@uphealth/mcp-server 1.0.0 → 1.1.1

package/DISTRIBUTION.md

@@ -1,19 +1,20 @@
 # Use Uphealth Signal from an AI agent (MCP)
 
-The Uphealth MCP server lets any [Model Context Protocol](https://modelcontextprotocol.io/) client — Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, or your own agent — drive a cued health-message stream as four tools. It wraps the [Signal API](https://uphealth.us/docs); the model never sees your raw HTTP layer.
+The Uphealth MCP server lets any [Model Context Protocol](https://modelcontextprotocol.io/) client — Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, or your own agent — look up federal health facts and drive a cued health-message stream as five tools (one needs no key). It wraps the [Signal API](https://uphealth.us/docs); the model never sees your raw HTTP layer.
 
-**Get a free sandbox key** (no credit card, no PHI, no BAA) at **https://uphealth.us/signup**, then pick an install method below.
+**Try it with zero setup:** `lookup_health_fact` needs **no key** — one already-public federal fact per question. For the adaptive stream, **get a free sandbox key** (no credit card, no PHI, no BAA) at **https://uphealth.us/signup**, then pick an install method below.
 
-## The four tools
+## The five tools
 
-| Tool | Wraps | Does |
-|---|---|---|
-| `create_patient_stream` | `POST /v1/signal/streams` | Start a stream from a template; returns the opening cue |
-| `get_next_cued_message` | `POST /v1/signal/streams/:id/cue` | Submit the patient's response, get the next message |
-| `read_stream_state` | `GET /v1/signal/streams/:id` | Read state + current cue without advancing |
-| `list_sandbox_topics` | `GET /v1/signal/sandbox-topics` | List the five sandbox topics |
+| Tool | Wraps | Key? | Does |
+|---|---|---|---|
+| `lookup_health_fact` | `GET /v1/public/health-fact` | **none** | One already-public federal fact for a question/topic + its source + an uphealth.me link |
+| `create_patient_stream` | `POST /v1/signal/streams` | `up_…` | Start a stream from a template; returns the opening cue |
+| `get_next_cued_message` | `POST /v1/signal/streams/:id/cue` | `up_…` | Submit the patient's response, get the next message |
+| `read_stream_state` | `GET /v1/signal/streams/:id` | `up_…` | Read state + current cue without advancing |
+| `list_sandbox_topics` | `GET /v1/signal/sandbox-topics` | `up_…` | List the five sandbox topics |
 
-**The one rule:** every cue after the first requires feedback on the prior one (the model passes the patient's `response_action`). The tool descriptions teach this, so a capable agent drives the loop correctly.
+**The one rule** (keyed tools): every cue after the first requires feedback on the prior one (the model passes the patient's `response_action`). The tool descriptions teach this, so a capable agent drives the loop correctly.
 
 ---
 

package/README.md

@@ -1,12 +1,12 @@
 # Uphealth MCP Server (Track A A4)
 
-Wraps the [`api.uphealth.us` cued-stream API](../docs/spec_track_a_a1_cued_stream_api.md) as agent-callable [Model Context Protocol](https://modelcontextprotocol.io/) tools. Buyers configure their Claude Desktop / Cursor / agentic platform with the MCP server URL + a `up_sandbox_…` API token; the agent then calls 4 MCP tools to drive a cued patient stream.
+Wraps the [`api.uphealth.us` cued-stream API](../docs/spec_track_a_a1_cued_stream_api.md) as agent-callable [Model Context Protocol](https://modelcontextprotocol.io/) tools. The agent can call `lookup_health_fact` with **zero setup — no key** to get one already-public federal health fact, then configure a free `up_sandbox_…` key to drive an adaptive cued patient stream with the 4 keyed tools.
 
 Locks captured in [`docs/spec_track_a_a4_mcp_server.md`](../docs/spec_track_a_a4_mcp_server.md):
 
 - **SDK** — TypeScript via `@modelcontextprotocol/sdk` (flipped from Python at 2026-05-22 build-kickoff revalidation)
-- **Tool surface** — 4 tools: `create_patient_stream` / `get_next_cued_message` / `read_stream_state` / `list_sandbox_topics`
-- **Auth** — Bearer-token passthrough (MCP server is stateless thin proxy; Rails validates)
+- **Tool surface** — 5 tools: a **no-key** `lookup_health_fact` (one already-public federal fact per question, zero setup) + 4 keyed tools (`create_patient_stream` / `get_next_cued_message` / `read_stream_state` / `list_sandbox_topics`)
+- **Auth** — Bearer-token passthrough (MCP server is stateless thin proxy; Rails validates). `lookup_health_fact` is the sole exception — it needs no key; the per-tool policy still 401s every keyed tool without one.
 - **Corpus** — sandbox only at v1
 - **Hostname** — `mcp.uphealth.us` subdomain (Option A locked)
 - **Transport** — Streamable HTTP

package/dist/auth.js

@@ -0,0 +1,36 @@
+// Authorization header parsing for the Streamable HTTP transport.
+//
+// Extracted from index.ts as a pure, side-effect-free module so it can be
+// unit-tested without booting the Express listener (index.ts calls
+// startHttpServer() at import time).
+//
+// Accepts BOTH forms of the Authorization header value:
+//   - "Bearer up_sandbox_…"  — the standard form sent by /docs, the SDKs, and
+//     any client that follows the quickstart.
+//   - "up_sandbox_…"         — a BARE key with no "Bearer " prefix. The Smithery
+//     gateway forwards a config field to an upstream header via the config-schema
+//     `x-to: { header: "Authorization" }` mapping, but it forwards only the RAW
+//     value (no "Bearer " prefix / no templating — per Smithery's session-config
+//     docs). Accepting the bare key lets the Smithery `uphealth/signal` listing be
+//     connectable with a clean "paste your key" UX instead of forcing the user to
+//     type "Bearer " into the API-key field.
+//
+// Rails remains the auth authority — this only extracts a *candidate* token to
+// forward. A header that is neither "Bearer …" nor a bare up_… key reads as "no
+// key" so the caller can return the 401 onboarding hint rather than forwarding
+// garbage (e.g. "Basic …") to Rails.
+const BARE_KEY = /^up_[A-Za-z0-9_-]+$/;
+export function parseAuthorizationHeader(headerValue) {
+    if (!headerValue)
+        return null;
+    const trimmed = headerValue.trim();
+    const bearer = /^Bearer\s+(.+)$/i.exec(trimmed);
+    if (bearer)
+        return bearer[1].trim();
+    // Bare key (Smithery raw-forwarded). Restricted to our key shape so a
+    // malformed/other-scheme header still yields the 401 onboarding hint.
+    if (BARE_KEY.test(trimmed))
+        return trimmed;
+    return null;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AACnE,qCAAqC;AACrC,EAAE;AACF,wDAAwD;AACxD,8EAA8E;AAC9E,8CAA8C;AAC9C,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,mFAAmF;AACnF,kFAAkF;AAClF,6CAA6C;AAC7C,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,qCAAqC;AAErC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AAEvC,MAAM,UAAU,wBAAwB,CACtC,WAAsC;IAEtC,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpC,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE3C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/config.js

@@ -18,6 +18,6 @@ export const config = {
     nodeEnv: optionalEnv("NODE_ENV", "development"),
     logLevel: optionalEnv("LOG_LEVEL", "info"),
     serverName: "uphealth-mcp",
-    serverVersion: "1.0.0",
+    serverVersion: "1.1.1",
 };
 //# sourceMappingURL=config.js.map

package/dist/generated/signal-catalog.js

@@ -0,0 +1,243 @@
+// GENERATED FILE — do not edit by hand.
+// Source: app/services/cued_streams/mcp_catalog.rb (CuedStreams::McpCatalog),
+//   built from CuedStreams::TemplateRegistry + config/stream_templates/*.yml.
+// Regenerate on .me (needs Rails + the template YAMLs):
+//   bundle exec rake signal:mcp_catalog
+// Byte-exact drift-guarded by spec/lib/cued_streams/mcp_catalog_drift_spec.rb
+// (Rails CI; runs even on TS-only PRs since mcp-server/** is not paths-ignored).
+//
+// The metadata-only, non-PHI Signal template catalog. Served by the MCP
+// `signal://catalog` resource; the create_patient_stream tool derives its
+// template_id enum from SIGNAL_TEMPLATE_IDS. Carries NO corpus bodies and NO
+// patient data — only the gating contract (audience tags + de-identified
+// patient_context keys) each live template publishes.
+export const SIGNAL_CATALOG = {
+    "schema_version": 1,
+    "templates": [
+        {
+            "template_id": "diabetes_pharma_initiation_30day",
+            "display_name": "Diabetes Pharma Initiation (30-day)",
+            "status": "live",
+            "marketing_slug": "diabetes-pharma-init",
+            "expected_duration_days": 30,
+            "required_audience_tags": [
+                "diabetes_medication_optin"
+            ],
+            "optional_audience_tags": [
+                "t2d_optin"
+            ],
+            "excluded_audience_tags": [
+                "t1d_optin"
+            ],
+            "b_plus_gated_tag": "diabetes_medication_optin",
+            "required_patient_context": [
+                {
+                    "key": "medication_class",
+                    "type": "enum",
+                    "enum": [
+                        "metformin",
+                        "sglt2",
+                        "glp1",
+                        "dpp4",
+                        "sulfonylurea",
+                        "insulin",
+                        "other"
+                    ]
+                }
+            ],
+            "delivery_modes_supported": [
+                "display",
+                "deliver"
+            ],
+            "crisis_footer_rendered_on": "never",
+            "default_cadence": "daily"
+        },
+        {
+            "template_id": "general_wellness_daily",
+            "display_name": "General Wellness",
+            "status": "live",
+            "marketing_slug": "general-wellness",
+            "expected_duration_days": "indefinite",
+            "required_audience_tags": [],
+            "optional_audience_tags": [
+                "mental_health_optin",
+                "substance_use_optin",
+                "sex_repro_optin",
+                "child_health_optin",
+                "lgbtq_optin",
+                "cancer_diagnosis_optin",
+                "cancer_survivor_optin",
+                "cancer_caregiver_optin",
+                "parent_pediatric_cancer_optin",
+                "diabetes_medication_optin",
+                "veteran_optin",
+                "postpartum_optin"
+            ],
+            "excluded_audience_tags": [
+                "t1d_optin",
+                "t2d_optin"
+            ],
+            "b_plus_gated_tag": null,
+            "required_patient_context": [],
+            "delivery_modes_supported": [
+                "display",
+                "deliver"
+            ],
+            "crisis_footer_rendered_on": "never",
+            "default_cadence": "sometimes"
+        },
+        {
+            "template_id": "heart_pharma_initiation_30day",
+            "display_name": "Heart Pharma Initiation (30-day)",
+            "status": "live",
+            "marketing_slug": "heart-pharma-init",
+            "expected_duration_days": 30,
+            "required_audience_tags": [
+                "heart_medication_optin"
+            ],
+            "optional_audience_tags": [
+                "t2d_optin"
+            ],
+            "excluded_audience_tags": [],
+            "b_plus_gated_tag": "heart_medication_optin",
+            "required_patient_context": [
+                {
+                    "key": "medication_class",
+                    "type": "enum",
+                    "enum": [
+                        "statin",
+                        "antihypertensive",
+                        "anticoagulant",
+                        "other"
+                    ]
+                }
+            ],
+            "delivery_modes_supported": [
+                "display",
+                "deliver"
+            ],
+            "crisis_footer_rendered_on": "never",
+            "default_cadence": "daily"
+        },
+        {
+            "template_id": "hypertension_lifestyle_90day",
+            "display_name": "Hypertension Lifestyle (90-day)",
+            "status": "live",
+            "marketing_slug": "hypertension-lifestyle",
+            "expected_duration_days": 90,
+            "required_audience_tags": [],
+            "optional_audience_tags": [],
+            "excluded_audience_tags": [],
+            "b_plus_gated_tag": null,
+            "required_patient_context": [],
+            "delivery_modes_supported": [
+                "display",
+                "deliver"
+            ],
+            "crisis_footer_rendered_on": "never",
+            "default_cadence": "often"
+        },
+        {
+            "template_id": "quit_smoking_90day",
+            "display_name": "Quit Smoking (90-day)",
+            "status": "live",
+            "marketing_slug": "quit-smoking",
+            "expected_duration_days": 90,
+            "required_audience_tags": [],
+            "optional_audience_tags": [
+                "veteran_optin"
+            ],
+            "excluded_audience_tags": [],
+            "b_plus_gated_tag": null,
+            "required_patient_context": [
+                {
+                    "key": "quit_date",
+                    "type": "date",
+                    "validation": "ISO 8601 date"
+                }
+            ],
+            "delivery_modes_supported": [
+                "display",
+                "deliver"
+            ],
+            "crisis_footer_rendered_on": "never",
+            "default_cadence": "daily"
+        },
+        {
+            "template_id": "relapse_prevention_90day",
+            "display_name": "Relapse Prevention (90-day)",
+            "status": "live",
+            "marketing_slug": "relapse-prevention",
+            "expected_duration_days": 90,
+            "required_audience_tags": [
+                "substance_use_optin"
+            ],
+            "optional_audience_tags": [
+                "mental_health_optin",
+                "lgbtq_optin",
+                "veteran_optin",
+                "mat_optin"
+            ],
+            "excluded_audience_tags": [
+                "t1d_optin",
+                "t2d_optin"
+            ],
+            "b_plus_gated_tag": null,
+            "required_patient_context": [
+                {
+                    "key": "weeks_since_onset",
+                    "type": "integer",
+                    "validation": "0..520"
+                }
+            ],
+            "delivery_modes_supported": [
+                "display",
+                "deliver"
+            ],
+            "crisis_footer_rendered_on": "every_cue",
+            "default_cadence": "daily"
+        },
+        {
+            "template_id": "weight_glp1_initiation_30day",
+            "display_name": "Weight Management GLP-1 Initiation (30-day)",
+            "status": "live",
+            "marketing_slug": "weight-glp1-init",
+            "expected_duration_days": 30,
+            "required_audience_tags": [
+                "weight_loss_medication_optin"
+            ],
+            "optional_audience_tags": [
+                "t2d_optin"
+            ],
+            "excluded_audience_tags": [],
+            "b_plus_gated_tag": "weight_loss_medication_optin",
+            "required_patient_context": [
+                {
+                    "key": "medication_class",
+                    "type": "enum",
+                    "enum": [
+                        "glp1",
+                        "dual_gip_glp1",
+                        "other"
+                    ]
+                }
+            ],
+            "delivery_modes_supported": [
+                "display",
+                "deliver"
+            ],
+            "crisis_footer_rendered_on": "never",
+            "default_cadence": "daily"
+        }
+    ]
+};
+export const SIGNAL_TEMPLATE_IDS = [
+    "diabetes_pharma_initiation_30day",
+    "general_wellness_daily",
+    "heart_pharma_initiation_30day",
+    "hypertension_lifestyle_90day",
+    "quit_smoking_90day",
+    "relapse_prevention_90day",
+    "weight_glp1_initiation_30day"
+];
+//# sourceMappingURL=signal-catalog.js.map

package/dist/generated/signal-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-catalog.js","sourceRoot":"","sources":["../../src/generated/signal-catalog.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,8EAA8E;AAC9E,8EAA8E;AAC9E,wDAAwD;AACxD,wCAAwC;AACxC,8EAA8E;AAC9E,iFAAiF;AACjF,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,sDAAsD;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gBAAgB,EAAE,CAAC;IACnB,WAAW,EAAE;QACX;YACE,aAAa,EAAE,kCAAkC;YACjD,cAAc,EAAE,qCAAqC;YACrD,QAAQ,EAAE,MAAM;YAChB,gBAAgB,EAAE,sBAAsB;YACxC,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE;gBACxB,2BAA2B;aAC5B;YACD,wBAAwB,EAAE;gBACxB,WAAW;aACZ;YACD,wBAAwB,EAAE;gBACxB,WAAW;aACZ;YACD,kBAAkB,EAAE,2BAA2B;YAC/C,0BAA0B,EAAE;gBAC1B;oBACE,KAAK,EAAE,kBAAkB;oBACzB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE;wBACN,WAAW;wBACX,OAAO;wBACP,MAAM;wBACN,MAAM;wBACN,cAAc;wBACd,SAAS;wBACT,OAAO;qBACR;iBACF;aACF;YACD,0BAA0B,EAAE;gBAC1B,SAAS;gBACT,SAAS;aACV;YACD,2BAA2B,EAAE,OAAO;YACpC,iBAAiB,EAAE,OAAO;SAC3B;QACD;YACE,aAAa,EAAE,wBAAwB;YACvC,cAAc,EAAE,kBAAkB;YAClC,QAAQ,EAAE,MAAM;YAChB,gBAAgB,EAAE,kBAAkB;YACpC,wBAAwB,EAAE,YAAY;YACtC,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE;gBACxB,qBAAqB;gBACrB,qBAAqB;gBACrB,iBAAiB;gBACjB,oBAAoB;gBACpB,aAAa;gBACb,wBAAwB;gBACxB,uBAAuB;gBACvB,wBAAwB;gBACxB,+BAA+B;gBAC/B,2BAA2B;gBAC3B,eAAe;gBACf,kBAAkB;aACnB;YACD,wBAAwB,EAAE;gBACxB,WAAW;gBACX,WAAW;aACZ;YACD,kBAAkB,EAAE,IAAI;YACxB,0BAA0B,EAAE,EAAE;YAC9B,0BAA0B,EAAE;gBAC1B,SAAS;gBACT,SAAS;aACV;YACD,2BAA2B,EAAE,OAAO;YACpC,iBAAiB,EAAE,WAAW;SAC/B;QACD;YACE,aAAa,EAAE,+BAA+B;YAC9C,cAAc,EAAE,kCAAkC;YAClD,QAAQ,EAAE,MAAM;YAChB,gBAAgB,EAAE,mBAAmB;YACrC,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE;gBACxB,wBAAwB;aACzB;YACD,wBAAwB,EAAE;gBACxB,WAAW;aACZ;YACD,wBAAwB,EAAE,EAAE;YAC5B,kBAAkB,EAAE,wBAAwB;YAC5C,0BAA0B,EAAE;gBAC1B;oBACE,KAAK,EAAE,kBAAkB;oBACzB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE;wBACN,QAAQ;wBACR,kBAAkB;wBAClB,eAAe;wBACf,OAAO;qBACR;iBACF;aACF;YACD,0BAA0B,EAAE;gBAC1B,SAAS;gBACT,SAAS;aACV;YACD,2BAA2B,EAAE,OAAO;YACpC,iBAAiB,EAAE,OAAO;SAC3B;QACD;YACE,aAAa,EAAE,8BAA8B;YAC7C,cAAc,EAAE,iCAAiC;YACjD,QAAQ,EAAE,MAAM;YAChB,gBAAgB,EAAE,wBAAwB;YAC1C,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE,EAAE;YAC5B,kBAAkB,EAAE,IAAI;YACxB,0BAA0B,EAAE,EAAE;YAC9B,0BAA0B,EAAE;gBAC1B,SAAS;gBACT,SAAS;aACV;YACD,2BAA2B,EAAE,OAAO;YACpC,iBAAiB,EAAE,OAAO;SAC3B;QACD;YACE,aAAa,EAAE,oBAAoB;YACnC,cAAc,EAAE,uBAAuB;YACvC,QAAQ,EAAE,MAAM;YAChB,gBAAgB,EAAE,cAAc;YAChC,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE;gBACxB,eAAe;aAChB;YACD,wBAAwB,EAAE,EAAE;YAC5B,kBAAkB,EAAE,IAAI;YACxB,0BAA0B,EAAE;gBAC1B;oBACE,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,MAAM;oBACd,YAAY,EAAE,eAAe;iBAC9B;aACF;YACD,0BAA0B,EAAE;gBAC1B,SAAS;gBACT,SAAS;aACV;YACD,2BAA2B,EAAE,OAAO;YACpC,iBAAiB,EAAE,OAAO;SAC3B;QACD;YACE,aAAa,EAAE,0BAA0B;YACzC,cAAc,EAAE,6BAA6B;YAC7C,QAAQ,EAAE,MAAM;YAChB,gBAAgB,EAAE,oBAAoB;YACtC,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE;gBACxB,qBAAqB;aACtB;YACD,wBAAwB,EAAE;gBACxB,qBAAqB;gBACrB,aAAa;gBACb,eAAe;gBACf,WAAW;aACZ;YACD,wBAAwB,EAAE;gBACxB,WAAW;gBACX,WAAW;aACZ;YACD,kBAAkB,EAAE,IAAI;YACxB,0BAA0B,EAAE;gBAC1B;oBACE,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EAAE,SAAS;oBACjB,YAAY,EAAE,QAAQ;iBACvB;aACF;YACD,0BAA0B,EAAE;gBAC1B,SAAS;gBACT,SAAS;aACV;YACD,2BAA2B,EAAE,WAAW;YACxC,iBAAiB,EAAE,OAAO;SAC3B;QACD;YACE,aAAa,EAAE,8BAA8B;YAC7C,cAAc,EAAE,6CAA6C;YAC7D,QAAQ,EAAE,MAAM;YAChB,gBAAgB,EAAE,kBAAkB;YACpC,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE;gBACxB,8BAA8B;aAC/B;YACD,wBAAwB,EAAE;gBACxB,WAAW;aACZ;YACD,wBAAwB,EAAE,EAAE;YAC5B,kBAAkB,EAAE,8BAA8B;YAClD,0BAA0B,EAAE;gBAC1B;oBACE,KAAK,EAAE,kBAAkB;oBACzB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE;wBACN,MAAM;wBACN,eAAe;wBACf,OAAO;qBACR;iBACF;aACF;YACD,0BAA0B,EAAE;gBAC1B,SAAS;gBACT,SAAS;aACV;YACD,2BAA2B,EAAE,OAAO;YACpC,iBAAiB,EAAE,OAAO;SAC3B;KACF;CACO,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kCAAkC;IAClC,wBAAwB;IACxB,+BAA+B;IAC/B,8BAA8B;IAC9B,oBAAoB;IACpB,0BAA0B;IAC1B,8BAA8B;CACtB,CAAC"}

package/dist/index.js

@@ -27,16 +27,18 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { config } from "./config.js";
 import { withRequestContext } from "./context.js";
 import { buildServer } from "./server.js";
+import { parseAuthorizationHeader } from "./auth.js";
+import { requestAllowedWithoutBearer } from "./tool-auth-policy.js";
 // The MCP Server factory lives in server.ts and is shared with the stdio
 // entrypoint (stdio.ts), so tools + annotations are registered in exactly
 // one place. This module is the Streamable HTTP transport only.
 // ---------- Express wrapper ----------
 function extractBearer(req) {
     const header = req.header("authorization") ?? req.header("Authorization");
-    if (!header)
-        return null;
-    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-    return match ? match[1].trim() : null;
+    // parseAuthorizationHeader accepts "Bearer up_…" AND a bare "up_…" key
+    // (the latter is how the Smithery gateway forwards the raw config value —
+    // see auth.ts). Rails stays the auth authority.
+    return parseAuthorizationHeader(header);
 }
 function startHttpServer() {
     const app = express();
@@ -49,15 +51,21 @@ function startHttpServer() {
     // server-initiated streams (Streamable HTTP transport spec).
     const mcpHandler = async (req, res, _next) => {
         const bearer = extractBearer(req);
-        if (!bearer) {
+        // Per-tool policy: a request with no Bearer is allowed ONLY if every message
+        // is keyless-eligible (the handshake, discovery, or a lookup_health_fact
+        // call). Anything else — notably a keyed tools/call — still gets the 401
+        // onboarding hint. With a Bearer present the flow is unchanged.
+        if (!bearer && !requestAllowedWithoutBearer(req.body)) {
             res.status(401).json({
                 error: "unauthorized",
-                message: "Missing or malformed Authorization: Bearer header. Get a free sandbox key at https://uphealth.us/signup, then send it as 'Authorization: Bearer up_sandbox_…'.",
+                message: "Missing or malformed Authorization: Bearer header. Get a free sandbox key at https://uphealth.us/signup, then send it as 'Authorization: Bearer up_sandbox_…'. (No key needed for the lookup_health_fact tool.)",
             });
             return;
         }
         try {
-            await withRequestContext({ bearer }, async () => {
+            // bearer may be null on the keyless path; the lookup tool calls Rails with
+            // no Authorization, and keyed tools can't reach here without one.
+            await withRequestContext({ bearer: bearer ?? "" }, async () => {
                 const server = buildServer();
                 const transport = new StreamableHTTPServerTransport({
                     sessionIdGenerator: undefined, // stateless mode per A4 spec §4

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,SAAS;AACT,4EAA4E;AAC5E,EAAE;AACF,oBAAoB;AACpB,iFAAiF;AACjF,qEAAqE;AACrE,iDAAiD;AACjD,sEAAsE;AACtE,wEAAwE;AACxE,kEAAkE;AAClE,uEAAuE;AACvE,oDAAoD;AACpD,uEAAuE;AACvE,+CAA+C;AAC/C,sEAAsE;AACtE,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,+BAA+B;AAC/B,EAAE;AACF,yDAAyD;AAEzD,OAAO,OAA2D,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,0EAA0E;AAC1E,gEAAgE;AAEhE,wCAAwC;AAExC,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAExC,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QAC5E,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,OAAO,EACL,gKAAgK;aACnK,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE;gBAC9C,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAClD,kBAAkB,EAAE,SAAS,EAAE,gCAAgC;iBAChE,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,2DAA2D;YAC3D,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE5B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,OAAO,CAAC,GAAG,CACT,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,mBAAmB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,CAC1G,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ;AACR,eAAe,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,SAAS;AACT,4EAA4E;AAC5E,EAAE;AACF,oBAAoB;AACpB,iFAAiF;AACjF,qEAAqE;AACrE,iDAAiD;AACjD,sEAAsE;AACtE,wEAAwE;AACxE,kEAAkE;AAClE,uEAAuE;AACvE,oDAAoD;AACpD,uEAAuE;AACvE,+CAA+C;AAC/C,sEAAsE;AACtE,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,+BAA+B;AAC/B,EAAE;AACF,yDAAyD;AAEzD,OAAO,OAA2D,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,yEAAyE;AACzE,0EAA0E;AAC1E,gEAAgE;AAEhE,wCAAwC;AAExC,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,gDAAgD;IAChD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAExC,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QAC5E,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,6EAA6E;QAC7E,yEAAyE;QACzE,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,OAAO,EACL,iNAAiN;aACpN,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,2EAA2E;YAC3E,kEAAkE;YAClE,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;gBAC5D,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;oBAClD,kBAAkB,EAAE,SAAS,EAAE,gCAAgC;iBAChE,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,2DAA2D;YAC3D,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE5B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,OAAO,CAAC,GAAG,CACT,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,aAAa,mBAAmB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,CAC1G,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ;AACR,eAAe,EAAE,CAAC"}

package/dist/output-schemas.js

@@ -33,6 +33,27 @@ const CUE_SCHEMA = {
     },
     additionalProperties: true,
 };
+// A5 parity (2026-06-14) — Discovery cue-cap headroom, surfaced from the Rails
+// RateLimit-* response headers (streams_controller#set_rate_limit_headers).
+// PRESENT ONLY on Discovery-tier responses — Rails omits the headers on other
+// tiers (no cue cap), so this block is absent (never required, never zero-filled)
+// there. Lets an agent self-throttle before the monthly cue cap's 429.
+const RATE_LIMIT_SCHEMA = {
+    type: "object",
+    description: "Discovery monthly cue-cap headroom. Absent on non-Discovery tiers (no cap).",
+    properties: {
+        limit: { type: "integer", description: "Discovery monthly cue cap." },
+        remaining: {
+            type: "integer",
+            description: "Cues remaining in the current calendar month (UTC).",
+        },
+        reset: {
+            type: "integer",
+            description: "Seconds until the cap window resets (start of next calendar month, UTC; same basis as the 429 Retry-After).",
+        },
+    },
+    additionalProperties: true,
+};
 // Legal/disclosure block returned on every success (A1 §6.7). Do not strip in your UI.
 const META_SCHEMA = {
     type: "object",
@@ -54,6 +75,7 @@ export const createPatientStreamOutputSchema = {
         state: { type: "string" },
         first_cue: CUE_SCHEMA,
         next_cue_eligible_at: { type: ["string", "null"] },
+        rate_limit: RATE_LIMIT_SCHEMA,
         _meta: META_SCHEMA,
     },
     required: ["stream_id", "state", "first_cue", "_meta"],
@@ -69,6 +91,7 @@ export const getNextCuedMessageOutputSchema = {
         // StreamExhausted fields (end-of-stream marker):
         sandbox_exhausted: { type: "boolean", description: "Present + true when the sandbox subset is exhausted; no next_cue then." },
         message: { type: "string" },
+        rate_limit: RATE_LIMIT_SCHEMA,
         _meta: META_SCHEMA,
     },
     // next_cue is omitted from `required` because the exhausted-stream result has
@@ -84,6 +107,7 @@ export const readStreamStateOutputSchema = {
         current_cue: { type: ["object", "null"], additionalProperties: true },
         next_cue_eligible: { type: "boolean" },
         events_count: { type: "integer" },
+        rate_limit: RATE_LIMIT_SCHEMA,
         _meta: META_SCHEMA,
     },
     required: ["stream_id", "state", "_meta"],
@@ -97,4 +121,35 @@ export const listSandboxTopicsOutputSchema = {
     },
     required: ["topic_labels", "_meta"],
 };
+// Rung-0 (2026-06-15) — the no-auth lookup_health_fact result. ONE already-public
+// federal fact + federal source + an uphealth.me link + the upgrade CTA. NO
+// numeric scores / model outputs ever (intelligence-framing lock) — those stay
+// behind auth + metering. This schema describes the SUCCESS shape; a no-match /
+// rate-limited / corpus-down lookup returns isError text (no structuredContent).
+export const lookupHealthFactOutputSchema = {
+    type: "object",
+    properties: {
+        fact: {
+            type: "object",
+            description: "The single already-public federal fact.",
+            properties: {
+                kind: { type: "string", description: "fact | list | tip" },
+                body: { type: "string" },
+                agency: { type: "string", description: "Federal source agency label, e.g. CDC / MedlinePlus / NIDDK." },
+                source_url: { type: "string", description: "The federal public-domain source." },
+                uphealth_url: { type: "string", description: "The public uphealth.me topic page." },
+            },
+            additionalProperties: true,
+        },
+        topic: { type: "string", description: "The matched topic's title." },
+        disclaimer: { type: "string" },
+        attribution: { type: "string", description: "\"Source: <agency> via Uphealth\"." },
+        upgrade: {
+            type: "object",
+            description: "The free-key upsell — adaptive sequencing lives behind a Discovery key.",
+            additionalProperties: true,
+        },
+    },
+    required: ["fact", "disclaimer", "attribution", "upgrade"],
+};
 //# sourceMappingURL=output-schemas.js.map

package/dist/output-schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"output-schemas.js","sourceRoot":"","sources":["../src/output-schemas.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,uEAAuE;AACvE,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAE9E,6EAA6E;AAC7E,MAAM,UAAU,GAAG;IACjB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,gFAAgF;IAC7F,UAAU,EAAE;QACV,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;QAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC9G,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE;QACxG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;KAChE;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,yDAAyD;IACtE,UAAU,EAAE;QACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzC;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oDAAoD,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,SAAS,EAAE,UAAU;QACrB,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QAClD,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC;CACvD,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,oBAAoB;QACpB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oEAAoE,EAAE;QAClH,QAAQ,EAAE,UAAU;QACpB,iDAAiD;QACjD,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,wEAAwE,EAAE;QAC7H,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,KAAK,EAAE,WAAW;KACnB;IACD,8EAA8E;IAC9E,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE;QACrE,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACtC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC1D,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3C,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC;CACpC,CAAC"}
+{"version":3,"file":"output-schemas.js","sourceRoot":"","sources":["../src/output-schemas.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,uEAAuE;AACvE,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAE9E,6EAA6E;AAC7E,MAAM,UAAU,GAAG;IACjB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,gFAAgF;IAC7F,UAAU,EAAE;QACV,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;QAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC9G,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE;QACxG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;KAChE;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,kFAAkF;AAClF,uEAAuE;AACvE,MAAM,iBAAiB,GAAG;IACxB,IAAI,EAAE,QAAQ;IACd,WAAW,EACT,6EAA6E;IAC/E,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACrE,SAAS,EAAE;YACT,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,qDAAqD;SACnE;QACD,KAAK,EAAE;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EACT,6GAA6G;SAChH;KACF;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,yDAAyD;IACtE,UAAU,EAAE;QACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzC;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oDAAoD,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,SAAS,EAAE,UAAU;QACrB,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QAClD,UAAU,EAAE,iBAAiB;QAC7B,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC;CACvD,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,oBAAoB;QACpB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oEAAoE,EAAE;QAClH,QAAQ,EAAE,UAAU;QACpB,iDAAiD;QACjD,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,wEAAwE,EAAE;QAC7H,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,UAAU,EAAE,iBAAiB;QAC7B,KAAK,EAAE,WAAW;KACnB;IACD,8EAA8E;IAC9E,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE;QACrE,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACtC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACjC,UAAU,EAAE,iBAAiB;QAC7B,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC1D,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3C,KAAK,EAAE,WAAW;KACnB;IACD,QAAQ,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,kFAAkF;AAClF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,IAAI,EAAE,QAAiB;IACvB,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,yCAAyC;YACtD,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;gBAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8DAA8D,EAAE;gBACvG,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;gBAChF,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE;aACpF;YACD,oBAAoB,EAAE,IAAI;SAC3B;QACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACpE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE;QAClF,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,yEAAyE;YACtF,oBAAoB,EAAE,IAAI;SAC3B;KACF;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC;CAC3D,CAAC"}

package/dist/prompts.js

@@ -0,0 +1,90 @@
+// A5 dev-surface (2026-06-15) — MCP prompts (user-controlled reusable workflows).
+//
+// Two prompts encode the canonical "pick a template, then create a stream and run
+// an episode" path so a host raises tool-selection accuracy instead of guessing:
+//   - pick_template   : choose the right Signal template for a clinical context
+//   - evaluate_signal : the full create + cue-loop episode, end to end
+//
+// BOUNDARY (locked): Display-mode, non-PHI, read-only guidance. The prompts steer
+// the agent to read the signal://catalog resource and pre-satisfy gating; they
+// never instruct it to send PHI or fabricate health content. Not medical advice.
+export const prompts = [
+    {
+        name: "pick_template",
+        description: "Choose the single best Signal stream template for a patient/clinical context, " +
+            "and list the audience_tags + de-identified patient_context that create_patient_stream " +
+            "will require. Reads the signal://catalog resource so it never invents a template_id.",
+        arguments: [
+            {
+                name: "clinical_context",
+                description: "What the messaging journey is about — e.g. 'adult starting a GLP-1 for weight " +
+                    "management', 'opioid-use-disorder relapse prevention, 6 weeks since onset', " +
+                    "'general wellness onboarding'.",
+                required: true,
+            },
+        ],
+    },
+    {
+        name: "evaluate_signal",
+        description: "Run a complete Signal episode end to end: read the catalog, pick a template, create a " +
+            "Display-mode stream with no PHI, then loop cues — submitting the prior response each " +
+            "time — and branch on the receptivity score + audience-safety verdict. The canonical " +
+            "way to evaluate whether Signal fits before integrating.",
+        arguments: [
+            {
+                name: "goal",
+                description: "The outcome you are evaluating Signal for — e.g. 'a 30-day medication-initiation " +
+                    "adherence journey for our diabetes cohort'.",
+                required: true,
+            },
+            {
+                name: "patient_summary",
+                description: "Optional de-identified description of the test patient (NO PHI) — e.g. 'adult, " +
+                    "starting metformin, week 0'. Used to fill audience_tags + patient_context.",
+                required: false,
+            },
+        ],
+    },
+];
+function userMessage(text) {
+    return [{ role: "user", content: { type: "text", text } }];
+}
+function str(value, fallback) {
+    return typeof value === "string" && value.trim().length > 0 ? value : fallback;
+}
+// GetPrompt handler. Throws on an unknown name (the SDK maps the throw to a
+// JSON-RPC error).
+export function getPrompt(name, args) {
+    switch (name) {
+        case "pick_template": {
+            const context = str(args.clinical_context, "(no clinical context given)");
+            return {
+                description: "Pick the best Signal template for a clinical context.",
+                messages: userMessage(`I'm building a Signal messaging journey for: ${context}\n\n` +
+                    `1. Read the \`signal://catalog\` MCP resource (the live template list + each template's gating).\n` +
+                    `2. Choose the SINGLE best \`template_id\` — use only ids that appear in the catalog; never invent one.\n` +
+                    `3. List, for that template: its required_audience_tags, any optional tags worth adding, its excluded_audience_tags (never include these), and its required_patient_context fields (key + type + allowed values).\n` +
+                    `4. Explain in one or two sentences why it fits, and call out the crisis-footer / b_plus gating if the catalog flags any.\n\n` +
+                    `Do not create the stream yet — just recommend the template and the exact arguments create_patient_stream will need. This is wellness content, not medical advice.`),
+            };
+        }
+        case "evaluate_signal": {
+            const goal = str(args.goal, "(no goal given)");
+            const patient = str(args.patient_summary, "a de-identified test patient (no PHI)");
+            return {
+                description: "Run a full Signal create + cue episode to evaluate fit.",
+                messages: userMessage(`Evaluate Signal for this goal: ${goal}\n` +
+                    `Test patient: ${patient}\n\n` +
+                    `Run the full episode in Display mode (no PHI, no BAA):\n` +
+                    `1. Read the \`signal://catalog\` resource; pick the best template_id and compute audience_tags (include every required tag, no excluded tag) + de-identified patient_context.\n` +
+                    `2. Call create_patient_stream with that template_id, audience_tags, attributes, and an idempotency_key (UUID) so a retry is safe. Keep the returned stream_id and the first cue.\n` +
+                    `3. Loop: read the cue's body + its receptivity score (0–1, advisory) + audience-safety verdict, decide the patient's response_action (from the catalog's cue vocabulary), then call get_next_cued_message with that feedback. Every cue after the first REQUIRES the prior response — the engine returns 409 feedback_required if you skip it (the sequencing moat).\n` +
+                    `4. After a few turns, summarize: did the sequence stay on-topic and federally-sourced, did receptivity track the feedback, and did any cue get safety-filtered?\n\n` +
+                    `Surface the federal source on each cue. This is wellness content, not medical advice; do not send PHI.`),
+            };
+        }
+        default:
+            throw new Error(`Unknown prompt: ${name}. Available prompts: pick_template, evaluate_signal.`);
+    }
+}
+//# sourceMappingURL=prompts.js.map

package/dist/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAChF,uEAAuE;AACvE,EAAE;AACF,kFAAkF;AAClF,+EAA+E;AAC/E,iFAAiF;AAcjF,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,gFAAgF;YAChF,wFAAwF;YACxF,sFAAsF;QACxF,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EACT,gFAAgF;oBAChF,8EAA8E;oBAC9E,gCAAgC;gBAClC,QAAQ,EAAE,IAAI;aACf;SACF;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wFAAwF;YACxF,uFAAuF;YACvF,sFAAsF;YACtF,yDAAyD;QAC3D,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EACT,mFAAmF;oBACnF,6CAA6C;gBAC/C,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,iFAAiF;oBACjF,4EAA4E;gBAC9E,QAAQ,EAAE,KAAK;aAChB;SACF;KACF;CACF,CAAC;AASF,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,GAAG,CAAC,KAAc,EAAE,QAAgB;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjF,CAAC;AAED,4EAA4E;AAC5E,mBAAmB;AACnB,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,IAA6B;IAE7B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;YAC1E,OAAO;gBACL,WAAW,EAAE,uDAAuD;gBACpE,QAAQ,EAAE,WAAW,CACnB,gDAAgD,OAAO,MAAM;oBAC3D,oGAAoG;oBACpG,0GAA0G;oBAC1G,oNAAoN;oBACpN,8HAA8H;oBAC9H,mKAAmK,CACtK;aACF,CAAC;QACJ,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,GAAG,CACjB,IAAI,CAAC,eAAe,EACpB,uCAAuC,CACxC,CAAC;YACF,OAAO;gBACL,WAAW,EAAE,yDAAyD;gBACtE,QAAQ,EAAE,WAAW,CACnB,kCAAkC,IAAI,IAAI;oBACxC,iBAAiB,OAAO,MAAM;oBAC9B,0DAA0D;oBAC1D,iLAAiL;oBACjL,oLAAoL;oBACpL,wWAAwW;oBACxW,qKAAqK;oBACrK,wGAAwG,CAC3G;aACF,CAAC;QACJ,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,sDAAsD,CAC9E,CAAC;IACN,CAAC;AACH,CAAC"}