loomiomcp 0.0.1

package/dist/http.js

@@ -0,0 +1,1569 @@
+// src/loomio/client.ts
+import { fetch } from "undici";
+
+// src/env.ts
+function readBool(name) {
+  const raw = process.env[name]?.toLowerCase();
+  return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
+}
+function readPositiveInt(name, fallback, min = 1) {
+  const raw = process.env[name];
+  if (raw === void 0 || raw === "") return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < min) return fallback;
+  return Math.floor(n);
+}
+
+// src/log.ts
+import { AsyncLocalStorage } from "async_hooks";
+function logVerbose() {
+  return readBool("LOOMIO_MCP_LOG_VERBOSE");
+}
+var chainHandlers = {
+  "tool.call": (ctx, f) => {
+    if (typeof f["tool"] === "string") ctx.tools.push(f["tool"]);
+  },
+  "loomio.request": (ctx) => {
+    ctx.loomioCalls += 1;
+  }
+};
+function logEvent(event, fields, opts = {}) {
+  const ctx = requestContext.getStore();
+  if (ctx) chainHandlers[event]?.(ctx, fields);
+  if (!opts.force && !logVerbose()) return;
+  process.stderr.write(
+    `${JSON.stringify({ event, ...fields, timestamp: (/* @__PURE__ */ new Date()).toISOString() })}
+`
+  );
+}
+function redactPath(path) {
+  const noQuery = path.split("?")[0] ?? path;
+  return noQuery.replace(/\/\d+(?:,\d+)*/g, "/:id");
+}
+var requestContext = new AsyncLocalStorage();
+function withRequestContext(initial, fn) {
+  const ctx = {
+    ...initial,
+    tools: [],
+    loomioCalls: 0,
+    startedAt: Date.now()
+  };
+  return requestContext.run(ctx, async () => {
+    try {
+      return await fn();
+    } finally {
+      logEvent("tool.chain", {
+        ...ctx.clientId ? { clientId: ctx.clientId } : {},
+        tools: ctx.tools,
+        toolCount: ctx.tools.length,
+        loomioCalls: ctx.loomioCalls,
+        durationMs: Date.now() - ctx.startedAt
+      });
+    }
+  });
+}
+function getRequestContext() {
+  return requestContext.getStore();
+}
+
+// src/loomio/client.ts
+var DEFAULT_BASE_URL = "https://www.loomio.com/api";
+function baseUrl() {
+  const override = process.env["LOOMIO_API_BASE_URL"];
+  if (!override) return DEFAULT_BASE_URL;
+  if (!URL.canParse(override)) {
+    throw new LoomioAuthError(
+      `LOOMIO_API_BASE_URL is not a valid URL: ${JSON.stringify(override)}`
+    );
+  }
+  const u = new URL(override);
+  const isLocal = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]" || u.hostname === "::1";
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && isLocal)) {
+    throw new LoomioAuthError(
+      `LOOMIO_API_BASE_URL must be https:// (or http:// on localhost); got ${u.protocol}//${u.hostname}. Sending the Loomio API key to that URL would expose it.`
+    );
+  }
+  return override;
+}
+function isReadOnly() {
+  return readBool("LOOMIO_MCP_READONLY");
+}
+var LoomioReadOnlyError = class extends Error {
+  constructor(method) {
+    super(
+      `loomiomcp is running in read-only mode (LOOMIO_MCP_READONLY is set). ${method} requests are refused. Unset LOOMIO_MCP_READONLY to enable writes.`
+    );
+    this.name = "LoomioReadOnlyError";
+  }
+};
+var LoomioAuthError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "LoomioAuthError";
+  }
+  status;
+};
+var LoomioApiError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "LoomioApiError";
+  }
+  status;
+};
+function getApiKey() {
+  const key = process.env["LOOMIO_API_KEY"];
+  if (!key) {
+    throw new LoomioAuthError(
+      "LOOMIO_API_KEY environment variable is not set. Generate one in Loomio under your profile \u2192 API keys."
+    );
+  }
+  return key;
+}
+function getB3ApiKey() {
+  const key = process.env["LOOMIO_B3_API_KEY"];
+  if (!key) {
+    throw new LoomioAuthError(
+      "LOOMIO_B3_API_KEY environment variable is not set. The b3 admin endpoints require a server-instance secret (ENV['B3_API_KEY'] on the Loomio server, >16 chars). Only Loomio instance operators have this."
+    );
+  }
+  return key;
+}
+function hasB3ApiKey() {
+  return Boolean(process.env["LOOMIO_B3_API_KEY"]);
+}
+function baseHeaders() {
+  return {
+    Accept: "application/json"
+  };
+}
+async function parseErrorBody(res) {
+  try {
+    const body = await res.json();
+    if (body.errors && typeof body.errors === "object") {
+      const parts = [];
+      for (const [field, msgs] of Object.entries(body.errors)) {
+        const msg = Array.isArray(msgs) ? msgs.join(", ") : String(msgs);
+        parts.push(`${field}: ${msg}`);
+      }
+      if (parts.length > 0) return parts.join("; ");
+    }
+    if (body.message) return body.message;
+    if (body.error) return body.error;
+    return res.statusText;
+  } catch {
+    return res.statusText;
+  }
+}
+var REQUEST_TIMEOUT_MS = 6e4;
+function isAbortError(err) {
+  return err instanceof Error && (err.name === "AbortError" || /aborted/i.test(err.message));
+}
+function timeoutError() {
+  throw new LoomioApiError(
+    504,
+    `Loomio API request timed out after ${REQUEST_TIMEOUT_MS / 1e3}s. The Loomio API may be slow or hung; retry after a short wait.`
+  );
+}
+async function fetchWithTimeout(url, options) {
+  const hasCallerSignal = !!options && options.signal !== void 0;
+  const controller = hasCallerSignal ? void 0 : new AbortController();
+  const timer = controller && setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+  timer?.unref();
+  const cleanup = () => {
+    if (timer) clearTimeout(timer);
+  };
+  const opts = controller ? { ...options ?? {}, signal: controller.signal } : options ?? {};
+  try {
+    const res = await fetch(url, opts);
+    return { res, cleanup };
+  } catch (err) {
+    cleanup();
+    if (isAbortError(err)) timeoutError();
+    throw err;
+  }
+}
+async function throwForStatus(res) {
+  if (res.status === 401 || res.status === 403) {
+    const detail = await parseErrorBody(res);
+    throw new LoomioAuthError(
+      `Loomio API returned ${res.status}: ${detail}. Check that LOOMIO_API_KEY is valid and has access to the requested resource.`,
+      res.status
+    );
+  }
+  if (!res.ok) {
+    const msg = await parseErrorBody(res);
+    throw new LoomioApiError(res.status, `Loomio API error ${res.status}: ${msg}`);
+  }
+}
+async function handleResponse(res) {
+  await throwForStatus(res);
+  try {
+    return await res.json();
+  } catch (err) {
+    if (isAbortError(err)) timeoutError();
+    throw err;
+  }
+}
+var B2_AUTH = { field: "api_key", getValue: getApiKey };
+var B3_AUTH = { field: "b3_api_key", getValue: getB3ApiKey };
+function buildUrl(auth, path, params) {
+  const url = new URL(`${baseUrl()}${path}`);
+  if (params) {
+    for (const [key, value] of Object.entries(params)) {
+      if (value !== void 0) {
+        url.searchParams.set(key, String(value));
+      }
+    }
+  }
+  url.searchParams.set(auth.field, auth.getValue());
+  return url.toString();
+}
+async function doFetch(url, options) {
+  const startedAt = Date.now();
+  const method = options?.method ?? "GET";
+  const first = await fetchWithTimeout(url, options);
+  return { ...first, startedAt, method, url };
+}
+async function consumeBody(start, body) {
+  try {
+    return await body();
+  } finally {
+    emitLoomioRequest(start.method, start.url, start.res, Date.now() - start.startedAt);
+  }
+}
+function emitLoomioRequest(method, url, res, durationMs) {
+  let path = "";
+  try {
+    path = redactPath(new URL(url).pathname);
+  } catch {
+    path = "?";
+  }
+  const lenHeader = res.headers.get("content-length");
+  const responseBytes = lenHeader ? Number.parseInt(lenHeader, 10) : 0;
+  logEvent("loomio.request", {
+    method,
+    path,
+    status: res.status,
+    durationMs,
+    responseBytes: Number.isFinite(responseBytes) ? responseBytes : 0
+  });
+}
+async function loomioGet(path, params) {
+  const url = buildUrl(B2_AUTH, path, params);
+  const start = await doFetch(url, { headers: baseHeaders() });
+  try {
+    return await consumeBody(start, () => handleResponse(start.res));
+  } finally {
+    start.cleanup();
+  }
+}
+function encodeForm(body) {
+  const u = new URLSearchParams();
+  for (const [k, v] of Object.entries(body)) {
+    if (v === void 0 || v === null) continue;
+    if (Array.isArray(v)) {
+      for (const item of v) u.append(`${k}[]`, String(item));
+    } else {
+      u.append(k, String(v));
+    }
+  }
+  return u.toString();
+}
+async function loomioPost(path, body, opts = {}) {
+  if (isReadOnly()) throw new LoomioReadOnlyError("POST");
+  const url = buildUrl(B2_AUTH, path, opts.params);
+  const encoding = opts.encoding ?? "json";
+  const start = await doFetch(url, {
+    method: "POST",
+    headers: {
+      ...baseHeaders(),
+      "Content-Type": encoding === "form" ? "application/x-www-form-urlencoded" : "application/json"
+    },
+    body: encoding === "form" ? encodeForm(body) : JSON.stringify(body)
+  });
+  try {
+    return await consumeBody(start, () => handleResponse(start.res));
+  } finally {
+    start.cleanup();
+  }
+}
+async function loomioPostB3(path, params) {
+  if (isReadOnly()) throw new LoomioReadOnlyError("POST");
+  const url = buildUrl(B3_AUTH, path, params);
+  const start = await doFetch(url, {
+    method: "POST",
+    headers: { ...baseHeaders(), "Content-Type": "application/json" },
+    body: "{}"
+  });
+  try {
+    return await consumeBody(start, () => handleResponse(start.res));
+  } finally {
+    start.cleanup();
+  }
+}
+
+// src/auth/provider.ts
+import { createHash, randomBytes, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import {
+  InvalidGrantError,
+  InvalidTargetError,
+  InvalidTokenError
+} from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import {
+  checkResourceAllowed,
+  resourceUrlFromServerUrl
+} from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+
+// src/auth/token.ts
+import { createHmac, timingSafeEqual } from "crypto";
+import { z } from "zod";
+var SignedTokenClaimsSchema = z.object({
+  type: z.enum(["access", "refresh"]),
+  clientId: z.string().min(1),
+  resource: z.string().optional(),
+  scopes: z.array(z.string()),
+  expiresAt: z.number().int(),
+  nonce: z.string().min(1)
+});
+function b64urlEncode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64urlDecode(s) {
+  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
+  return Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
+}
+function sign(payload, key) {
+  return b64urlEncode(createHmac("sha256", key).update(payload).digest());
+}
+function issueToken(claims, signingKey2) {
+  const payloadB64 = b64urlEncode(Buffer.from(JSON.stringify(claims), "utf8"));
+  const sig = sign(payloadB64, signingKey2);
+  return `${payloadB64}.${sig}`;
+}
+var TokenSignatureError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TokenSignatureError";
+  }
+};
+var TokenExpiredError = class extends Error {
+  constructor() {
+    super("token expired");
+    this.name = "TokenExpiredError";
+  }
+};
+function verifyToken(token, signingKey2) {
+  const parts = token.split(".");
+  if (parts.length !== 2) {
+    throw new TokenSignatureError("malformed token");
+  }
+  const [payloadB64, providedSig] = parts;
+  const expectedSig = sign(payloadB64, signingKey2);
+  const a = Buffer.from(providedSig);
+  const b = Buffer.from(expectedSig);
+  if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    throw new TokenSignatureError("invalid signature");
+  }
+  let raw;
+  try {
+    raw = JSON.parse(b64urlDecode(payloadB64).toString("utf8"));
+  } catch {
+    throw new TokenSignatureError("malformed payload");
+  }
+  const parsed = SignedTokenClaimsSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new TokenSignatureError("malformed payload");
+  }
+  const claims = parsed.data;
+  if (claims.expiresAt < Date.now()) {
+    throw new TokenExpiredError();
+  }
+  return claims;
+}
+
+// src/auth/provider.ts
+var ACCESS_TOKEN_TTL_MS = 1 * 24 * 60 * 60 * 1e3;
+var REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var AUTH_CODE_TTL_MS = 5 * 60 * 1e3;
+var AUTH_CODE_MAX_ENTRIES = 1e4;
+var AUTH_CODE_GC_INTERVAL_MS = 60 * 1e3;
+var InMemoryClientsStore = class {
+  clients = /* @__PURE__ */ new Map();
+  getClient(clientId) {
+    return this.clients.get(clientId);
+  }
+  registerClient(client) {
+    const clientId = randomUUID();
+    const full = {
+      ...client,
+      client_id: clientId,
+      client_id_issued_at: Math.floor(Date.now() / 1e3)
+    };
+    this.clients.set(clientId, full);
+    return full;
+  }
+};
+var FixedClientStore = class {
+  client;
+  constructor(args) {
+    if (!args.clientId || args.clientId.length < 1) {
+      throw new Error("FixedClientStore: clientId is required");
+    }
+    if (!args.clientSecret || args.clientSecret.length < 16) {
+      throw new Error("FixedClientStore: clientSecret must be at least 16 chars");
+    }
+    if (!args.redirectUris.length) {
+      throw new Error("FixedClientStore: at least one redirectUri is required");
+    }
+    this.client = {
+      client_id: args.clientId,
+      client_secret: args.clientSecret,
+      client_id_issued_at: Math.floor(Date.now() / 1e3),
+      client_secret_expires_at: 0,
+      redirect_uris: args.redirectUris,
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "client_secret_post",
+      ...args.clientName ? { client_name: args.clientName } : {}
+    };
+  }
+  getClient(clientId) {
+    if (clientId !== this.client.client_id) return void 0;
+    return this.client;
+  }
+};
+var OAuthProvider = class {
+  clientsStore;
+  authCodes = /* @__PURE__ */ new Map();
+  signingKey;
+  resourceUrl;
+  gcTimer;
+  skipLocalPkceValidation = true;
+  constructor(args) {
+    if (!args.signingKey || args.signingKey.length < 16) {
+      throw new Error("OAuthProvider: signing key must be at least 16 chars long");
+    }
+    this.clientsStore = args.clientsStore;
+    this.signingKey = args.signingKey;
+    this.resourceUrl = args.resourceUrl ? resourceUrlFromServerUrl(args.resourceUrl) : void 0;
+    if (args.enableAuthCodeGc ?? true) {
+      this.gcTimer = setInterval(() => this.gcAuthCodes(), AUTH_CODE_GC_INTERVAL_MS);
+      this.gcTimer.unref();
+    }
+  }
+  shutdown() {
+    if (this.gcTimer) clearInterval(this.gcTimer);
+  }
+  async authorize(client, params, res) {
+    const resource = this.resolveResource(params.resource);
+    const code = randomBytes(32).toString("hex");
+    this.authCodes.set(code, {
+      clientId: client.client_id,
+      codeChallenge: params.codeChallenge,
+      redirectUri: params.redirectUri,
+      resource,
+      expiresAt: Date.now() + AUTH_CODE_TTL_MS
+    });
+    this.gcAuthCodes();
+    while (this.authCodes.size > AUTH_CODE_MAX_ENTRIES) {
+      const oldest = this.authCodes.keys().next().value;
+      if (oldest === void 0) break;
+      this.authCodes.delete(oldest);
+    }
+    const url = new URL(params.redirectUri);
+    url.searchParams.set("code", code);
+    if (params.state) url.searchParams.set("state", params.state);
+    res.redirect(url.toString());
+  }
+  async challengeForAuthorizationCode(_client, authorizationCode) {
+    const state = this.authCodes.get(authorizationCode);
+    if (!state || state.expiresAt < Date.now()) {
+      throw new InvalidGrantError("invalid or expired authorization code");
+    }
+    return state.codeChallenge;
+  }
+  async exchangeAuthorizationCode(client, authorizationCode, codeVerifier, redirectUri, resource) {
+    const state = this.authCodes.get(authorizationCode);
+    if (!state || state.expiresAt < Date.now()) {
+      throw new InvalidGrantError("invalid or expired authorization code");
+    }
+    if (state.clientId !== client.client_id) {
+      throw new InvalidGrantError("authorization code was issued to a different client");
+    }
+    if (redirectUri && redirectUri !== state.redirectUri) {
+      throw new InvalidGrantError("redirect_uri mismatch");
+    }
+    if (!codeVerifier) {
+      throw new InvalidGrantError("code_verifier required");
+    }
+    const expected = createHash("sha256").update(codeVerifier).digest("base64url");
+    const expectedBuf = Buffer.from(expected, "utf8");
+    const storedBuf = Buffer.from(state.codeChallenge, "utf8");
+    if (expectedBuf.length !== storedBuf.length || !timingSafeEqual2(expectedBuf, storedBuf)) {
+      throw new InvalidGrantError("code_verifier does not match the challenge");
+    }
+    const requestedResource = this.resolveResource(resource);
+    if (requestedResource && state.resource && requestedResource !== state.resource) {
+      throw new InvalidGrantError("resource mismatch");
+    }
+    this.authCodes.delete(authorizationCode);
+    return this.issueTokenPair(client.client_id, requestedResource ?? state.resource);
+  }
+  async exchangeRefreshToken(client, refreshToken, _scopes, resource) {
+    let claims;
+    try {
+      claims = verifyToken(refreshToken, this.signingKey);
+    } catch (err) {
+      if (err instanceof TokenSignatureError || err instanceof TokenExpiredError) {
+        throw new InvalidGrantError("invalid refresh token");
+      }
+      throw err;
+    }
+    if (claims.type !== "refresh") {
+      throw new InvalidGrantError("not a refresh token");
+    }
+    if (claims.clientId !== client.client_id) {
+      throw new InvalidGrantError("refresh token was issued to a different client");
+    }
+    this.assertClaimsResource(claims, InvalidGrantError);
+    const requestedResource = this.resolveResource(resource);
+    if (requestedResource && claims.resource && requestedResource !== claims.resource) {
+      throw new InvalidGrantError("refresh token resource mismatch");
+    }
+    return this.issueTokenPair(client.client_id, requestedResource ?? claims.resource);
+  }
+  async verifyAccessToken(token) {
+    let claims;
+    try {
+      claims = verifyToken(token, this.signingKey);
+    } catch (err) {
+      if (err instanceof TokenSignatureError) {
+        throw new InvalidTokenError("invalid token");
+      }
+      if (err instanceof TokenExpiredError) {
+        throw new InvalidTokenError("token expired");
+      }
+      throw err;
+    }
+    if (claims.type !== "access") {
+      throw new InvalidTokenError("not an access token");
+    }
+    this.assertClaimsResource(claims, InvalidTokenError);
+    return {
+      token,
+      clientId: claims.clientId,
+      scopes: claims.scopes,
+      expiresAt: Math.floor(claims.expiresAt / 1e3)
+    };
+  }
+  issueTokenPair(clientId, resource) {
+    const now = Date.now();
+    const access = issueToken(
+      {
+        type: "access",
+        clientId,
+        ...resource ? { resource } : {},
+        scopes: [],
+        expiresAt: now + ACCESS_TOKEN_TTL_MS,
+        nonce: randomBytes(8).toString("hex")
+      },
+      this.signingKey
+    );
+    const refresh = issueToken(
+      {
+        type: "refresh",
+        clientId,
+        ...resource ? { resource } : {},
+        scopes: [],
+        expiresAt: now + REFRESH_TOKEN_TTL_MS,
+        nonce: randomBytes(8).toString("hex")
+      },
+      this.signingKey
+    );
+    return {
+      access_token: access,
+      token_type: "Bearer",
+      expires_in: Math.floor(ACCESS_TOKEN_TTL_MS / 1e3),
+      refresh_token: refresh
+    };
+  }
+  resolveResource(requestedResource) {
+    if (!this.resourceUrl) {
+      return requestedResource ? resourceUrlFromServerUrl(requestedResource).href : void 0;
+    }
+    if (!requestedResource) return this.resourceUrl.href;
+    if (!checkResourceAllowed({
+      requestedResource,
+      configuredResource: this.resourceUrl
+    })) {
+      throw new InvalidTargetError(
+        `requested resource is not this MCP server: ${requestedResource.href}`
+      );
+    }
+    return this.resourceUrl.href;
+  }
+  assertClaimsResource(claims, ErrorClass) {
+    if (!this.resourceUrl) return;
+    if (!claims.resource) {
+      throw new ErrorClass("token is missing MCP resource audience");
+    }
+    if (!checkResourceAllowed({
+      requestedResource: claims.resource,
+      configuredResource: this.resourceUrl
+    })) {
+      throw new ErrorClass("token was issued for a different MCP resource");
+    }
+  }
+  gcAuthCodes() {
+    const now = Date.now();
+    for (const [code, state] of this.authCodes.entries()) {
+      if (state.expiresAt < now) this.authCodes.delete(code);
+    }
+  }
+};
+
+// src/http/config.ts
+var DEFAULT_ANTHROPIC_REDIRECT_URIS = [
+  "https://claude.ai/api/mcp/auth_callback",
+  "https://claude.ai/api/oauth/callback",
+  "https://claude.ai/oauth/callback"
+];
+var DEFAULT_MCP_CLIENT_ORIGINS = ["https://claude.ai"];
+function isLocalHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+}
+function isLocalhostUrl(url) {
+  if (!URL.canParse(url)) return false;
+  return isLocalHostname(new URL(url).hostname);
+}
+function selectMode(env = process.env, publicBaseUrl2) {
+  const CLIENT_ID = env["MCP_OAUTH_CLIENT_ID"];
+  const CLIENT_SECRET = env["MCP_OAUTH_CLIENT_SECRET"];
+  const REDIRECT_URIS_ENV = env["MCP_OAUTH_REDIRECT_URIS"];
+  const insecureAutoApprove = env["MCP_OAUTH_INSECURE_AUTO_APPROVE"] === "1" || env["MCP_OAUTH_INSECURE_AUTO_APPROVE"]?.toLowerCase() === "true";
+  if (CLIENT_ID && CLIENT_SECRET) {
+    const redirectUris = REDIRECT_URIS_ENV ? REDIRECT_URIS_ENV.split(",").map((s) => s.trim()).filter(Boolean) : DEFAULT_ANTHROPIC_REDIRECT_URIS;
+    if (!redirectUris.length) {
+      return {
+        error: "MCP_OAUTH_REDIRECT_URIS was set but contained no usable URIs"
+      };
+    }
+    const bad = redirectUris.find((u) => !URL.canParse(u));
+    if (bad) {
+      return {
+        error: `MCP_OAUTH_REDIRECT_URIS contains a malformed URL: ${bad}`
+      };
+    }
+    return {
+      ok: {
+        kind: "static-client",
+        clientId: CLIENT_ID,
+        clientSecret: CLIENT_SECRET,
+        redirectUris
+      }
+    };
+  }
+  if (CLIENT_ID || CLIENT_SECRET) {
+    return {
+      error: "MCP_OAUTH_CLIENT_ID and MCP_OAUTH_CLIENT_SECRET must both be set to enable static-client mode (got only one)."
+    };
+  }
+  if (insecureAutoApprove) {
+    const isLocal = publicBaseUrl2 !== void 0 && isLocalhostUrl(publicBaseUrl2);
+    const acknowledged = env["MCP_OAUTH_I_KNOW_WHAT_IM_DOING"]?.toLowerCase() === "yes";
+    if (!isLocal && !acknowledged) {
+      return {
+        error: "MCP_OAUTH_INSECURE_AUTO_APPROVE is set but PUBLIC_BASE_URL is not a localhost address. This mode lets anyone who can reach the URL register an OAuth client and use the shared Loomio API key; it must not be exposed publicly. Either:\n  - Point PUBLIC_BASE_URL at http://localhost / 127.0.0.1 / ::1 (recommended), or\n  - Set MCP_OAUTH_I_KNOW_WHAT_IM_DOING=yes to acknowledge the risk (only do this on a private network)."
+      };
+    }
+    return { ok: { kind: "insecure-auto-approve" } };
+  }
+  return {
+    error: "No OAuth mode configured. Either:\n  - Set MCP_OAUTH_CLIENT_ID and MCP_OAUTH_CLIENT_SECRET (recommended for public deployments)\n  - Or set MCP_OAUTH_INSECURE_AUTO_APPROVE=1 (only safe for local development or private-network deployments)"
+  };
+}
+function resolveBaseConfig(env = process.env) {
+  const publicBaseUrl2 = env["PUBLIC_BASE_URL"];
+  if (!publicBaseUrl2) {
+    return {
+      error: "PUBLIC_BASE_URL is not set. It must be the public origin of this server (e.g. https://example.run.app), used to build OAuth metadata and authorization redirect URLs."
+    };
+  }
+  if (!URL.canParse(publicBaseUrl2)) {
+    return {
+      error: `PUBLIC_BASE_URL is not a valid URL: ${publicBaseUrl2}`
+    };
+  }
+  const parsedBaseUrl = new URL(publicBaseUrl2);
+  const isLocal = isLocalHostname(parsedBaseUrl.hostname);
+  const isHttps = parsedBaseUrl.protocol === "https:";
+  const isHttpLocal = parsedBaseUrl.protocol === "http:" && isLocal;
+  if (!isHttps && !isHttpLocal) {
+    return {
+      error: `PUBLIC_BASE_URL must be https://\u2026 (or http://localhost for development); got ${parsedBaseUrl.protocol}//${parsedBaseUrl.hostname}.`
+    };
+  }
+  const signingKey2 = env["MCP_OAUTH_SIGNING_KEY"];
+  if (!signingKey2 || signingKey2.length < 16) {
+    return {
+      error: "MCP_OAUTH_SIGNING_KEY must be set and at least 16 chars long. It is the HMAC key used to sign OAuth access tokens; rotating it invalidates all outstanding tokens."
+    };
+  }
+  const portRaw = env["PORT"] ?? "8080";
+  const port2 = Number(portRaw);
+  if (!Number.isInteger(port2) || port2 < 1 || port2 > 65535) {
+    return {
+      error: `PORT must be an integer in 1..65535 (got ${JSON.stringify(portRaw)}).`
+    };
+  }
+  const jsonLimit2 = env["MCP_HTTP_JSON_LIMIT"] ?? "1mb";
+  const allowedOriginsRaw = env["MCP_ALLOWED_ORIGINS"];
+  const extraOrigins = allowedOriginsRaw ? allowedOriginsRaw.split(",").map((s) => s.trim()).filter(Boolean) : [];
+  const parsedExtraOrigins = [];
+  for (const origin of extraOrigins) {
+    if (!URL.canParse(origin)) {
+      return {
+        error: `MCP_ALLOWED_ORIGINS contains a malformed URL: ${origin}`
+      };
+    }
+    const parsedOrigin = new URL(origin);
+    const isAllowedHttps = parsedOrigin.protocol === "https:";
+    const isAllowedHttpLocal = parsedOrigin.protocol === "http:" && isLocalHostname(parsedOrigin.hostname);
+    if (!isAllowedHttps && !isAllowedHttpLocal) {
+      return {
+        error: `MCP_ALLOWED_ORIGINS entries must be https:// origins (or http://localhost for development); got ${parsedOrigin.protocol}//${parsedOrigin.hostname}.`
+      };
+    }
+    parsedExtraOrigins.push(parsedOrigin);
+  }
+  const allowedOrigins = Array.from(
+    /* @__PURE__ */ new Set([
+      parsedBaseUrl.origin,
+      ...DEFAULT_MCP_CLIENT_ORIGINS,
+      ...parsedExtraOrigins.map((origin) => origin.origin)
+    ])
+  );
+  const trustProxyRaw = env["MCP_HTTP_TRUST_PROXY"] ?? "1";
+  const trustProxy2 = Number(trustProxyRaw);
+  if (!Number.isInteger(trustProxy2) || trustProxy2 < 0 || trustProxy2 > 10) {
+    return {
+      error: `MCP_HTTP_TRUST_PROXY must be an integer in 0..10 (got ${JSON.stringify(trustProxyRaw)}). Use 1 for Cloud Run / single-proxy fronts, 2+ for multi-hop ingress, 0 for bare-IP deployments.`
+    };
+  }
+  return {
+    ok: { publicBaseUrl: publicBaseUrl2, signingKey: signingKey2, port: port2, jsonLimit: jsonLimit2, allowedOrigins, trustProxy: trustProxy2 }
+  };
+}
+
+// src/http/app.ts
+import express3 from "express";
+
+// src/icon.ts
+var ICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="loomiomcp">
+  <!-- Placeholder mark: letter L on a tinted circle. Visually neutral \u2014
+       does not reproduce any Loomio trademark. -->
+  <circle cx="32" cy="32" r="28" fill="#2563EB"/>
+  <path d="M22 16 L22 48 L44 48 L44 42 L28 42 L28 16 Z" fill="#FFFFFF"/>
+</svg>`;
+var ICON_DATA_URI = `data:image/svg+xml;base64,${Buffer.from(ICON_SVG, "utf8").toString("base64")}`;
+var ICONS = [
+  {
+    src: ICON_DATA_URI,
+    mimeType: "image/svg+xml",
+    sizes: ["64x64", "any"]
+  }
+];
+
+// src/http/oauth-routes.ts
+import { createHash as createHash2, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import express from "express";
+import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
+function secretDigest(value) {
+  return createHash2("sha256").update(value, "utf8").digest();
+}
+function timingSafeSecretEqual(provided, expected) {
+  return timingSafeEqual3(secretDigest(provided), secretDigest(expected));
+}
+function mountOAuthRoutes(app2, opts) {
+  const { oauthProvider: oauthProvider2, issuerUrl: issuerUrl2, resourceName, mcpResourceUrl: mcpResourceUrl2 } = opts;
+  app2.post("/token", express.urlencoded({ extended: false }), async (req, res, next) => {
+    const sendInvalidClient = (description) => {
+      res.status(401).json({
+        error: "invalid_client",
+        error_description: description
+      });
+    };
+    const body = req.body ?? {};
+    const clientId = typeof body["client_id"] === "string" ? body["client_id"] : void 0;
+    const providedSecret = typeof body["client_secret"] === "string" ? body["client_secret"] : void 0;
+    if (!clientId) {
+      sendInvalidClient("client credentials required");
+      return;
+    }
+    let expected;
+    try {
+      expected = await oauthProvider2.clientsStore.getClient(clientId);
+    } catch {
+      res.status(500).json({
+        error: "server_error",
+        error_description: "client lookup failed"
+      });
+      return;
+    }
+    const expectedSecret = expected && typeof expected.client_secret === "string" && expected.client_secret ? expected.client_secret : "";
+    const secretsMatch = timingSafeSecretEqual(providedSecret ?? "", expectedSecret);
+    if (!expected) {
+      sendInvalidClient("client authentication failed");
+      return;
+    }
+    if (!expectedSecret) {
+      next();
+      return;
+    }
+    const expiresAt = expected.client_secret_expires_at;
+    const secretExpired = typeof expiresAt === "number" && expiresAt !== 0 && expiresAt < Math.floor(Date.now() / 1e3);
+    if (providedSecret === void 0 || !secretsMatch || secretExpired) {
+      sendInvalidClient("client authentication failed");
+      return;
+    }
+    next();
+  });
+  app2.use(
+    mcpAuthRouter({
+      provider: oauthProvider2,
+      issuerUrl: issuerUrl2,
+      scopesSupported: [],
+      resourceName,
+      resourceServerUrl: mcpResourceUrl2
+    })
+  );
+}
+
+// src/http/transport.ts
+import express2 from "express";
+import { ipKeyGenerator, rateLimit } from "express-rate-limit";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { SUPPORTED_PROTOCOL_VERSIONS } from "@modelcontextprotocol/sdk/types.js";
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/server/register-tool.ts
+var READ_PREFIXES = ["search_", "filter_", "get_", "list_", "show_", "run_"];
+function isReadOnlyByName(name) {
+  return READ_PREFIXES.some((p) => name.startsWith(p));
+}
+function isDestructive(name) {
+  return name.startsWith("delete_") || name === "manage_memberships" || name === "deactivate_user";
+}
+function inferAnnotations(name) {
+  const readOnly = isReadOnlyByName(name);
+  return {
+    readOnlyHint: readOnly,
+    destructiveHint: isDestructive(name),
+    idempotentHint: readOnly,
+    openWorldHint: true
+  };
+}
+function argFieldNames(input) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) return [];
+  return Object.keys(input);
+}
+function emitToolCall(opts) {
+  logEvent("tool.call", {
+    tool: opts.tool,
+    ...opts.clientId ? { clientId: opts.clientId } : {},
+    argFields: opts.argFields,
+    durationMs: Date.now() - opts.startedAt,
+    outcome: opts.outcome
+  });
+}
+function wrapAsText(result) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+  };
+}
+function registerTool(server, name, description, schema, handler) {
+  const registerWithSchema = server.registerTool.bind(server);
+  registerWithSchema(
+    name,
+    { description, inputSchema: schema, annotations: inferAnnotations(name) },
+    async (input) => {
+      const startedAt = Date.now();
+      const argFields = argFieldNames(input);
+      const clientId = getRequestContext()?.clientId;
+      try {
+        const result = await handler(input);
+        emitToolCall({ tool: name, clientId, argFields, startedAt, outcome: "success" });
+        return wrapAsText(result);
+      } catch (err) {
+        emitToolCall({ tool: name, clientId, argFields, startedAt, outcome: "error" });
+        throw err;
+      }
+    }
+  );
+}
+
+// src/tools/discussions.ts
+import { z as z3 } from "zod";
+
+// src/tools/_common.ts
+import { z as z2 } from "zod";
+var positiveId = z2.number().int().positive();
+var loomioKey = z2.string().regex(/^[A-Za-z0-9_-]+$/, "Loomio short keys may only contain letters, numbers, _ and -.");
+var idOrKey = z2.union([loomioKey, positiveId]);
+function encodePathSegment(value) {
+  const raw = String(value);
+  if (raw === "" || raw === "." || raw === "..") {
+    throw new Error("id_or_key must be a non-empty Loomio id or short key.");
+  }
+  return encodeURIComponent(raw);
+}
+var PollTypeEnum = z2.enum([
+  "proposal",
+  "poll",
+  "count",
+  "score",
+  "ranked_choice",
+  "meeting",
+  "dot_vote"
+]);
+
+// src/tools/discussions.ts
+var getDiscussionSchema = z3.object({
+  id_or_key: idOrKey.describe(
+    "Discussion id (numeric) or short string key (e.g. 'abcDEF12'). Loomio accepts either."
+  )
+});
+async function getDiscussion(input) {
+  return loomioGet(`/b2/discussions/${encodePathSegment(input.id_or_key)}`);
+}
+var listDiscussionsSchema = z3.object({
+  group_id: positiveId.describe("ID of the Loomio group whose discussions to list (required)."),
+  status: z3.enum(["open", "closed", "all"]).optional().describe(
+    "Filter by status. 'open' = unlocked, 'closed' = locked, 'all' = every kept discussion. Loomio defaults to 'open'."
+  ),
+  limit: z3.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
+  offset: z3.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
+});
+async function listDiscussions(input) {
+  return loomioGet("/b2/discussions", {
+    group_id: input.group_id,
+    ...input.status ? { status: input.status } : {},
+    ...input.limit !== void 0 ? { limit: input.limit } : {},
+    ...input.offset !== void 0 ? { offset: input.offset } : {}
+  });
+}
+var createDiscussionSchema = z3.object({
+  title: z3.string().min(1).describe("Discussion title (required)."),
+  group_id: positiveId.describe("ID of the Loomio group to create the discussion in (required)."),
+  description: z3.string().optional().describe("Optional discussion body."),
+  description_format: z3.enum(["md", "html"]).optional().describe("Format of `description`. Defaults to Loomio's group default when omitted."),
+  private: z3.boolean().optional().describe(
+    "Visibility: true = group members only, false = publicly visible. Loomio's validator enforces this against the group's `discussion_privacy_options`: `public_only` requires `private: false`, `private_only` requires `private: true`, `public_or_private` allows either. When omitted, the connector reads the group's setting and chooses the value Loomio's web UI would pick: `false` for `public_only`, `true` otherwise (matching `Group#discussion_private_default`). Pass an explicit value to override."
+  ),
+  recipient_audience: z3.enum(["group"]).optional().describe("Audience selector for notification recipients. 'group' = notify whole group."),
+  recipient_user_ids: z3.array(positiveId).optional().describe("Explicit list of user IDs to notify."),
+  recipient_emails: z3.array(z3.string().email()).optional().describe("Explicit list of email addresses to notify."),
+  recipient_message: z3.string().optional().describe("Optional custom message to include in notifications.")
+});
+async function resolveDiscussionPrivate(groupId) {
+  try {
+    const resp = await loomioGet(`/v1/groups/${groupId}`);
+    const opts = resp.groups?.[0]?.discussion_privacy_options;
+    return opts !== "public_only";
+  } catch (err) {
+    if ((err instanceof LoomioAuthError || err instanceof LoomioApiError) && err.status === 403) {
+      return true;
+    }
+    throw err;
+  }
+}
+async function createDiscussion(input) {
+  if (isReadOnly()) throw new LoomioReadOnlyError("POST");
+  const priv = input.private !== void 0 ? input.private : await resolveDiscussionPrivate(input.group_id);
+  return loomioPost("/b2/discussions", { ...input, private: priv });
+}
+
+// src/tools/polls.ts
+import { z as z4 } from "zod";
+var getPollSchema = z4.object({
+  id_or_key: idOrKey.describe("Poll id (numeric) or short string key.")
+});
+async function getPoll(input) {
+  return loomioGet(`/b2/polls/${encodePathSegment(input.id_or_key)}`);
+}
+var listPollsSchema = z4.object({
+  group_id: positiveId.describe("ID of the Loomio group whose polls to list (required)."),
+  status: z4.enum(["active", "closed", "all"]).optional().describe("Filter polls by status. Loomio defaults to 'active'."),
+  limit: z4.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
+  offset: z4.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
+});
+async function listPolls(input) {
+  return loomioGet("/b2/polls", {
+    group_id: input.group_id,
+    ...input.status ? { status: input.status } : {},
+    ...input.limit !== void 0 ? { limit: input.limit } : {},
+    ...input.offset !== void 0 ? { offset: input.offset } : {}
+  });
+}
+var createPollSchema = z4.object({
+  title: z4.string().min(1).describe("Poll title (required)."),
+  poll_type: PollTypeEnum.describe(
+    "Poll type. One of: proposal, poll, count, score, ranked_choice, meeting, dot_vote."
+  ),
+  group_id: positiveId.optional().describe(
+    "Group the poll belongs to. Required when not attaching to an existing discussion via discussion_id."
+  ),
+  discussion_id: positiveId.optional().describe(
+    "Attach the poll to an existing discussion. When set, group_id is taken from the discussion."
+  ),
+  details: z4.string().optional().describe("Optional poll body / context."),
+  details_format: z4.enum(["md", "html"]).optional().describe("Format of `details`. Defaults to 'md'."),
+  options: z4.array(z4.string().min(1)).optional().describe(
+    "Voting options. `proposal` has built-in agree/disagree/abstain options; for poll / count / score / ranked_choice / meeting / dot_vote you MUST supply your own."
+  ),
+  closing_at: z4.string().optional().describe("ISO-8601 timestamp at which the poll closes."),
+  specified_voters_only: z4.boolean().optional().describe("If true, only users in recipient_user_ids / recipient_emails can vote."),
+  hide_results: z4.enum(["off", "until_vote", "until_closed"]).optional().describe("Results visibility policy. Defaults to 'off'."),
+  shuffle_options: z4.boolean().optional().describe("If true, shuffle option display order."),
+  anonymous: z4.boolean().optional().describe("If true, hide voter identities."),
+  recipient_audience: z4.enum(["group"]).optional(),
+  notify_on_closing_soon: z4.enum(["nobody", "author", "voters", "undecided_voters", "all_members"]).optional().describe("Who Loomio notifies as the closing date approaches. Defaults to 'nobody'."),
+  recipient_user_ids: z4.array(positiveId).optional(),
+  recipient_emails: z4.array(z4.string().email()).optional(),
+  recipient_message: z4.string().optional(),
+  notify_recipients: z4.boolean().optional().describe("If false, suppress the initial notification email. Defaults to false.")
+}).superRefine((input, ctx) => {
+  if (input.group_id === void 0 && input.discussion_id === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["group_id"],
+      message: "Either group_id or discussion_id is required."
+    });
+  }
+  if (input.poll_type !== "proposal" && !input.options?.length) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["options"],
+      message: "options is required for non-proposal poll types."
+    });
+  }
+});
+async function createPoll(input) {
+  return loomioPost("/b2/polls", input);
+}
+
+// src/tools/memberships.ts
+import { z as z5 } from "zod";
+var listMembershipsSchema = z5.object({
+  group_id: positiveId.describe(
+    "ID of the Loomio group whose memberships to list (required). Caller must be a group admin; the response includes member email addresses."
+  ),
+  limit: z5.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
+  offset: z5.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
+});
+async function listMemberships(input) {
+  return loomioGet("/b2/memberships", {
+    group_id: input.group_id,
+    ...input.limit !== void 0 ? { limit: input.limit } : {},
+    ...input.offset !== void 0 ? { offset: input.offset } : {}
+  });
+}
+var manageMembershipsSchema = z5.object({
+  group_id: positiveId.describe(
+    "ID of the Loomio group to modify (required). Caller must be a group admin."
+  ),
+  emails: z5.array(z5.string().email()).min(1).describe(
+    "Email addresses to ensure are members. Each address that isn't already a member is invited / added."
+  ),
+  remove_absent: z5.boolean().optional().describe(
+    "DANGEROUS. When true, Loomio REMOVES every existing member whose email is NOT in `emails`. Empty-emails (after dedupe) effectively removes the entire group. Default false. Only set true after reading list_memberships and confirming the diff with a human."
+  )
+});
+async function manageMemberships(input) {
+  return loomioPost("/b2/memberships", input);
+}
+
+// src/tools/groups.ts
+import { z as z6 } from "zod";
+var DEFAULT_START_ID = 1;
+var DEFAULT_END_ID = 200;
+var MAX_END_ID = 1e4;
+var MAX_PROBE_SPAN = 500;
+var CONCURRENCY = 5;
+var listGroupsSchema = z6.object({
+  start_id: z6.number().int().min(1).optional().describe("First group_id to probe (inclusive). Defaults to 1."),
+  end_id: z6.number().int().min(1).max(MAX_END_ID).optional().describe(
+    "Last group_id to probe (inclusive). Defaults to 200. A single call may scan at most 500 ids; use multiple calls for wider ranges."
+  ),
+  stop_after_consecutive_misses: z6.number().int().min(1).max(MAX_PROBE_SPAN).optional().describe(
+    "Early-exit heuristic: stop probing after this many consecutive 404/403 misses. Saves wall time on sparse id ranges. Defaults to 50."
+  )
+}).superRefine((input, ctx) => {
+  const start = input.start_id ?? DEFAULT_START_ID;
+  const end = input.end_id ?? DEFAULT_END_ID;
+  if (end < start) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["end_id"],
+      message: "end_id must be greater than or equal to start_id."
+    });
+    return;
+  }
+  if (end - start + 1 > MAX_PROBE_SPAN) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["end_id"],
+      message: `A single list_groups call may scan at most ${MAX_PROBE_SPAN} ids.`
+    });
+  }
+});
+async function probeOne(id) {
+  try {
+    const resp = await loomioGet("/b2/polls", {
+      group_id: id,
+      limit: 1,
+      status: "all"
+    });
+    return { id, groups: resp.groups ?? [] };
+  } catch (err) {
+    if (err instanceof LoomioApiError && err.status === 404) return { id, groups: [] };
+    if (err instanceof LoomioAuthError && err.status === 403) return { id, groups: [] };
+    throw err;
+  }
+}
+function slim(g) {
+  return {
+    id: g.id,
+    key: g.key,
+    handle: g.handle,
+    name: g.name,
+    parent_id: g.parent_id,
+    discussion_privacy_options: g.discussion_privacy_options,
+    is_visible_to_public: g.is_visible_to_public,
+    memberships_count: g.memberships_count
+  };
+}
+async function listGroups(input) {
+  const parsed = listGroupsSchema.parse(input);
+  const start = parsed.start_id ?? DEFAULT_START_ID;
+  const end = parsed.end_id ?? DEFAULT_END_ID;
+  const maxMisses = parsed.stop_after_consecutive_misses ?? 50;
+  const seenIds = /* @__PURE__ */ new Set();
+  const found = [];
+  let consecutiveMisses = 0;
+  let earlyExit = false;
+  let lastScanned = start - 1;
+  for (let batchStart = start; batchStart <= end; batchStart += CONCURRENCY) {
+    const ids = [];
+    for (let id = batchStart; id < batchStart + CONCURRENCY && id <= end; id++) {
+      ids.push(id);
+    }
+    const results = await Promise.all(ids.map((id) => probeOne(id)));
+    for (const r of results) {
+      lastScanned = r.id;
+      if (r.groups.length > 0) {
+        for (const g of r.groups) {
+          if (!seenIds.has(g.id)) {
+            seenIds.add(g.id);
+            found.push(slim(g));
+          }
+        }
+        consecutiveMisses = 0;
+      } else {
+        consecutiveMisses++;
+      }
+    }
+    if (consecutiveMisses >= maxMisses) {
+      earlyExit = true;
+      break;
+    }
+  }
+  return {
+    groups: found,
+    scanned: {
+      from: start,
+      to: lastScanned,
+      stopped_early: earlyExit,
+      total_found: found.length
+    }
+  };
+}
+
+// src/tools/comments.ts
+import { z as z7 } from "zod";
+var createCommentSchema = z7.object({
+  discussion_id: positiveId.describe("ID of the discussion to comment on."),
+  body: z7.string().min(1).describe("Comment body (required)."),
+  body_format: z7.enum(["md", "html"]).optional().describe("Format of `body`. Defaults to Loomio's group default when omitted.")
+});
+async function createComment(input) {
+  const { discussion_id, ...rest } = input;
+  return loomioPost("/b2/comments", rest, {
+    params: { discussion_id },
+    encoding: "form"
+  });
+}
+
+// src/tools/admin.ts
+import { z as z8 } from "zod";
+var deactivateUserSchema = z8.object({
+  id: positiveId.describe("Loomio user id to deactivate. Returns 404 if not active.")
+});
+async function deactivateUser(input) {
+  return loomioPostB3("/b3/users/deactivate", { id: input.id });
+}
+var reactivateUserSchema = z8.object({
+  id: positiveId.describe(
+    "Loomio user id to reactivate. Returns 404 if not currently deactivated."
+  )
+});
+async function reactivateUser(input) {
+  return loomioPostB3("/b3/users/reactivate", { id: input.id });
+}
+
+// src/server.ts
+function createLoomioMcpServer() {
+  const readOnly = isReadOnly();
+  const b3Enabled = hasB3ApiKey();
+  const server = new McpServer({
+    name: "loomiomcp",
+    version: "0.1.0",
+    description: "MCP server for Loomio (loomio.com / self-hosted). Wraps Loomio's b2 public API: read and create discussions, polls, comments, plus list and manage group memberships. Read-only mode supported via LOOMIO_MCP_READONLY=1 (Cloud Run pattern). Optional b3 admin operations (deactivate / reactivate user) when LOOMIO_B3_API_KEY is set \u2014 instance operators only. Read tools annotated with readOnlyHint so MCP clients can auto-approve safe calls; destructive writes (manage_memberships with remove_absent, deactivate_user) carry destructiveHint.",
+    websiteUrl: "https://github.com/soil-dev/loomiomcp",
+    icons: ICONS
+  });
+  registerTool(
+    server,
+    "get_discussion",
+    "Fetch a single Loomio discussion (thread) by id or short string key. Returns the full record \u2014 title, description, group, author, ranges/last-activity timestamps, and embedded users \u2014 in one round-trip. Use for 'show me discussion X', 'what's in thread Y', or to resolve an id_or_key referenced by another tool's output. To enumerate a group's discussions instead of fetching one, use list_discussions.",
+    getDiscussionSchema,
+    getDiscussion
+  );
+  registerTool(
+    server,
+    "list_discussions",
+    "List discussions in a Loomio group, ordered by latest activity. Required: `group_id`. Optional `status` filter \u2014 'open' (unlocked, default), 'closed' (locked), 'all' (every kept thread); `limit` 1-200 (Loomio default 50); `offset` for pagination. Caller must be a group member. Use to answer 'what's being discussed in group X', 'show me recent threads', or before create_discussion to check for duplicates. For one specific thread, use get_discussion.",
+    listDiscussionsSchema,
+    listDiscussions
+  );
+  if (!readOnly) {
+    registerTool(
+      server,
+      "create_discussion",
+      "Create a new Loomio discussion (thread) in a group. Required: `title`, `group_id`. The `private` field is auto-resolved from the group's `discussion_privacy_options` when omitted (matches Loomio's web UI default \u2014 public_only \u2192 false, anything else \u2192 true); pass it explicitly to override. Optional `description` + `description_format` ('md' / 'html') set the body. Notification recipients can be specified via `recipient_audience: 'group'` (notify all members), `recipient_user_ids` (explicit user ids), or `recipient_emails` (invite new people), optionally with a `recipient_message`. Caller must be allowed to start discussions in the group.",
+      createDiscussionSchema,
+      createDiscussion
+    );
+  }
+  registerTool(
+    server,
+    "get_poll",
+    "Fetch a single Loomio poll (proposal / vote / multi-choice / score / ranked_choice / meeting / dot_vote) by id or short string key. Returns the poll record \u2014 title, type, options, closing state, voter visibility settings, and embedded author. Use for 'show me poll X', 'what's the result of Y', or to follow up on a poll id referenced elsewhere. To enumerate a group's polls, use list_polls.",
+    getPollSchema,
+    getPoll
+  );
+  registerTool(
+    server,
+    "list_polls",
+    "List polls in a Loomio group, ordered by creation date (newest first). Required: `group_id`. Optional `status` filter \u2014 'active' (default), 'closed', 'all' (every kept poll); `limit` 1-200 (default 50); `offset` for pagination. Caller must be a group member. Use to answer 'what's up for vote in group X', 'show me past poll results', or before create_poll to check what's already proposed.",
+    listPollsSchema,
+    listPolls
+  );
+  if (!readOnly) {
+    registerTool(
+      server,
+      "create_poll",
+      "Create a new Loomio poll. Required: `title`, `poll_type` \u2014 one of 'proposal' (built-in agree / disagree / abstain), 'poll' (single-choice), 'count' (count signers), 'score' (1-5 rating, configurable via min_score / max_score), 'ranked_choice' (STV), 'meeting' (time poll), 'dot_vote' (point allocation, see dots_per_person). For every type except 'proposal' you MUST supply `options` (array of strings). Either supply `group_id` for a standalone poll or `discussion_id` to attach to an existing thread. Optional: `details` + `details_format`, `closing_at` (ISO-8601), `anonymous`, `hide_results` ('off' / 'until_vote' / 'until_closed'), `specified_voters_only`, `shuffle_options`, `notify_on_closing_soon`, recipient fields. KNOWN UPSTREAM LIMITATION: Loomio's b2 `permitted_params` omits `:private`, so the auto-created Topic always defaults to `private: true` and groups with public-discussions-only policy reject the create with a 422 and empty errors hash. See NOTES-ON-LOOMIO-API.md. Workaround at the moment: create polls only in groups that allow private discussions.",
+      createPollSchema,
+      createPoll
+    );
+  }
+  registerTool(
+    server,
+    "list_memberships",
+    "List members of a Loomio group with their email addresses, roles, and join state. Required: `group_id`. Caller MUST be a group admin (non-admins get HTTP 403; the response is server-side scoped to include `include_email: true`). Optional `limit` 1-200 (default 50) and `offset` for pagination. Use to answer 'who's in group X', 'find a member by email', or \u2014 critically \u2014 BEFORE calling manage_memberships with remove_absent=true, since the diff between current and intended members is what makes that destructive call safe.",
+    listMembershipsSchema,
+    listMemberships
+  );
+  registerTool(
+    server,
+    "list_groups",
+    "List groups the connector's api-key user can see, by probing a group_id range. Loomio's API has no native 'list groups' endpoint that honours api-key auth (v1's profile/groups needs a session; the v1 explore endpoint returns only public groups). This tool works around that by issuing one `b2/polls?group_id=N&limit=1&status=all` per id and collecting the group objects from the 200 responses \u2014 404s skipped, 403s treated as soft misses. Scope: returns every group the bot is a **member** of (plus their parent groups, which b2/polls embeds in the response). Bot users with `is_admin: true` bypass the membership check and see every group on the instance. Optional knobs: `start_id` (default 1), `end_id` (default 200; a single call may scan at most 500 ids), `stop_after_consecutive_misses` (default 50; early-exit on sparse id ranges). Caveat: this is the right tool to answer 'what groups can you see' and similar discovery questions, but it costs O(end_id - start_id) outbound calls \u2014 typically ~50\u2013200 HTTP requests in 2\u20135 seconds. The returned group objects are slimmed to `{id, key, handle, name, parent_id, discussion_privacy_options, is_visible_to_public, memberships_count}`; to drill in, use `list_memberships`, `list_discussions`, `list_polls` with the relevant id.",
+    listGroupsSchema,
+    listGroups
+  );
+  if (!readOnly) {
+    registerTool(
+      server,
+      "manage_memberships",
+      "Invite users to a Loomio group by email and (optionally) REMOVE members not in the supplied list. Required: `group_id` (caller must be a group admin), `emails` (array of email addresses). Default mode is additive: every address in `emails` that isn't already a member is invited / added; no existing member is touched. DANGEROUS OPTION \u2014 `remove_absent: true`: Loomio REMOVES every existing group member whose email is NOT in `emails`. The zero-or-stale-emails case can wipe the entire group. There is no server-side dry-run and no undo. ALWAYS call list_memberships first, compute the diff explicitly, and confirm with a human before invoking with remove_absent=true. Returns `{added_emails: [...], removed_emails: [...]}` listing exactly what changed.",
+      manageMembershipsSchema,
+      manageMemberships
+    );
+  }
+  if (!readOnly) {
+    registerTool(
+      server,
+      "create_comment",
+      "Post a comment (reply) on an existing Loomio discussion. Required: `discussion_id`, `body`. Optional `body_format` ('md' or 'html'; defaults to the group's setting). Caller must be permitted to post in the discussion's group. Use for 'reply to thread X', 'add a follow-up to discussion Y', or to chain a series of automated updates. For starting a new thread instead, use create_discussion.",
+      createCommentSchema,
+      createComment
+    );
+  }
+  if (b3Enabled && !readOnly) {
+    registerTool(
+      server,
+      "deactivate_user",
+      "INSTANCE-ADMIN. Deactivate a Loomio user account instance-wide by user id. Required: `id` (numeric Loomio user id). Authenticates using `LOOMIO_B3_API_KEY` (matched against `ENV['B3_API_KEY']` on the Loomio server; \u226517 chars). This secret authenticates the SERVER, not the calling user \u2014 only set LOOMIO_B3_API_KEY if you operate the Loomio instance and have already deployed loomiomcp in a single-tenant context. Schedules an async DeactivateUserWorker that revokes sessions, memberships, and email subscriptions. Reversible via reactivate_user as long as the user record persists. Returns 404 if the user is not currently active.",
+      deactivateUserSchema,
+      deactivateUser
+    );
+    registerTool(
+      server,
+      "reactivate_user",
+      "INSTANCE-ADMIN. Reactivate a previously-deactivated Loomio user by id. Required: `id`. Authenticates with LOOMIO_B3_API_KEY (server-instance admin secret \u2014 see deactivate_user). Restores the user's ability to log in, but does NOT restore prior memberships or subscriptions; those must be re-applied separately. Returns 404 if the user is not currently deactivated.",
+      reactivateUserSchema,
+      reactivateUser
+    );
+  }
+  return server;
+}
+
+// src/http/transport.ts
+var DEFAULT_MCP_RATE_LIMIT_WINDOW_MS = 6e4;
+var DEFAULT_MCP_RATE_LIMIT_MAX = 600;
+var MAX_MEMORY_STORE_WINDOW_MS = 2 ** 31 - 1;
+function resolveMcpRateLimitConfig() {
+  const windowMs = Math.min(
+    readPositiveInt("MCP_HTTP_RATE_LIMIT_WINDOW_MS", DEFAULT_MCP_RATE_LIMIT_WINDOW_MS),
+    MAX_MEMORY_STORE_WINDOW_MS
+  );
+  return {
+    windowMs,
+    limit: readPositiveInt("MCP_HTTP_RATE_LIMIT_MAX", DEFAULT_MCP_RATE_LIMIT_MAX),
+    disabled: process.env["MCP_HTTP_RATE_LIMIT_DISABLED"] === "1"
+  };
+}
+function mountTransport(app2, opts) {
+  const { oauthProvider: oauthProvider2, mcpResourceUrl: mcpResourceUrl2, jsonLimit: jsonLimit2, allowedOrigins } = opts;
+  const mcpResourceMetadataUrl = getOAuthProtectedResourceMetadataUrl(mcpResourceUrl2);
+  const guardOrigin = (req, res, next) => {
+    const origin = req.get("Origin");
+    if (!origin) {
+      next();
+      return;
+    }
+    let normalizedOrigin;
+    try {
+      normalizedOrigin = new URL(origin).origin;
+    } catch {
+      res.status(403).json({
+        jsonrpc: "2.0",
+        error: { code: -32e3, message: "Invalid Origin header" },
+        id: null
+      });
+      return;
+    }
+    if (!allowedOrigins.includes(normalizedOrigin)) {
+      res.status(403).json({
+        jsonrpc: "2.0",
+        error: { code: -32e3, message: "Origin is not allowed" },
+        id: null
+      });
+      return;
+    }
+    next();
+  };
+  const {
+    windowMs: rateLimitWindowMs,
+    limit: rateLimitMax,
+    disabled: rateLimitDisabled
+  } = resolveMcpRateLimitConfig();
+  const mcpRateLimit = rateLimit({
+    windowMs: rateLimitWindowMs,
+    limit: rateLimitMax,
+    standardHeaders: "draft-7",
+    legacyHeaders: false,
+    keyGenerator: (req) => {
+      const clientId = req.auth?.clientId;
+      if (clientId) return clientId;
+      return ipKeyGenerator(req.ip ?? "");
+    },
+    skip: () => rateLimitDisabled,
+    handler: (_req, res) => {
+      res.status(429).json({
+        jsonrpc: "2.0",
+        error: { code: -32e3, message: "Too Many Requests" },
+        id: null
+      });
+    }
+  });
+  const guardProtocolVersion = (req, res, next) => {
+    const protocolVersion = req.get("MCP-Protocol-Version");
+    if (protocolVersion && !SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {
+      res.status(400).json({
+        jsonrpc: "2.0",
+        error: {
+          code: -32e3,
+          message: `Bad Request: Unsupported protocol version: ${protocolVersion}`
+        },
+        id: null
+      });
+      return;
+    }
+    next();
+  };
+  app2.post(
+    "/mcp",
+    guardOrigin,
+    requireBearerAuth({
+      verifier: oauthProvider2,
+      resourceMetadataUrl: mcpResourceMetadataUrl
+    }),
+    mcpRateLimit,
+    guardProtocolVersion,
+    express2.json({ limit: jsonLimit2 }),
+    async (req, res) => {
+      try {
+        const clientId = req.auth?.clientId;
+        const server = createLoomioMcpServer();
+        const transport = new StreamableHTTPServerTransport({});
+        res.on("close", () => {
+          void transport.close();
+          void server.close();
+        });
+        await withRequestContext({ clientId }, async () => {
+          await server.connect(transport);
+          await transport.handleRequest(req, res, req.body);
+        });
+      } catch (err) {
+        const name = err instanceof Error ? err.name : typeof err;
+        const status = err && typeof err === "object" && "status" in err ? Number(err.status) : void 0;
+        const summary = status !== void 0 ? `${name} ${status}` : name;
+        if (process.env["MCP_HTTP_DEBUG"] === "1") {
+          const message = err instanceof Error ? err.message : String(err);
+          console.error(`[loomiomcp] /mcp error: ${summary} \u2014 ${message}`);
+        } else {
+          console.error(`[loomiomcp] /mcp error: ${summary}`);
+        }
+        if (!res.headersSent) {
+          res.status(500).json({ error: "internal_error" });
+        }
+      }
+    }
+  );
+  const methodNotAllowed = (_req, res) => {
+    res.set("Allow", "POST").status(405).json({
+      error: "method_not_allowed",
+      message: "Use POST for MCP requests; this server runs in stateless mode."
+    });
+  };
+  app2.get(
+    "/mcp",
+    guardOrigin,
+    requireBearerAuth({
+      verifier: oauthProvider2,
+      resourceMetadataUrl: mcpResourceMetadataUrl
+    }),
+    mcpRateLimit,
+    guardProtocolVersion,
+    methodNotAllowed
+  );
+  app2.delete(
+    "/mcp",
+    guardOrigin,
+    requireBearerAuth({
+      verifier: oauthProvider2,
+      resourceMetadataUrl: mcpResourceMetadataUrl
+    }),
+    mcpRateLimit,
+    guardProtocolVersion,
+    methodNotAllowed
+  );
+}
+
+// src/http/app.ts
+function createApp(opts) {
+  const { oauthProvider: oauthProvider2, issuerUrl: issuerUrl2, jsonLimit: jsonLimit2, allowedOrigins } = opts;
+  const resourceName = opts.resourceName ?? "Loomio MCP";
+  const trustProxy2 = opts.trustProxy ?? 1;
+  const mcpResourceUrl2 = new URL("/mcp", issuerUrl2);
+  const app2 = express3();
+  app2.set("trust proxy", trustProxy2);
+  mountOAuthRoutes(app2, {
+    oauthProvider: oauthProvider2,
+    issuerUrl: issuerUrl2,
+    resourceName,
+    mcpResourceUrl: mcpResourceUrl2
+  });
+  const iconHandler = (_req, res) => {
+    res.set("Content-Type", "image/svg+xml").set("Cache-Control", "public, max-age=86400").send(ICON_SVG);
+  };
+  app2.get("/icon.svg", iconHandler);
+  app2.get("/favicon.ico", iconHandler);
+  mountTransport(app2, {
+    oauthProvider: oauthProvider2,
+    mcpResourceUrl: mcpResourceUrl2,
+    jsonLimit: jsonLimit2,
+    allowedOrigins
+  });
+  return app2;
+}
+
+// src/http.ts
+function fatal(message) {
+  console.error(`[loomiomcp] FATAL: ${message}`);
+  process.exit(1);
+}
+if (!process.env["LOOMIO_API_KEY"]) {
+  fatal(
+    "LOOMIO_API_KEY environment variable is not set. Generate one in Loomio under your profile \u2192 API keys."
+  );
+}
+var baseResult = resolveBaseConfig();
+if ("error" in baseResult) fatal(baseResult.error);
+var { publicBaseUrl, signingKey, port, jsonLimit, trustProxy } = baseResult.ok;
+var modeResult = selectMode(process.env, publicBaseUrl);
+if ("error" in modeResult) fatal(modeResult.error);
+var mode = modeResult.ok;
+var issuerUrl = new URL(publicBaseUrl);
+var mcpResourceUrl = new URL("/mcp", issuerUrl);
+var oauthProvider = mode.kind === "static-client" ? new OAuthProvider({
+  clientsStore: new FixedClientStore({
+    clientId: mode.clientId,
+    clientSecret: mode.clientSecret,
+    redirectUris: mode.redirectUris,
+    clientName: "loomiomcp pre-registered client"
+  }),
+  signingKey,
+  resourceUrl: mcpResourceUrl
+}) : new OAuthProvider({
+  clientsStore: new InMemoryClientsStore(),
+  signingKey,
+  resourceUrl: mcpResourceUrl
+});
+var app = createApp({
+  oauthProvider,
+  issuerUrl,
+  jsonLimit,
+  allowedOrigins: baseResult.ok.allowedOrigins,
+  trustProxy
+});
+app.listen(port, () => {
+  const readMode = isReadOnly() ? "read-only" : "read-write";
+  const authLabel = mode.kind === "static-client" ? "static-client" : "INSECURE_AUTO_APPROVE";
+  console.log(
+    `[loomiomcp] HTTP server listening on :${port} | mode=${readMode} | auth=${authLabel} | issuer=${issuerUrl}`
+  );
+  if (mode.kind === "insecure-auto-approve") {
+    console.warn(
+      "[loomiomcp] WARNING: auth mode is INSECURE_AUTO_APPROVE. Anyone who can reach this URL can register a client and use the configured Loomio API key. Suitable only for local development or private-network deployments."
+    );
+  }
+});