise((resolve) => {\n    const app = createHttpApp();\n    const server = createServer(toNodeListener(app));\n\n    server.listen(port, host, () => {\n      const displayHost = host === '0.0.0.0' ? 'localhost' : host;\n      console.log(`Productive MCP server v${VERSION}`);\n      console.log(`Node.js ${process.version}`);\n      console.log('');\n      console.log(`Running at http://${displayHost}:${port}`);\n      console.log('');\n      console.log('Endpoints:');\n      console.log(`  POST http://${displayHost}:${port}/mcp - MCP JSON-RPC endpoint`);\n      console.log(`  GET  http://${displayHost}:${port}/health - Health check`);\n      console.log('');\n      console.log('OAuth 2.0 (MCP auth spec compliant):');\n      console.log(`  GET  http://${displayHost}:${port}/.well-known/oauth-authorization-server`);\n      console.log(`  POST http://${displayHost}:${port}/register - Dynamic Client Registration`);\n      console.log(`  GET  http://${displayHost}:${port}/authorize - Authorization endpoint`);\n      console.log(`  POST http://${displayHost}:${port}/token - Token endpoint`);\n      console.log('');\n      console.log('Authentication:');\n      console.log('  Option 1: OAuth flow (Claude Desktop will handle this automatically)');\n      console.log('  Option 2: Bearer token in Authorization header');\n      console.log('            Token format: base64(organizationId:apiToken:userId)');\n      console.log('');\n      if (!process.env.OAUTH_SECRET) {\n        console.log('⚠️  WARNING: OAUTH_SECRET not set. Set it in production!');\n        console.log('   export OAUTH_SECRET=\"your-random-secret-here\"');\n        console.log('');\n      }\n      resolve(server);\n    });\n  });\n}\n\n// Start server when run directly\nconst isMainModule =\n  import.meta.url === `file://${process.argv[1]}` ||\n  process.argv[1]?.endsWith('/productive-mcp-server') ||\n  process.argv[1]?.endsWith('\\\\productive-mcp-server');\n\nif (isMainModule) {\n  const port = Number.parseInt(process.env.PORT || String(DEFAULT_PORT), 10);\n  const host = process.env.HOST || DEFAULT_HOST;\n\n  startHttpServer(port, host).catch((error) => {\n    console.error('Fatal error:', error);\n    process.exit(1);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAM,eAAe;AACrB,IAAM,eAAe;;;;AAKrB,SAAgB,gBACd,OAAe,cACf,OAAe,cACE;AACjB,QAAO,IAAI,SAAS,YAAY;EAE9B,MAAM,SAAS,aAAa,eADhB,eAAe,CACoB,CAAC;AAEhD,SAAO,OAAO,MAAM,YAAY;GAC9B,MAAM,cAAc,SAAS,YAAY,cAAc;AACvD,WAAQ,IAAI,0BAA0B,UAAU;AAChD,WAAQ,IAAI,WAAW,QAAQ,UAAU;AACzC,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,qBAAqB,YAAY,GAAG,OAAO;AACvD,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,aAAa;AACzB,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,8BAA8B;AAC/E,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,wBAAwB;AACzE,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,uCAAuC;AACnD,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,yCAAyC;AAC1F,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,yCAAyC;AAC1F,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,qCAAqC;AACtF,WAAQ,IAAI,iBAAiB,YAAY,GAAG,KAAK,yBAAyB;AAC1E,WAAQ,IAAI,GAAG;AACf,WAAQ,IAAI,kBAAkB;AAC9B,WAAQ,IAAI,yEAAyE;AACrF,WAAQ,IAAI,mDAAmD;AAC/D,WAAQ,IAAI,mEAAmE;AAC/E,WAAQ,IAAI,GAAG;AACf,OAAI,CAAC,QAAQ,IAAI,cAAc;AAC7B,YAAQ,IAAI,2DAA2D;AACvE,YAAQ,IAAI,qDAAmD;AAC/D,YAAQ,IAAI,GAAG;;AAEjB,WAAQ,OAAO;IACf;GACF;;AASJ,IAJE,OAAO,KAAK,QAAQ,UAAU,QAAQ,KAAK,QAC3C,QAAQ,KAAK,IAAI,SAAS,yBAAyB,IACnD,QAAQ,KAAK,IAAI,SAAS,0BAA0B,CAMpD,iBAHa,OAAO,SAAS,QAAQ,IAAI,QAAQ,OAAO,aAAa,EAAE,GAAG,EAC7D,QAAQ,IAAI,QAAQ,aAEN,CAAC,OAAO,UAAU;AAC3C,SAAQ,MAAM,gBAAgB,MAAM;AACpC,SAAQ,KAAK,EAAE;EACf"}

package/dist/stdio.js

@@ -1,119 +1,99 @@
-import { getConfig, setConfig } from "@studiometa/productive-cli";
-import { e as executeToolWithCredentials } from "./index-CZpVCEu4.js";
-import { TOOLS, STDIO_ONLY_TOOLS } from "./tools.js";
+import { t as executeToolWithCredentials } from "./handlers-BYE2INiR.js";
+import "./handlers.js";
+import { STDIO_ONLY_TOOLS, TOOLS } from "./tools.js";
+import { getConfig, setConfig } from "@studiometa/productive-api";
+/**
+* Get all available tools (including stdio-only configuration tools)
+*/
 function getAvailableTools() {
-  return [...TOOLS, ...STDIO_ONLY_TOOLS];
+	return [...TOOLS, ...STDIO_ONLY_TOOLS];
 }
+/**
+* Get available prompts
+*/
 function getAvailablePrompts() {
-  return [
-    {
-      name: "setup_productive",
-      description: "Interactive setup for Productive.io credentials",
-      arguments: []
-    }
-  ];
+	return [{
+		name: "setup_productive",
+		description: "Interactive setup for Productive.io credentials",
+		arguments: []
+	}];
 }
+/**
+* Handle the setup_productive prompt
+*/
 async function handleSetupPrompt() {
-  const config = await getConfig();
-  const hasConfig = !!(config.organizationId && config.apiToken);
-  return {
-    messages: [
-      {
-        role: "user",
-        content: {
-          type: "text",
-          text: hasConfig ? "I have already configured Productive.io credentials. Would you like to update them?" : "I need to configure my Productive.io credentials. Please help me set up:\n1. Organization ID\n2. API Token\n3. User ID (optional)"
-        }
-      }
-    ]
-  };
+	const config = await getConfig();
+	return { messages: [{
+		role: "user",
+		content: {
+			type: "text",
+			text: !!(config.organizationId && config.apiToken) ? "I have already configured Productive.io credentials. Would you like to update them?" : "I need to configure my Productive.io credentials. Please help me set up:\n1. Organization ID\n2. API Token\n3. User ID (optional)"
+		}
+	}] };
 }
+/**
+* Handle the productive_configure tool
+*/
 async function handleConfigureTool(args) {
-  const { organizationId, apiToken, userId } = args;
-  await setConfig("organizationId", organizationId);
-  await setConfig("apiToken", apiToken);
-  if (userId) {
-    await setConfig("userId", userId);
-  }
-  return {
-    content: [
-      {
-        type: "text",
-        text: JSON.stringify(
-          {
-            success: true,
-            message: "Productive.io credentials configured successfully",
-            configured: {
-              organizationId,
-              userId: userId || "not set",
-              apiToken: "***" + apiToken.slice(-4)
-            }
-          },
-          null,
-          2
-        )
-      }
-    ]
-  };
+	const { organizationId, apiToken, userId } = args;
+	await setConfig("organizationId", organizationId);
+	await setConfig("apiToken", apiToken);
+	if (userId) await setConfig("userId", userId);
+	return { content: [{
+		type: "text",
+		text: JSON.stringify({
+			success: true,
+			message: "Productive.io credentials configured successfully",
+			configured: {
+				organizationId,
+				userId: userId || "not set",
+				apiToken: "***" + apiToken.slice(-4)
+			}
+		}, null, 2)
+	}] };
 }
+/**
+* Handle the productive_get_config tool
+*/
 async function handleGetConfigTool() {
-  const currentConfig = await getConfig();
-  return {
-    content: [
-      {
-        type: "text",
-        text: JSON.stringify(
-          {
-            organizationId: currentConfig.organizationId || "not configured",
-            userId: currentConfig.userId || "not configured",
-            apiToken: currentConfig.apiToken ? "***" + currentConfig.apiToken.slice(-4) : "not configured",
-            configured: !!(currentConfig.organizationId && currentConfig.apiToken)
-          },
-          null,
-          2
-        )
-      }
-    ]
-  };
+	const currentConfig = await getConfig();
+	return { content: [{
+		type: "text",
+		text: JSON.stringify({
+			organizationId: currentConfig.organizationId || "not configured",
+			userId: currentConfig.userId || "not configured",
+			apiToken: currentConfig.apiToken ? "***" + currentConfig.apiToken.slice(-4) : "not configured",
+			configured: !!(currentConfig.organizationId && currentConfig.apiToken)
+		}, null, 2)
+	}] };
 }
+/**
+* Handle a tool call request
+*/
 async function handleToolCall(name, args) {
-  if (name === "productive_configure") {
-    return handleConfigureTool(args);
-  }
-  if (name === "productive_get_config") {
-    return handleGetConfigTool();
-  }
-  const config = await getConfig();
-  if (!config.organizationId || !config.apiToken) {
-    return {
-      content: [
-        {
-          type: "text",
-          text: 'Error: Productive.io credentials not configured. Please use the "productive_configure" tool to set your credentials, or set PRODUCTIVE_ORG_ID and PRODUCTIVE_API_TOKEN environment variables.'
-        }
-      ],
-      isError: true
-    };
-  }
-  return executeToolWithCredentials(name, args, {
-    organizationId: config.organizationId,
-    apiToken: config.apiToken,
-    userId: config.userId
-  });
+	if (name === "productive_configure") return handleConfigureTool(args);
+	if (name === "productive_get_config") return handleGetConfigTool();
+	const config = await getConfig();
+	if (!config.organizationId || !config.apiToken) return {
+		content: [{
+			type: "text",
+			text: "Error: Productive.io credentials not configured. Please use the \"productive_configure\" tool to set your credentials, or set PRODUCTIVE_ORG_ID and PRODUCTIVE_API_TOKEN environment variables."
+		}],
+		isError: true
+	};
+	return executeToolWithCredentials(name, args, {
+		organizationId: config.organizationId,
+		apiToken: config.apiToken,
+		userId: config.userId
+	});
 }
+/**
+* Handle a prompt request
+*/
 async function handlePrompt(name) {
-  if (name === "setup_productive") {
-    return handleSetupPrompt();
-  }
-  throw new Error(`Unknown prompt: ${name}`);
+	if (name === "setup_productive") return handleSetupPrompt();
+	throw new Error(`Unknown prompt: ${name}`);
 }
-export {
-  getAvailablePrompts,
-  getAvailableTools,
-  handleConfigureTool,
-  handleGetConfigTool,
-  handlePrompt,
-  handleSetupPrompt,
-  handleToolCall
-};
-//# sourceMappingURL=stdio.js.map
+export { getAvailablePrompts, getAvailableTools, handleConfigureTool, handleGetConfigTool, handlePrompt, handleSetupPrompt, handleToolCall };
+
+//# sourceMappingURL=stdio.js.map

package/dist/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sources":["../src/stdio.ts"],"sourcesContent":["/**\n * Stdio transport handlers for Productive MCP Server\n *\n * This module contains the handler logic for the stdio transport.\n * The actual server startup is in index.ts.\n */\n\nimport type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';\n\nimport { getConfig, setConfig } from '@studiometa/productive-cli';\n\nimport { executeToolWithCredentials } from './handlers.js';\nimport { TOOLS, STDIO_ONLY_TOOLS } from './tools.js';\n\nexport type ToolResult = CallToolResult;\n\n/**\n * Get all available tools (including stdio-only configuration tools)\n */\nexport function getAvailableTools() {\n  return [...TOOLS, ...STDIO_ONLY_TOOLS];\n}\n\n/**\n * Get available prompts\n */\nexport function getAvailablePrompts() {\n  return [\n    {\n      name: 'setup_productive',\n      description: 'Interactive setup for Productive.io credentials',\n      arguments: [],\n    },\n  ];\n}\n\n/**\n * Handle the setup_productive prompt\n */\nexport async function handleSetupPrompt(): Promise<{\n  messages: Array<{ role: string; content: { type: string; text: string } }>;\n}> {\n  const config = await getConfig();\n  const hasConfig = !!(config.organizationId && config.apiToken);\n\n  return {\n    messages: [\n      {\n        role: 'user',\n        content: {\n          type: 'text',\n          text: hasConfig\n            ? 'I have already configured Productive.io credentials. Would you like to update them?'\n            : 'I need to configure my Productive.io credentials. Please help me set up:\\n1. Organization ID\\n2. API Token\\n3. User ID (optional)',\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Handle the productive_configure tool\n */\nexport async function handleConfigureTool(args: {\n  organizationId: string;\n  apiToken: string;\n  userId?: string;\n}): Promise<ToolResult> {\n  const { organizationId, apiToken, userId } = args;\n\n  await setConfig('organizationId', organizationId);\n  await setConfig('apiToken', apiToken);\n  if (userId) {\n    await setConfig('userId', userId);\n  }\n\n  return {\n    content: [\n      {\n        type: 'text',\n        text: JSON.stringify(\n          {\n            success: true,\n            message: 'Productive.io credentials configured successfully',\n            configured: {\n              organizationId,\n              userId: userId || 'not set',\n              apiToken: '***' + apiToken.slice(-4),\n            },\n          },\n          null,\n          2,\n        ),\n      },\n    ],\n  };\n}\n\n/**\n * Handle the productive_get_config tool\n */\nexport async function handleGetConfigTool(): Promise<ToolResult> {\n  const currentConfig = await getConfig();\n  return {\n    content: [\n      {\n        type: 'text',\n        text: JSON.stringify(\n          {\n            organizationId: currentConfig.organizationId || 'not configured',\n            userId: currentConfig.userId || 'not configured',\n            apiToken: currentConfig.apiToken\n              ? '***' + currentConfig.apiToken.slice(-4)\n              : 'not configured',\n            configured: !!(currentConfig.organizationId && currentConfig.apiToken),\n          },\n          null,\n          2,\n        ),\n      },\n    ],\n  };\n}\n\n/**\n * Handle a tool call request\n */\nexport async function handleToolCall(\n  name: string,\n  args: Record<string, unknown>,\n): Promise<ToolResult> {\n  // Handle stdio-only configuration tools\n  if (name === 'productive_configure') {\n    return handleConfigureTool(args as Parameters<typeof handleConfigureTool>[0]);\n  }\n\n  if (name === 'productive_get_config') {\n    return handleGetConfigTool();\n  }\n\n  // Get config for API tools\n  const config = await getConfig();\n  if (!config.organizationId || !config.apiToken) {\n    return {\n      content: [\n        {\n          type: 'text',\n          text: 'Error: Productive.io credentials not configured. Please use the \"productive_configure\" tool to set your credentials, or set PRODUCTIVE_ORG_ID and PRODUCTIVE_API_TOKEN environment variables.',\n        },\n      ],\n      isError: true,\n    };\n  }\n\n  // Execute tool with credentials from config\n  return executeToolWithCredentials(name, args, {\n    organizationId: config.organizationId,\n    apiToken: config.apiToken,\n    userId: config.userId,\n  });\n}\n\n/**\n * Handle a prompt request\n */\nexport async function handlePrompt(name: string): Promise<{\n  messages: Array<{ role: string; content: { type: string; text: string } }>;\n}> {\n  if (name === 'setup_productive') {\n    return handleSetupPrompt();\n  }\n\n  throw new Error(`Unknown prompt: ${name}`);\n}\n"],"names":[],"mappings":";;;AAmBO,SAAS,oBAAoB;AAClC,SAAO,CAAC,GAAG,OAAO,GAAG,gBAAgB;AACvC;AAKO,SAAS,sBAAsB;AACpC,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,aAAa;AAAA,MACb,WAAW,CAAA;AAAA,IAAC;AAAA,EACd;AAEJ;AAKA,eAAsB,oBAEnB;AACD,QAAM,SAAS,MAAM,UAAA;AACrB,QAAM,YAAY,CAAC,EAAE,OAAO,kBAAkB,OAAO;AAErD,SAAO;AAAA,IACL,UAAU;AAAA,MACR;AAAA,QACE,MAAM;AAAA,QACN,SAAS;AAAA,UACP,MAAM;AAAA,UACN,MAAM,YACF,wFACA;AAAA,QAAA;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEJ;AAKA,eAAsB,oBAAoB,MAIlB;AACtB,QAAM,EAAE,gBAAgB,UAAU,OAAA,IAAW;AAE7C,QAAM,UAAU,kBAAkB,cAAc;AAChD,QAAM,UAAU,YAAY,QAAQ;AACpC,MAAI,QAAQ;AACV,UAAM,UAAU,UAAU,MAAM;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,UACT;AAAA,YACE,SAAS;AAAA,YACT,SAAS;AAAA,YACT,YAAY;AAAA,cACV;AAAA,cACA,QAAQ,UAAU;AAAA,cAClB,UAAU,QAAQ,SAAS,MAAM,EAAE;AAAA,YAAA;AAAA,UACrC;AAAA,UAEF;AAAA,UACA;AAAA,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEJ;AAKA,eAAsB,sBAA2C;AAC/D,QAAM,gBAAgB,MAAM,UAAA;AAC5B,SAAO;AAAA,IACL,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,UACT;AAAA,YACE,gBAAgB,cAAc,kBAAkB;AAAA,YAChD,QAAQ,cAAc,UAAU;AAAA,YAChC,UAAU,cAAc,WACpB,QAAQ,cAAc,SAAS,MAAM,EAAE,IACvC;AAAA,YACJ,YAAY,CAAC,EAAE,cAAc,kBAAkB,cAAc;AAAA,UAAA;AAAA,UAE/D;AAAA,UACA;AAAA,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEJ;AAKA,eAAsB,eACpB,MACA,MACqB;AAErB,MAAI,SAAS,wBAAwB;AACnC,WAAO,oBAAoB,IAAiD;AAAA,EAC9E;AAEA,MAAI,SAAS,yBAAyB;AACpC,WAAO,oBAAA;AAAA,EACT;AAGA,QAAM,SAAS,MAAM,UAAA;AACrB,MAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,UAAU;AAC9C,WAAO;AAAA,MACL,SAAS;AAAA,QACP;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,QAAA;AAAA,MACR;AAAA,MAEF,SAAS;AAAA,IAAA;AAAA,EAEb;AAGA,SAAO,2BAA2B,MAAM,MAAM;AAAA,IAC5C,gBAAgB,OAAO;AAAA,IACvB,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,EAAA,CAChB;AACH;AAKA,eAAsB,aAAa,MAEhC;AACD,MAAI,SAAS,oBAAoB;AAC/B,WAAO,kBAAA;AAAA,EACT;AAEA,QAAM,IAAI,MAAM,mBAAmB,IAAI,EAAE;AAC3C;"}
+{"version":3,"file":"stdio.js","names":[],"sources":["../src/stdio.ts"],"sourcesContent":["/**\n * Stdio transport handlers for Productive MCP Server\n *\n * This module contains the handler logic for the stdio transport.\n * The actual server startup is in index.ts.\n */\n\nimport type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';\n\nimport { getConfig, setConfig } from '@studiometa/productive-api';\n\nimport { executeToolWithCredentials } from './handlers.js';\nimport { TOOLS, STDIO_ONLY_TOOLS } from './tools.js';\n\nexport type ToolResult = CallToolResult;\n\n/**\n * Get all available tools (including stdio-only configuration tools)\n */\nexport function getAvailableTools() {\n  return [...TOOLS, ...STDIO_ONLY_TOOLS];\n}\n\n/**\n * Get available prompts\n */\nexport function getAvailablePrompts() {\n  return [\n    {\n      name: 'setup_productive',\n      description: 'Interactive setup for Productive.io credentials',\n      arguments: [],\n    },\n  ];\n}\n\n/**\n * Handle the setup_productive prompt\n */\nexport async function handleSetupPrompt(): Promise<{\n  messages: Array<{ role: string; content: { type: string; text: string } }>;\n}> {\n  const config = await getConfig();\n  const hasConfig = !!(config.organizationId && config.apiToken);\n\n  return {\n    messages: [\n      {\n        role: 'user',\n        content: {\n          type: 'text',\n          text: hasConfig\n            ? 'I have already configured Productive.io credentials. Would you like to update them?'\n            : 'I need to configure my Productive.io credentials. Please help me set up:\\n1. Organization ID\\n2. API Token\\n3. User ID (optional)',\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Handle the productive_configure tool\n */\nexport async function handleConfigureTool(args: {\n  organizationId: string;\n  apiToken: string;\n  userId?: string;\n}): Promise<ToolResult> {\n  const { organizationId, apiToken, userId } = args;\n\n  await setConfig('organizationId', organizationId);\n  await setConfig('apiToken', apiToken);\n  if (userId) {\n    await setConfig('userId', userId);\n  }\n\n  return {\n    content: [\n      {\n        type: 'text',\n        text: JSON.stringify(\n          {\n            success: true,\n            message: 'Productive.io credentials configured successfully',\n            configured: {\n              organizationId,\n              userId: userId || 'not set',\n              apiToken: '***' + apiToken.slice(-4),\n            },\n          },\n          null,\n          2,\n        ),\n      },\n    ],\n  };\n}\n\n/**\n * Handle the productive_get_config tool\n */\nexport async function handleGetConfigTool(): Promise<ToolResult> {\n  const currentConfig = await getConfig();\n  return {\n    content: [\n      {\n        type: 'text',\n        text: JSON.stringify(\n          {\n            organizationId: currentConfig.organizationId || 'not configured',\n            userId: currentConfig.userId || 'not configured',\n            apiToken: currentConfig.apiToken\n              ? '***' + currentConfig.apiToken.slice(-4)\n              : 'not configured',\n            configured: !!(currentConfig.organizationId && currentConfig.apiToken),\n          },\n          null,\n          2,\n        ),\n      },\n    ],\n  };\n}\n\n/**\n * Handle a tool call request\n */\nexport async function handleToolCall(\n  name: string,\n  args: Record<string, unknown>,\n): Promise<ToolResult> {\n  // Handle stdio-only configuration tools\n  if (name === 'productive_configure') {\n    return handleConfigureTool(args as Parameters<typeof handleConfigureTool>[0]);\n  }\n\n  if (name === 'productive_get_config') {\n    return handleGetConfigTool();\n  }\n\n  // Get config for API tools\n  const config = await getConfig();\n  if (!config.organizationId || !config.apiToken) {\n    return {\n      content: [\n        {\n          type: 'text',\n          text: 'Error: Productive.io credentials not configured. Please use the \"productive_configure\" tool to set your credentials, or set PRODUCTIVE_ORG_ID and PRODUCTIVE_API_TOKEN environment variables.',\n        },\n      ],\n      isError: true,\n    };\n  }\n\n  // Execute tool with credentials from config\n  return executeToolWithCredentials(name, args, {\n    organizationId: config.organizationId,\n    apiToken: config.apiToken,\n    userId: config.userId,\n  });\n}\n\n/**\n * Handle a prompt request\n */\nexport async function handlePrompt(name: string): Promise<{\n  messages: Array<{ role: string; content: { type: string; text: string } }>;\n}> {\n  if (name === 'setup_productive') {\n    return handleSetupPrompt();\n  }\n\n  throw new Error(`Unknown prompt: ${name}`);\n}\n"],"mappings":";;;;;;;AAmBA,SAAgB,oBAAoB;AAClC,QAAO,CAAC,GAAG,OAAO,GAAG,iBAAiB;;;;;AAMxC,SAAgB,sBAAsB;AACpC,QAAO,CACL;EACE,MAAM;EACN,aAAa;EACb,WAAW,EAAE;EACd,CACF;;;;;AAMH,eAAsB,oBAEnB;CACD,MAAM,SAAS,MAAM,WAAW;AAGhC,QAAO,EACL,UAAU,CACR;EACE,MAAM;EACN,SAAS;GACP,MAAM;GACN,MARU,CAAC,EAAE,OAAO,kBAAkB,OAAO,YASzC,wFACA;GACL;EACF,CACF,EACF;;;;;AAMH,eAAsB,oBAAoB,MAIlB;CACtB,MAAM,EAAE,gBAAgB,UAAU,WAAW;AAE7C,OAAM,UAAU,kBAAkB,eAAe;AACjD,OAAM,UAAU,YAAY,SAAS;AACrC,KAAI,OACF,OAAM,UAAU,UAAU,OAAO;AAGnC,QAAO,EACL,SAAS,CACP;EACE,MAAM;EACN,MAAM,KAAK,UACT;GACE,SAAS;GACT,SAAS;GACT,YAAY;IACV;IACA,QAAQ,UAAU;IAClB,UAAU,QAAQ,SAAS,MAAM,GAAG;IACrC;GACF,EACD,MACA,EACD;EACF,CACF,EACF;;;;;AAMH,eAAsB,sBAA2C;CAC/D,MAAM,gBAAgB,MAAM,WAAW;AACvC,QAAO,EACL,SAAS,CACP;EACE,MAAM;EACN,MAAM,KAAK,UACT;GACE,gBAAgB,cAAc,kBAAkB;GAChD,QAAQ,cAAc,UAAU;GAChC,UAAU,cAAc,WACpB,QAAQ,cAAc,SAAS,MAAM,GAAG,GACxC;GACJ,YAAY,CAAC,EAAE,cAAc,kBAAkB,cAAc;GAC9D,EACD,MACA,EACD;EACF,CACF,EACF;;;;;AAMH,eAAsB,eACpB,MACA,MACqB;AAErB,KAAI,SAAS,uBACX,QAAO,oBAAoB,KAAkD;AAG/E,KAAI,SAAS,wBACX,QAAO,qBAAqB;CAI9B,MAAM,SAAS,MAAM,WAAW;AAChC,KAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,SACpC,QAAO;EACL,SAAS,CACP;GACE,MAAM;GACN,MAAM;GACP,CACF;EACD,SAAS;EACV;AAIH,QAAO,2BAA2B,MAAM,MAAM;EAC5C,gBAAgB,OAAO;EACvB,UAAU,OAAO;EACjB,QAAQ,OAAO;EAChB,CAAC;;;;;AAMJ,eAAsB,aAAa,MAEhC;AACD,KAAI,SAAS,mBACX,QAAO,mBAAmB;AAG5B,OAAM,IAAI,MAAM,mBAAmB,OAAO"}