canvas-lms-mcp 2.5.0 → 2.5.2

package/README.md

@@ -345,6 +345,27 @@ const courses = await canvas.courses.list()
 | `CANVAS_PSEUDONYM_AUDIT_LOG` | No | Path to an append-only file that mirrors `resolve_pseudonym` audit lines (stderr is always written) |
 | `CANVAS_PROVENANCE_FENCING` | No | **On by default.** Set to exactly `false` to disable [provenance fencing](#provenance-fencing-untrusted-canvas-content) |
 | `CANVAS_DESTRUCTIVE_TOOLS` | No | `allow` (default) or `block`. Set to exactly `block` to unregister the ten irreversible delete tools (see [Destructive tool policy](#destructive-tool-policy)) |
+| `CANVAS_STRING_IDS` | No | **Off by default.** Set to exactly `true` to request Canvas identifiers as JSON strings instead of numbers (see [64-bit Canvas identifiers](#64-bit-canvas-identifiers-opt-in-string-ids)) |
+
+## 64-bit Canvas identifiers (opt-in string IDs)
+
+Canvas IDs are 64-bit integers, but a sharded, multi-tenant hosted Canvas assigns global IDs well above `Number.MAX_SAFE_INTEGER` (`9007199254740991`) once an account lives on shard 901 or higher. `JSON.parse` silently rounds such a value — `9010000000000001` arrives as `9010000000000000` — before any code in this server, or in the client reading its response, ever sees it.
+
+**Off by default, opt-in, byte-exact to enable:**
+
+```bash
+CANVAS_STRING_IDS=true canvas-lms-mcp --base-url https://school.instructure.com
+```
+
+The comparison is `=== "true"` and nothing else — no trimming, no case-folding, no truthy coercion. `True`, `TRUE`, `1`, `yes`, a trailing space, or an unset variable all leave the flag **off**. This is deliberate: every normalization step on a flag value widens the set of strings that can enable it by accident, and a precision feature that silently stays off is safer than one that silently turns on.
+
+With the flag on, this server asks Canvas to render every identifier as a JSON **string** rather than a number, on every `/api/v1` request it issues — including list endpoints and every page a response's pagination `Link` leads to — so the string form follows the data through to the end of a paginated fetch, not just the first page.
+
+**Not sent to New Quizzes.** `/api/quiz/v1` is served by a separate service that does not implement this negotiation, so the header is deliberately not sent on those 11 request call sites; a New Quizzes response's identifiers are unaffected by this flag either way.
+
+**What a caller observes:** every identifier in a tool's response — the MCP structured-content surface, the text surface, and the typed `CanvasClient` returned by [library import](docs/integration-guide.md#pattern-3-library-import-embedded-server) — becomes a canonical decimal string instead of a `number`, independent of this flag. Response identifiers are normalized to strings unconditionally so a client never has to special-case "did the flag catch this field"; the flag controls only whether Canvas itself renders large IDs precisely before that normalization runs, which is what actually prevents the precision loss for IDs above the safe-integer range.
+
+**Recommended for any hosted, multi-shard Canvas instance** — i.e., most institutional (non-self-hosted) deployments — where object IDs on shard 901+ are reachable in principle. A single-shard, self-hosted Canvas has no exposure and can leave this off.
 
 ## Destructive tool policy
 
@@ -611,7 +632,7 @@ See [CONTRIBUTING.md](./CONTRIBUTING.md) for the full contribution and validatio
 Thanks to our community contributors for improving canvas-lms-mcp:
 
 - [@roowus](https://github.com/roowus): tuple-style JSON Schema fix for OpenAI-compatible clients ([#308](https://github.com/bruchris/canvas-lms-mcp/pull/308))
-- [@algorithm0r](https://github.com/algorithm0r): New Quizzes payload fix ([#367](https://github.com/bruchris/canvas-lms-mcp/pull/367)), module item update/delete ([#368](https://github.com/bruchris/canvas-lms-mcp/pull/368)), Classic Quiz deletes ([#369](https://github.com/bruchris/canvas-lms-mcp/pull/369)), rubric attach/delete ([#370](https://github.com/bruchris/canvas-lms-mcp/pull/370)), assignment grading fields ([#371](https://github.com/bruchris/canvas-lms-mcp/pull/371))
+- [@algorithm0r](https://github.com/algorithm0r): New Quizzes payload fix ([#367](https://github.com/bruchris/canvas-lms-mcp/pull/367)), module item update/delete ([#368](https://github.com/bruchris/canvas-lms-mcp/pull/368)), Classic Quiz deletes ([#369](https://github.com/bruchris/canvas-lms-mcp/pull/369)), rubric attach/delete ([#370](https://github.com/bruchris/canvas-lms-mcp/pull/370)), assignment grading fields ([#371](https://github.com/bruchris/canvas-lms-mcp/pull/371)), assignment lock and unlock dates ([#424](https://github.com/bruchris/canvas-lms-mcp/pull/424)), course grade weighting and display settings ([#425](https://github.com/bruchris/canvas-lms-mcp/pull/425))
 - [@chiptoe-svg](https://github.com/chiptoe-svg): rubric association lookup on get_rubric ([#327](https://github.com/bruchris/canvas-lms-mcp/pull/327))
 
 See [all contributors](https://github.com/bruchris/canvas-lms-mcp/graphs/contributors).

package/dist/auth/oauth/config.d.ts

@@ -87,6 +87,4 @@ export declare function loadOAuthProfileConfig(env: OAuthEnv, overrides?: OAuthC
  * network. Returns the host to bind, or throws.
  */
 export declare function resolveBindHost(config: OAuthProfileConfig, requestedHost: string | undefined): string;
-/** Hash a pre-registered client secret for storage; exported for the client store. */
-export declare function hashClientSecret(secret: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/auth/oauth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/config.ts"],"names":[],"mappings":"AAQA,uEAAuE;AACvE,eAAO,MAAM,UAAU,0CAA2C,CAAA;AAClE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAElD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAE3D;AAED,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,UAAkB,CAAA;AAEzD,2BAA2B;AAC3B,eAAO,MAAM,wBAAwB,QAAU,CAAA;AAC/C,eAAO,MAAM,yBAAyB,QAAoB,CAAA;AAC1D,eAAO,MAAM,8BAA8B,QAAS,CAAA;AACpD,eAAO,MAAM,iCAAiC,QAAU,CAAA;AAExD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,qEAAqE;QACrE,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,EAAE,mBAAmB,EAAE,CAAA;IAC9B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAA;QACZ,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,6SAYjB,CAAA;AAEV,MAAM,WAAW,QAAQ;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,mCAAmC,CAAC,EAAE,MAAM,CAAA;IAC5C,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CA4BzF;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD;AAyED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,QAAQ,EACb,SAAS,GAAE,oBAAyB,GACnC,kBAAkB,CA0EpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,CAaR;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/config.ts"],"names":[],"mappings":"AAOA,uEAAuE;AACvE,eAAO,MAAM,UAAU,0CAA2C,CAAA;AAClE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAElD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAE3D;AAED,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,UAAkB,CAAA;AAEzD,2BAA2B;AAC3B,eAAO,MAAM,wBAAwB,QAAU,CAAA;AAC/C,eAAO,MAAM,yBAAyB,QAAoB,CAAA;AAC1D,eAAO,MAAM,8BAA8B,QAAS,CAAA;AACpD,eAAO,MAAM,iCAAiC,QAAU,CAAA;AAExD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,qEAAqE;QACrE,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,EAAE,mBAAmB,EAAE,CAAA;IAC9B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAA;QACZ,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,6SAYjB,CAAA;AAEV,MAAM,WAAW,QAAQ;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,mCAAmC,CAAC,EAAE,MAAM,CAAA;IAC5C,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CA4BzF;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD;AAyED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,QAAQ,EACb,SAAS,GAAE,oBAAyB,GACnC,kBAAkB,CA0EpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,CAaR"}

package/dist/canvas/index.cjs

@@ -6,13 +6,13 @@
 
 
 
-var _chunkLGKRFDO5cjs = require('../chunk-LGKRFDO5.cjs');
+var _chunk27FJDG3Ycjs = require('../chunk-27FJDG3Y.cjs');
 
 
 
 
 
-var _chunkZKG3VDNNcjs = require('../chunk-ZKG3VDNN.cjs');
+var _chunkZOOMOVE5cjs = require('../chunk-ZOOMOVE5.cjs');
 
 
 
@@ -25,5 +25,5 @@ var _chunkZKG3VDNNcjs = require('../chunk-ZKG3VDNN.cjs');
 
 
 
-exports.CANVAS_MAX_ID = _chunkLGKRFDO5cjs.CANVAS_MAX_ID; exports.CanvasApiError = _chunkZKG3VDNNcjs.CanvasApiError; exports.CanvasClient = _chunkLGKRFDO5cjs.CanvasClient; exports.CanvasHttpClient = _chunkZKG3VDNNcjs.CanvasHttpClient; exports.MAX_SAFE_CANVAS_NUMBER_ID = _chunkLGKRFDO5cjs.MAX_SAFE_CANVAS_NUMBER_ID; exports.appendCanvasQuery = _chunkZKG3VDNNcjs.appendCanvasQuery; exports.canvasIdInput = _chunkLGKRFDO5cjs.canvasIdInput; exports.canvasIdList = _chunkLGKRFDO5cjs.canvasIdList; exports.compareCanvasIds = _chunkLGKRFDO5cjs.compareCanvasIds; exports.normalizeCanvasIdInput = _chunkLGKRFDO5cjs.normalizeCanvasIdInput; exports.toCanvasQuery = _chunkZKG3VDNNcjs.toCanvasQuery;
+exports.CANVAS_MAX_ID = _chunk27FJDG3Ycjs.CANVAS_MAX_ID; exports.CanvasApiError = _chunkZOOMOVE5cjs.CanvasApiError; exports.CanvasClient = _chunk27FJDG3Ycjs.CanvasClient; exports.CanvasHttpClient = _chunkZOOMOVE5cjs.CanvasHttpClient; exports.MAX_SAFE_CANVAS_NUMBER_ID = _chunk27FJDG3Ycjs.MAX_SAFE_CANVAS_NUMBER_ID; exports.appendCanvasQuery = _chunkZOOMOVE5cjs.appendCanvasQuery; exports.canvasIdInput = _chunk27FJDG3Ycjs.canvasIdInput; exports.canvasIdList = _chunk27FJDG3Ycjs.canvasIdList; exports.compareCanvasIds = _chunk27FJDG3Ycjs.compareCanvasIds; exports.normalizeCanvasIdInput = _chunk27FJDG3Ycjs.normalizeCanvasIdInput; exports.toCanvasQuery = _chunkZOOMOVE5cjs.toCanvasQuery;
 //# sourceMappingURL=index.cjs.map

package/dist/canvas/index.js

@@ -6,13 +6,13 @@ import {
   canvasIdList,
   compareCanvasIds,
   normalizeCanvasIdInput
-} from "../chunk-SIEP7DD3.js";
+} from "../chunk-2EY3U7IR.js";
 import {
   CanvasApiError,
   CanvasHttpClient,
   appendCanvasQuery,
   toCanvasQuery
-} from "../chunk-SBND74S5.js";
+} from "../chunk-66TL3XQU.js";
 export {
   CANVAS_MAX_ID,
   CanvasApiError,

package/dist/{chunk-LGKRFDO5.cjs → chunk-27FJDG3Y.cjs}

@@ -1,7 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
-var _chunkZKG3VDNNcjs = require('./chunk-ZKG3VDNN.cjs');
+var _chunkZOOMOVE5cjs = require('./chunk-ZOOMOVE5.cjs');
 
 // src/canvas/courses.ts
 var DEFAULT_LIST_INCLUDE = ["term"];
@@ -283,7 +283,7 @@ var RubricsModule = class {
       headers: { "Content-Type": "application/x-www-form-urlencoded" }
     });
     if (result.error === true) {
-      throw new (0, _chunkZKG3VDNNcjs.CanvasApiError)(
+      throw new (0, _chunkZOOMOVE5cjs.CanvasApiError)(
         _optionalChain([result, 'access', _2 => _2.messages, 'optionalAccess', _3 => _3.join, 'call', _4 => _4("; ")]) || "Canvas rejected the rubric",
         422,
         endpoint
@@ -1512,7 +1512,7 @@ var NewQuizzesModule = class {
         `/api/quiz/v1/courses/${courseId}/accommodations/${userId}`
       );
     } catch (err) {
-      if (err instanceof _chunkZKG3VDNNcjs.CanvasApiError && err.status === 404) return null;
+      if (err instanceof _chunkZOOMOVE5cjs.CanvasApiError && err.status === 404) return null;
       throw err;
     }
   }
@@ -2011,7 +2011,7 @@ var CanvasClient = class {
   
   
   constructor(config) {
-    this.client = new (0, _chunkZKG3VDNNcjs.CanvasHttpClient)(config);
+    this.client = new (0, _chunkZOOMOVE5cjs.CanvasHttpClient)(config);
     this.courses = new CoursesModule(this.client);
     this.assignments = new AssignmentsModule(this.client);
     this.submissions = new SubmissionsModule(this.client);
@@ -2060,4 +2060,4 @@ var CanvasClient = class {
 
 
 exports.mapWithConcurrency = mapWithConcurrency; exports.SEARCH_CONTENT_TYPES = SEARCH_CONTENT_TYPES; exports.OUTCOME_CONTEXT_TYPES = OUTCOME_CONTEXT_TYPES; exports.OUTCOME_DETAIL_LEVELS = OUTCOME_DETAIL_LEVELS; exports.OUTCOME_ROLLUP_AGGREGATE_STATS = OUTCOME_ROLLUP_AGGREGATE_STATS; exports.OUTCOME_ROLLUP_SORT_BY = OUTCOME_ROLLUP_SORT_BY; exports.OUTCOME_SORT_ORDER = OUTCOME_SORT_ORDER; exports.OUTCOME_EXCLUDE_OPTIONS = OUTCOME_EXCLUDE_OPTIONS; exports.CANVAS_MAX_ID = CANVAS_MAX_ID; exports.MAX_SAFE_CANVAS_NUMBER_ID = MAX_SAFE_CANVAS_NUMBER_ID; exports.canvasIdInput = canvasIdInput; exports.canvasIdList = canvasIdList; exports.compareCanvasIds = compareCanvasIds; exports.normalizeCanvasIdInput = normalizeCanvasIdInput; exports.CanvasClient = CanvasClient;
-//# sourceMappingURL=chunk-LGKRFDO5.cjs.map
+//# sourceMappingURL=chunk-27FJDG3Y.cjs.map