@uphealth/mcp-server 1.0.0 → 1.1.1

package/dist/rails-client.js

@@ -18,8 +18,15 @@ import { config } from "./config.js";
 export async function callRails(opts) {
     const url = new URL(opts.path, config.railsApiBaseUrl).toString();
     const headers = {
+        ...(opts.headers ?? {}),
         Authorization: `Bearer ${opts.bearer}`,
         Accept: "application/json",
+        // NOW #5 (2026-06-14) — identify the MCP server as the integration surface so
+        // the activation report can split cues by raw HTTP vs SDK vs MCP. Rails reads
+        // X-Uphealth-Client (falling back to User-Agent) onto the cued event payload.
+        // See CuedStreams::IntegrationSurface. The SDKs send the analogous token.
+        "User-Agent": `uphealth-mcp-server/${config.serverVersion}`,
+        "X-Uphealth-Client": `uphealth-mcp-server/${config.serverVersion}`,
     };
     const fetchInit = {
         method: opts.method,
@@ -29,6 +36,29 @@ export async function callRails(opts) {
         headers["Content-Type"] = "application/json";
         fetchInit.body = JSON.stringify(opts.body);
     }
+    return dispatch(url, fetchInit);
+}
+/**
+ * Perform an UNAUTHENTICATED GET to the Rails public API surface — Rung-0, the
+ * no-auth /v1/public/* lookup (2026-06-15). Sends NO Authorization header: the
+ * endpoint bypasses RequireTenant entirely, so there is no token to forward.
+ * Still carries the client-attribution tokens so server-side [public-lookup]
+ * traffic stays recognizable.
+ */
+export async function callRailsPublic(opts) {
+    const url = new URL(opts.path, config.railsApiBaseUrl).toString();
+    const headers = {
+        ...(opts.headers ?? {}),
+        Accept: "application/json",
+        "User-Agent": `uphealth-mcp-server/${config.serverVersion}`,
+        "X-Uphealth-Client": `uphealth-mcp-server/${config.serverVersion}`,
+    };
+    return dispatch(url, { method: opts.method, headers });
+}
+// Shared fetch + JSON-parse for both the authenticated (callRails) and the
+// unauthenticated (callRailsPublic) paths. Returns the full Rails response
+// (status + parsed body + lowercased headers) so callers can branch on codes.
+async function dispatch(url, fetchInit) {
     const response = await fetch(url, fetchInit);
     const responseHeaders = {};
     response.headers.forEach((value, key) => {

package/dist/rails-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"rails-client.js","sourceRoot":"","sources":["../src/rails-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,+DAA+D;AAC/D,iEAAiE;AACjE,sEAAsE;AACtE,EAAE;AACF,qEAAqE;AAErE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgBrC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAc,IAK5C;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClE,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;QACtC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IAEF,MAAM,SAAS,GAAgB;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC7C,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE7C,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,IAAI,EAA2B,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AACvC,CAAC"}
+{"version":3,"file":"rails-client.js","sourceRoot":"","sources":["../src/rails-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,+DAA+D;AAC/D,iEAAiE;AACjE,sEAAsE;AACtE,EAAE;AACF,qEAAqE;AAErE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgBrC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAc,IAU5C;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClE,MAAM,OAAO,GAA2B;QACtC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACvB,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;QACtC,MAAM,EAAE,kBAAkB;QAC1B,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,0EAA0E;QAC1E,YAAY,EAAE,uBAAuB,MAAM,CAAC,aAAa,EAAE;QAC3D,mBAAmB,EAAE,uBAAuB,MAAM,CAAC,aAAa,EAAE;KACnE,CAAC;IAEF,MAAM,SAAS,GAAgB;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC7C,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,QAAQ,CAAI,GAAG,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAc,IAIlD;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClE,MAAM,OAAO,GAA2B;QACtC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,kBAAkB;QAC1B,YAAY,EAAE,uBAAuB,MAAM,CAAC,aAAa,EAAE;QAC3D,mBAAmB,EAAE,uBAAuB,MAAM,CAAC,aAAa,EAAE;KACnE,CAAC;IAEF,OAAO,QAAQ,CAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,SAAsB;IAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE7C,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,IAAI,EAA2B,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AACvC,CAAC"}

package/dist/resources.js

@@ -0,0 +1,127 @@
+// A5 dev-surface (2026-06-15) — MCP resources.
+//
+// Two read-only resources:
+//   - `signal://catalog`  — the live Signal template catalog (from the GENERATED,
+//     drift-guarded src/generated/signal-catalog.ts) PLUS the accepted cue
+//     `response_action` vocabulary (single-sourced from cue-actions.ts).
+//   - `signal://openapi`  — the machine-readable OpenAPI 3.1 contract URLs +
+//     the receptivity-score semantics (strategy §4 #5 — "lets the server
+//     self-describe; cheap, read-only"). Points an agent at the spec to generate
+//     a client; carries no spec body (no runtime fetch, no drift).
+//
+// WHY: an agent reads `signal://catalog` BEFORE create_patient_stream so it can
+// pick a template and pre-satisfy that template's audience-tag + patient-context
+// gating — turning a clinical-template 422 into a 201 + first cue.
+//
+// BOUNDARY (locked, A1 §6.6 + dev-PMF strategy §4): read-only, metadata-only,
+// non-PHI, Display-mode. The catalog carries the GATING CONTRACT only — never
+// corpus message bodies (those are returned per-cue at runtime, after a stream
+// exists) and never patient data. The resource handlers make NO Rails call.
+import { SIGNAL_CATALOG } from "./generated/signal-catalog.js";
+import { CUE_RESPONSE_ACTIONS } from "./cue-actions.js";
+export const SIGNAL_CATALOG_URI = "signal://catalog";
+export const SIGNAL_OPENAPI_URI = "signal://openapi";
+// Stable public URLs for the machine-readable contract (same as the docs
+// surfaces single-source in UphealthUs::DocsMarkdown). The spec is a static file
+// served on uphealth.us; these are not the API base URL.
+const OPENAPI_YAML_URL = "https://uphealth.us/openapi/signal-v1.yaml";
+const OPENAPI_JSON_URL = "https://uphealth.us/openapi/signal-v1.json";
+const POSTMAN_URL = "https://uphealth.us/openapi/uphealth-signal.postman_collection.json";
+const DOCS_URL = "https://uphealth.us/docs";
+// = AdaptiveResponse::Archetypes::CUE_FALLBACK_ACTION (Rails folds an
+// unrecognized-but-well-formed response_action to this acknowledge-class value).
+const CUE_FALLBACK_ACTION = "acknowledge";
+// The resource body, assembled once at module load (static — no I/O).
+const catalogBody = {
+    ...SIGNAL_CATALOG,
+    cue_actions: {
+        accepted: [...CUE_RESPONSE_ACTIONS],
+        fallback_action: CUE_FALLBACK_ACTION,
+        forward_compat: "The cue vocabulary grows over time. Submit an accepted value, or any " +
+            "well-formed token matching /^[a-z][a-z0-9_]{0,63}$/ — unknown well-formed " +
+            "tokens are accepted (200) and echoed back as normalized_action='acknowledge'; " +
+            "a malformed token returns 422 (invalid_feedback). Treat unknown response_action " +
+            "values in responses as acknowledge-class.",
+    },
+    gating: {
+        to_create: "audience_tags MUST include every required_audience_tags and MUST NOT include " +
+            "any excluded_audience_tags, or create returns 422 (missing_required_audience_tags " +
+            "/ incompatible_audience_tag) on a production-tier key. A free sandbox (Discovery) " +
+            "key skips the gate and always cues the curated sandbox corpus — see list_sandbox_topics.",
+        patient_context: "Populate required_patient_context with de-identified values before create; a " +
+            "production create missing a required field is rejected. Never send PHI — Display " +
+            "mode renders in your own app, so no PHI and no BAA are involved.",
+        b_plus: "Where b_plus_gated_tag is set, Lists and Tips outside the template's primary " +
+            "category additionally require that tag on the patient; Facts are universal.",
+    },
+    usage: "Pick a template by clinical context, compute audience_tags from required/optional " +
+        "(never an excluded tag), fill required_patient_context with de-identified values, " +
+        "then call create_patient_stream — gating is pre-satisfied, so you get a 201 + first " +
+        "cue instead of a 422. Every cue is federally-sourced and audience-safety-checked. " +
+        "Not medical advice.",
+};
+// The OpenAPI / receptivity reference body (static — no I/O, no spec body, so it
+// never drifts from or hammers the served spec). Points the agent at the
+// machine-readable contract and explains the advisory receptivity score.
+const openapiBody = {
+    description: "The machine-readable OpenAPI 3.1 contract for the Signal cued-stream API. " +
+        "Fetch one of the spec URLs below to self-describe the API or generate a client.",
+    openapi: {
+        yaml_url: OPENAPI_YAML_URL,
+        json_url: OPENAPI_JSON_URL,
+        postman_url: POSTMAN_URL,
+        docs_url: DOCS_URL,
+    },
+    receptivity: {
+        range: "0.0–1.0",
+        neutral: 0.5,
+        present_on: "every cue object (first_cue / next_cue / current_cue)",
+        meaning: "An advisory estimate of how receptive the patient is right now, built from " +
+            "their own feedback on prior cues; 0.50 is the neutral state of a brand-new " +
+            "patient. It is yours to read or ignore — the engine already applies it to " +
+            "choose the message.",
+    },
+    note: "Read-only reference. Not medical advice.",
+};
+// ListResources payload.
+export const resources = [
+    {
+        uri: SIGNAL_CATALOG_URI,
+        name: "Signal template catalog & cue vocabulary",
+        description: "The live Signal stream templates (id, audience-tag + de-identified patient-context " +
+            "gating, duration, delivery modes, crisis-footer policy) plus the accepted cue " +
+            "response_action vocabulary. Read this BEFORE create_patient_stream to pick a template " +
+            "and pre-satisfy its gating. Metadata only — no patient data, no message bodies.",
+        mimeType: "application/json",
+    },
+    {
+        uri: SIGNAL_OPENAPI_URI,
+        name: "OpenAPI specification & receptivity reference",
+        description: "The machine-readable OpenAPI 3.1 contract URLs (YAML / JSON / Postman) + the docs " +
+            "home, plus the advisory receptivity-score semantics every cue carries. Read this to " +
+            "self-describe the API or generate a client.",
+        mimeType: "application/json",
+    },
+];
+// ReadResource handler. Throws on an unknown uri (the SDK maps the throw to a
+// JSON-RPC error). Both resources are static JSON, assembled at module load.
+const RESOURCE_BODIES = {
+    [SIGNAL_CATALOG_URI]: catalogBody,
+    [SIGNAL_OPENAPI_URI]: openapiBody,
+};
+export function readResource(uri) {
+    const body = RESOURCE_BODIES[uri];
+    if (body === undefined) {
+        throw new Error(`Unknown resource: ${uri}. Available: ${SIGNAL_CATALOG_URI}, ${SIGNAL_OPENAPI_URI}.`);
+    }
+    return {
+        contents: [
+            {
+                uri,
+                mimeType: "application/json",
+                text: JSON.stringify(body, null, 2),
+            },
+        ],
+    };
+}
+//# sourceMappingURL=resources.js.map

package/dist/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,2BAA2B;AAC3B,kFAAkF;AAClF,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,iFAAiF;AACjF,mEAAmE;AACnE,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAE5E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAErD,yEAAyE;AACzE,iFAAiF;AACjF,yDAAyD;AACzD,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AACtE,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AACtE,MAAM,WAAW,GAAG,qEAAqE,CAAC;AAC1F,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAE5C,sEAAsE;AACtE,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAE1C,sEAAsE;AACtE,MAAM,WAAW,GAAG;IAClB,GAAG,cAAc;IACjB,WAAW,EAAE;QACX,QAAQ,EAAE,CAAC,GAAG,oBAAoB,CAAC;QACnC,eAAe,EAAE,mBAAmB;QACpC,cAAc,EACZ,uEAAuE;YACvE,4EAA4E;YAC5E,gFAAgF;YAChF,kFAAkF;YAClF,2CAA2C;KAC9C;IACD,MAAM,EAAE;QACN,SAAS,EACP,+EAA+E;YAC/E,oFAAoF;YACpF,oFAAoF;YACpF,0FAA0F;QAC5F,eAAe,EACb,+EAA+E;YAC/E,mFAAmF;YACnF,kEAAkE;QACpE,MAAM,EACJ,+EAA+E;YAC/E,6EAA6E;KAChF;IACD,KAAK,EACH,oFAAoF;QACpF,oFAAoF;QACpF,sFAAsF;QACtF,oFAAoF;QACpF,qBAAqB;CACxB,CAAC;AAEF,iFAAiF;AACjF,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,WAAW,GAAG;IAClB,WAAW,EACT,4EAA4E;QAC5E,iFAAiF;IACnF,OAAO,EAAE;QACP,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,QAAQ;KACnB;IACD,WAAW,EAAE;QACX,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,uDAAuD;QACnE,OAAO,EACL,6EAA6E;YAC7E,6EAA6E;YAC7E,4EAA4E;YAC5E,qBAAqB;KACxB;IACD,IAAI,EAAE,0CAA0C;CACjD,CAAC;AAEF,yBAAyB;AACzB,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB;QACE,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,0CAA0C;QAChD,WAAW,EACT,qFAAqF;YACrF,gFAAgF;YAChF,wFAAwF;YACxF,iFAAiF;QACnF,QAAQ,EAAE,kBAAkB;KAC7B;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,+CAA+C;QACrD,WAAW,EACT,oFAAoF;YACpF,sFAAsF;YACtF,6CAA6C;QAC/C,QAAQ,EAAE,kBAAkB;KAC7B;CACO,CAAC;AASX,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,eAAe,GAA4B;IAC/C,CAAC,kBAAkB,CAAC,EAAE,WAAW;IACjC,CAAC,kBAAkB,CAAC,EAAE,WAAW;CAClC,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,qBAAqB,GAAG,gBAAgB,kBAAkB,KAAK,kBAAkB,GAAG,CACrF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE;YACR;gBACE,GAAG;gBACH,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;aACpC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/server.js

@@ -8,12 +8,18 @@
 //
 // Spec: docs/spec_track_a_a4_mcp_server.md §3 + §4 + §6.
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { config } from "./config.js";
 import { tools, findToolByName } from "./tools/index.js";
 import { errorResult } from "./tool-result.js";
+import { resources, readResource } from "./resources.js";
+import { prompts, getPrompt } from "./prompts.js";
 export function buildServer() {
-    const server = new Server({ name: config.serverName, version: config.serverVersion }, { capabilities: { tools: {} } });
+    const server = new Server({ name: config.serverName, version: config.serverVersion }, 
+    // A5 dev-surface (2026-06-15) — resources (the signal://catalog template +
+    // cue-vocabulary metadata) and prompts (pick_template / evaluate_signal) join
+    // tools so an agent can pick a template + pre-satisfy gating before creating.
+    { capabilities: { tools: {}, resources: {}, prompts: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: tools.map((t) => ({
             name: t.name,
@@ -24,6 +30,14 @@ export function buildServer() {
             outputSchema: t.outputSchema,
         })),
     }));
+    // A5 dev-surface — resources: read-only, metadata-only signal://catalog.
+    server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+        resources: resources.map((r) => ({ ...r })),
+    }));
+    server.setRequestHandler(ReadResourceRequestSchema, async (req) => readResource(req.params.uri));
+    // A5 dev-surface — prompts: the canonical pick-template / run-an-episode flows.
+    server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts }));
+    server.setRequestHandler(GetPromptRequestSchema, async (req) => getPrompt(req.params.name, req.params.arguments ?? {}));
     server.setRequestHandler(CallToolRequestSchema, async (req) => {
         const toolName = req.params.name;
         const args = (req.params.arguments ?? {});

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,kEAAkE;AAClE,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,yDAAyD;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,8EAA8E;YAC9E,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAA2B,EAAE;QACrF,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QACrE,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,WAAW,CAAC,iBAAiB,QAAQ,EAAE,CAAmB,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAmB,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,kEAAkE;AAClE,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,yDAAyD;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,GAEvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;IAC1D,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAC5D,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,8EAA8E;YAC9E,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,yEAAyE;IACzE,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAChE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;KAC5C,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAChE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAC7B,CAAC;IAEF,gFAAgF;IAChF,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC7D,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CACvD,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAA2B,EAAE;QACrF,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QACrE,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,WAAW,CAAC,iBAAiB,QAAQ,EAAE,CAAmB,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAmB,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/stdio-context.js

@@ -0,0 +1,19 @@
+// Pure resolver for the stdio entrypoint's process-level fallback context.
+//
+// Split into its own side-effect-free module (only a type-only import) so it can
+// be unit-tested WITHOUT importing stdio.ts — whose bottom-of-file main() boots a
+// transport on import. (An `import.meta.url === argv[1]` entrypoint guard was
+// considered and rejected: npm runs the published bin via a `.bin/…` symlink, so
+// argv[1] is the symlink path while import.meta.url is the real dist/stdio.js —
+// they don't match, and main() would never run. Keeping the helper separate lets
+// stdio.ts call main() unconditionally, as the entrypoint must.)
+//
+// Contract: a missing / whitespace-only key yields an EMPTY bearer (keyless
+// mode) — NOT a process exit. With an empty bearer, lookup_health_fact still
+// works (it calls the public endpoint with no bearer) and every keyed tool
+// forwards the empty bearer so Rails 401s it at call-time. Rails is the auth
+// authority. A present key is returned trimmed.
+export function stdioFallbackContext(rawKey) {
+    return { bearer: (rawKey ?? "").trim() };
+}
+//# sourceMappingURL=stdio-context.js.map

package/dist/stdio-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-context.js","sourceRoot":"","sources":["../src/stdio-context.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,gDAAgD;AAIhD,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,OAAO,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3C,CAAC"}

package/dist/stdio.js

@@ -4,30 +4,39 @@
 //
 //   npx -y @uphealth/mcp-server
 //
-// with the user's key in the environment:
+// KEYLESS by default. The one keyless tool (lookup_health_fact) works with NO
+// key, matching the hosted Streamable HTTP deployment at mcp.uphealth.us
+// (src/index.ts) — so "zero setup" is true on BOTH the npx and the remote path,
+// not just the remote. Supply a free sandbox key in the environment to unlock the
+// keyed tools (create_patient_stream, get_next_cued_message, …):
 //
 //   UPHEALTH_API_KEY=up_sandbox_…
 //
-// This is the dominant MCP install pattern (local stdio), complementing the
-// hosted Streamable HTTP deployment at mcp.uphealth.us (src/index.ts). The two
-// share the same tools and the same Server factory (server.ts).
+// The two transports share the same tools and the same Server factory (server.ts).
 //
-// A stdio process is single-tenant: one user, one key for its lifetime. We set
-// that key as the process-level fallback context, so the same tool handlers
-// that read the per-request bearer over HTTP work unchanged here.
+// A stdio process is single-tenant: one user, one bearer for its lifetime. We set
+// that bearer as the process-level fallback context, so the same tool handlers
+// that read the per-request bearer over HTTP work unchanged here. With NO key we
+// set an EMPTY bearer: lookup_health_fact hits the public endpoint (no bearer
+// needed) and works; every keyed tool forwards the empty bearer and Rails 401s it
+// at call-time. Rails stays the single auth authority (defense in depth) — we do
+// not pre-reject keyless here; we let the keyless tool through and let Rails gate
+// the keyed ones, exactly as the HTTP per-tool policy does (tool-auth-policy.ts).
 import "./bootstrap-env.js"; // must run before anything imports config.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { setFallbackContext } from "./context.js";
+import { stdioFallbackContext } from "./stdio-context.js";
 import { buildServer } from "./server.js";
 async function main() {
-    const apiKey = process.env.UPHEALTH_API_KEY?.trim();
-    if (!apiKey) {
-        // Write guidance to stderr (stdout is the MCP JSON-RPC channel).
-        console.error("Uphealth MCP: missing UPHEALTH_API_KEY. Get a free sandbox key at " +
-            "https://uphealth.us/signup, then set UPHEALTH_API_KEY in your MCP client config.");
-        process.exit(1);
+    const ctx = stdioFallbackContext(process.env.UPHEALTH_API_KEY);
+    if (!ctx.bearer) {
+        // Informational, NOT fatal. stdout is the MCP JSON-RPC channel, so guidance
+        // goes to stderr. Keyless mode is fully functional for lookup_health_fact.
+        console.error("Uphealth MCP: running keyless — lookup_health_fact works with no key. " +
+            "For the keyed tools (patient streams + cues), get a free sandbox key at " +
+            "https://uphealth.us/signup and set UPHEALTH_API_KEY in your MCP client config.");
     }
-    setFallbackContext({ bearer: apiKey });
+    setFallbackContext(ctx);
     const server = buildServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA,uEAAuE;AACvE,4EAA4E;AAC5E,EAAE;AACF,gCAAgC;AAChC,EAAE;AACF,0CAA0C;AAC1C,EAAE;AACF,kCAAkC;AAClC,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,gEAAgE;AAChE,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,kEAAkE;AAElE,OAAO,oBAAoB,CAAC,CAAC,6CAA6C;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iEAAiE;QACjE,OAAO,CAAC,KAAK,CACX,oEAAoE;YAClE,kFAAkF,CACrF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,2EAA2E;IAC3E,kEAAkE;AACpE,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA,uEAAuE;AACvE,4EAA4E;AAC5E,EAAE;AACF,gCAAgC;AAChC,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,kFAAkF;AAClF,iEAAiE;AACjE,EAAE;AACF,kCAAkC;AAClC,EAAE;AACF,mFAAmF;AACnF,EAAE;AACF,kFAAkF;AAClF,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAElF,OAAO,oBAAoB,CAAC,CAAC,6CAA6C;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,4EAA4E;QAC5E,2EAA2E;QAC3E,OAAO,CAAC,KAAK,CACX,wEAAwE;YACtE,0EAA0E;YAC1E,gFAAgF,CACnF,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,2EAA2E;IAC3E,kEAAkE;AACpE,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tool-auth-policy.js

@@ -0,0 +1,52 @@
+// Per-tool auth policy for the Streamable HTTP transport (Rung-0, 2026-06-15).
+//
+// Extracted from index.ts as a pure, side-effect-free module — like auth.ts — so
+// it can be unit-tested without booting the Express listener (index.ts calls
+// startHttpServer() at import time).
+//
+// The guard used to be all-or-nothing: NO Bearer → 401 for EVERY /mcp request,
+// including the handshake. Rung-0 relaxes it to a per-tool policy so the one
+// keyless tool (lookup_health_fact) — and ONLY the JSON-RPC methods needed to
+// reach it — work without a key, while every keyed tool still 401s. Rails stays
+// the auth authority (defense in depth): even if this gate were bypassed, a keyed
+// tool forwards an empty Bearer and Rails 401s it.
+// The ONLY tool callable without a Bearer. Add a tool here = make it keyless.
+export const NO_AUTH_TOOLS = new Set(["lookup_health_fact"]);
+// MCP handshake / discovery methods that must work keyless so a client can
+// initialize a session and discover lookup_health_fact at all. These expose only
+// public catalog metadata (tool/resource/prompt names + schemas) — no secrets,
+// no tenant data. Notably ABSENT: resources/read + prompts/get + every keyed
+// tools/call, which still require a Bearer.
+export const NO_AUTH_METHODS = new Set([
+    "initialize",
+    "notifications/initialized",
+    "ping",
+    "tools/list",
+    "resources/list",
+    "prompts/list",
+]);
+export function messageAllowedWithoutBearer(msg) {
+    if (!msg || typeof msg !== "object")
+        return false;
+    const method = msg.method;
+    if (typeof method !== "string")
+        return false;
+    if (NO_AUTH_METHODS.has(method))
+        return true;
+    if (method === "tools/call") {
+        const name = msg.params?.name;
+        return typeof name === "string" && NO_AUTH_TOOLS.has(name);
+    }
+    return false;
+}
+// A request (single message OR a JSON-RPC batch) may proceed without a Bearer
+// ONLY if EVERY message in it is individually allowed — a batch that mixes a
+// keyless method with a keyed tools/call is rejected wholesale. An empty/garbage
+// body is not allowed (falls through to the 401 onboarding hint).
+export function requestAllowedWithoutBearer(body) {
+    const messages = Array.isArray(body) ? body : [body];
+    if (messages.length === 0)
+        return false;
+    return messages.every(messageAllowedWithoutBearer);
+}
+//# sourceMappingURL=tool-auth-policy.js.map

package/dist/tool-auth-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-auth-policy.js","sourceRoot":"","sources":["../src/tool-auth-policy.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,qCAAqC;AACrC,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,mDAAmD;AAEnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAErE,2EAA2E;AAC3E,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IAC7C,YAAY;IACZ,2BAA2B;IAC3B,MAAM;IACN,YAAY;IACZ,gBAAgB;IAChB,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAI,GAAuC,CAAC,MAAM,EAAE,IAAI,CAAC;QACnE,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,iFAAiF;AACjF,kEAAkE;AAClE,MAAM,UAAU,2BAA2B,CAAC,IAAa;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACrD,CAAC"}

package/dist/tool-result.js

@@ -4,13 +4,44 @@
 // responses propagate as isError with a structured message. Successful
 // responses include the Rails body verbatim (preserving the _meta
 // block per A1 §6.7).
-export function successResult(body) {
+/**
+ * Pull the RateLimit-Limit/Remaining/Reset triple out of a Rails response's
+ * headers. `fetch` lowercases header names, so we read the lowercase keys.
+ * Returns undefined when none are present — Rails omits them on non-Discovery
+ * tiers (no cue cap), so the field is absent rather than zero-filled there.
+ */
+export function extractRateLimit(headers) {
+    if (!headers)
+        return undefined;
+    const limit = headers["ratelimit-limit"];
+    const remaining = headers["ratelimit-remaining"];
+    const reset = headers["ratelimit-reset"];
+    if (limit == null && remaining == null && reset == null)
+        return undefined;
+    const rl = {};
+    if (limit != null)
+        rl.limit = Number(limit);
+    if (remaining != null)
+        rl.remaining = Number(remaining);
+    if (reset != null)
+        rl.reset = Number(reset);
+    return rl;
+}
+export function successResult(body, headers) {
+    // Merge an advisory `rate_limit` block into the payload when Rails sent the
+    // headers. Only when body is a plain object (every Signal 2xx envelope is) —
+    // otherwise pass it through untouched. When no headers are present the body is
+    // returned VERBATIM (identity preserved), matching the pre-A5-parity contract.
+    const rateLimit = extractRateLimit(headers);
+    const structured = rateLimit && body !== null && typeof body === "object" && !Array.isArray(body)
+        ? { ...body, rate_limit: rateLimit }
+        : body;
     return {
         // The text block stays as the JSON serialization of structuredContent so
         // hosts that don't support structuredContent still get the full payload
         // (MCP backward-compat guidance).
-        content: [{ type: "text", text: JSON.stringify(body, null, 2) }],
-        structuredContent: body,
+        content: [{ type: "text", text: JSON.stringify(structured, null, 2) }],
+        structuredContent: structured,
     };
 }
 export function errorResult(message) {

package/dist/tool-result.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-result.js","sourceRoot":"","sources":["../src/tool-result.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,kEAAkE;AAClE,sBAAsB;AAiBtB,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,OAAO;QACL,yEAAyE;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,IAA2B,EAC3B,OAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,WAAW,CAChB,GAAG,SAAS,+JAA+J,CAC5K,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;gBACrC,OAAO,WAAW,CAChB,GAAG,SAAS,6CAA6C,IAAI,EAAE,QAAQ,IAAI,UAAU,iDAAiD,CACvI,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,cAAc,OAAO,EAAE,CAAC,CAAC;QAC1D,KAAK,GAAG;YACN,OAAO,WAAW,CAChB,GAAG,SAAS,wDAAwD,CACrE,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBACpC,OAAO,WAAW,CAChB,GAAG,SAAS,8GAA8G,IAAI,EAAE,iBAAiB,4EAA4E,CAC9N,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;gBAC3C,OAAO,WAAW,CAChB,GAAG,SAAS,oFAAoF,IAAI,EAAE,iBAAiB,6DAA6D,CACrL,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;gBAC/B,OAAO,WAAW,CAAC,GAAG,SAAS,0CAA0C,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,aAAa,OAAO,EAAE,CAAC,CAAC;QACzD,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,gCAAgC,EAAE,CAAC;gBACjD,OAAO,WAAW,CAChB,GAAG,SAAS,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,yEAAyE,CACpK,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,2BAA2B,EAAE,CAAC;gBAC5C,OAAO,WAAW,CAChB,GAAG,SAAS,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,yEAAyE,CAC9J,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAChB,GAAG,SAAS,uBAAuB,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,0EAA0E;gBAC1E,MAAM,UAAU,GAAG,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;gBAC5C,MAAM,KAAK,GACT,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,aAAa,IAAI,GAAG,IAAI,IAAI,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/F,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,yBAAyB,IAAI,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,MAAM,KAAK,GAAG,UAAU;oBACtB,CAAC,CAAC,iFAAiF,UAAU,IAAI;oBACjG,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,WAAW,CAChB,GAAG,SAAS,oCAAoC,KAAK,uGAAuG,OAAO,GAAG,KAAK,EAAE,CAC9K,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,sBAAsB,OAAO,EAAE,CAAC,CAAC;QAClE,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;gBACvC,OAAO,WAAW,CAChB,GAAG,SAAS,oDAAoD,CACjE,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;gBACtC,OAAO,WAAW,CAChB,GAAG,SAAS,gGAAgG,CAC7G,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACpE;YACE,OAAO,WAAW,CAChB,GAAG,SAAS,qCAAqC,MAAM,MAAM,OAAO,EAAE,CACvE,CAAC;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-result.js","sourceRoot":"","sources":["../src/tool-result.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,kEAAkE;AAClE,sBAAsB;AA6BtB;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzC,IAAI,KAAK,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1E,MAAM,EAAE,GAAc,EAAE,CAAC;IACzB,IAAI,KAAK,IAAI,IAAI;QAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,SAAS,IAAI,IAAI;QAAE,EAAE,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,KAAK,IAAI,IAAI;QAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,OAAgC;IAEhC,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GACd,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5E,CAAC,CAAC,EAAE,GAAI,IAAgC,EAAE,UAAU,EAAE,SAAS,EAAE;QACjE,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,yEAAyE;QACzE,wEAAwE;QACxE,kCAAkC;QAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACtE,iBAAiB,EAAE,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,IAA2B,EAC3B,OAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,IAAI,eAAe,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,WAAW,CAChB,GAAG,SAAS,+JAA+J,CAC5K,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;gBACrC,OAAO,WAAW,CAChB,GAAG,SAAS,6CAA6C,IAAI,EAAE,QAAQ,IAAI,UAAU,iDAAiD,CACvI,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,cAAc,OAAO,EAAE,CAAC,CAAC;QAC1D,KAAK,GAAG;YACN,OAAO,WAAW,CAChB,GAAG,SAAS,wDAAwD,CACrE,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBACpC,OAAO,WAAW,CAChB,GAAG,SAAS,8GAA8G,IAAI,EAAE,iBAAiB,4EAA4E,CAC9N,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;gBAC3C,OAAO,WAAW,CAChB,GAAG,SAAS,oFAAoF,IAAI,EAAE,iBAAiB,6DAA6D,CACrL,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;gBAC/B,OAAO,WAAW,CAAC,GAAG,SAAS,0CAA0C,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,aAAa,OAAO,EAAE,CAAC,CAAC;QACzD,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,gCAAgC,EAAE,CAAC;gBACjD,OAAO,WAAW,CAChB,GAAG,SAAS,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,yEAAyE,CACpK,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,2BAA2B,EAAE,CAAC;gBAC5C,OAAO,WAAW,CAChB,GAAG,SAAS,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,yEAAyE,CAC9J,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAChB,GAAG,SAAS,uBAAuB,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,0EAA0E;gBAC1E,MAAM,UAAU,GAAG,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;gBAC5C,MAAM,KAAK,GACT,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,aAAa,IAAI,GAAG,IAAI,IAAI,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/F,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,yBAAyB,IAAI,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,MAAM,KAAK,GAAG,UAAU;oBACtB,CAAC,CAAC,iFAAiF,UAAU,IAAI;oBACjG,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,WAAW,CAChB,GAAG,SAAS,oCAAoC,KAAK,uGAAuG,OAAO,GAAG,KAAK,EAAE,CAC9K,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,sBAAsB,OAAO,EAAE,CAAC,CAAC;QAClE,KAAK,GAAG;YACN,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;gBACvC,OAAO,WAAW,CAChB,GAAG,SAAS,oDAAoD,CACjE,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;gBACtC,OAAO,WAAW,CAChB,GAAG,SAAS,gGAAgG,CAC7G,CAAC;YACJ,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,SAAS,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACpE;YACE,OAAO,WAAW,CAChB,GAAG,SAAS,qCAAqC,MAAM,MAAM,OAAO,EAAE,CACvE,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/tools/create-patient-stream.js

@@ -6,9 +6,12 @@
 // cued message. Each subsequent cue requires submitting the prior
 // message's feedback (the moat per A1 §3).
 //
-// v1 accepts only `general_wellness_daily` template + `display`
-// delivery_mode per the locked sandbox scope. Deliver-mode unlocks
-// at Per-Episode tier after BAA execution.
+// template_id accepts any LIVE template (SIGNAL_TEMPLATE_IDS, derived from the
+// drift-guarded generated catalog — the single source shared with the
+// signal://catalog resource). Clinical templates require audience_tags +
+// patient_context the agent should pre-satisfy from the catalog resource (else a
+// production create 422s). delivery_mode is `display` in v1; Deliver unlocks at
+// Per-Episode tier after BAA execution.
 //
 // Scope required: stream:create.
 // Spec: docs/spec_track_a_a4_mcp_server.md §6.3.
@@ -16,9 +19,16 @@ import { callRails, isErrorStatus } from "../rails-client.js";
 import { currentContext } from "../context.js";
 import { successResult, railsErrorToToolResult, } from "../tool-result.js";
 import { createPatientStreamOutputSchema } from "../output-schemas.js";
+import { SIGNAL_TEMPLATE_IDS } from "../generated/signal-catalog.js";
 export const createPatientStreamTool = {
     name: "create_patient_stream",
-    description: "Create a cued stream for a patient. Returns stream_id + first cued message. Each subsequent cue MUST submit the prior message's feedback — the engine refuses to advance without it (the moat mechanic).",
+    description: "Create a Signal cued stream for one patient and get the first cue back synchronously. " +
+        "Every cue is federally-sourced, audience-safety-checked, and sequenced on the patient's " +
+        "prior response — so your agent never fabricates health content. Choose a template_id from " +
+        "the signal://catalog resource and pre-satisfy its required audience_tags + patient_context " +
+        "(clinical templates 422 without them). Display mode renders in your app: no PHI, no BAA. " +
+        "Each later cue MUST submit the prior message's feedback — the engine refuses to advance " +
+        "without it (the sequencing moat).",
     annotations: {
         title: "Create patient stream",
         readOnlyHint: false,
@@ -30,8 +40,13 @@ export const createPatientStreamTool = {
         properties: {
             template_id: {
                 type: "string",
-                enum: ["general_wellness_daily"],
-                description: "v1 sandbox supports one template; future templates land as v1+ ships.",
+                // Single-sourced from the drift-guarded generated catalog (same source as
+                // the signal://catalog resource) — never hand-list a second copy here.
+                enum: [...SIGNAL_TEMPLATE_IDS],
+                description: "One of the live Signal templates. Read the signal://catalog resource for each " +
+                    "template's required audience_tags + patient_context. On a production key a clinical " +
+                    "template 422s if its required tags/context are missing — pre-satisfy them from the " +
+                    "catalog. A free sandbox (Discovery) key always cues the curated sandbox corpus.",
             },
             attributes: {
                 type: "object",
@@ -52,6 +67,11 @@ export const createPatientStreamTool = {
                 type: "integer",
                 default: 14,
             },
+            idempotency_key: {
+                type: "string",
+                format: "uuid",
+                description: "Optional. Stripe-style create idempotency: a retried create with the same key returns the ORIGINAL stream instead of minting (and billing) a second one. Forwarded as the Idempotency-Key request header. UUID v4 recommended.",
+            },
         },
         required: ["template_id"],
         additionalProperties: true,
@@ -59,16 +79,24 @@ export const createPatientStreamTool = {
     outputSchema: createPatientStreamOutputSchema,
     async handler(args) {
         const { bearer } = currentContext();
+        // idempotency_key is a REQUEST HEADER on the Rails side (read at
+        // streams_controller#create), not a body param — strip it from the body and
+        // forward it as Idempotency-Key. Everything else passes through verbatim.
+        const { idempotency_key, ...streamArgs } = args;
+        const headers = typeof idempotency_key === "string" && idempotency_key.length > 0
+            ? { "Idempotency-Key": idempotency_key }
+            : undefined;
         const response = await callRails({
             method: "POST",
             path: "/v1/signal/streams",
             bearer,
-            body: args,
+            body: streamArgs,
+            headers,
         });
         if (isErrorStatus(response.status)) {
             return railsErrorToToolResult(response.status, response.body, "create_patient_stream", response.headers);
         }
-        return successResult(response.body);
+        return successResult(response.body, response.headers);
     },
 };
 //# sourceMappingURL=create-patient-stream.js.map

package/dist/tools/create-patient-stream.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-patient-stream.js","sourceRoot":"","sources":["../../src/tools/create-patient-stream.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,eAAe;AACf,4BAA4B;AAC5B,iEAAiE;AACjE,kEAAkE;AAClE,2CAA2C;AAC3C,EAAE;AACF,gEAAgE;AAChE,mEAAmE;AACnE,2CAA2C;AAC3C,EAAE;AACF,iCAAiC;AACjC,iDAAiD;AAEjD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAEvE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACT,0MAA0M;IAC5M,WAAW,EAAE;QACX,KAAK,EAAE,uBAAuB;QAC9B,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,IAAI;KACpB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,UAAU,EAAE;YACV,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,IAAI,EAAE,CAAC,wBAAwB,CAAC;gBAChC,WAAW,EAAE,uEAAuE;aACrF;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAiB;gBACvB,WAAW,EACT,mGAAmG;aACtG;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,OAAgB;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;gBAClC,WAAW,EAAE,qFAAqF;aACnG;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,QAAiB;gBACvB,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,yEAAyE;aACvF;YACD,qBAAqB,EAAE;gBACrB,IAAI,EAAE,SAAkB;gBACxB,OAAO,EAAE,EAAE;aACZ;SACF;QACD,QAAQ,EAAE,CAAC,aAAa,CAAC;QACzB,oBAAoB,EAAE,IAAI;KAC3B;IACD,YAAY,EAAE,+BAA+B;IAC7C,KAAK,CAAC,OAAO,CAAC,IAA6B;QACzC,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,IAA6B,EACtC,uBAAuB,EACvB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;CACF,CAAC"}
+{"version":3,"file":"create-patient-stream.js","sourceRoot":"","sources":["../../src/tools/create-patient-stream.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,eAAe;AACf,4BAA4B;AAC5B,iEAAiE;AACjE,kEAAkE;AAClE,2CAA2C;AAC3C,EAAE;AACF,+EAA+E;AAC/E,sEAAsE;AACtE,yEAAyE;AACzE,iFAAiF;AACjF,gFAAgF;AAChF,wCAAwC;AACxC,EAAE;AACF,iCAAiC;AACjC,iDAAiD;AAEjD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACT,wFAAwF;QACxF,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,0FAA0F;QAC1F,mCAAmC;IACrC,WAAW,EAAE;QACX,KAAK,EAAE,uBAAuB;QAC9B,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,IAAI;KACpB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,UAAU,EAAE;YACV,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,0EAA0E;gBAC1E,uEAAuE;gBACvE,IAAI,EAAE,CAAC,GAAG,mBAAmB,CAAC;gBAC9B,WAAW,EACT,gFAAgF;oBAChF,sFAAsF;oBACtF,qFAAqF;oBACrF,iFAAiF;aACpF;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAiB;gBACvB,WAAW,EACT,mGAAmG;aACtG;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,OAAgB;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;gBAClC,WAAW,EAAE,qFAAqF;aACnG;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,QAAiB;gBACvB,IAAI,EAAE,CAAC,SAAS,CAAC;gBACjB,OAAO,EAAE,SAAS;gBAClB,WAAW,EAAE,yEAAyE;aACvF;YACD,qBAAqB,EAAE;gBACrB,IAAI,EAAE,SAAkB;gBACxB,OAAO,EAAE,EAAE;aACZ;YACD,eAAe,EAAE;gBACf,IAAI,EAAE,QAAiB;gBACvB,MAAM,EAAE,MAAM;gBACd,WAAW,EACT,gOAAgO;aACnO;SACF;QACD,QAAQ,EAAE,CAAC,aAAa,CAAC;QACzB,oBAAoB,EAAE,IAAI;KAC3B;IACD,YAAY,EAAE,+BAA+B;IAC7C,KAAK,CAAC,OAAO,CAAC,IAA6B;QACzC,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,iEAAiE;QACjE,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,EAAE,eAAe,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC;QAChD,MAAM,OAAO,GACX,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;YAC/D,CAAC,CAAC,EAAE,iBAAiB,EAAE,eAAe,EAAE;YACxC,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,IAAI,EAAE,UAAU;YAChB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,IAA6B,EACtC,uBAAuB,EACvB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;CACF,CAAC"}

package/dist/tools/get-next-cued-message.js

@@ -16,7 +16,12 @@ import { CUE_RESPONSE_ACTIONS } from "../cue-actions.js";
 import { getNextCuedMessageOutputSchema } from "../output-schemas.js";
 export const getNextCuedMessageTool = {
     name: "get_next_cued_message",
-    description: "Submit the prior message's feedback and receive the next cued message. THIS TOOL REFUSES WITHOUT PRIOR-MESSAGE FEEDBACK — the moat. Same idempotency_key + same feedback returns the cached cue; conflicting feedback under the same key returns 409.",
+    description: "Submit the patient's response to the prior cue and get the next one — federally-sourced, " +
+        "audience-safety-checked, and re-sequenced on that feedback. REFUSES WITHOUT PRIOR-MESSAGE " +
+        "FEEDBACK (the moat): the engine will not advance a stream blind, returning 409 if you skip " +
+        "it. response_action is one of the accepted cue vocabulary (see the signal://catalog " +
+        "resource). Same idempotency_key + same feedback returns the cached cue; conflicting " +
+        "feedback under the same key returns 409.",
     annotations: {
         title: "Submit feedback, get next cued message",
         readOnlyHint: false,
@@ -72,7 +77,7 @@ export const getNextCuedMessageTool = {
         if (isErrorStatus(response.status)) {
             return railsErrorToToolResult(response.status, response.body, "get_next_cued_message", response.headers);
         }
-        return successResult(response.body);
+        return successResult(response.body, response.headers);
     },
 };
 //# sourceMappingURL=get-next-cued-message.js.map

package/dist/tools/get-next-cued-message.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-next-cued-message.js","sourceRoot":"","sources":["../../src/tools/get-next-cued-message.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,eAAe;AACf,oCAAoC;AACpC,kEAAkE;AAClE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,EAAE;AACF,8BAA8B;AAC9B,qEAAqE;AAErE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,WAAW,GAEZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAEtE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACT,uPAAuP;IACzP,WAAW,EAAE;QACX,KAAK,EAAE,wCAAwC;QAC/C,YAAY,EAAE,KAAK;QACnB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACpB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,UAAU,EAAE;YACV,SAAS,EAAE;gBACT,IAAI,EAAE,SAAkB;gBACxB,WAAW,EAAE,kDAAkD;aAChE;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAiB;gBACvB,UAAU,EAAE;oBACV,eAAe,EAAE;wBACf,IAAI,EAAE,QAAiB;wBACvB,iEAAiE;wBACjE,2EAA2E;wBAC3E,4DAA4D;wBAC5D,IAAI,EAAE,CAAC,GAAG,oBAAoB,CAAC;qBAChC;oBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;oBACtC,eAAe,EAAE;wBACf,IAAI,EAAE,QAAiB;wBACvB,MAAM,EAAE,MAAM;wBACd,WAAW,EACT,4HAA4H;qBAC/H;iBACF;gBACD,QAAQ,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;aACjD;SACF;QACD,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACnC,oBAAoB,EAAE,KAAK;KAC5B;IACD,YAAY,EAAE,8BAA8B;IAC5C,KAAK,CAAC,OAAO,CAAC,IAGb;QACC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,OAAO,WAAW,CAChB,iEAAiE;gBAC/D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,WAAW,CAChB,sHAAsH,CACvH,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB,IAAI,CAAC,SAAS,MAAM;YAChD,MAAM;YACN,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,IAA6B,EACtC,uBAAuB,EACvB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;CACF,CAAC"}
+{"version":3,"file":"get-next-cued-message.js","sourceRoot":"","sources":["../../src/tools/get-next-cued-message.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,eAAe;AACf,oCAAoC;AACpC,kEAAkE;AAClE,uEAAuE;AACvE,qEAAqE;AACrE,kEAAkE;AAClE,EAAE;AACF,8BAA8B;AAC9B,qEAAqE;AAErE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAuB,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,WAAW,GAEZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAEtE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACT,2FAA2F;QAC3F,4FAA4F;QAC5F,6FAA6F;QAC7F,sFAAsF;QACtF,sFAAsF;QACtF,0CAA0C;IAC5C,WAAW,EAAE;QACX,KAAK,EAAE,wCAAwC;QAC/C,YAAY,EAAE,KAAK;QACnB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACpB;IACD,WAAW,EAAE;QACX,IAAI,EAAE,QAAiB;QACvB,UAAU,EAAE;YACV,SAAS,EAAE;gBACT,IAAI,EAAE,SAAkB;gBACxB,WAAW,EAAE,kDAAkD;aAChE;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAiB;gBACvB,UAAU,EAAE;oBACV,eAAe,EAAE;wBACf,IAAI,EAAE,QAAiB;wBACvB,iEAAiE;wBACjE,2EAA2E;wBAC3E,4DAA4D;wBAC5D,IAAI,EAAE,CAAC,GAAG,oBAAoB,CAAC;qBAChC;oBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;oBACtC,eAAe,EAAE;wBACf,IAAI,EAAE,QAAiB;wBACvB,MAAM,EAAE,MAAM;wBACd,WAAW,EACT,4HAA4H;qBAC/H;iBACF;gBACD,QAAQ,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;aACjD;SACF;QACD,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACnC,oBAAoB,EAAE,KAAK;KAC5B;IACD,YAAY,EAAE,8BAA8B;IAC5C,KAAK,CAAC,OAAO,CAAC,IAGb;QACC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5E,OAAO,WAAW,CAChB,iEAAiE;gBAC/D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,WAAW,CAChB,sHAAsH,CACvH,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB,IAAI,CAAC,SAAS,MAAM;YAChD,MAAM;YACN,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;SAClC,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,CAC3B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,IAA6B,EACtC,uBAAuB,EACvB,QAAQ,CAAC,OAAO,CACjB,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;CACF,CAAC"}

package/dist/tools/index.js

@@ -1,10 +1,14 @@
 // Track A A4 PR 2 — MCP tool registry.
-// All 4 v1 tools per docs/spec_track_a_a4_mcp_server.md §6.3.
+// The 4 keyed v1 tools per docs/spec_track_a_a4_mcp_server.md §6.3, plus the
+// Rung-0 no-auth lookup_health_fact (2026-06-15) — the one keyless tool (the
+// per-tool guard relax lives in index.ts; the others still 401 without a key).
 import { createPatientStreamTool } from "./create-patient-stream.js";
 import { getNextCuedMessageTool } from "./get-next-cued-message.js";
 import { readStreamStateTool } from "./read-stream-state.js";
 import { listSandboxTopicsTool } from "./list-sandbox-topics.js";
+import { lookupHealthFactTool } from "./lookup-health-fact.js";
 export const tools = [
+    lookupHealthFactTool,
     createPatientStreamTool,
     getNextCuedMessageTool,
     readStreamStateTool,