@timetick/mcp 0.3.1 → 0.3.2

package/README.md

@@ -1,19 +1,21 @@
 # @timetick/mcp
 
-Run [Timetick](https://timetick.io) from your AI client. Say "I want to test my CSMS" and the agent signs you in, sets up simulators, runs the test and explains the result. It works with OCPP 1.6 and 2.0.1, and can test a CSMS or a real charger.
+Run [Timetick](https://timetick.io) from your AI client. Say "I want to test my CSMS" and the agent sets up simulators, runs the test and explains the result. It works with OCPP 1.6 and 2.0.1, and can test a CSMS or a real charger.
 
 ## Install
 
+Sign up at [app.timetick.io](https://app.timetick.io) and create your first project. Open the user menu, choose **API keys** and create a key. Then add the server with that key.
+
 Claude Code:
 
 ```
-claude mcp add timetick -- npx -y @timetick/mcp@latest
+claude mcp add timetick -e TIMETICK_API_TOKEN=your_api_key -- npx -y @timetick/mcp@latest
 ```
 
 Codex:
 
 ```
-codex mcp add timetick -- npx -y @timetick/mcp@latest
+codex mcp add timetick --env TIMETICK_API_TOKEN=your_api_key -- npx -y @timetick/mcp@latest
 ```
 
 Gemini CLI, Claude Desktop, Cursor and other MCP clients:
@@ -23,7 +25,8 @@ Gemini CLI, Claude Desktop, Cursor and other MCP clients:
   "mcpServers": {
     "timetick": {
       "command": "npx",
-      "args": ["-y", "@timetick/mcp@latest"]
+      "args": ["-y", "@timetick/mcp@latest"],
+      "env": { "TIMETICK_API_TOKEN": "your_api_key" }
     }
   }
 }
@@ -31,15 +34,7 @@ Gemini CLI, Claude Desktop, Cursor and other MCP clients:
 
 Keep `@latest` so you stay on the current version.
 
-## Sign in
-
-Ask the agent to log in to Timetick. A page opens in your browser where you can sign in, create an account or paste an API key. Your password stays out of the AI conversation.
-
-If you use Google or LinkedIn to sign in, create an API key in the portal under **API keys** and paste it on that page.
-
-On a machine with no browser, such as over SSH, set `TIMETICK_API_TOKEN` to your API key in the client config.
-
-To switch accounts, ask the agent to log in again. To use two accounts at once, add the server twice, each with its own `TIMETICK_API_TOKEN`.
+To switch accounts, change `TIMETICK_API_TOKEN` and restart the client. To use two accounts at once, add the server twice, each with its own `TIMETICK_API_TOKEN`.
 
 ## Test your CSMS
 
@@ -59,7 +54,7 @@ Your charger connects to Timetick's CSMS. Someone at the charger does the physic
 - Read results and OCPP logs
 - Manage projects, tags and API keys
 
-Some things still need the [portal](https://app.timetick.io): billing, resetting a password, and security profiles (Basic Auth or certificates towards a CSMS).
+Some things still need the [portal](https://app.timetick.io): signing up, billing, resetting a password, and security profiles (Basic Auth or certificates towards a CSMS).
 
 ## Projects and trial
 
@@ -71,7 +66,7 @@ If you have several projects, tell the agent which one to use.
 
 ## Read-only mode
 
-Set `TIMETICK_MCP_READONLY=1` and the agent can read your data but not change it. You can still sign in and out.
+Set `TIMETICK_MCP_READONLY=1` and the agent can read your data but not change it.
 
 ## Help
 

package/dist/index.js

@@ -4,53 +4,10 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
-// src/auth/credentials.ts
-import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
-var DEFAULT_API_ENDPOINT = "https://app.timetick.io/graphql";
-function apiEndpoint() {
-  return process.env.TIMETICK_API_URL ?? DEFAULT_API_ENDPOINT;
-}
-function credentialFilePath() {
-  return process.env.TIMETICK_CREDENTIALS_PATH ?? join(homedir(), ".timetick", "credentials.json");
-}
-var cached;
-async function loadCredentials(reload = false) {
-  if (cached !== void 0 && !reload) return cached;
-  const text = await readFile(credentialFilePath(), "utf8").catch(() => null);
-  const parsed = text ? safeParse(text) : null;
-  cached = parsed?.apiKey && parsed.endpoint === apiEndpoint() ? parsed : null;
-  return cached;
-}
-function safeParse(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return null;
-  }
-}
-function peekCredentials() {
-  return cached ?? null;
-}
-async function saveCredentials(credentials) {
-  const path = credentialFilePath();
-  await mkdir(dirname(path), { recursive: true, mode: 448 });
-  await writeFile(path, `${JSON.stringify(credentials, null, 2)}
-`, { mode: 384 });
-  await chmod(path, 384).catch(() => {
-  });
-  cached = credentials;
-}
-async function clearCredentials() {
-  cached = null;
-  await rm(credentialFilePath(), { force: true });
-}
-
 // src/instructions.ts
-var SERVER_INSTRUCTIONS = `Timetick simulates EV chargers (OCPP 1.6 / 2.0.1) and runs tests against a CSMS: the user's own or Timetick's. Day-to-day work runs through these tools. The web portal is still needed for billing, API keys on Google or LinkedIn accounts, resetting a password, and security profiles (Basic Auth or certificates towards a CSMS).
+var SERVER_INSTRUCTIONS = `Timetick simulates EV chargers (OCPP 1.6 / 2.0.1) and runs tests against a CSMS: the user's own or Timetick's. Day-to-day work runs through these tools. The web portal is still needed for signing up, the first API key, billing, resetting a password, and security profiles (Basic Auth or certificates towards a CSMS).
 
-Sign-in: call whoami. If not logged in, call login, which opens a local browser page for sign-in or sign-up. Never ask for passwords or API keys in chat.
+Sign-in: call whoami. If no API key is configured, ask the user to create one in the portal under API keys, set it as TIMETICK_API_TOKEN in the client config and restart the client. Never ask for passwords or API keys in chat.
 
 Pick the setup from what is under test:
 - The user's CSMS: simulators connect to it. create_endpoint type EXTERNAL with its public ws(s):// URL; Timetick connects from the cloud, so localhost or private addresses cannot work, and the CSMS must accept the simulator name as the charge point identity. Simulators perform charger-side steps automatically. A Remote: step waits up to 10 minutes for the user's CSMS to send that command, so tell the user what to send and when. It passes or fails on its own from expected results; without them use complete_test_step or fail_test_step.
@@ -69,15 +26,33 @@ function allowSlowConnections() {
 
 // src/tools/auth.ts
 import { z } from "zod";
-import { TimetickError as TimetickError3 } from "@timetick/sdk";
+import { TimetickError as TimetickError2 } from "@timetick/sdk";
 
-// src/auth/browser-login.ts
-import { createServer } from "http";
-import { spawn } from "child_process";
-import { randomBytes } from "crypto";
+// src/sdk.ts
+import { createClient } from "@timetick/sdk";
 
-// src/result.ts
-import { TimetickError } from "@timetick/sdk";
+// src/links.ts
+var DEFAULT_API_ENDPOINT = "https://app.timetick.io/graphql";
+function portalUrl(path = "/") {
+  return new URL(path, process.env.TIMETICK_API_URL ?? DEFAULT_API_ENDPOINT).toString();
+}
+var SIMULATOR_PATH = /\/projects\/([^/?#&|>\s]+)\/simulators\/([^/?#&|>\s]+)/;
+function looksLikeLink(text) {
+  return /^<?https?:\/\//i.test(text) || /(^|\.)timetick\.io\//i.test(text);
+}
+function parseSimulatorRef(input) {
+  const text = input.trim();
+  if (!looksLikeLink(text)) return { simulator: text };
+  const unescaped = text.replace(/&amp;/g, "&");
+  const match = unescaped.match(SIMULATOR_PATH);
+  if (!match) {
+    throw new Error(
+      `"${input}" looks like a link but not to a simulator. Expected https://app.timetick.io/projects/<project id>/simulators/<simulator id>.`
+    );
+  }
+  return { project: decodeURIComponent(match[1]), simulator: decodeURIComponent(match[2]) };
+}
+var SIMULATOR_ARG_DESCRIPTION = "Simulator id, base name, or portal link (https://app.timetick.io/projects/<id>/simulators/<id>)";
 
 // src/version.ts
 import { readFileSync } from "fs";
@@ -107,7 +82,25 @@ async function updateNotice() {
   return `A newer Timetick MCP server is available: ${newest} (running ${VERSION}). ${UPDATE_HOW_TO}`;
 }
 
+// src/sdk.ts
+function notLoggedInMessage() {
+  return `No API key configured. Ask the user to sign in at ${portalUrl()}, create a key under API keys in the user menu, set it as TIMETICK_API_TOKEN in the client config and restart the client. Never ask for the key in chat.`;
+}
+var client = null;
+function sdk() {
+  if (client) return client;
+  const apiKey = process.env.TIMETICK_API_TOKEN;
+  if (!apiKey) throw new Error(notLoggedInMessage());
+  client = createClient({
+    apiKey,
+    endpoint: process.env.TIMETICK_API_URL,
+    headers: CLIENT_HEADER
+  });
+  return client;
+}
+
 // src/result.ts
+import { TimetickError } from "@timetick/sdk";
 var KEY_RENAMES = {
   chargerActions: "steps",
   scenarioAction: "step",
@@ -265,7 +258,7 @@ function describeApiError(err) {
     return `This version of the Timetick MCP server (${VERSION}) no longer matches the Timetick API, so the request was rejected before anything ran. ${UPDATE_HOW_TO} If it is already the newest version, report this to support@timetick.io. Details: ${err.message}`;
   }
   if (/not authenticated/i.test(err.message)) {
-    return process.env.TIMETICK_API_TOKEN ? "Timetick rejected the API key in TIMETICK_API_TOKEN (revoked, expired or disabled). Replace it in the client config." : "Timetick rejected the API key (revoked, expired or disabled). Call `whoami`, which picks up a key stored by another session; if it is still rejected, call `login`.";
+    return "Timetick rejected the API key in TIMETICK_API_TOKEN (revoked, expired or disabled). Replace it in the client config.";
   }
   if (/trial is not available/i.test(err.message)) {
     return "This account has used its free trial, so this needs a paid plan, which is set up in the web portal.";
@@ -299,401 +292,70 @@ async function guard(fn) {
   }
 }
 
-// src/auth/platform.ts
-import { hostname } from "os";
-import { TimetickError as TimetickError2 } from "@timetick/sdk";
-async function request(operationName, query, variables, headers = {}) {
-  const res = await fetch(apiEndpoint(), {
-    method: "POST",
-    headers: { "content-type": "application/json", ...CLIENT_HEADER, ...headers },
-    body: JSON.stringify({ operationName, query, variables })
-  });
-  const body = await res.json().catch(() => null);
-  if (body?.errors?.length) {
-    throw new TimetickError2(body.errors);
-  }
-  if (!body?.data) {
-    throw new Error(
-      res.status >= 500 ? `Timetick is not responding properly (HTTP ${res.status}). Try again shortly.` : `${apiEndpoint()} did not answer like the Timetick API (HTTP ${res.status}). Check TIMETICK_API_URL.`
-    );
-  }
-  return { data: body.data, setCookie: res.headers.getSetCookie?.() ?? [] };
-}
-var SIGN_IN_MUTATION = `
-  mutation SignIn($email: String!, $password: String!) {
-    signIn(email: $email, password: $password) {
-      id
-      email
-      firstName
-      lastName
-    }
-  }
-`;
-var SIGN_UP_MUTATION = `
-  mutation SignUp($email: String!, $password: String!, $firstName: String, $lastName: String, $companyName: String) {
-    signUp(email: $email, password: $password, firstName: $firstName, lastName: $lastName, companyName: $companyName) {
-      id
-    }
-  }
-`;
-var CREATE_API_KEY_MUTATION = `
-  mutation CreateApiKey($name: String!) {
-    createApiKey(name: $name, enabled: true) {
-      apiKey { id name createdAt }
-      secretKey
-    }
-  }
-`;
-var DELETE_API_KEY_MUTATION = `
-  mutation DeleteApiKey($id: ID!) {
-    deleteApiKey(id: $id)
-  }
-`;
-var SESSION_USER_QUERY = `
-  query SessionUser {
-    currentUser {
-      id
-      email
-      firstName
-      lastName
-      companyName
-    }
-  }
-`;
-function extractSessionCookie(setCookie) {
-  for (const cookie of setCookie) {
-    const [pair] = cookie.split(";");
-    const [name, ...rest] = pair.split("=");
-    if (name?.trim() === "sessionID") {
-      const value = rest.join("=");
-      return value ? `sessionID=${value}` : null;
-    }
-  }
-  return null;
-}
-async function signIn(email, password) {
-  const { data, setCookie } = await request("SignIn", SIGN_IN_MUTATION, { email, password });
-  if (!data.signIn) throw new Error("Sign-in failed: wrong email or password.");
-  const sessionCookie = extractSessionCookie(setCookie);
-  if (!sessionCookie) {
-    throw new Error("Signed in but the platform did not return a session cookie.");
-  }
-  return { sessionCookie, user: data.signIn };
-}
-async function signUp(input) {
-  await request("SignUp", SIGN_UP_MUTATION, input);
-}
-async function createApiKey(sessionCookie, name) {
-  const { data } = await request("CreateApiKey", CREATE_API_KEY_MUTATION, { name }, { cookie: sessionCookie });
-  const response = data.createApiKey;
-  if (!response?.secretKey || !response.apiKey?.id) {
-    throw new Error("The platform accepted the login but did not return an API key.");
-  }
-  return { id: response.apiKey.id, secretKey: response.secretKey };
-}
-async function deleteApiKey(apiKey, id) {
-  const { data } = await request("DeleteApiKey", DELETE_API_KEY_MUTATION, { id }, { "x-api-key": apiKey });
-  if (data.deleteApiKey === "ERROR") throw new Error("The platform could not delete the key.");
-}
-async function fetchSessionUser(apiKey) {
-  const { data } = await request("SessionUser", SESSION_USER_QUERY, {}, { "x-api-key": apiKey });
-  return data.currentUser ?? null;
-}
-function displayName(user) {
-  return [user.firstName, user.lastName].filter(Boolean).join(" ") || void 0;
-}
-async function revokeReplaced(previous, newKey) {
-  if (!previous?.keyId || previous.apiKey === newKey) return;
-  await deleteApiKey(previous.apiKey, previous.keyId).catch((err) => {
-    console.error(`Timetick MCP: could not revoke the replaced API key ${previous.keyId}: ${String(err)}`);
-  });
-}
-async function loginWithCredentials(email, password) {
-  const { sessionCookie, user } = await signIn(email, password);
-  const key = await createApiKey(sessionCookie, `MCP (${hostname()})`);
-  const previous = await loadCredentials(true);
-  const credentials = {
-    apiKey: key.secretKey,
-    endpoint: apiEndpoint(),
-    keyId: key.id,
-    email: user.email ?? email,
-    userName: displayName(user),
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await saveCredentials(credentials);
-  await revokeReplaced(previous, credentials.apiKey);
-  return { credentials, keyId: key.id };
-}
-async function loginWithApiKey(apiKey) {
-  const user = await fetchSessionUser(apiKey).catch((err) => {
-    if (err instanceof TimetickError2 && /not authenticated/i.test(err.message)) return null;
-    throw err;
-  });
-  if (!user?.id) throw new Error("Timetick did not accept that API key.");
-  const previous = await loadCredentials(true);
-  const credentials = {
-    apiKey,
-    endpoint: apiEndpoint(),
-    email: user.email ?? void 0,
-    userName: displayName(user),
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await saveCredentials(credentials);
-  await revokeReplaced(previous, apiKey);
-  return { credentials };
-}
-function portalUrl(path = "/") {
-  return new URL(path, apiEndpoint()).toString();
-}
-
-// src/auth/browser-login.ts
-var LOGIN_TIMEOUT_MS = 10 * 60 * 1e3;
-var MAX_BODY_BYTES = 64 * 1024;
-var TERMS_URL = "https://timetick.io/terms/";
-var PRIVACY_URL = "https://timetick.io/privacy-policy/";
-var EMAIL_RULE = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(\.[a-zA-Z]{2,63})+$/;
-var PASSWORD_RULE = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)\S{8,}$/;
-var STYLE = `
-  body { font-family: -apple-system, "Segoe UI", sans-serif; background: #f6f7f9; display: flex;
-         justify-content: center; padding-top: 8vh; margin: 0; }
-  .card { background: #fff; border-radius: 12px; box-shadow: 0 8px 30px rgba(0,0,0,.08);
-          padding: 2.2rem; width: 24rem; }
-  h1 { font-size: 1.2rem; margin: 0 0 .3rem; }
-  summary { cursor: pointer; font-weight: 600; font-size: .95rem; padding: .7rem 0 .3rem; }
-  p.sub, p.hint { color: #667; font-size: .8rem; margin: .2rem 0 .8rem; }
-  label { display: block; font-size: .78rem; color: #445; margin: .7rem 0 .25rem; }
-  input { width: 100%; box-sizing: border-box; padding: .55rem .7rem; font-size: .95rem;
-          border: 1px solid #ccd; border-radius: 8px; }
-  input[type=checkbox] { width: auto; margin-right: .4rem; }
-  button { margin-top: 1.1rem; width: 100%; padding: .6rem; font-size: .95rem; color: #fff;
-           background: #2563eb; border: 0; border-radius: 8px; cursor: pointer; }
-  .error { background: #fee2e2; color: #991b1b; border-radius: 8px; padding: .6rem .8rem; font-size: .85rem; }
-  .notice { background: #dcfce7; color: #166534; border-radius: 8px; padding: .6rem .8rem; font-size: .85rem; }
-`;
-function shell(title, body) {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title><style>${STYLE}</style></head>
-<body><div class="card">${body}</div></body></html>`;
-}
-function escapeHtml(text) {
-  return text.replace(
-    /[&<>"']/g,
-    (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
-  );
-}
-function page(state, tab, message) {
-  return shell(
-    "Timetick \u2014 sign in",
-    `<h1>Connect your AI client to Timetick</h1>
-    <p class="sub">This page runs on your computer. What you type goes to the Timetick MCP server on this
-    machine and from there to Timetick. It is not shared with the AI client or its conversation.</p>
-    ${message ? `<div class="${message.kind}">${escapeHtml(message.text)}</div>` : ""}
-    <details ${tab === "signin" ? "open" : ""}><summary>Sign in</summary>
-      <form method="post" action="/${state}/signin">
-        <label for="email">Email</label><input id="email" name="email" type="email" required>
-        <label for="password">Password</label><input id="password" name="password" type="password" required>
-        <button type="submit">Sign in</button>
-      </form>
-      <p class="hint"><a href="${escapeHtml(portalUrl("/reset-password"))}" target="_blank" rel="noreferrer">Forgot your password?</a></p>
-    </details>
-    <details ${tab === "signup" ? "open" : ""}><summary>Create an account</summary>
-      <form method="post" action="/${state}/signup">
-        <label for="new-email">Work email</label><input id="new-email" name="email" type="email" required>
-        <label for="new-password">Password (8+ characters with upper and lower case and a digit)</label>
-        <input id="new-password" name="password" type="password" required>
-        <label for="passwordConfirm">Confirm password</label>
-        <input id="passwordConfirm" name="passwordConfirm" type="password" required>
-        <label for="firstName">First name</label><input id="firstName" name="firstName" required minlength="2" maxlength="50">
-        <label for="lastName">Last name</label><input id="lastName" name="lastName" required minlength="2" maxlength="50">
-        <label for="companyName">Company</label><input id="companyName" name="companyName" required minlength="2" maxlength="50">
-        <label><input name="agree" type="checkbox" required>I agree with the
-          <a href="${TERMS_URL}" target="_blank" rel="noreferrer">Terms and Conditions</a> and the
-          <a href="${PRIVACY_URL}" target="_blank" rel="noreferrer">Privacy Policy</a></label>
-        <button type="submit">Create account</button>
-      </form>
-    </details>
-    <details ${tab === "apikey" ? "open" : ""}><summary>Signed up with Google or LinkedIn</summary>
-      <p class="hint">Sign in to the <a href="${escapeHtml(portalUrl())}" target="_blank" rel="noreferrer">
-      Timetick portal</a>, open your project, go to API keys, create one and paste it here.</p>
-      <form method="post" action="/${state}/apikey">
-        <label for="apiKey">API key</label><input id="apiKey" name="apiKey" type="password" required>
-        <button type="submit">Use this key</button>
-      </form>
-    </details>`
-  );
-}
-var donePage = (title, message) => shell("Timetick", `<h1>${title}</h1><p class="sub">${message}</p>`);
-function openBrowser(url) {
-  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-  const child = spawn(command, args, { detached: true, stdio: "ignore" });
-  child.on("error", () => {
-  });
-  child.unref();
-}
-async function readForm(req) {
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of req) {
-    size += chunk.length;
-    if (size > MAX_BODY_BYTES) throw new Error("The form is too large.");
-    chunks.push(chunk);
-  }
-  const out = {};
-  for (const [key, value] of new URLSearchParams(Buffer.concat(chunks).toString("utf8"))) {
-    out[key] = key === "password" || key === "passwordConfirm" ? value : value.trim();
-  }
-  return out;
-}
-function sendHtml(res, status, html) {
-  res.writeHead(status, {
-    "content-type": "text/html; charset=utf-8",
-    "cache-control": "no-store",
-    "referrer-policy": "no-referrer",
-    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'"
-  });
-  res.end(html);
-}
-function validateSignUp(form) {
-  if (!EMAIL_RULE.test(form.email ?? "")) throw new Error("Check the email address.");
-  if (!PASSWORD_RULE.test(form.password ?? "")) {
-    throw new Error("The password needs 8 or more characters with upper and lower case and a digit, and no spaces.");
-  }
-  if (form.password !== form.passwordConfirm) throw new Error("The passwords do not match.");
-  const named = (value, label) => {
-    if (!value || value.length < 2 || value.length > 50) throw new Error(`${label} must be 2 to 50 characters.`);
-    return value;
-  };
-  const account = {
-    email: form.email,
-    password: form.password,
-    firstName: named(form.firstName, "First name"),
-    lastName: named(form.lastName, "Last name"),
-    companyName: named(form.companyName, "Company")
-  };
-  if (form.agree !== "on") throw new Error("Please agree with the Terms and Conditions and the Privacy Policy.");
-  return account;
-}
-var pending = null;
-async function startBrowserLogin(onLogin) {
-  if (pending) {
-    const login = await pending;
-    openBrowser(login.url);
-    return login;
-  }
-  pending = openLoginPage(onLogin).catch((err) => {
-    pending = null;
-    throw err;
-  });
-  return pending;
-}
-async function openLoginPage(onLogin) {
-  const state = randomBytes(16).toString("hex");
-  let resolveDone;
-  let rejectDone;
-  const done = new Promise((resolve, reject) => {
-    resolveDone = resolve;
-    rejectDone = reject;
-  });
-  done.catch(() => {
-  });
-  let host = "";
-  const server = createServer(async (req, res) => {
-    const [, token, action] = (req.url ?? "/").split("?")[0].split("/");
-    if (req.headers.host !== host || token !== state) {
-      return sendHtml(res, 404, donePage("Page expired", "Call the login tool again."));
-    }
-    if (req.method === "GET" && !action) return sendHtml(res, 200, page(state, "signin"));
-    if (req.method !== "POST") return sendHtml(res, 405, donePage("Not allowed", "Unsupported request."));
-    const tab = action === "signup" ? "signup" : action === "apikey" ? "apikey" : "signin";
-    try {
-      const form = await readForm(req);
-      if (action === "signup") {
-        await signUp(validateSignUp(form));
-        return sendHtml(res, 200, page(state, "signin", {
-          kind: "notice",
-          text: "Account created. Open the confirmation link we emailed you, then sign in here."
-        }));
-      }
-      let result;
-      if (action === "apikey") {
-        if (!form.apiKey) throw new Error("Paste an API key.");
-        result = await loginWithApiKey(form.apiKey);
-      } else {
-        if (!form.email || !form.password) throw new Error("Email and password are required.");
-        result = await loginWithCredentials(form.email, form.password);
-      }
-      sendHtml(res, 200, donePage("Connected", "You can close this window and return to your AI client."));
-      finish();
-      onLogin(result);
-      resolveDone(result);
-    } catch (err) {
-      sendHtml(res, 400, page(state, tab, {
-        kind: "error",
-        text: isNetworkFailure(err) ? "Could not reach Timetick. Check your connection and try again." : describeError(err)
-      }));
-    }
-  });
-  const timer = setTimeout(() => {
-    finish();
-    rejectDone(new Error("Sign-in timed out after 10 minutes. Call the login tool to try again."));
-  }, LOGIN_TIMEOUT_MS);
-  timer.unref();
-  function finish() {
-    clearTimeout(timer);
-    server.close();
-    server.closeIdleConnections?.();
-    pending = null;
-  }
-  await new Promise((resolve, reject) => {
-    server.once("error", (err) => {
-      clearTimeout(timer);
-      reject(new Error(`Could not start the local sign-in page: ${err.message}`));
-    });
-    server.listen(0, "127.0.0.1", resolve);
-  });
-  server.unref();
-  const address = server.address();
-  if (!address || typeof address === "string") {
-    finish();
-    throw new Error("Could not determine the local sign-in page address.");
-  }
-  host = `127.0.0.1:${address.port}`;
-  const url = `http://${host}/${state}`;
-  openBrowser(url);
-  console.error(`Timetick MCP: waiting for sign-in at ${url}`);
-  return { url, done };
+// src/tools/auth.ts
+function registerAuthTools(server, target = server) {
+  server.registerTool(
+    "whoami",
+    {
+      annotations: { readOnlyHint: true },
+      title: "Show authentication status",
+      description: "Show who the MCP server is authenticated as, the server version, and whether a newer version is available.",
+      inputSchema: {}
+    },
+    async () => guard(async () => {
+      const notice = await updateNotice();
+      const footer = `Timetick MCP ${VERSION}.${notice ? ` ${notice}` : ""}`;
+      if (!process.env.TIMETICK_API_TOKEN) return ok(`${notLoggedInMessage()}
+${footer}`);
+      const user = await sdk().users.getCurrent().catch((err) => {
+        if (err instanceof TimetickError2 && /not authenticated/i.test(err.message)) return null;
+        throw err;
+      });
+      if (!user?.id) {
+        return fail(`The API key in TIMETICK_API_TOKEN was not accepted (revoked, expired or disabled). Replace it in the client config.
+${footer}`);
+      }
+      const name = [user.firstName, user.lastName].filter(Boolean).join(" ") || user.email || "unknown user";
+      const company = `${user.email && user.email !== name ? ` <${user.email}>` : ""}${user.companyName ? `, ${user.companyName}` : ""}`;
+      return ok(`Authenticated as ${name}${company}.
+${footer}`, { user });
+    })
+  );
+  target.registerTool(
+    "update_profile",
+    {
+      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+      title: "Update profile",
+      description: "Update your Timetick account profile (name, company, phone). Changing the sign-in email is done in the web portal.",
+      inputSchema: {
+        firstName: z.string().optional(),
+        lastName: z.string().optional(),
+        companyName: z.string().optional(),
+        companyWebsite: z.string().optional(),
+        phoneNumber: z.string().optional(),
+        countryCode: z.string().optional().describe("Two-letter country code, e.g. 'NL'")
+      }
+    },
+    async (input) => guard(async () => {
+      const me = await sdk().users.getCurrent();
+      if (!me?.id) return fail("Could not resolve the current user id.");
+      const { id } = me;
+      const values = Object.fromEntries(
+        Object.entries(input).filter(([, v]) => v !== void 0)
+      );
+      const updated = await sdk().users.updateProfile({ id, ...values });
+      return ok(`Updated profile.`, updated);
+    })
+  );
 }
 
-// src/sdk.ts
-import { createClient } from "@timetick/sdk";
-var NOT_LOGGED_IN_MESSAGE = "Not logged in. Call the `login` tool: it opens a sign-in page in the local browser. On a machine without a browser, set the TIMETICK_API_TOKEN environment variable instead.";
-function authStatus() {
-  const envKey = process.env.TIMETICK_API_TOKEN;
-  if (envKey) return { source: "env", apiKey: envKey };
-  const stored = peekCredentials();
-  if (stored) return { source: "stored", apiKey: stored.apiKey, email: stored.email };
-  return { source: "none", apiKey: null };
-}
-var client = null;
-function sdk() {
-  if (client) return client;
-  const status = authStatus();
-  if (!status.apiKey) throw new Error(NOT_LOGGED_IN_MESSAGE);
-  client = createClient({
-    apiKey: status.apiKey,
-    endpoint: process.env.TIMETICK_API_URL,
-    headers: CLIENT_HEADER
-  });
-  return client;
-}
-function resetSdk() {
-  client = null;
-}
+// src/tools/context.ts
+import { z as z2 } from "zod";
 
 // src/context.ts
 var ContextError = class extends Error {
 };
-var cached2 = null;
+var cached = null;
 async function buildContext(projectId, projectName, source) {
   const worlds = await sdk().simWorlds.list(projectId);
   const world = worlds?.[0];
@@ -738,7 +400,7 @@ ${formatProjects(projects)}`
   return { id: match.id, name: match.name ?? "(unnamed)" };
 }
 async function getContext() {
-  if (cached2) return cached2;
+  if (cached) return cached;
   const projects = await sdk().projects.list();
   if (!projects || projects.length === 0) {
     throw new ContextError("This account has no projects yet. Create one with create_project.");
@@ -750,158 +412,26 @@ ${formatProjects(projects)}`
     );
   }
   const only = projects[0];
-  cached2 = await buildContext(only.id, only.name ?? "(unnamed)", "single-project");
-  return cached2;
+  cached = await buildContext(only.id, only.name ?? "(unnamed)", "single-project");
+  return cached;
 }
 async function useProject(input) {
   const match = await findProject(input.project);
-  cached2 = await buildContext(match.id, match.name, "explicit");
-  return cached2;
+  cached = await buildContext(match.id, match.name, "explicit");
+  return cached;
 }
 async function lookupProject(project) {
   const match = await findProject(project);
   return buildContext(match.id, match.name, "explicit");
 }
 function resetContext() {
-  cached2 = null;
+  cached = null;
 }
 function peekContext() {
-  return cached2;
-}
-
-// src/tools/auth.ts
-var LOGIN_WAIT_MS = 45 * 1e3;
-function afterAuthChange() {
-  resetSdk();
-  resetContext();
-}
-function loggedInMessage({ credentials }) {
-  const who = credentials.userName ?? credentials.email ?? "unknown user";
-  return `Logged in as ${who}. The API key is stored at ${credentialFilePath()}; every tool now works.`;
-}
-function registerAuthTools(server, target = server) {
-  server.registerTool(
-    "login",
-    {
-      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
-      title: "Log in to Timetick",
-      description: "Sign in or create a Timetick account and store an API key locally, so every other tool works without the web portal. Opens a one-time page in the local browser, where the user signs in, signs up or pastes an API key. Credentials never pass through this conversation, so never ask for them in chat. If sign-in is not finished within 45 seconds this returns the page address: show it to the user, wait until they say they are done, then call whoami. Needed once per machine, or again to switch to another account, which replaces the stored key.",
-      inputSchema: {}
-    },
-    async () => guard(async () => {
-      if (process.env.TIMETICK_API_TOKEN) {
-        return fail(
-          "TIMETICK_API_TOKEN is set in the client config and always wins, so a login here would have no effect. Remove the variable and restart the client to use login."
-        );
-      }
-      const login = await startBrowserLogin(afterAuthChange);
-      const finished = await Promise.race([
-        login.done,
-        new Promise((resolve) => setTimeout(() => resolve(null), LOGIN_WAIT_MS).unref())
-      ]);
-      if (finished) return ok(loggedInMessage(finished));
-      return ok(
-        `The sign-in page is open at ${login.url} (only reachable from this machine; open it manually if no browser window appeared). It stays open for 10 minutes. Ask the user to finish there, then call whoami to confirm.`
-      );
-    })
-  );
-  server.registerTool(
-    "logout",
-    {
-      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
-      title: "Log out of Timetick",
-      description: "Revoke the locally stored API key on the Timetick platform and delete it from this machine. Does nothing to a key provided via the TIMETICK_API_TOKEN environment variable.",
-      inputSchema: {}
-    },
-    async () => guard(async () => {
-      await loadCredentials(true);
-      const status = authStatus();
-      if (status.source === "none") return fail("Already logged out: no stored credentials.");
-      if (status.source === "env") {
-        return fail(
-          "Authentication comes from the TIMETICK_API_TOKEN environment variable, so logout can't revoke it. Remove the variable from the client config instead."
-        );
-      }
-      const stored = await loadCredentials();
-      let revocation = "The key was pasted in by hand, so it stays active until you delete it in the portal.";
-      if (stored?.keyId) {
-        revocation = await deleteApiKey(stored.apiKey, stored.keyId).then(
-          () => "The API key was revoked on the platform.",
-          (err) => `The API key could NOT be revoked (${err instanceof Error ? err.message : String(err)}); delete key ${stored.keyId} in the portal.`
-        );
-      }
-      await clearCredentials();
-      afterAuthChange();
-      return ok(`Logged out and removed the key from ${credentialFilePath()}. ${revocation}`);
-    })
-  );
-  server.registerTool(
-    "whoami",
-    {
-      annotations: { readOnlyHint: true },
-      title: "Show authentication status",
-      description: "Show who the MCP server is authenticated as, where the API key came from, the server version, and whether a newer version is available. Also picks up a login finished in the browser.",
-      inputSchema: {}
-    },
-    async () => guard(async () => {
-      const before = authStatus().apiKey;
-      await loadCredentials(true);
-      const status = authStatus();
-      if (status.apiKey !== before) afterAuthChange();
-      const notice = await updateNotice();
-      const footer = `Timetick MCP ${VERSION}.${notice ? ` ${notice}` : ""}`;
-      if (!status.apiKey) {
-        return ok(
-          `Not logged in: no API key found (looked at TIMETICK_API_TOKEN and ${credentialFilePath()}). Call the login tool to authenticate.
-${footer}`
-        );
-      }
-      const user = await fetchSessionUser(status.apiKey).catch((err) => {
-        if (err instanceof TimetickError3 && /not authenticated/i.test(err.message)) return null;
-        throw err;
-      });
-      if (!user?.id) {
-        const next = status.source === "env" ? "Replace TIMETICK_API_TOKEN in the client config." : "Call the login tool to sign in again.";
-        return fail(`The API key was not accepted (revoked, expired or disabled). ${next}
-${footer}`);
-      }
-      const name = [user.firstName, user.lastName].filter(Boolean).join(" ") || user.email || "unknown user";
-      const company = `${user.email && user.email !== name ? ` <${user.email}>` : ""}${user.companyName ? `, ${user.companyName}` : ""}`;
-      const source = status.source === "env" ? "TIMETICK_API_TOKEN environment variable" : "stored credentials";
-      return ok(`Authenticated as ${name}${company} (key from ${source}).
-${footer}`, { user, source: status.source });
-    })
-  );
-  target.registerTool(
-    "update_profile",
-    {
-      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
-      title: "Update profile",
-      description: "Update your Timetick account profile (name, company, phone). Changing the sign-in email is done in the web portal.",
-      inputSchema: {
-        firstName: z.string().optional(),
-        lastName: z.string().optional(),
-        companyName: z.string().optional(),
-        companyWebsite: z.string().optional(),
-        phoneNumber: z.string().optional(),
-        countryCode: z.string().optional().describe("Two-letter country code, e.g. 'NL'")
-      }
-    },
-    async (input) => guard(async () => {
-      const me = await sdk().users.getCurrent();
-      if (!me?.id) return fail("Could not resolve the current user id.");
-      const { id } = me;
-      const values = Object.fromEntries(
-        Object.entries(input).filter(([, v]) => v !== void 0)
-      );
-      const updated = await sdk().users.updateProfile({ id, ...values });
-      return ok(`Updated profile.`, updated);
-    })
-  );
+  return cached;
 }
 
 // src/tools/context.ts
-import { z as z2 } from "zod";
 async function planNote(projectId) {
   const project = await sdk().projects.get(projectId).catch(() => null);
   if (!project) return "";
@@ -949,25 +479,6 @@ function registerContextTools(server) {
 import { z as z4 } from "zod";
 import { describeStepArgs } from "@timetick/sdk";
 
-// src/links.ts
-var SIMULATOR_PATH = /\/projects\/([^/?#&|>\s]+)\/simulators\/([^/?#&|>\s]+)/;
-function looksLikeLink(text) {
-  return /^<?https?:\/\//i.test(text) || /(^|\.)timetick\.io\//i.test(text);
-}
-function parseSimulatorRef(input) {
-  const text = input.trim();
-  if (!looksLikeLink(text)) return { simulator: text };
-  const unescaped = text.replace(/&amp;/g, "&");
-  const match = unescaped.match(SIMULATOR_PATH);
-  if (!match) {
-    throw new Error(
-      `"${input}" looks like a link but not to a simulator. Expected https://app.timetick.io/projects/<project id>/simulators/<simulator id>.`
-    );
-  }
-  return { project: decodeURIComponent(match[1]), simulator: decodeURIComponent(match[2]) };
-}
-var SIMULATOR_ARG_DESCRIPTION = "Simulator id, base name, or portal link (https://app.timetick.io/projects/<id>/simulators/<id>)";
-
 // src/resolve.ts
 async function resolveSimWorld(project) {
   if (project) return lookupProject(project);
@@ -978,11 +489,11 @@ var CANDIDATE_LIMIT = 10;
 async function resolveSimulator(simWorldId, simulator) {
   const needle = simulator.toLowerCase();
   const records = [];
-  for (let page2 = 1; ; page2++) {
+  for (let page = 1; ; page++) {
     const result = await sdk().simulators.list({
       simWorldId,
       searchValue: simulator,
-      pagination: { page: page2, pageSize: RESOLVE_PAGE_SIZE }
+      pagination: { page, pageSize: RESOLVE_PAGE_SIZE }
     });
     records.push(...result?.records ?? []);
     if (!result?.records?.length || !result.pageInfo?.hasNextPage) break;
@@ -1023,8 +534,8 @@ async function resolveSimulatorById(id) {
   return { id: byId.id, baseName: byId.baseName ?? "", protocol: String(byId.protocol) };
 }
 async function resolveHardware(ctx, hardware) {
-  const page2 = await sdk().hardware.list({ deviceScopeId: ctx.deviceScopeId, searchValue: hardware });
-  const records = page2?.records ?? [];
+  const page = await sdk().hardware.list({ deviceScopeId: ctx.deviceScopeId, searchValue: hardware });
+  const records = page?.records ?? [];
   const match = records.find((r) => r?.id === hardware) ?? records.find((r) => r?.serialNumber?.toLowerCase() === hardware.toLowerCase());
   if (match?.id) return { id: match.id, name: match.serialNumber ?? match.id, protocol: String(match.protocol) };
   const byId = await sdk().hardware.get(hardware).catch(() => null);
@@ -1050,12 +561,12 @@ async function resolveRunTarget(input) {
 }
 var CATALOG_PAGE_SIZE = 200;
 async function loadActionCatalog(simWorldId, protocol) {
-  const page2 = await sdk().actions.list({
+  const page = await sdk().actions.list({
     simWorldId,
     filters: { protocol },
     pagination: { page: 1, pageSize: CATALOG_PAGE_SIZE }
   });
-  return (page2?.records ?? []).filter((action) => action != null);
+  return (page?.records ?? []).filter((action) => action != null);
 }
 function findAction(catalog, protocol, actionName) {
   const needle = actionName.trim().toLowerCase();
@@ -1079,8 +590,8 @@ var paginationArgs = {
   page: z3.number().int().min(1).optional().describe("Page number, starting at 1 (default 1)"),
   pageSize: z3.number().int().min(1).max(200).optional().describe(`Results per page (default ${DEFAULT_PAGE_SIZE})`)
 };
-function pagination(page2, pageSize, defaultPageSize = DEFAULT_PAGE_SIZE) {
-  return { page: page2 ?? 1, pageSize: pageSize ?? defaultPageSize };
+function pagination(page, pageSize, defaultPageSize = DEFAULT_PAGE_SIZE) {
+  return { page: page ?? 1, pageSize: pageSize ?? defaultPageSize };
 }
 function pageSummary(noun, count, pageInfo) {
   const total = pageInfo?.totalCount;
@@ -1129,13 +640,13 @@ function registerDataTools(server) {
         project: z4.string().optional().describe("Project name or id (defaults to active project)")
       }
     },
-    async ({ search, protocol, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, protocol, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().simulators.list({
         simWorldId: ctx.simWorldId,
         searchValue: search,
         filters: protocol ? { protocol } : void 0,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(
         pageSummary("simulator(s)", result?.records?.length ?? 0, result?.pageInfo),
@@ -1172,12 +683,12 @@ function registerDataTools(server) {
         project: z4.string().optional().describe("Project name or id (defaults to active project)")
       }
     },
-    async ({ search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().hardware.list({
         deviceScopeId: ctx.deviceScopeId,
         searchValue: search,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(
         pageSummary("hardware record(s)", result?.records?.length ?? 0, result?.pageInfo),
@@ -1214,13 +725,13 @@ function registerDataTools(server) {
         project: z4.string().optional().describe("Project name or id (defaults to active project)")
       }
     },
-    async ({ protocol, search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ protocol, search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().actions.list({
         simWorldId: ctx.simWorldId,
         searchValue: search,
         filters: { protocol },
-        pagination: pagination(page2, pageSize, 100)
+        pagination: pagination(page, pageSize, 100)
       });
       const actions = (result?.records ?? []).filter((a) => a != null).map(summarizeAction);
       return ok(pageSummary("step(s)", actions.length, result?.pageInfo), actions);
@@ -1424,12 +935,12 @@ function registerSimulatorTools(server) {
       });
       for (let attempt = 0; !simulator && attempt < CREATE_POLL_ATTEMPTS; attempt++) {
         await new Promise((resolve) => setTimeout(resolve, CREATE_POLL_DELAY_MS));
-        const page2 = await sdk().simulators.list({
+        const page = await sdk().simulators.list({
           simWorldId: ctx.simWorldId,
           searchValue: baseName,
           filters: { endpointIds: [endpointId] }
         });
-        simulator = page2?.records?.find((record) => record?.baseName === baseName);
+        simulator = page?.records?.find((record) => record?.baseName === baseName);
       }
       if (!simulator) {
         return ok(
@@ -1686,13 +1197,13 @@ function registerTestTools(server) {
         project: projectArg
       }
     },
-    async ({ protocol, search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ protocol, search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().tests.list({
         simWorldId: ctx.simWorldId,
         searchValue: search,
         filters: protocol ? { protocol } : void 0,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(pageSummary("test(s)", result?.records?.length ?? 0, result?.pageInfo), result);
     })
@@ -1733,13 +1244,13 @@ function registerTestTools(server) {
         project: projectArg
       }
     },
-    async ({ protocol, search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ protocol, search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().tests.listTemplates({
         simWorldId: ctx.simWorldId,
         searchValue: search,
         filters: protocol ? { protocol } : void 0,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(pageSummary("template(s)", result?.records?.length ?? 0, result?.pageInfo), result);
     })
@@ -1891,12 +1402,12 @@ var SIMULATOR_PAGE_SIZE = 200;
 var FINISHED_STATUSES = /* @__PURE__ */ new Set(["COMPLETED", "FAILED", "SKIPPED"]);
 async function listSimulatorIds(simWorldId, selection) {
   const ids = [];
-  for (let page2 = 1; ; page2++) {
+  for (let page = 1; ; page++) {
     const result = await sdk().simulators.list({
       simWorldId,
       searchValue: selection.search,
       filters: { protocol: selection.protocol, tagIds: selection.tagIds },
-      pagination: { page: page2, pageSize: SIMULATOR_PAGE_SIZE }
+      pagination: { page, pageSize: SIMULATOR_PAGE_SIZE }
     });
     const records = result?.records ?? [];
     for (const record of records) if (record?.id) ids.push(record.id);
@@ -2039,11 +1550,11 @@ function registerTestRunTools(server) {
         project: projectArg
       }
     },
-    async ({ page: page2, pageSize, project }) => guard(async () => {
+    async ({ page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().testRuns.list({
         simWorldId: ctx.simWorldId,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(pageSummary("test run(s)", result?.records?.length ?? 0, result?.pageInfo), {
         ...result,
@@ -2153,12 +1664,12 @@ function registerTestRunTools(server) {
         project: projectArg
       }
     },
-    async ({ testId, page: page2, pageSize, project }) => guard(async () => {
+    async ({ testId, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().testRuns.listGrouped({
         simWorldId: ctx.simWorldId,
         filters: { categories: ["STRESS_TEST"], ...testId ? { scenarioIds: [testId] } : {} },
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(pageSummary("stress test(s)", result?.records?.length ?? 0, result?.pageInfo), result);
     })
@@ -2281,11 +1792,11 @@ function registerTestPlanTools(server) {
         project: projectArg
       }
     },
-    async ({ search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().testPlans.list({
         filters: { simWorldId: ctx.simWorldId, name: search },
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(
         pageSummary("test plan(s)", result?.records?.length ?? 0, result?.pageInfo),
@@ -2560,11 +2071,11 @@ function findRunSimulator(records, simulator) {
     (rc) => rc.charger?.baseName?.toLowerCase() === needle || rc.device?.serialNumber?.toLowerCase() === needle
   );
 }
-function summarizeRun(run, simulators, page2, steps) {
+function summarizeRun(run, simulators, page, steps) {
   const records = (simulators?.records ?? []).filter(Boolean);
   const lines = [
     `Test run ${run.id} ("${run.scenario?.name ?? "?"}"): ${run.status}` + (run.failReason ? ` \u2014 ${run.failReason}` : "") + `. Started ${run.realStartTimestamp ?? run.startTimestamp ?? "\u2014"}, stopped ${run.realStopTimestamp ?? "\u2014"}.`,
-    pageSummary("simulator(s)", records.length, simulators?.pageInfo ?? { page: page2 })
+    pageSummary("simulator(s)", records.length, simulators?.pageInfo ?? { page })
   ];
   for (const rc of records) {
     const target = rc.charger?.id ? `simulator ${rc.charger.id}` : `hardware ${rc.device?.id ?? "?"}`;
@@ -2656,10 +2167,10 @@ function registerSupportTools(server) {
       },
       annotations: READ_ONLY
     },
-    async ({ runId, page: page2, simulator }) => guard(async () => {
+    async ({ runId, page, simulator }) => guard(async () => {
       const run = await sdk().testRuns.getDetails(runId);
       if (!run) return ok(`No test run found with id ${runId}.`);
-      const current = page2 ?? 1;
+      const current = page ?? 1;
       const simulators = await sdk().testRuns.listSimulators(runId, {
         pagination: { page: current, pageSize: RUN_SIMULATORS_PAGE_SIZE }
       });
@@ -2703,7 +2214,7 @@ function registerApiKeyTools(server) {
     {
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       title: "Create API key",
-      description: "Create a new API key for the account. The secret is shown once in the reply \u2014 store it immediately, it cannot be retrieved later. Use this to give another machine or integration access without sharing your login.",
+      description: "Create a new API key for the account. The secret is shown once in the reply \u2014 store it immediately, it cannot be retrieved later. Use this to give another machine or integration access without sharing this key.",
       inputSchema: {
         name: z10.string().describe("Key name, e.g. 'CI pipeline'"),
         expiresAt: z10.string().optional().describe("Optional expiration date (ISO 8601)")
@@ -2728,15 +2239,9 @@ function registerApiKeyTools(server) {
       }
     },
     async ({ keyId }) => guard(async () => {
-      const stored = peekCredentials();
       const key = await sdk().apiKeys.rotate(keyId);
-      if (stored?.keyId === keyId && !process.env.TIMETICK_API_TOKEN && key?.secretKey) {
-        await saveCredentials({ ...stored, apiKey: key.secretKey });
-        resetSdk();
-        return ok(`Rotated the API key this server uses (id: ${keyId}) and stored the new secret locally.`);
-      }
       return ok(
-        `Rotated API key (id: ${key?.apiKey?.id}). The previous secret no longer works. New secret shown once below \u2014 save it now.`,
+        `Rotated API key (id: ${key?.apiKey?.id}). The previous secret no longer works. New secret shown once below \u2014 save it now. If this is the key in TIMETICK_API_TOKEN, update the client config and restart the client.`,
         { secretKey: key?.secretKey }
       );
     })
@@ -2752,12 +2257,9 @@ function registerApiKeyTools(server) {
       }
     },
     async ({ keyId }) => guard(async () => {
-      if (peekCredentials()?.keyId === keyId && !process.env.TIMETICK_API_TOKEN) {
-        return fail("This is the API key this server is using. Call logout to revoke it and sign out.");
-      }
       const status = await sdk().apiKeys.delete(keyId);
       if (status === "ERROR") return fail(`API key ${keyId} could not be deleted.`);
-      return ok(`Deleted API key ${keyId}.`);
+      return ok(`Deleted API key ${keyId}. If this is the key in TIMETICK_API_TOKEN, update the client config and restart the client.`);
     })
   );
 }
@@ -2946,12 +2448,12 @@ function registerCatalogTools(server) {
         project: projectArg
       }
     },
-    async ({ search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().manufacturers.list({
         simWorldId: ctx.simWorldId,
         searchValue: search,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(
         pageSummary("manufacturer(s)", result?.records?.length ?? 0, result?.pageInfo),
@@ -3037,13 +2539,13 @@ function registerCatalogTools(server) {
         project: projectArg
       }
     },
-    async ({ search, protocol, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, protocol, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().models.list({
         simWorldId: ctx.simWorldId,
         searchValue: search,
         filters: protocol ? { protocol } : void 0,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(pageSummary("model(s)", result?.records?.length ?? 0, result?.pageInfo), result);
     })
@@ -3151,13 +2653,13 @@ function registerCatalogTools(server) {
         project: projectArg
       }
     },
-    async ({ search, protocol, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, protocol, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().endpoints.list({
         simWorldId: ctx.simWorldId,
         searchValue: search,
         filters: protocol ? { protocol } : void 0,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(pageSummary("endpoint(s)", result?.records?.length ?? 0, result?.pageInfo), result);
     })
@@ -3293,12 +2795,12 @@ function registerOcppConfigTools(server) {
         project: projectArg
       }
     },
-    async ({ search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().ocppConfigs.list({
         simWorldId: ctx.simWorldId,
         searchValue: search,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(
         pageSummary("OCPP config(s)", result?.records?.length ?? 0, result?.pageInfo),
@@ -3414,12 +2916,12 @@ function registerSimulatorConfigTools(server) {
         project: projectArg
       }
     },
-    async ({ search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().simulatorConfigs.list({
         simWorldId: ctx.simWorldId,
         searchValue: search,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(
         pageSummary("simulator config(s)", result?.records?.length ?? 0, result?.pageInfo),
@@ -3549,12 +3051,12 @@ function registerTagTools(server) {
         project: projectArg
       }
     },
-    async ({ search, page: page2, pageSize, project }) => guard(async () => {
+    async ({ search, page, pageSize, project }) => guard(async () => {
       const ctx = await resolveSimWorld(project);
       const result = await sdk().tags.list({
         projectId: ctx.projectId,
         searchValue: search,
-        pagination: pagination(page2, pageSize)
+        pagination: pagination(page, pageSize)
       });
       return ok(pageSummary("tag(s)", result?.records?.length ?? 0, result?.pageInfo), result);
     })
@@ -3708,7 +3210,6 @@ function registerTools(server, options) {
 // src/index.ts
 async function main() {
   allowSlowConnections();
-  const loggedIn = await loadCredentials();
   const readOnly = isReadOnlyMode();
   const server = new McpServer(
     { name: "timetick", version: VERSION },
@@ -3718,7 +3219,7 @@ async function main() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error(
-    `Timetick MCP server ${VERSION} running on stdio${readOnly ? " (read-only)" : ""}${loggedIn || process.env.TIMETICK_API_TOKEN ? "" : ": not logged in yet, call the login tool"}`
+    `Timetick MCP server ${VERSION} running on stdio${readOnly ? " (read-only)" : ""}${process.env.TIMETICK_API_TOKEN ? "" : ": no API key, set TIMETICK_API_TOKEN"}`
   );
   void updateNotice().then((notice) => {
     if (notice) console.error(`Timetick MCP: ${notice}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timetick/mcp",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Model Context Protocol (MCP) server for Timetick (https://app.timetick.io) platform",
   "license": "AGPL-3.0-or-later",
   "author": "Timetick <support@timetick.io>",