@uphealth/mcp-server 1.0.0

package/DISTRIBUTION.md

@@ -0,0 +1,129 @@
+# Use Uphealth Signal from an AI agent (MCP)
+
+The Uphealth MCP server lets any [Model Context Protocol](https://modelcontextprotocol.io/) client — Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, or your own agent — drive a cued health-message stream as four tools. It wraps the [Signal API](https://uphealth.us/docs); the model never sees your raw HTTP layer.
+
+**Get a free sandbox key** (no credit card, no PHI, no BAA) at **https://uphealth.us/signup**, then pick an install method below.
+
+## The four tools
+
+| Tool | Wraps | Does |
+|---|---|---|
+| `create_patient_stream` | `POST /v1/signal/streams` | Start a stream from a template; returns the opening cue |
+| `get_next_cued_message` | `POST /v1/signal/streams/:id/cue` | Submit the patient's response, get the next message |
+| `read_stream_state` | `GET /v1/signal/streams/:id` | Read state + current cue without advancing |
+| `list_sandbox_topics` | `GET /v1/signal/sandbox-topics` | List the five sandbox topics |
+
+**The one rule:** every cue after the first requires feedback on the prior one (the model passes the patient's `response_action`). The tool descriptions teach this, so a capable agent drives the loop correctly.
+
+---
+
+## Option A — Local (stdio via `npx`) · recommended
+
+No hosting, no URL. The client launches the server as a subprocess with your key in its environment.
+
+### Claude Desktop
+
+`claude_desktop_config.json` (Settings → Developer → Edit Config):
+
+```json
+{
+  "mcpServers": {
+    "uphealth": {
+      "command": "npx",
+      "args": ["-y", "@uphealth/mcp-server"],
+      "env": { "UPHEALTH_API_KEY": "up_sandbox_YOUR_KEY" }
+    }
+  }
+}
+```
+
+### Cursor
+
+`~/.cursor/mcp.json` (or a project's `.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "uphealth": {
+      "command": "npx",
+      "args": ["-y", "@uphealth/mcp-server"],
+      "env": { "UPHEALTH_API_KEY": "up_sandbox_YOUR_KEY" }
+    }
+  }
+}
+```
+
+### VS Code (Copilot agent mode)
+
+`.vscode/mcp.json`:
+
+```json
+{
+  "servers": {
+    "uphealth": {
+      "command": "npx",
+      "args": ["-y", "@uphealth/mcp-server"],
+      "env": { "UPHEALTH_API_KEY": "up_sandbox_YOUR_KEY" }
+    }
+  }
+}
+```
+
+### Claude Code (CLI)
+
+```bash
+claude mcp add uphealth --env UPHEALTH_API_KEY=up_sandbox_YOUR_KEY -- npx -y @uphealth/mcp-server
+```
+
+Any other stdio MCP client uses the same shape: command `npx`, args `["-y", "@uphealth/mcp-server"]`, env `UPHEALTH_API_KEY`.
+
+---
+
+## Option B — Remote (hosted Streamable HTTP)
+
+The server is also hosted at `https://mcp.uphealth.us/mcp`. Clients with native remote-MCP support add it directly with an `Authorization: Bearer` header. For clients that only speak stdio, bridge with `mcp-remote`:
+
+```json
+{
+  "mcpServers": {
+    "uphealth": {
+      "command": "npx",
+      "args": [
+        "-y", "mcp-remote", "https://mcp.uphealth.us/mcp",
+        "--header", "Authorization: Bearer up_sandbox_YOUR_KEY"
+      ]
+    }
+  }
+}
+```
+
+---
+
+## Verify
+
+Use the MCP Inspector against either transport:
+
+```bash
+# local stdio
+UPHEALTH_API_KEY=up_sandbox_YOUR_KEY npx @modelcontextprotocol/inspector npx -y @uphealth/mcp-server
+
+# hosted
+npx @modelcontextprotocol/inspector --transport streamable-http \
+  --url https://mcp.uphealth.us/mcp \
+  --header "Authorization: Bearer up_sandbox_YOUR_KEY"
+```
+
+Then call `create_patient_stream` with `template_id: "general_wellness_daily"`, and `get_next_cued_message` with a `response_action` (e.g. `did_it`).
+
+## Notes
+
+- **Keep your key private.** Treat `UPHEALTH_API_KEY` like any secret; don't commit client configs containing a live key.
+- **Display mode only** in the sandbox — no PHI, no BAA. Deliver mode is BAA-gated at the PMPM tier.
+- **Discovery quota:** 50 cues / calendar month. Over the cap, tools return the `over_quota` result with an upgrade link.
+
+## Links
+
+- Docs: https://uphealth.us/docs
+- OpenAPI: https://uphealth.us/openapi/signal-v1.yaml
+- SDKs: [`@uphealth/signal`](../sdks/typescript) (Node/TS) · [`uphealth-signal`](../sdks/python) (Python)
+- Get a key: https://uphealth.us/signup

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anschutz Media, Inc. (Uphealth)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,101 @@
+# Uphealth MCP Server (Track A A4)
+
+Wraps the [`api.uphealth.us` cued-stream API](../docs/spec_track_a_a1_cued_stream_api.md) as agent-callable [Model Context Protocol](https://modelcontextprotocol.io/) tools. Buyers configure their Claude Desktop / Cursor / agentic platform with the MCP server URL + a `up_sandbox_…` API token; the agent then calls 4 MCP tools to drive a cued patient stream.
+
+Locks captured in [`docs/spec_track_a_a4_mcp_server.md`](../docs/spec_track_a_a4_mcp_server.md):
+
+- **SDK** — TypeScript via `@modelcontextprotocol/sdk` (flipped from Python at 2026-05-22 build-kickoff revalidation)
+- **Tool surface** — 4 tools: `create_patient_stream` / `get_next_cued_message` / `read_stream_state` / `list_sandbox_topics`
+- **Auth** — Bearer-token passthrough (MCP server is stateless thin proxy; Rails validates)
+- **Corpus** — sandbox only at v1
+- **Hostname** — `mcp.uphealth.us` subdomain (Option A locked)
+- **Transport** — Streamable HTTP
+
+## Local dev
+
+```bash
+nvm use            # picks Node 22 from .nvmrc
+npm install
+cp .env.example .env
+npm run dev        # tsx hot-reload of src/index.ts
+```
+
+The dev server listens on `:3001`. Point an MCP client at `http://localhost:3001/mcp` with `Authorization: Bearer <a valid up_sandbox_… token from api.uphealth.us>`.
+
+## Build + run (production)
+
+```bash
+npm ci             # full install — typescript (the compiler) is a devDependency
+npm run build      # tsc → dist/
+node dist/index.js # systemd does this via bin/mcp-server-systemd.sh
+```
+
+## Tests
+
+```bash
+npm test           # vitest run; mocks global fetch
+```
+
+## Environment
+
+See [`.env.example`](.env.example) for the full list. Required: `RAILS_API_BASE_URL`. Optional with defaults: `MCP_SERVER_PORT` (`3001`), `NODE_ENV` (`development`), `LOG_LEVEL` (`info`).
+
+## Deployment (co-located on the `.us` droplet at `mcp.uphealth.us`)
+
+Per spec §6.1 lock 2026-05-22, the MCP server runs as a Node process **co-located with Rails on the existing `.us` droplet** (`164.92.77.128`, $14/mo `s-1vcpu-2gb-amd`). No separate droplet — the MCP server is a thin Node proxy (< 50 MB RAM, no DB connection, no state) so resource pressure on Rails is negligible. The existing [`bin/deploy`](../bin/deploy) cron handles MCP rebuilds when files under `mcp-server/` change.
+
+A separate companion droplet remains a v2 option if MCP traffic exceeds Rails on the shared droplet OR an enterprise buyer requires isolation. See spec §6.1 for the migration path.
+
+### One-time provisioning sequence
+
+The provisioning steps live on the existing `.us` droplet (`164.92.77.128`). Eric does the DO panel step (#2 DNS); the rest run via SSH.
+
+1. **Install Node 22 LTS** (only step that adds new software; the `.us` droplet currently runs Ruby + Rails only). Install via the **NodeSource apt repo** so `node` + `npm` land at `/usr/bin/` on the system PATH:
+   ```bash
+   curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+   apt install -y nodejs          # Node 22 + npm at /usr/bin/{node,npm}
+   node --version                 # expect v22.x
+   which node npm                 # expect /usr/bin/node  /usr/bin/npm
+   ```
+   > A system-PATH install is required, not nvm: (a) the systemd unit's `ExecStart=/usr/bin/node` is an absolute path, and (b) the `bin/deploy` auto-rebuild hook gates on `command -v npm`, which the cron environment only resolves for a `/usr/bin` install. Plain `apt install nodejs` (without the NodeSource repo) ships an EOL Node on Ubuntu; nvm puts `node` under `~/.nvm` where neither the absolute `ExecStart` nor the cron PATH will find it.
+2. **Add DNS** — Eric adds A record `mcp.uphealth.us → 164.92.77.128` via DO Networking → Domains → uphealth.us (same IP as the existing `uphealth.us` / `www.uphealth.us` / `api.uphealth.us` records; we're co-locating). Propagation typically minutes.
+3. **Configure env** — copy [`mcp-server/.env.example`](.env.example) to `/root/uphealth-us/mcp-server/.env.production`; set `RAILS_API_BASE_URL=https://api.uphealth.us` and `NODE_ENV=production`. `chmod 600` since it's root-only.
+4. **Initial build** — `cd /root/uphealth-us/mcp-server && npm ci && npm run build` (full install — `typescript` is a devDependency the build needs — then `tsc` → `dist/`; this is exactly what `bin/mcp-server-systemd.sh` runs on every subsequent deploy). Verify `dist/index.js` exists. Do NOT use `npm ci --omit=dev` here: it skips the compiler and the build silently fails (see the comment block in `bin/mcp-server-systemd.sh` documenting the `tsc@2.0.4` fall-through).
+5. **Install systemd unit** — `cp /root/uphealth-us/config/systemd/uphealth-mcp-server.service /etc/systemd/system/` → `systemctl daemon-reload` → `systemctl enable --now uphealth-mcp-server` → `systemctl status uphealth-mcp-server` to verify "active (running)". Logs via `journalctl -u uphealth-mcp-server -f`.
+6. **nginx vhost** — `cp /root/uphealth-us/mcp-server/ops/nginx-vhost.conf /etc/nginx/sites-available/uphealth-us-mcp` → `ln -s /etc/nginx/sites-available/uphealth-us-mcp /etc/nginx/sites-enabled/` → `nginx -t` (must pass) → `systemctl reload nginx`.
+7. **Cert SAN extension** — `certbot --nginx --expand -d uphealth.us -d www.uphealth.us -d api.uphealth.us -d mcp.uphealth.us`. Existing cert at `/etc/letsencrypt/live/uphealth.us/` gains the new SAN; auto-renewal via the certbot timer continues.
+8. **Auto-deploy cron is already running** on `/root/uphealth-us/bin/deploy` per the existing `.us` setup. The `bin/deploy` extension (PR #424) detects changes under `mcp-server/` and runs `bin/mcp-server-systemd.sh` automatically. No new cron entry needed.
+
+After step 8, subsequent pushes that touch `mcp-server/` trigger `npm ci && npm run build && systemctl restart uphealth-mcp-server` automatically (via `bin/mcp-server-systemd.sh`).
+
+### Smoke verification (post-deploy)
+
+Mirror the A1 PR C 6-step smoke against the MCP server using `@modelcontextprotocol/inspector`:
+
+```bash
+npx @modelcontextprotocol/inspector \
+  --transport streamable-http \
+  --url https://mcp.uphealth.us/mcp \
+  --header "Authorization: Bearer <up_sandbox_…>"
+```
+
+Then in the inspector UI:
+
+1. `create_patient_stream` with `template_id: "general_wellness_daily"` → returns `stream_id` + `first_cue`
+2. `get_next_cued_message` WITHOUT feedback → returns `isError: true` with the moat-explainer message
+3. `get_next_cued_message` WITH valid feedback → returns next cue
+4. `get_next_cued_message` again with same `idempotency_key` + same feedback → returns the cached cue (idempotent)
+5. `read_stream_state` → returns current state + events_count
+6. `list_sandbox_topics` → returns 5 topic labels
+
+Pass criteria: all 6 steps green; the moat error in step 2 includes the phrase "structural, not a bug".
+
+## Registry submission (at A4 launch)
+
+Per [`docs/spec_track_a_a4_mcp_server.md`](../docs/spec_track_a_a4_mcp_server.md) §9 and [`future_roadmap.md`](../docs/future_roadmap.md) §3 A4 strategic context, submit at launch to:
+
+- Anthropic MCP registry
+- Claude Desktop MCP directory
+- Third-party catalogs (mcp.so, mcpservers.com if active at launch time)
+
+Captures the 5-month MCP-positioning window. Don't defer.

package/dist/bootstrap-env.js

@@ -0,0 +1,10 @@
+// Side-effect module imported FIRST by the stdio entrypoint, before any module
+// that reads config.ts. A local `npx @uphealth/mcp-server` user should not have
+// to set RAILS_API_BASE_URL — it always points at the public API host — so we
+// default it here when unset. The hosted HTTP deployment still sets it
+// explicitly via .env.production, which takes precedence.
+if (!process.env.RAILS_API_BASE_URL) {
+    process.env.RAILS_API_BASE_URL = "https://api.uphealth.us";
+}
+export {};
+//# sourceMappingURL=bootstrap-env.js.map

package/dist/bootstrap-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-env.js","sourceRoot":"","sources":["../src/bootstrap-env.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,uEAAuE;AACvE,0DAA0D;AAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,yBAAyB,CAAC;AAC7D,CAAC"}

package/dist/config.js

@@ -0,0 +1,23 @@
+// Track A A4 PR 2 — Env-driven config for the MCP server.
+// Strict env parsing at boot; throws with a clear message if a required
+// var is missing so systemd boot logs surface the misconfiguration
+// instead of silently defaulting.
+function requireEnv(name) {
+    const value = process.env[name];
+    if (!value) {
+        throw new Error(`Missing required env var: ${name}. See mcp-server/.env.example for the full list.`);
+    }
+    return value;
+}
+function optionalEnv(name, fallback) {
+    return process.env[name] ?? fallback;
+}
+export const config = {
+    port: parseInt(optionalEnv("MCP_SERVER_PORT", "3001"), 10),
+    railsApiBaseUrl: requireEnv("RAILS_API_BASE_URL"),
+    nodeEnv: optionalEnv("NODE_ENV", "development"),
+    logLevel: optionalEnv("LOG_LEVEL", "info"),
+    serverName: "uphealth-mcp",
+    serverVersion: "1.0.0",
+};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,wEAAwE;AACxE,mEAAmE;AACnE,kCAAkC;AAElC,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,kDAAkD,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1D,eAAe,EAAE,UAAU,CAAC,oBAAoB,CAAC;IACjD,OAAO,EAAE,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC;IAC/C,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC;IAC1C,UAAU,EAAE,cAAc;IAC1B,aAAa,EAAE,OAAO;CACd,CAAC"}

package/dist/context.js

@@ -0,0 +1,37 @@
+// Track A A4 PR 2 — Per-request context for Bearer-passthrough auth.
+//
+// MCP tool handlers don't directly receive the inbound HTTP headers
+// (the SDK abstracts the transport). Use AsyncLocalStorage to bind the
+// inbound Authorization header to the request's async context so tool
+// handlers can read it without it leaking across concurrent requests.
+//
+// Spec: docs/spec_track_a_a4_mcp_server.md §4 (statelessness — server
+// holds no per-tenant state; the AsyncLocalStorage scope is per-async-
+// frame, not a global cache, so this preserves the property).
+import { AsyncLocalStorage } from "node:async_hooks";
+const storage = new AsyncLocalStorage();
+// Process-level fallback context. The HTTP transport (index.ts) binds the
+// bearer per request via withRequestContext (AsyncLocalStorage), so each
+// concurrent tenant stays isolated. The stdio transport (stdio.ts) is a
+// single-tenant local process — one user, one key for the process lifetime —
+// where there is no per-request scope to wrap the long-lived connection's
+// later message callbacks in. For that case a process-level fallback is the
+// correct model. The ALS store always wins when present, so the HTTP path is
+// unaffected and multi-tenant isolation is preserved.
+let fallbackContext = null;
+export function setFallbackContext(ctx) {
+    fallbackContext = ctx;
+}
+export function withRequestContext(ctx, fn) {
+    return storage.run(ctx, fn);
+}
+export function currentContext() {
+    const ctx = storage.getStore() ?? fallbackContext;
+    if (!ctx) {
+        // Tool handler called outside any request context — only happens in tests
+        // that forget the harness, or in misconfigured code paths.
+        throw new Error("No request context — tool handler called outside withRequestContext scope");
+    }
+    return ctx;
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,sEAAsE;AACtE,EAAE;AACF,sEAAsE;AACtE,uEAAuE;AACvE,8DAA8D;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAMrD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAExD,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,sDAAsD;AACtD,IAAI,eAAe,GAA0B,IAAI,CAAC;AAElD,MAAM,UAAU,kBAAkB,CAAC,GAA0B;IAC3D,eAAe,GAAG,GAAG,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,GAAmB,EAAE,EAAoB;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,eAAe,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cue-actions.js

@@ -0,0 +1,32 @@
+// Track A A4 — Canonical cue `response_action` vocabulary (single TS source).
+//
+// This list MUST stay byte-for-byte in sync with the Rails canonical constant
+//   AdaptiveResponse::Archetypes::CUE_ACCEPTED_ACTIONS
+//   (= CuedStreams::SandboxSelector::VALID_RESPONSE_ACTIONS)
+// in lib/adaptive_response/archetypes.rb. Per the A4 spec §6.3 + §9.5.6 the MCP
+// tool schema must NOT hand-maintain a second copy that can drift — so every
+// tool that advertises a response_action enum imports THIS constant, and a
+// Rails CI drift spec (spec/lib/adaptive_response/mcp_cue_enum_drift_spec.rb)
+// fails the build if the two ever diverge.
+//
+// History: before 2026-06-13 the get_next_cued_message tool hand-listed the
+// pre-§9.5 set ["did_it", "check_it", "know_it", "skipped"]. That advertised the
+// now-removed `skipped` (Rails 422s it) and omitted six valid actions
+// (already_do / will_try / new_to_me / needed_this / acknowledge / no_response),
+// so the tool's own JSON-Schema rejected valid feedback before it reached Rails.
+//
+// Forward-compat (§9.5.4): the vocabulary GROWS over time; MCP clients MUST
+// tolerate unknown response_action values in responses and SHOULD treat unknown
+// archetypes as `acknowledge`-class. Widening = bump this list + redeploy.
+export const CUE_RESPONSE_ACTIONS = [
+    "did_it",
+    "already_do",
+    "will_try",
+    "check_it",
+    "new_to_me",
+    "needed_this",
+    "know_it",
+    "acknowledge",
+    "no_response",
+];
+//# sourceMappingURL=cue-actions.js.map

package/dist/cue-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cue-actions.js","sourceRoot":"","sources":["../src/cue-actions.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,uDAAuD;AACvD,6DAA6D;AAC7D,gFAAgF;AAChF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,2CAA2C;AAC3C,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,sEAAsE;AACtE,iFAAiF;AACjF,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,UAAU;IACV,WAAW;IACX,aAAa;IACb,SAAS;IACT,aAAa;IACb,aAAa;CACL,CAAC"}

package/dist/index.js

@@ -0,0 +1,86 @@
+// Track A A4 PR 2 — MCP server entry point.
+//
+// Stack:
+//   Express ←→ StreamableHTTPServerTransport ←→ MCP Server ←→ tool handlers
+//
+// Per-request flow:
+//   1. nginx vhost at mcp.uphealth.us terminates TLS + proxies to localhost:3001
+//   2. Express receives POST /mcp (or GET /mcp for SSE upgrade) with
+//      Authorization: Bearer up_sandbox_… header
+//   3. Express middleware extracts the Bearer + wraps the rest of the
+//      handler chain in withRequestContext({ bearer }) so tool handlers
+//      can read it without it leaking across concurrent requests.
+//   4. StreamableHTTPServerTransport handles the MCP JSON-RPC envelope
+//      + dispatches to the registered tool handler.
+//   5. Tool handler calls Rails via the rails-client.ts wrapper, which
+//      reads the bearer from currentContext().
+//   6. Rails response (200 or non-2xx) gets translated to an MCP tool
+//      result by tool-result.ts and returned to the agent.
+//
+// Statelessness: the MCP server holds no per-tenant state, no token
+// cache, no session store. Auth state lives in Rails. Per the A4 spec
+// §4 "Statelessness" property.
+//
+// Spec: docs/spec_track_a_a4_mcp_server.md §3 + §4 + §6.
+import express from "express";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { config } from "./config.js";
+import { withRequestContext } from "./context.js";
+import { buildServer } from "./server.js";
+// The MCP Server factory lives in server.ts and is shared with the stdio
+// entrypoint (stdio.ts), so tools + annotations are registered in exactly
+// one place. This module is the Streamable HTTP transport only.
+// ---------- Express wrapper ----------
+function extractBearer(req) {
+    const header = req.header("authorization") ?? req.header("Authorization");
+    if (!header)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match ? match[1].trim() : null;
+}
+function startHttpServer() {
+    const app = express();
+    app.use(express.json({ limit: "1mb" }));
+    // Health check (does NOT require auth; useful for nginx/load-balancer probes).
+    app.get("/health", (_req, res) => {
+        res.status(200).json({ status: "ok", server: config.serverName, version: config.serverVersion });
+    });
+    // MCP endpoint — POST is request/response; GET is SSE upgrade for
+    // server-initiated streams (Streamable HTTP transport spec).
+    const mcpHandler = async (req, res, _next) => {
+        const bearer = extractBearer(req);
+        if (!bearer) {
+            res.status(401).json({
+                error: "unauthorized",
+                message: "Missing or malformed Authorization: Bearer header. Get a free sandbox key at https://uphealth.us/signup, then send it as 'Authorization: Bearer up_sandbox_…'.",
+            });
+            return;
+        }
+        try {
+            await withRequestContext({ bearer }, async () => {
+                const server = buildServer();
+                const transport = new StreamableHTTPServerTransport({
+                    sessionIdGenerator: undefined, // stateless mode per A4 spec §4
+                });
+                await server.connect(transport);
+                await transport.handleRequest(req, res, req.body);
+            });
+        }
+        catch (err) {
+            // Catch-all error guard — keep nginx + the Streamable HTTP transport
+            // from observing an unhandled exception. Logs server-side.
+            console.error("[mcp-server] handler error:", err);
+            if (!res.headersSent) {
+                res.status(500).json({ error: "internal_error" });
+            }
+        }
+    };
+    app.post("/mcp", mcpHandler);
+    app.get("/mcp", mcpHandler);
+    app.listen(config.port, () => {
+        console.log(`[${config.serverName}@${config.serverVersion}] listening on :${config.port} → ${config.railsApiBaseUrl}`);
+    });
+}
+// Boot.
+startHttpServer();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,SAAS;AACT,4EAA4E;AAC5E,EAAE;AACF,oBAAoB;AACpB,iFAAiF;AACjF,qEAAqE;AACrE,iDAAiD;AACjD,sEAAsE;AACtE,wEAAwE;AACxE,kEAAkE;AAClE,uEAAuE;AACvE,oDAAoD;AACpD,uEAAuE;AACvE,+CAA+C;AAC/C,sEAAsE;AACtE,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,+BAA+B;AAC/B,EAAE;AACF,yDAAyD;AAEzD,OAAO,OAA2D,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,0EAA0E;AAC1E,gEAAgE;AAEhE,wCAAwC;AAExC,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAExC,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QAC5E,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,OAAO,EACL,gKAAgK;aACnK,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE;gBAC9C,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAClD,kBAAkB,EAAE,SAAS,EAAE,gCAAgC;iBAChE,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,2DAA2D;YAC3D,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE5B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,OAAO,CAAC,GAAG,CACT,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,mBAAmB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,CAC1G,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ;AACR,eAAe,EAAE,CAAC"}

package/dist/output-schemas.js

@@ -0,0 +1,100 @@
+// Track A A4 / A5 (2026-06-14) — MCP `outputSchema` declarations for the 4 tools.
+//
+// Declaring outputSchema (+ returning `structuredContent`, see tool-result.ts)
+// lets MCP hosts validate and parse a tool's result reliably instead of
+// re-parsing the human-readable text blob. The shapes mirror the Rails
+// responses in public/openapi/signal-v1.json (StreamCreated / CueOutcome /
+// StreamRead / SandboxTopics) and the SDK types.
+//
+// Forward-compat by construction: JSON Schema's `additionalProperties`
+// defaults to TRUE when omitted, so a future additive response field never
+// makes a strict host reject a valid result — the same tolerance the response
+// vocabulary itself follows. Only `required` lists fields the API always emits.
+//
+// The SDK's Tool.outputSchema is a ZodObject<{ type: "object", properties?,
+// required? }> — so each tool's TOP-LEVEL schema carries exactly those keys
+// (the top-level `type` MUST be the literal "object"). Descriptions + nested
+// detail live on the property schemas, which the SDK passes through verbatim.
+// A single cued message + its receptivity score and audience-safety verdict.
+const CUE_SCHEMA = {
+    type: "object",
+    description: "A cued message plus its per-cue receptivity score and audience-safety verdict.",
+    properties: {
+        cue_event_id: { type: "integer" },
+        message_id: { type: "integer" },
+        message_class: { type: "string" },
+        kind: { type: "string", description: "fact | list | tip" },
+        body: { type: "string" },
+        source_url: { type: "string" },
+        source_quote: { type: "string" },
+        receptivity: { type: "number", description: "Advisory receptivity in [0.0, 1.0]; 0.5 = neutral/new patient." },
+        safety: { type: "object", additionalProperties: true, description: "PHI-free audience-safety verdict." },
+        cued_at: { type: "string", description: "ISO 8601 timestamp." },
+    },
+    additionalProperties: true,
+};
+// Legal/disclosure block returned on every success (A1 §6.7). Do not strip in your UI.
+const META_SCHEMA = {
+    type: "object",
+    description: "Legal/disclosure block returned on every 2xx (A1 §6.7).",
+    properties: {
+        api_version: { type: "string" },
+        no_medical_advice: { type: "boolean" },
+        not_samd: { type: "boolean" },
+        license_attribution: { type: "string" },
+        delivery_mode: { type: "string" },
+        sequencing_ip_notice: { type: "string" },
+    },
+    additionalProperties: true,
+};
+export const createPatientStreamOutputSchema = {
+    type: "object",
+    properties: {
+        stream_id: { type: "integer", description: "Persist this — every later cue/read references it." },
+        state: { type: "string" },
+        first_cue: CUE_SCHEMA,
+        next_cue_eligible_at: { type: ["string", "null"] },
+        _meta: META_SCHEMA,
+    },
+    required: ["stream_id", "state", "first_cue", "_meta"],
+};
+export const getNextCuedMessageOutputSchema = {
+    type: "object",
+    properties: {
+        stream_id: { type: "integer" },
+        state: { type: "string" },
+        // CueResult fields:
+        idempotent: { type: "boolean", description: "true when this is the cached result of a repeated idempotency_key." },
+        next_cue: CUE_SCHEMA,
+        // StreamExhausted fields (end-of-stream marker):
+        sandbox_exhausted: { type: "boolean", description: "Present + true when the sandbox subset is exhausted; no next_cue then." },
+        message: { type: "string" },
+        _meta: META_SCHEMA,
+    },
+    // next_cue is omitted from `required` because the exhausted-stream result has
+    // no next_cue — only the common fields are guaranteed on every cue response.
+    required: ["stream_id", "state", "_meta"],
+};
+export const readStreamStateOutputSchema = {
+    type: "object",
+    properties: {
+        stream_id: { type: "integer" },
+        template_id: { type: "string" },
+        state: { type: "string" },
+        current_cue: { type: ["object", "null"], additionalProperties: true },
+        next_cue_eligible: { type: "boolean" },
+        events_count: { type: "integer" },
+        _meta: META_SCHEMA,
+    },
+    required: ["stream_id", "state", "_meta"],
+};
+export const listSandboxTopicsOutputSchema = {
+    type: "object",
+    properties: {
+        topic_labels: { type: "array", items: { type: "string" } },
+        template_id_for_sandbox: { type: "string" },
+        _meta: META_SCHEMA,
+    },
+    required: ["topic_labels", "_meta"],
+};
+//# sourceMappingURL=output-schemas.js.map

package/dist/output-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-schemas.js","sourceRoot":"","sources":["../src/output-schemas.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,uEAAuE;AACvE,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAE9E,6EAA6E;AAC7E,MAAM,UAAU,GAAG;IACjB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,gFAAgF;IAC7F,UAAU,EAAE;QACV,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;QAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC9G,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE;QACxG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;KAChE;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,yDAAyD;IACtE,UAAU,EAAE;QACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzC;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oDAAoD,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,SAAS,EAAE,UAAU;QACrB,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QAClD,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC;CACvD,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,oBAAoB;QACpB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oEAAoE,EAAE;QAClH,QAAQ,EAAE,UAAU;QACpB,iDAAiD;QACjD,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,wEAAwE,EAAE;QAC7H,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,KAAK,EAAE,WAAW;KACnB;IACD,8EAA8E;IAC9E,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE;QACrE,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACtC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC1D,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3C,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC;CACpC,CAAC"}

package/dist/rails-client.js

@@ -0,0 +1,62 @@
+// Track A A4 PR 2 — Thin HTTP wrapper around api.uphealth.us A1 endpoints.
+//
+// Bearer-token passthrough per Eric Gate-1 2026-05-18 (preserved at
+// 2026-05-22 build-kickoff revalidation). The MCP server reads the
+// Authorization header on inbound MCP requests and forwards it
+// unmodified to Rails. No token cache, no session store, no auth
+// state on the MCP server side — Rails is the single source of truth.
+//
+// Spec: docs/spec_track_a_a4_mcp_server.md §6.4 (error propagation).
+import { config } from "./config.js";
+/**
+ * Perform a Bearer-passthrough HTTP call to the Rails A1 API.
+ *
+ * `bearer` is the agent's auth token (already in `up_sandbox_…` shape).
+ * Returns the full Rails response (status + parsed body) so callers can
+ * branch on Rails error codes per spec §6.4.
+ */
+export async function callRails(opts) {
+    const url = new URL(opts.path, config.railsApiBaseUrl).toString();
+    const headers = {
+        Authorization: `Bearer ${opts.bearer}`,
+        Accept: "application/json",
+    };
+    const fetchInit = {
+        method: opts.method,
+        headers,
+    };
+    if (opts.body !== undefined) {
+        headers["Content-Type"] = "application/json";
+        fetchInit.body = JSON.stringify(opts.body);
+    }
+    const response = await fetch(url, fetchInit);
+    const responseHeaders = {};
+    response.headers.forEach((value, key) => {
+        responseHeaders[key] = value;
+    });
+    let parsed = null;
+    const text = await response.text();
+    if (text.length > 0) {
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            // Rails should always return JSON for API endpoints; if it didn't,
+            // the response body is opaque text. Surface it as an error body.
+            parsed = { error: "non_json_response", raw: text };
+        }
+    }
+    return { status: response.status, body: parsed, headers: responseHeaders };
+}
+/**
+ * Detect Rails error responses (non-2xx). Used by tool handlers to
+ * decide whether to return MCP tool results as isError per spec §6.4.
+ *
+ * Note: create_patient_stream wraps `POST /v1/signal/streams`, which renders
+ * 201 Created on success — the `< 200 || >= 300` range (not `!== 200`)
+ * deliberately treats 201 as success. tools.test.ts pins this.
+ */
+export function isErrorStatus(status) {
+    return status < 200 || status >= 300;
+}
+//# sourceMappingURL=rails-client.js.map

package/dist/rails-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rails-client.js","sourceRoot":"","sources":["../src/rails-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,+DAA+D;AAC/D,iEAAiE;AACjE,sEAAsE;AACtE,EAAE;AACF,qEAAqE;AAErE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgBrC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAc,IAK5C;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClE,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;QACtC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IAEF,MAAM,SAAS,GAAgB;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC7C,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE7C,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,IAAI,EAA2B,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AACvC,CAAC"}

package/dist/server.js

@@ -0,0 +1,38 @@
+// Shared MCP Server factory — used by BOTH transports:
+//   - src/index.ts   (Streamable HTTP, hosted at mcp.uphealth.us)
+//   - src/stdio.ts   (stdio, for local `npx @uphealth/mcp-server` installs)
+//
+// Holds no per-tenant state. The bearer is resolved per call from the request
+// context (context.ts): the HTTP path binds it per request; the stdio path
+// sets a process-level fallback. Tools + tool-result are identical across both.
+//
+// Spec: docs/spec_track_a_a4_mcp_server.md §3 + §4 + §6.
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { config } from "./config.js";
+import { tools, findToolByName } from "./tools/index.js";
+import { errorResult } from "./tool-result.js";
+export function buildServer() {
+    const server = new Server({ name: config.serverName, version: config.serverVersion }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: tools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+            annotations: t.annotations,
+            // A5 (2026-06-14) — outputSchema lets hosts validate/parse structuredContent.
+            outputSchema: t.outputSchema,
+        })),
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const toolName = req.params.name;
+        const args = (req.params.arguments ?? {});
+        const tool = findToolByName(toolName);
+        if (!tool) {
+            return errorResult(`Unknown tool: ${toolName}`);
+        }
+        return (await tool.handler(args));
+    });
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,kEAAkE;AAClE,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,yDAAyD;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,8EAA8E;YAC9E,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAA2B,EAAE;QACrF,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QACrE,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,WAAW,CAAC,iBAAiB,QAAQ,EAAE,CAAmB,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAmB,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/stdio.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+// Stdio entrypoint — makes the Uphealth MCP server runnable as a local
+// subprocess by any MCP client (Claude Desktop, Cursor, VS Code, etc.) via:
+//
+//   npx -y @uphealth/mcp-server
+//
+// with the user's key in the environment:
+//
+//   UPHEALTH_API_KEY=up_sandbox_…
+//
+// This is the dominant MCP install pattern (local stdio), complementing the
+// hosted Streamable HTTP deployment at mcp.uphealth.us (src/index.ts). The two
+// share the same tools and the same Server factory (server.ts).
+//
+// A stdio process is single-tenant: one user, one key for its lifetime. We set
+// that key as the process-level fallback context, so the same tool handlers
+// that read the per-request bearer over HTTP work unchanged here.
+import "./bootstrap-env.js"; // must run before anything imports config.ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { setFallbackContext } from "./context.js";
+import { buildServer } from "./server.js";
+async function main() {
+    const apiKey = process.env.UPHEALTH_API_KEY?.trim();
+    if (!apiKey) {
+        // Write guidance to stderr (stdout is the MCP JSON-RPC channel).
+        console.error("Uphealth MCP: missing UPHEALTH_API_KEY. Get a free sandbox key at " +
+            "https://uphealth.us/signup, then set UPHEALTH_API_KEY in your MCP client config.");
+        process.exit(1);
+    }
+    setFallbackContext({ bearer: apiKey });
+    const server = buildServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // The process now stays alive serving JSON-RPC over stdio until the client
+    // closes stdin. No banner on stdout — it is the protocol channel.
+}
+main().catch((err) => {
+    console.error("[uphealth-mcp] fatal:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=stdio.js.map

package/dist/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA,uEAAuE;AACvE,4EAA4E;AAC5E,EAAE;AACF,gCAAgC;AAChC,EAAE;AACF,0CAA0C;AAC1C,EAAE;AACF,kCAAkC;AAClC,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,gEAAgE;AAChE,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,kEAAkE;AAElE,OAAO,oBAAoB,CAAC,CAAC,6CAA6C;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iEAAiE;QACjE,OAAO,CAAC,KAAK,CACX,oEAAoE;YAClE,kFAAkF,CACrF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,2EAA2E;IAC3E,kEAAkE;AACpE,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tool-result.js

@@ -0,0 +1,90 @@
+// Track A A4 PR 2 — Helpers for building MCP tool results.
+//
+// Spec: docs/spec_track_a_a4_mcp_server.md §6.4 — Rails non-2xx
+// responses propagate as isError with a structured message. Successful
+// responses include the Rails body verbatim (preserving the _meta
+// block per A1 §6.7).
+export function successResult(body) {
+    return {
+        // The text block stays as the JSON serialization of structuredContent so
+        // hosts that don't support structuredContent still get the full payload
+        // (MCP backward-compat guidance).
+        content: [{ type: "text", text: JSON.stringify(body, null, 2) }],
+        structuredContent: body,
+    };
+}
+export function errorResult(message) {
+    return {
+        content: [{ type: "text", text: message }],
+        isError: true,
+    };
+}
+/**
+ * Translate a Rails error response into an MCP tool error result per
+ * the spec §6.4 propagation table. Preserves Rails error codes + any
+ * structured detail fields so agents can branch on the underlying cause.
+ *
+ * THE MOAT (A1 §3) is enforced via the 409 feedback_required case —
+ * the error message must clearly communicate the constraint is
+ * structural, not a transient bug.
+ */
+export function railsErrorToToolResult(status, body, context, headers) {
+    const errCode = body?.error ?? "unknown_error";
+    const ctxPrefix = context ? `${context}: ` : "";
+    switch (status) {
+        case 401:
+            return errorResult(`${ctxPrefix}Authentication failed. Check that your Authorization: Bearer header carries a valid up_sandbox_… token. Get a free sandbox key at https://uphealth.us/signup.`);
+        case 403:
+            if (errCode === "insufficient_scope") {
+                return errorResult(`${ctxPrefix}Insufficient scope. Your token lacks the '${body?.required ?? "required"}' scope. Upgrade tier or request a scope grant.`);
+            }
+            return errorResult(`${ctxPrefix}Forbidden: ${errCode}`);
+        case 404:
+            return errorResult(`${ctxPrefix}Resource not found (or belongs to a different tenant).`);
+        case 409:
+            if (errCode === "feedback_required") {
+                return errorResult(`${ctxPrefix}THE MOAT (A1 §3 Design Constraint #1) — cannot advance stream without submitting feedback for cue_event_id ${body?.last_cue_event_id} first. This is structural, not a bug. Provide feedback in your next call.`);
+            }
+            if (errCode === "idempotency_key_conflict") {
+                return errorResult(`${ctxPrefix}Idempotency key already used for a different feedback payload (existing_event_id ${body?.existing_event_id}). Use a fresh UUID or replay the original payload exactly.`);
+            }
+            if (errCode === "stream_ended") {
+                return errorResult(`${ctxPrefix}Stream is ended; cannot advance further.`);
+            }
+            return errorResult(`${ctxPrefix}Conflict: ${errCode}`);
+        case 422:
+            if (errCode === "missing_required_audience_tags") {
+                return errorResult(`${ctxPrefix}This template requires audience tag(s) ${JSON.stringify(body?.required ?? [])} that were not supplied. Add them to the audience_tags array and retry.`);
+            }
+            if (errCode === "incompatible_audience_tag") {
+                return errorResult(`${ctxPrefix}Incompatible audience tag(s) ${JSON.stringify(body?.incompatible ?? [])} for this template. Remove them from the audience_tags array and retry.`);
+            }
+            return errorResult(`${ctxPrefix}Invalid parameters: ${JSON.stringify(body?.details ?? body?.message ?? body)}`);
+        case 429:
+            if (errCode === "over_quota") {
+                // GTM P7 Discovery cap — the upgrade moment, NOT a transient failure.
+                // Surface the upgrade_url + usage so the agent can route the developer
+                // to checkout, plus the Retry-After window (seconds until the calendar-
+                // month reset, UTC) from the response header (rails-client populates it).
+                const retryAfter = headers?.["retry-after"];
+                const usage = body?.cap != null ? ` (${body?.current_count ?? "?"}/${body?.cap} this calendar month)` : "";
+                const upgrade = body?.upgrade_url ? ` Upgrade to continue: ${body?.upgrade_url}.` : "";
+                const retry = retryAfter
+                    ? ` The cap resets at the start of the next calendar month (UTC) — Retry-After: ~${retryAfter}s.`
+                    : "";
+                return errorResult(`${ctxPrefix}Discovery monthly cue cap reached${usage}. This is an upgrade signal, not a transient bug — retrying the same call will keep hitting the cap.${upgrade}${retry}`);
+            }
+            return errorResult(`${ctxPrefix}Too many requests: ${errCode}`);
+        case 503:
+            if (errCode === "sandbox_corpus_empty") {
+                return errorResult(`${ctxPrefix}Sandbox corpus is being seeded; retry in a moment.`);
+            }
+            if (errCode === "content_unavailable") {
+                return errorResult(`${ctxPrefix}The content corpus is temporarily unreachable upstream. This is transient — retry in a moment.`);
+            }
+            return errorResult(`${ctxPrefix}Service unavailable: ${errCode}`);
+        default:
+            return errorResult(`${ctxPrefix}Unexpected Rails response (status=${status}): ${errCode}`);
+    }
+}
+//# sourceMappingURL=tool-result.js.map

package/dist/tool-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-result.js","sourceRoot":"","sources":["../src/tool-result.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,kEAAkE;AAClE,sBAAsB;AAiBtB,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,OAAO;QACL,yEAAyE;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,IAA2B,EAC3B,OAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,WAAW,CAChB,GAAG,SAAS,+JAA+J,CAC5K,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;gBACrC,OAAO,WAAW,CAChB,GAAG,SAAS,6CAA6C,IAAI,EAAE,QAAQ,IAAI,UAAU,iDAAiD,CACvI,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,cAAc,OAAO,EAAE,CAAC,CAAC;QAC1D,KAAK,GAAG;YACN,OAAO,WAAW,CAChB,GAAG,SAAS,wDAAwD,CACrE,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBACpC,OAAO,WAAW,CAChB,GAAG,SAAS,8GAA8G,IAAI,EAAE,iBAAiB,4EAA4E,CAC9N,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;gBAC3C,OAAO,WAAW,CAChB,GAAG,SAAS,oFAAoF,IAAI,EAAE,iBAAiB,6DAA6D,CACrL,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;gBAC/B,OAAO,WAAW,CAAC,GAAG,SAAS,0CAA0C,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,aAAa,OAAO,EAAE,CAAC,CAAC;QACzD,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,gCAAgC,EAAE,CAAC;gBACjD,OAAO,WAAW,CAChB,GAAG,SAAS,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,yEAAyE,CACpK,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,2BAA2B,EAAE,CAAC;gBAC5C,OAAO,WAAW,CAChB,GAAG,SAAS,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,yEAAyE,CAC9J,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAChB,GAAG,SAAS,uBAAuB,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,0EAA0E;gBAC1E,MAAM,UAAU,GAAG,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;gBAC5C,MAAM,KAAK,GACT,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,aAAa,IAAI,GAAG,IAAI,IAAI,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/F,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,yBAAyB,IAAI,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,MAAM,KAAK,GAAG,UAAU;oBACtB,CAAC,CAAC,iFAAiF,UAAU,IAAI;oBACjG,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,WAAW,CAChB,GAAG,SAAS,oCAAoC,KAAK,uGAAuG,OAAO,GAAG,KAAK,EAAE,CAC9K,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,sBAAsB,OAAO,EAAE,CAAC,CAAC;QAClE,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;gBACvC,OAAO,WAAW,CAChB,GAAG,SAAS,oDAAoD,CACjE,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;gBACtC,OAAO,WAAW,CAChB,GAAG,SAAS,gGAAgG,CAC7G,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACpE;YACE,OAAO,WAAW,CAChB,GAAG,SAAS,qCAAqC,MAAM,MAAM,OAAO,EAAE,CACvE,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/tools/create-patient-stream.js

@@ -0,0 +1,74 @@
+// Track A A4 PR 2 — MCP tool: create_patient_stream
+//
+// Wraps Rails:
+//   POST /v1/signal/streams
+// Creates a cued stream for a patient. Returns stream_id + first
+// cued message. Each subsequent cue requires submitting the prior
+// message's feedback (the moat per A1 §3).
+//
+// v1 accepts only `general_wellness_daily` template + `display`
+// delivery_mode per the locked sandbox scope. Deliver-mode unlocks
+// at Per-Episode tier after BAA execution.
+//
+// Scope required: stream:create.
+// Spec: docs/spec_track_a_a4_mcp_server.md §6.3.
+import { callRails, isErrorStatus } from "../rails-client.js";
+import { currentContext } from "../context.js";
+import { successResult, railsErrorToToolResult, } from "../tool-result.js";
+import { createPatientStreamOutputSchema } from "../output-schemas.js";
+export const createPatientStreamTool = {
+    name: "create_patient_stream",
+    description: "Create a cued stream for a patient. Returns stream_id + first cued message. Each subsequent cue MUST submit the prior message's feedback — the engine refuses to advance without it (the moat mechanic).",
+    annotations: {
+        title: "Create patient stream",
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: true,
+    },
+    inputSchema: {
+        type: "object",
+        properties: {
+            template_id: {
+                type: "string",
+                enum: ["general_wellness_daily"],
+                description: "v1 sandbox supports one template; future templates land as v1+ ships.",
+            },
+            attributes: {
+                type: "object",
+                description: "De-identified patient context. v1 accepts free-form jsonb; future templates will enforce schemas.",
+            },
+            audience_tags: {
+                type: "array",
+                items: { type: "string" },
+                description: "Subset of the 14-tag B5/B6 schema. See list_sandbox_topics for sample topic labels.",
+            },
+            delivery_mode: {
+                type: "string",
+                enum: ["display"],
+                default: "display",
+                description: "v1 is Display-only; Deliver-mode unlocks at Per-Episode tier after BAA.",
+            },
+            feedback_timeout_days: {
+                type: "integer",
+                default: 14,
+            },
+        },
+        required: ["template_id"],
+        additionalProperties: true,
+    },
+    outputSchema: createPatientStreamOutputSchema,
+    async handler(args) {
+        const { bearer } = currentContext();
+        const response = await callRails({
+            method: "POST",
+            path: "/v1/signal/streams",
+            bearer,
+            body: args,
+        });
+        if (isErrorStatus(response.status)) {
+            return railsErrorToToolResult(response.status, response.body, "create_patient_stream", response.headers);
+        }
+        return successResult(response.body);
+    },
+};
+//# sourceMappingURL=create-patient-stream.js.map

package/dist/tools/create-patient-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-patient-stream.js","sourceRoot":"","sources":["../../src/tools/create-patient-stream.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,eAAe;AACf,4BAA4B;AAC5B,iEAAiE;AACjE,kEAAkE;AAClE,2CAA2C;AAC3C,EAAE;AACF,gEAAgE;AAChE,mEAAmE;AACnE,2CAA2C;AAC3C,EAAE;AACF,iCAAiC;AACjC,iDAAiD;AAEjD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAEvE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACT,0MAA0M;IAC5M,WAAW,EAAE;QACX,KAAK,EAAE,uBAAuB;QAC9B,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,IAAI;KACpB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,UAAU,EAAE;YACV,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,IAAI,EAAE,CAAC,wBAAwB,CAAC;gBAChC,WAAW,EAAE,uEAAuE;aACrF;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAiB;gBACvB,WAAW,EACT,mGAAmG;aACtG;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,OAAgB;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;gBAClC,WAAW,EAAE,qFAAqF;aACnG;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,QAAiB;gBACvB,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,yEAAyE;aACvF;YACD,qBAAqB,EAAE;gBACrB,IAAI,EAAE,SAAkB;gBACxB,OAAO,EAAE,EAAE;aACZ;SACF;QACD,QAAQ,EAAE,CAAC,aAAa,CAAC;QACzB,oBAAoB,EAAE,IAAI;KAC3B;IACD,YAAY,EAAE,+BAA+B;IAC7C,KAAK,CAAC,OAAO,CAAC,IAA6B;QACzC,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,IAA6B,EACtC,uBAAuB,EACvB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;CACF,CAAC"}

package/dist/tools/get-next-cued-message.js

@@ -0,0 +1,78 @@
+// Track A A4 PR 2 — MCP tool: get_next_cued_message
+//
+// Wraps Rails:
+//   POST /v1/signal/streams/:id/cue
+// THIS TOOL REFUSES WITHOUT PRIOR-MESSAGE FEEDBACK — the moat per
+// A1 §3 Design Constraint #1. Missing feedback returns 409 from Rails;
+// railsErrorToToolResult maps that to an isError result with a clear
+// message explaining the constraint is structural, not transient.
+//
+// Scope required: stream:cue.
+// Spec: docs/spec_track_a_a4_mcp_server.md §6.3 + §6.4 (moat error).
+import { callRails, isErrorStatus } from "../rails-client.js";
+import { currentContext } from "../context.js";
+import { successResult, railsErrorToToolResult, errorResult, } from "../tool-result.js";
+import { CUE_RESPONSE_ACTIONS } from "../cue-actions.js";
+import { getNextCuedMessageOutputSchema } from "../output-schemas.js";
+export const getNextCuedMessageTool = {
+    name: "get_next_cued_message",
+    description: "Submit the prior message's feedback and receive the next cued message. THIS TOOL REFUSES WITHOUT PRIOR-MESSAGE FEEDBACK — the moat. Same idempotency_key + same feedback returns the cached cue; conflicting feedback under the same key returns 409.",
+    annotations: {
+        title: "Submit feedback, get next cued message",
+        readOnlyHint: false,
+        idempotentHint: true,
+        openWorldHint: true,
+    },
+    inputSchema: {
+        type: "object",
+        properties: {
+            stream_id: {
+                type: "integer",
+                description: "The stream_id returned by create_patient_stream.",
+            },
+            feedback: {
+                type: "object",
+                properties: {
+                    response_action: {
+                        type: "string",
+                        // Canonical cue vocabulary — single-sourced from cue-actions.ts,
+                        // drift-guarded against AdaptiveResponse::Archetypes::CUE_ACCEPTED_ACTIONS
+                        // (A4 spec §6.3 + §9.5.6). Do NOT hand-edit this list here.
+                        enum: [...CUE_RESPONSE_ACTIONS],
+                    },
+                    free_text: { type: "string" },
+                    idempotency_key: {
+                        type: "string",
+                        format: "uuid",
+                        description: "UUID v4 recommended. Same key + same feedback returns the cached cue; conflicting feedback under the same key returns 409.",
+                    },
+                },
+                required: ["response_action", "idempotency_key"],
+            },
+        },
+        required: ["stream_id", "feedback"],
+        additionalProperties: false,
+    },
+    outputSchema: getNextCuedMessageOutputSchema,
+    async handler(args) {
+        if (typeof args.stream_id !== "number" || !Number.isInteger(args.stream_id)) {
+            return errorResult("get_next_cued_message: stream_id must be an integer. Received: " +
+                JSON.stringify(args.stream_id));
+        }
+        if (!args.feedback || typeof args.feedback !== "object") {
+            return errorResult("get_next_cued_message: feedback object is required (the moat). Provide response_action + idempotency_key at minimum.");
+        }
+        const { bearer } = currentContext();
+        const response = await callRails({
+            method: "POST",
+            path: `/v1/signal/streams/${args.stream_id}/cue`,
+            bearer,
+            body: { feedback: args.feedback },
+        });
+        if (isErrorStatus(response.status)) {
+            return railsErrorToToolResult(response.status, response.body, "get_next_cued_message", response.headers);
+        }
+        return successResult(response.body);
+    },
+};
+//# sourceMappingURL=get-next-cued-message.js.map

package/dist/tools/get-next-cued-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-next-cued-message.js","sourceRoot":"","sources":["../../src/tools/get-next-cued-message.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,eAAe;AACf,oCAAoC;AACpC,kEAAkE;AAClE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,EAAE;AACF,8BAA8B;AAC9B,qEAAqE;AAErE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,WAAW,GAEZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAEtE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACT,uPAAuP;IACzP,WAAW,EAAE;QACX,KAAK,EAAE,wCAAwC;QAC/C,YAAY,EAAE,KAAK;QACnB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACpB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,UAAU,EAAE;YACV,SAAS,EAAE;gBACT,IAAI,EAAE,SAAkB;gBACxB,WAAW,EAAE,kDAAkD;aAChE;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAiB;gBACvB,UAAU,EAAE;oBACV,eAAe,EAAE;wBACf,IAAI,EAAE,QAAiB;wBACvB,iEAAiE;wBACjE,2EAA2E;wBAC3E,4DAA4D;wBAC5D,IAAI,EAAE,CAAC,GAAG,oBAAoB,CAAC;qBAChC;oBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;oBACtC,eAAe,EAAE;wBACf,IAAI,EAAE,QAAiB;wBACvB,MAAM,EAAE,MAAM;wBACd,WAAW,EACT,4HAA4H;qBAC/H;iBACF;gBACD,QAAQ,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;aACjD;SACF;QACD,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACnC,oBAAoB,EAAE,KAAK;KAC5B;IACD,YAAY,EAAE,8BAA8B;IAC5C,KAAK,CAAC,OAAO,CAAC,IAGb;QACC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,OAAO,WAAW,CAChB,iEAAiE;gBAC/D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,WAAW,CAChB,sHAAsH,CACvH,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB,IAAI,CAAC,SAAS,MAAM;YAChD,MAAM;YACN,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,IAA6B,EACtC,uBAAuB,EACvB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;CACF,CAAC"}

package/dist/tools/index.js

@@ -0,0 +1,16 @@
+// Track A A4 PR 2 — MCP tool registry.
+// All 4 v1 tools per docs/spec_track_a_a4_mcp_server.md §6.3.
+import { createPatientStreamTool } from "./create-patient-stream.js";
+import { getNextCuedMessageTool } from "./get-next-cued-message.js";
+import { readStreamStateTool } from "./read-stream-state.js";
+import { listSandboxTopicsTool } from "./list-sandbox-topics.js";
+export const tools = [
+    createPatientStreamTool,
+    getNextCuedMessageTool,
+    readStreamStateTool,
+    listSandboxTopicsTool,
+];
+export function findToolByName(name) {
+    return tools.find((t) => t.name === name);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,8DAA8D;AAE9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,uBAAuB;IACvB,sBAAsB;IACtB,mBAAmB;IACnB,qBAAqB;CACb,CAAC;AAIX,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/tools/list-sandbox-topics.js

@@ -0,0 +1,42 @@
+// Track A A4 PR 2 — MCP tool: list_sandbox_topics
+//
+// Wraps the Rails describe-only meta endpoint
+//   GET /v1/signal/sandbox-topics
+// shipped in A4 PR 1 (uphealth#422). Returns the 5-topic-label
+// allowlist that defines the v1 sandbox corpus. Use to preview what
+// content domains exist before creating a stream.
+//
+// Scope required: stream:metadata (in DISCOVERY_SCOPES per A2 §5.1).
+// Spec: docs/spec_track_a_a4_mcp_server.md §6.3.
+import { callRails, isErrorStatus } from "../rails-client.js";
+import { currentContext } from "../context.js";
+import { successResult, railsErrorToToolResult, } from "../tool-result.js";
+import { listSandboxTopicsOutputSchema } from "../output-schemas.js";
+export const listSandboxTopicsTool = {
+    name: "list_sandbox_topics",
+    description: "Returns the 5-topic-label allowlist that defines the v1 sandbox corpus. Use this to preview what content domains exist before creating a stream. Does NOT enumerate messages — the corpus stays internal.",
+    annotations: {
+        title: "List sandbox topics",
+        readOnlyHint: true,
+        openWorldHint: false,
+    },
+    inputSchema: {
+        type: "object",
+        properties: {},
+        additionalProperties: false,
+    },
+    outputSchema: listSandboxTopicsOutputSchema,
+    async handler(_args) {
+        const { bearer } = currentContext();
+        const response = await callRails({
+            method: "GET",
+            path: "/v1/signal/sandbox-topics",
+            bearer,
+        });
+        if (isErrorStatus(response.status)) {
+            return railsErrorToToolResult(response.status, response.body, "list_sandbox_topics", response.headers);
+        }
+        return successResult(response.body);
+    },
+};
+//# sourceMappingURL=list-sandbox-topics.js.map

package/dist/tools/list-sandbox-topics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-sandbox-topics.js","sourceRoot":"","sources":["../../src/tools/list-sandbox-topics.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,8CAA8C;AAC9C,kCAAkC;AAClC,+DAA+D;AAC/D,oEAAoE;AACpE,kDAAkD;AAClD,EAAE;AACF,qEAAqE;AACrE,iDAAiD;AAEjD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,2MAA2M;IAC7M,WAAW,EAAE;QACX,KAAK,EAAE,qBAAqB;QAC5B,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,KAAK;KACrB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,UAAU,EAAE,EAAE;QACd,oBAAoB,EAAE,KAAK;KAC5B;IACD,YAAY,EAAE,6BAA6B;IAC3C,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,2BAA2B;YACjC,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,IAA6B,EACtC,qBAAqB,EACrB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;CACF,CAAC"}

package/dist/tools/read-stream-state.js

@@ -0,0 +1,52 @@
+// Track A A4 PR 2 — MCP tool: read_stream_state
+//
+// Wraps Rails:
+//   GET /v1/signal/streams/:id
+// Read-only; does NOT advance the stream. Returns stream_id +
+// template_id + state + current_cue + next_cue_eligible + events_count
+// + _meta block.
+//
+// Scope required: stream:read.
+// Spec: docs/spec_track_a_a4_mcp_server.md §6.3.
+import { callRails, isErrorStatus } from "../rails-client.js";
+import { currentContext } from "../context.js";
+import { successResult, railsErrorToToolResult, errorResult, } from "../tool-result.js";
+import { readStreamStateOutputSchema } from "../output-schemas.js";
+export const readStreamStateTool = {
+    name: "read_stream_state",
+    description: "Read current stream state, current cued message, and events count. Read-only; does NOT advance the stream.",
+    annotations: {
+        title: "Read stream state",
+        readOnlyHint: true,
+        openWorldHint: true,
+    },
+    inputSchema: {
+        type: "object",
+        properties: {
+            stream_id: {
+                type: "integer",
+                description: "The stream_id returned by create_patient_stream.",
+            },
+        },
+        required: ["stream_id"],
+        additionalProperties: false,
+    },
+    outputSchema: readStreamStateOutputSchema,
+    async handler(args) {
+        if (typeof args.stream_id !== "number" || !Number.isInteger(args.stream_id)) {
+            return errorResult("read_stream_state: stream_id must be an integer. Received: " +
+                JSON.stringify(args.stream_id));
+        }
+        const { bearer } = currentContext();
+        const response = await callRails({
+            method: "GET",
+            path: `/v1/signal/streams/${args.stream_id}`,
+            bearer,
+        });
+        if (isErrorStatus(response.status)) {
+            return railsErrorToToolResult(response.status, response.body, "read_stream_state", response.headers);
+        }
+        return successResult(response.body);
+    },
+};
+//# sourceMappingURL=read-stream-state.js.map

package/dist/tools/read-stream-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-stream-state.js","sourceRoot":"","sources":["../../src/tools/read-stream-state.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,eAAe;AACf,+BAA+B;AAC/B,8DAA8D;AAC9D,uEAAuE;AACvE,iBAAiB;AACjB,EAAE;AACF,+BAA+B;AAC/B,iDAAiD;AAEjD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,WAAW,GAEZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,4GAA4G;IAC9G,WAAW,EAAE;QACX,KAAK,EAAE,mBAAmB;QAC1B,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,IAAI;KACpB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,UAAU,EAAE;YACV,SAAS,EAAE;gBACT,IAAI,EAAE,SAAkB;gBACxB,WAAW,EAAE,kDAAkD;aAChE;SACF;QACD,QAAQ,EAAE,CAAC,WAAW,CAAC;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IACD,YAAY,EAAE,2BAA2B;IACzC,KAAK,CAAC,OAAO,CAAC,IAA6B;QACzC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,OAAO,WAAW,CAChB,6DAA6D;gBAC3D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,sBAAsB,IAAI,CAAC,SAAS,EAAE;YAC5C,MAAM;SACP,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,IAA6B,EACtC,mBAAmB,EACnB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;CACF,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@uphealth/mcp-server",
+  "version": "1.0.0",
+  "mcpName": "us.uphealth/mcp",
+  "description": "Uphealth MCP server — drive cued health-message streams (Uphealth Signal) from any MCP client. Local stdio via npx, or hosted at mcp.uphealth.us.",
+  "license": "MIT",
+  "author": "Uphealth (Anschutz Media, Inc.)",
+  "homepage": "https://uphealth.us/docs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ericinsf/uphealth.git",
+    "directory": "mcp-server"
+  },
+  "bugs": {
+    "url": "https://uphealth.us/docs"
+  },
+  "keywords": ["mcp","model-context-protocol","uphealth","signal","health","healthcare","digital-health","agent","ai","llm-tools"],
+  "type": "module",
+  "bin": {
+    "uphealth-mcp": "dist/stdio.js"
+  },
+  "files": ["dist", "README.md", "DISTRIBUTION.md", "LICENSE"],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "start:stdio": "node dist/stdio.js",
+    "dev": "tsx src/index.ts",
+    "dev:stdio": "tsx src/stdio.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "express": "^4.21.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0",
+    "vitest": "^4.1.7"
+  }
+}