loomiomcp 0.0.6 → 0.0.9

package/README.md

@@ -13,7 +13,7 @@ analyse member activity — in plain English. Targets Loomio's **b2** API
 [/help/api2](https://www.loomio.com/help/api2) and the namespace where
 the controllers actually live in the open-source repo.
 
-Tools (b2, per-user `?api_key=`):
+Tools (b2, per-user API key):
 
 - `get_discussion(id_or_key)` — fetch one discussion
 - `list_discussions(group_id, status?, limit?, offset?)` — list a group's discussions
@@ -45,7 +45,7 @@ Tools (b2, per-user `?api_key=`):
   `remove_absent`.
 - `create_comment(discussion_id, body, body_format?)` — reply on a discussion
 
-Opt-in admin tools (b3, server-instance secret `?b3_api_key=`):
+Opt-in admin tools (b3, server-instance secret):
 
 Set `LOOMIO_B3_API_KEY` to enable. Only useful for Loomio instance operators.
 
@@ -67,13 +67,23 @@ See DEPLOY.md for Cloud Run.
 
 ## Auth
 
-Loomio's b2 API authenticates by API key passed as a `?api_key=…` query
-parameter. The connector injects it server-side; it never reaches the
-MCP client. Generate one in Loomio under your profile → API keys.
+Loomio authenticates by API key sent in an HTTP bearer header:
 
-The optional b3 admin namespace uses a different secret (`?b3_api_key=…`,
-validated against `ENV['B3_API_KEY']` on the Loomio server, >16 chars).
-Only relevant if you operate a Loomio instance.
+```text
+Authorization: Bearer <API_KEY>
+```
+
+The connector injects it server-side; it never reaches the MCP client.
+Generate one in Loomio under your profile → API keys.
+
+Keys passed in the query string (`?api_key=…`) are **rejected** — Loomio
+removed that scheme in July 2026 because URLs are retained in browser
+history, proxy logs, and monitoring systems. A request carrying its key
+that way is treated as unauthenticated and 403s.
+
+The optional b3 admin namespace uses the same bearer header with a
+different secret (validated against `ENV['B3_API_KEY']` on the Loomio
+server, >16 chars). Only relevant if you operate a Loomio instance.
 
 ## Read-only mode
 

package/dist/http.js

@@ -213,9 +213,9 @@ async function handleResponse(res) {
     throw err;
   }
 }
-var B2_AUTH = { field: "api_key", getValue: getApiKey };
-var B3_AUTH = { field: "b3_api_key", getValue: getB3ApiKey };
-function buildUrl(auth, path, params) {
+var B2_AUTH = getApiKey;
+var B3_AUTH = getB3ApiKey;
+function buildUrl(path, params) {
   const url = new URL(`${baseUrl()}${path}`);
   if (params) {
     for (const [key, value] of Object.entries(params)) {
@@ -224,9 +224,14 @@ function buildUrl(auth, path, params) {
       }
     }
   }
-  url.searchParams.set(auth.field, auth.getValue());
   return url.toString();
 }
+function authHeaders(auth) {
+  return {
+    ...baseHeaders(),
+    Authorization: `Bearer ${auth()}`
+  };
+}
 async function doFetch(url, options) {
   const startedAt = Date.now();
   const method = options?.method ?? "GET";
@@ -258,8 +263,8 @@ function emitLoomioRequest(method, url, res, durationMs) {
   });
 }
 async function loomioGet(path, params) {
-  const url = buildUrl(B2_AUTH, path, params);
-  const start = await doFetch(url, { headers: baseHeaders() });
+  const url = buildUrl(path, params);
+  const start = await doFetch(url, { headers: authHeaders(B2_AUTH) });
   try {
     return await consumeBody(start, () => handleResponse(start.res));
   } finally {
@@ -267,8 +272,8 @@ async function loomioGet(path, params) {
   }
 }
 async function loomioGetStatus(path, params) {
-  const url = buildUrl(B2_AUTH, path, params);
-  const start = await doFetch(url, { headers: baseHeaders() });
+  const url = buildUrl(path, params);
+  const start = await doFetch(url, { headers: authHeaders(B2_AUTH) });
   try {
     return await consumeBody(start, async () => {
       try {
@@ -295,12 +300,12 @@ function encodeForm(body) {
 }
 async function loomioPost(path, body, opts = {}) {
   if (isReadOnly()) throw new LoomioReadOnlyError("POST");
-  const url = buildUrl(B2_AUTH, path, opts.params);
+  const url = buildUrl(path, opts.params);
   const encoding = opts.encoding ?? "json";
   const start = await doFetch(url, {
     method: "POST",
     headers: {
-      ...baseHeaders(),
+      ...authHeaders(B2_AUTH),
       "Content-Type": encoding === "form" ? "application/x-www-form-urlencoded" : "application/json"
     },
     body: encoding === "form" ? encodeForm(body) : JSON.stringify(body)
@@ -313,10 +318,10 @@ async function loomioPost(path, body, opts = {}) {
 }
 async function loomioPostB3(path, params) {
   if (isReadOnly()) throw new LoomioReadOnlyError("POST");
-  const url = buildUrl(B3_AUTH, path, params);
+  const url = buildUrl(path, params);
   const start = await doFetch(url, {
     method: "POST",
-    headers: { ...baseHeaders(), "Content-Type": "application/json" },
+    headers: { ...authHeaders(B3_AUTH), "Content-Type": "application/json" },
     body: "{}"
   });
   try {
@@ -327,7 +332,8 @@ async function loomioPostB3(path, params) {
 }
 
 // src/auth/provider.ts
-import { createHash, randomBytes, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash, createHmac as createHmac2, randomBytes, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { z as z2 } from "zod";
 import {
   InvalidGrantError,
   InvalidTargetError,
@@ -376,6 +382,28 @@ var TokenExpiredError = class extends Error {
     this.name = "TokenExpiredError";
   }
 };
+function signData(obj, signingKey2) {
+  const payloadB64 = b64urlEncode(Buffer.from(JSON.stringify(obj), "utf8"));
+  return `${payloadB64}.${sign(payloadB64, signingKey2)}`;
+}
+function verifyData(blob, signingKey2) {
+  const parts = blob.split(".");
+  if (parts.length !== 2) {
+    throw new TokenSignatureError("malformed signed blob");
+  }
+  const [payloadB64, providedSig] = parts;
+  const expectedSig = sign(payloadB64, signingKey2);
+  const a = Buffer.from(providedSig);
+  const b = Buffer.from(expectedSig);
+  if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    throw new TokenSignatureError("invalid signature");
+  }
+  try {
+    return JSON.parse(b64urlDecode(payloadB64).toString("utf8"));
+  } catch {
+    throw new TokenSignatureError("malformed payload");
+  }
+}
 function verifyToken(token, signingKey2) {
   const parts = token.split(".");
   if (parts.length !== 2) {
@@ -411,20 +439,96 @@ var REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var AUTH_CODE_TTL_MS = 5 * 60 * 1e3;
 var AUTH_CODE_MAX_ENTRIES = 1e4;
 var AUTH_CODE_GC_INTERVAL_MS = 60 * 1e3;
-var InMemoryClientsStore = class {
-  clients = /* @__PURE__ */ new Map();
+var StatelessClientClaimsSchema = z2.object({
+  k: z2.literal("client"),
+  redirect_uris: z2.array(z2.string()).min(1),
+  grant_types: z2.array(z2.string()).optional(),
+  response_types: z2.array(z2.string()).optional(),
+  token_endpoint_auth_method: z2.string().optional(),
+  scope: z2.string().optional(),
+  client_name: z2.string().optional(),
+  iat: z2.number().int()
+});
+var DEFAULT_GRANT_TYPES = ["authorization_code", "refresh_token"];
+var DEFAULT_RESPONSE_TYPES = ["code"];
+var DEFAULT_AUTH_METHOD = "client_secret_post";
+var MAX_SIGNED_CLIENT_ID_BYTES = 16384;
+var StatelessClientsStore = class {
+  signingKey;
+  constructor(signingKey2) {
+    if (!signingKey2 || signingKey2.length < 16) {
+      throw new Error("StatelessClientsStore: signing key must be at least 16 chars");
+    }
+    this.signingKey = signingKey2;
+  }
+  // Deterministic per-client secret for confidential clients: any instance
+  // recomputes the same value, so client_secret_post auth works without
+  // storing the secret.
+  deriveSecret(clientId) {
+    return createHmac2("sha256", this.signingKey).update(`client_secret:${clientId}`).digest("base64url");
+  }
+  reconstruct(clientId, c) {
+    const authMethod = c.token_endpoint_auth_method ?? DEFAULT_AUTH_METHOD;
+    const isPublicClient = authMethod === "none";
+    return {
+      client_id: clientId,
+      client_id_issued_at: c.iat,
+      redirect_uris: c.redirect_uris,
+      grant_types: c.grant_types ?? DEFAULT_GRANT_TYPES,
+      response_types: c.response_types ?? DEFAULT_RESPONSE_TYPES,
+      token_endpoint_auth_method: authMethod,
+      ...isPublicClient ? {} : {
+        client_secret: this.deriveSecret(clientId),
+        client_secret_expires_at: 0
+        // never expires — there's nothing to rotate per-client
+      },
+      ...c.scope ? { scope: c.scope } : {},
+      ...c.client_name ? { client_name: c.client_name } : {}
+    };
+  }
   getClient(clientId) {
-    return this.clients.get(clientId);
+    if (Buffer.byteLength(clientId, "utf8") > MAX_SIGNED_CLIENT_ID_BYTES) return void 0;
+    let raw;
+    try {
+      raw = verifyData(clientId, this.signingKey);
+    } catch {
+      return void 0;
+    }
+    const parsed = StatelessClientClaimsSchema.safeParse(raw);
+    if (!parsed.success) return void 0;
+    return this.reconstruct(clientId, parsed.data);
   }
   registerClient(client) {
-    const clientId = randomUUID();
-    const full = {
+    const iat = Math.floor(Date.now() / 1e3);
+    const redirectUris = client.redirect_uris ?? [];
+    const authMethod = client.token_endpoint_auth_method ?? DEFAULT_AUTH_METHOD;
+    const isPublicClient = authMethod === "none";
+    const clientId = signData(
+      {
+        k: "client",
+        redirect_uris: redirectUris,
+        grant_types: client.grant_types ?? DEFAULT_GRANT_TYPES,
+        response_types: client.response_types ?? DEFAULT_RESPONSE_TYPES,
+        token_endpoint_auth_method: authMethod,
+        ...client.scope ? { scope: client.scope } : {},
+        ...client.client_name ? { client_name: client.client_name } : {},
+        iat
+      },
+      this.signingKey
+    );
+    return {
       ...client,
       client_id: clientId,
-      client_id_issued_at: Math.floor(Date.now() / 1e3)
+      client_id_issued_at: iat,
+      redirect_uris: redirectUris,
+      grant_types: client.grant_types ?? DEFAULT_GRANT_TYPES,
+      response_types: client.response_types ?? DEFAULT_RESPONSE_TYPES,
+      token_endpoint_auth_method: authMethod,
+      ...isPublicClient ? {} : {
+        client_secret: this.deriveSecret(clientId),
+        client_secret_expires_at: 0
+      }
     };
-    this.clients.set(clientId, full);
-    return full;
   }
 };
 var FixedClientStore = class {
@@ -931,14 +1035,14 @@ function registerTool(server, name, description, schema, handler) {
 }
 
 // src/tools/discussions.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // src/tools/_common.ts
-import { z as z2 } from "zod";
-var positiveId = z2.number().int().positive();
-var loomioKey = z2.string().regex(/^[A-Za-z0-9_-]+$/, "Loomio short keys may only contain letters, numbers, _ and -.");
-var idOrKey = z2.union([loomioKey, positiveId]);
-var isoTimestamp = z2.string().refine((v) => !Number.isNaN(Date.parse(v)), {
+import { z as z3 } from "zod";
+var positiveId = z3.number().int().positive();
+var loomioKey = z3.string().regex(/^[A-Za-z0-9_-]+$/, "Loomio short keys may only contain letters, numbers, _ and -.");
+var idOrKey = z3.union([loomioKey, positiveId]);
+var isoTimestamp = z3.string().refine((v) => !Number.isNaN(Date.parse(v)), {
   message: "must be a parseable ISO-8601 timestamp (e.g. 2026-01-31 or 2026-01-31T00:00:00Z)."
 }).optional();
 function encodePathSegment(value) {
@@ -948,7 +1052,7 @@ function encodePathSegment(value) {
   }
   return encodeURIComponent(raw);
 }
-var PollTypeEnum = z2.enum([
+var PollTypeEnum = z3.enum([
   "proposal",
   "poll",
   "count",
@@ -959,7 +1063,7 @@ var PollTypeEnum = z2.enum([
 ]);
 
 // src/tools/discussions.ts
-var getDiscussionSchema = z3.object({
+var getDiscussionSchema = z4.object({
   id_or_key: idOrKey.describe(
     "Discussion id (numeric) or short string key (e.g. 'abcDEF12'). Loomio accepts either."
   )
@@ -967,13 +1071,13 @@ var getDiscussionSchema = z3.object({
 async function getDiscussion(input) {
   return loomioGet(`/b2/discussions/${encodePathSegment(input.id_or_key)}`);
 }
-var listDiscussionsSchema = z3.object({
+var listDiscussionsSchema = z4.object({
   group_id: positiveId.describe("ID of the Loomio group whose discussions to list (required)."),
-  status: z3.enum(["open", "closed", "all"]).optional().describe(
+  status: z4.enum(["open", "closed", "all"]).optional().describe(
     "Filter by status. 'open' = unlocked, 'closed' = locked, 'all' = every kept discussion. Loomio defaults to 'open'."
   ),
-  limit: z3.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
-  offset: z3.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
+  limit: z4.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
+  offset: z4.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
 });
 async function listDiscussions(input) {
   return loomioGet("/b2/discussions", {
@@ -983,18 +1087,18 @@ async function listDiscussions(input) {
     ...input.offset !== void 0 ? { offset: input.offset } : {}
   });
 }
-var createDiscussionSchema = z3.object({
-  title: z3.string().min(1).describe("Discussion title (required)."),
+var createDiscussionSchema = z4.object({
+  title: z4.string().min(1).describe("Discussion title (required)."),
   group_id: positiveId.describe("ID of the Loomio group to create the discussion in (required)."),
-  description: z3.string().optional().describe("Optional discussion body."),
-  description_format: z3.enum(["md", "html"]).optional().describe("Format of `description`. Defaults to Loomio's group default when omitted."),
-  private: z3.boolean().optional().describe(
+  description: z4.string().optional().describe("Optional discussion body."),
+  description_format: z4.enum(["md", "html"]).optional().describe("Format of `description`. Defaults to Loomio's group default when omitted."),
+  private: z4.boolean().optional().describe(
     "Visibility: true = group members only, false = publicly visible. Loomio's validator enforces this against the group's `discussion_privacy_options`: `public_only` requires `private: false`, `private_only` requires `private: true`, `public_or_private` allows either. When omitted, the connector reads the group's setting and chooses the value Loomio's web UI would pick: `false` for `public_only`, `true` otherwise (matching `Group#discussion_private_default`). Pass an explicit value to override."
   ),
-  recipient_audience: z3.enum(["group"]).optional().describe("Audience selector for notification recipients. 'group' = notify whole group."),
-  recipient_user_ids: z3.array(positiveId).optional().describe("Explicit list of user IDs to notify."),
-  recipient_emails: z3.array(z3.string().email()).optional().describe("Explicit list of email addresses to notify."),
-  recipient_message: z3.string().optional().describe("Optional custom message to include in notifications.")
+  recipient_audience: z4.enum(["group"]).optional().describe("Audience selector for notification recipients. 'group' = notify whole group."),
+  recipient_user_ids: z4.array(positiveId).optional().describe("Explicit list of user IDs to notify."),
+  recipient_emails: z4.array(z4.string().email()).optional().describe("Explicit list of email addresses to notify."),
+  recipient_message: z4.string().optional().describe("Optional custom message to include in notifications.")
 });
 async function resolveDiscussionPrivate(groupId) {
   try {
@@ -1015,18 +1119,18 @@ async function createDiscussion(input) {
 }
 
 // src/tools/polls.ts
-import { z as z4 } from "zod";
-var getPollSchema = z4.object({
+import { z as z5 } from "zod";
+var getPollSchema = z5.object({
   id_or_key: idOrKey.describe("Poll id (numeric) or short string key.")
 });
 async function getPoll(input) {
   return loomioGet(`/b2/polls/${encodePathSegment(input.id_or_key)}`);
 }
-var listPollsSchema = z4.object({
+var listPollsSchema = z5.object({
   group_id: positiveId.describe("ID of the Loomio group whose polls to list (required)."),
-  status: z4.enum(["active", "closed", "all"]).optional().describe("Filter polls by status. Loomio defaults to 'active'."),
-  limit: z4.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
-  offset: z4.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
+  status: z5.enum(["active", "closed", "all"]).optional().describe("Filter polls by status. Loomio defaults to 'active'."),
+  limit: z5.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
+  offset: z5.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
 });
 async function listPolls(input) {
   return loomioGet("/b2/polls", {
@@ -1036,8 +1140,8 @@ async function listPolls(input) {
     ...input.offset !== void 0 ? { offset: input.offset } : {}
   });
 }
-var createPollSchema = z4.object({
-  title: z4.string().min(1).describe("Poll title (required)."),
+var createPollSchema = z5.object({
+  title: z5.string().min(1).describe("Poll title (required)."),
   poll_type: PollTypeEnum.describe(
     "Poll type. One of: proposal, poll, count, score, ranked_choice, meeting, dot_vote."
   ),
@@ -1047,22 +1151,22 @@ var createPollSchema = z4.object({
   discussion_id: positiveId.optional().describe(
     "Attach the poll to an existing discussion. When set, group_id is taken from the discussion."
   ),
-  details: z4.string().optional().describe("Optional poll body / context."),
-  details_format: z4.enum(["md", "html"]).optional().describe("Format of `details`. Defaults to 'md'."),
-  options: z4.array(z4.string().min(1)).optional().describe(
+  details: z5.string().optional().describe("Optional poll body / context."),
+  details_format: z5.enum(["md", "html"]).optional().describe("Format of `details`. Defaults to 'md'."),
+  options: z5.array(z5.string().min(1)).optional().describe(
     "Voting options. `proposal` has built-in agree/disagree/abstain options; for poll / count / score / ranked_choice / meeting / dot_vote you MUST supply your own."
   ),
-  closing_at: z4.string().optional().describe("ISO-8601 timestamp at which the poll closes."),
-  specified_voters_only: z4.boolean().optional().describe("If true, only users in recipient_user_ids / recipient_emails can vote."),
-  hide_results: z4.enum(["off", "until_vote", "until_closed"]).optional().describe("Results visibility policy. Defaults to 'off'."),
-  shuffle_options: z4.boolean().optional().describe("If true, shuffle option display order."),
-  anonymous: z4.boolean().optional().describe("If true, hide voter identities."),
-  recipient_audience: z4.enum(["group"]).optional(),
-  notify_on_closing_soon: z4.enum(["nobody", "author", "voters", "undecided_voters", "all_members"]).optional().describe("Who Loomio notifies as the closing date approaches. Defaults to 'nobody'."),
-  recipient_user_ids: z4.array(positiveId).optional(),
-  recipient_emails: z4.array(z4.string().email()).optional(),
-  recipient_message: z4.string().optional(),
-  notify_recipients: z4.boolean().optional().describe("If false, suppress the initial notification email. Defaults to false.")
+  closing_at: z5.string().optional().describe("ISO-8601 timestamp at which the poll closes."),
+  specified_voters_only: z5.boolean().optional().describe("If true, only users in recipient_user_ids / recipient_emails can vote."),
+  hide_results: z5.enum(["off", "until_vote", "until_closed"]).optional().describe("Results visibility policy. Defaults to 'off'."),
+  shuffle_options: z5.boolean().optional().describe("If true, shuffle option display order."),
+  anonymous: z5.boolean().optional().describe("If true, hide voter identities."),
+  recipient_audience: z5.enum(["group"]).optional(),
+  notify_on_closing_soon: z5.enum(["nobody", "author", "voters", "undecided_voters", "all_members"]).optional().describe("Who Loomio notifies as the closing date approaches. Defaults to 'nobody'."),
+  recipient_user_ids: z5.array(positiveId).optional(),
+  recipient_emails: z5.array(z5.string().email()).optional(),
+  recipient_message: z5.string().optional(),
+  notify_recipients: z5.boolean().optional().describe("If false, suppress the initial notification email. Defaults to false.")
 }).superRefine((input, ctx) => {
   if (input.group_id === void 0 && input.discussion_id === void 0) {
     ctx.addIssue({
@@ -1084,7 +1188,7 @@ async function createPoll(input) {
 }
 
 // src/tools/memberships.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // src/loomio/access.ts
 async function classifyGroupForbidden(groupId) {
@@ -1129,12 +1233,12 @@ async function explainForbidden(groupId, original, resource, fallback) {
     return original;
   }
 }
-var listMembershipsSchema = z5.object({
+var listMembershipsSchema = z6.object({
   group_id: positiveId.describe(
     "ID of the Loomio group whose memberships to list (required). The connector's bot user must be an admin (coordinator) of the group \u2014 Loomio only returns the member list, including email addresses, to group admins. For a non-admin bot this returns a clear 403 explaining the role requirement; names/usernames/ids (not emails) are still reachable via get_user_activity / list_events."
   ),
-  limit: z5.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
-  offset: z5.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
+  limit: z6.number().int().min(1).max(200).optional().describe("Page size. Loomio defaults to 50."),
+  offset: z6.number().int().min(0).optional().describe("Page offset. Defaults to 0.")
 });
 async function listMemberships(input) {
   try {
@@ -1155,14 +1259,14 @@ async function listMemberships(input) {
     throw err;
   }
 }
-var manageMembershipsSchema = z5.object({
+var manageMembershipsSchema = z6.object({
   group_id: positiveId.describe(
     "ID of the Loomio group to modify (required). Caller must be a group admin."
   ),
-  emails: z5.array(z5.string().email()).min(1).describe(
+  emails: z6.array(z6.string().email()).min(1).describe(
     "Email addresses to ensure are members. Each address that isn't already a member is invited / added."
   ),
-  remove_absent: z5.boolean().optional().describe(
+  remove_absent: z6.boolean().optional().describe(
     "DANGEROUS. When true, Loomio REMOVES every existing member whose email is NOT in `emails`. Empty-emails (after dedupe) effectively removes the entire group. Default false. Only set true after reading list_memberships and confirming the diff with a human."
   )
 });
@@ -1178,18 +1282,18 @@ async function manageMemberships(input) {
 }
 
 // src/tools/groups.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var DEFAULT_START_ID = 1;
 var DEFAULT_END_ID = 200;
 var MAX_END_ID = 1e4;
 var MAX_PROBE_SPAN = 500;
 var CONCURRENCY = 5;
-var listGroupsSchema = z6.object({
-  start_id: z6.number().int().min(1).optional().describe("First group_id to probe (inclusive). Defaults to 1."),
-  end_id: z6.number().int().min(1).max(MAX_END_ID).optional().describe(
+var listGroupsSchema = z7.object({
+  start_id: z7.number().int().min(1).optional().describe("First group_id to probe (inclusive). Defaults to 1."),
+  end_id: z7.number().int().min(1).max(MAX_END_ID).optional().describe(
     "Last group_id to probe (inclusive). Defaults to 200. A single call may scan at most 500 ids; use multiple calls for wider ranges."
   ),
-  stop_after_consecutive_misses: z6.number().int().min(1).max(MAX_PROBE_SPAN).optional().describe(
+  stop_after_consecutive_misses: z7.number().int().min(1).max(MAX_PROBE_SPAN).optional().describe(
     "Early-exit heuristic: stop probing after this many consecutive 404/403 misses. Saves wall time on sparse id ranges. Defaults to 50."
   )
 }).superRefine((input, ctx) => {
@@ -1284,23 +1388,23 @@ async function listGroups(input) {
 }
 
 // src/tools/events.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var CONCURRENCY2 = 6;
 var EVENTS_PAGE_SIZE = 200;
 var MAX_EVENTS_PAGES = 10;
 var MAX_DISCUSSION_PAGES = 20;
 var MAX_SCAN_DISCUSSIONS = 500;
-var listEventsSchema = z7.object({
+var listEventsSchema = z8.object({
   discussion_id: positiveId.describe(
     "ID of the discussion whose event stream to fetch. Required \u2014 Loomio's v1/events endpoint silently returns empty without it."
   ),
-  limit: z7.number().int().min(1).max(200).optional().describe(
+  limit: z8.number().int().min(1).max(200).optional().describe(
     "Page size for a single-page fetch. Omit limit/offset to let the connector paginate the full discussion stream up to its bounded cap."
   ),
-  offset: z7.number().int().min(0).optional().describe(
+  offset: z8.number().int().min(0).optional().describe(
     "Page offset (Loomio's `from` parameter). When supplied, list_events returns exactly that page instead of auto-paginating."
   ),
-  kinds: z7.array(z7.string().min(1)).optional().describe(
+  kinds: z8.array(z8.string().min(1)).optional().describe(
     "Optional filter to only these event kinds (applied client-side after fetch \u2014 Loomio doesn't filter `kind` server-side). Common kinds: new_discussion, new_comment, comment_edited, poll_created, stance_created, outcome_created, discussion_moved, discussion_closed, reaction."
   )
 });
@@ -1368,9 +1472,9 @@ var ACTIVITY_KINDS = /* @__PURE__ */ new Set([
   "outcome_created",
   "reaction"
 ]);
-var getUserActivitySchema = z7.object({
+var getUserActivitySchema = z8.object({
   user_id: positiveId.describe("Loomio user id whose activity to summarise."),
-  group_ids: z7.array(positiveId).min(1).max(50).describe(
+  group_ids: z8.array(positiveId).min(1).max(50).describe(
     "Groups to scan. Required \u2014 pass the result of `list_groups` (or a subset of it) to make the cost explicit. ~1 outbound HTTP request per discussion in scope, plus one list_discussions call per group; ~100-300 calls is typical for a wide scan. Capped at 50 groups per call."
   ),
   since: isoTimestamp.describe(
@@ -1563,11 +1667,11 @@ async function getUserActivity(input) {
 }
 
 // src/tools/comments.ts
-import { z as z8 } from "zod";
-var createCommentSchema = z8.object({
+import { z as z9 } from "zod";
+var createCommentSchema = z9.object({
   discussion_id: positiveId.describe("ID of the discussion to comment on."),
-  body: z8.string().min(1).describe("Comment body (required)."),
-  body_format: z8.enum(["md", "html"]).optional().describe("Format of `body`. Defaults to Loomio's group default when omitted.")
+  body: z9.string().min(1).describe("Comment body (required)."),
+  body_format: z9.enum(["md", "html"]).optional().describe("Format of `body`. Defaults to Loomio's group default when omitted.")
 });
 async function createComment(input) {
   const { discussion_id, ...rest } = input;
@@ -1578,14 +1682,14 @@ async function createComment(input) {
 }
 
 // src/tools/admin.ts
-import { z as z9 } from "zod";
-var deactivateUserSchema = z9.object({
+import { z as z10 } from "zod";
+var deactivateUserSchema = z10.object({
   id: positiveId.describe("Loomio user id to deactivate. Returns 404 if not active.")
 });
 async function deactivateUser(input) {
   return loomioPostB3("/b3/users/deactivate", { id: input.id });
 }
-var reactivateUserSchema = z9.object({
+var reactivateUserSchema = z10.object({
   id: positiveId.describe(
     "Loomio user id to reactivate. Returns 404 if not currently deactivated."
   )
@@ -1601,7 +1705,7 @@ function createLoomioMcpServer() {
   const server = new McpServer({
     name: "loomiomcp",
     // Keep in sync with package.json on each release.
-    version: "0.0.6",
+    version: "0.0.9",
     description: "MCP server for Loomio (loomio.com / self-hosted). Wraps Loomio's b2 public API: read and create discussions, polls, and comments; list and manage group memberships; read per-discussion event streams; and aggregate a user's participation across groups. Read-only mode supported via LOOMIO_MCP_READONLY=1 (Cloud Run pattern). Optional b3 admin operations (deactivate / reactivate user) when LOOMIO_B3_API_KEY is set \u2014 instance operators only. Read tools annotated with readOnlyHint so MCP clients can auto-approve safe calls; destructive writes (manage_memberships with remove_absent, deactivate_user) carry destructiveHint.",
     websiteUrl: "https://github.com/soil-dev/loomiomcp",
     icons: ICONS
@@ -1933,7 +2037,10 @@ var oauthProvider = mode.kind === "static-client" ? new OAuthProvider({
   signingKey,
   resourceUrl: mcpResourceUrl
 }) : new OAuthProvider({
-  clientsStore: new InMemoryClientsStore(),
+  // Stateless open-DCR store: registered clients survive restarts,
+  // scale-to-zero, redeploys, and multi-instance routing, so callers
+  // aren't forced to re-authenticate when the process recycles.
+  clientsStore: new StatelessClientsStore(signingKey),
   signingKey,
   resourceUrl: mcpResourceUrl
 });

package/dist/index.js

@@ -190,9 +190,9 @@ async function handleResponse(res) {
     throw err;
   }
 }
-var B2_AUTH = { field: "api_key", getValue: getApiKey };
-var B3_AUTH = { field: "b3_api_key", getValue: getB3ApiKey };
-function buildUrl(auth, path, params) {
+var B2_AUTH = getApiKey;
+var B3_AUTH = getB3ApiKey;
+function buildUrl(path, params) {
   const url = new URL(`${baseUrl()}${path}`);
   if (params) {
     for (const [key, value] of Object.entries(params)) {
@@ -201,9 +201,14 @@ function buildUrl(auth, path, params) {
       }
     }
   }
-  url.searchParams.set(auth.field, auth.getValue());
   return url.toString();
 }
+function authHeaders(auth) {
+  return {
+    ...baseHeaders(),
+    Authorization: `Bearer ${auth()}`
+  };
+}
 async function doFetch(url, options) {
   const startedAt = Date.now();
   const method = options?.method ?? "GET";
@@ -235,8 +240,8 @@ function emitLoomioRequest(method, url, res, durationMs) {
   });
 }
 async function loomioGet(path, params) {
-  const url = buildUrl(B2_AUTH, path, params);
-  const start = await doFetch(url, { headers: baseHeaders() });
+  const url = buildUrl(path, params);
+  const start = await doFetch(url, { headers: authHeaders(B2_AUTH) });
   try {
     return await consumeBody(start, () => handleResponse(start.res));
   } finally {
@@ -244,8 +249,8 @@ async function loomioGet(path, params) {
   }
 }
 async function loomioGetStatus(path, params) {
-  const url = buildUrl(B2_AUTH, path, params);
-  const start = await doFetch(url, { headers: baseHeaders() });
+  const url = buildUrl(path, params);
+  const start = await doFetch(url, { headers: authHeaders(B2_AUTH) });
   try {
     return await consumeBody(start, async () => {
       try {
@@ -272,12 +277,12 @@ function encodeForm(body) {
 }
 async function loomioPost(path, body, opts = {}) {
   if (isReadOnly()) throw new LoomioReadOnlyError("POST");
-  const url = buildUrl(B2_AUTH, path, opts.params);
+  const url = buildUrl(path, opts.params);
   const encoding = opts.encoding ?? "json";
   const start = await doFetch(url, {
     method: "POST",
     headers: {
-      ...baseHeaders(),
+      ...authHeaders(B2_AUTH),
       "Content-Type": encoding === "form" ? "application/x-www-form-urlencoded" : "application/json"
     },
     body: encoding === "form" ? encodeForm(body) : JSON.stringify(body)
@@ -290,10 +295,10 @@ async function loomioPost(path, body, opts = {}) {
 }
 async function loomioPostB3(path, params) {
   if (isReadOnly()) throw new LoomioReadOnlyError("POST");
-  const url = buildUrl(B3_AUTH, path, params);
+  const url = buildUrl(path, params);
   const start = await doFetch(url, {
     method: "POST",
-    headers: { ...baseHeaders(), "Content-Type": "application/json" },
+    headers: { ...authHeaders(B3_AUTH), "Content-Type": "application/json" },
     body: "{}"
   });
   try {
@@ -1049,7 +1054,7 @@ function createLoomioMcpServer() {
   const server2 = new McpServer({
     name: "loomiomcp",
     // Keep in sync with package.json on each release.
-    version: "0.0.6",
+    version: "0.0.9",
     description: "MCP server for Loomio (loomio.com / self-hosted). Wraps Loomio's b2 public API: read and create discussions, polls, and comments; list and manage group memberships; read per-discussion event streams; and aggregate a user's participation across groups. Read-only mode supported via LOOMIO_MCP_READONLY=1 (Cloud Run pattern). Optional b3 admin operations (deactivate / reactivate user) when LOOMIO_B3_API_KEY is set \u2014 instance operators only. Read tools annotated with readOnlyHint so MCP clients can auto-approve safe calls; destructive writes (manage_memberships with remove_absent, deactivate_user) carry destructiveHint.",
     websiteUrl: "https://github.com/soil-dev/loomiomcp",
     icons: ICONS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loomiomcp",
-  "version": "0.0.6",
+  "version": "0.0.9",
   "description": "Model Context Protocol server for Loomio. Lets Claude (Desktop, Code, or web Projects via Custom Connector) read and create Loomio discussions, polls, and comments, manage group memberships, and analyse member activity in plain English.",
   "keywords": [
     "mcp",