mcp-connectwise-psa 0.1.0

package/dist/http/app.js

@@ -0,0 +1,175 @@
+/**
+ * HTTP transport: Express app exposing
+ *
+ *   POST/GET/DELETE /mcp    MCP streamable-http endpoint (auth + RBAC)
+ *   GET  /health            liveness probe
+ *
+ * Authentication model:
+ *  - Role tokens (Authorization: Bearer …) map to viewer/editor/admin and gate
+ *    which tools a session gets, using the server-wide ConnectWise keys.
+ *  - Bring-your-own-keys: x-cw-public-key + x-cw-private-key headers bind the
+ *    session to that member's API keys with the FULL tool surface — the
+ *    member's own ConnectWise security role is the access control, and writes
+ *    (notes, time entries) are attributed to that member. Optional
+ *    x-cw-member-id header names the member for "my tickets"/"my time".
+ *    CLIENT_CW_KEYS controls the policy (with-token default / open / disabled).
+ *  - A session id never carries privilege: every request re-authenticates and
+ *    must present the same principal (role + label + key hash) the session was
+ *    created with.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import express from "express";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { authenticateToken, loadTokenEntries } from "../auth/tokens.js";
+import { createServer, SERVER_NAME, SERVER_VERSION } from "../server.js";
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+function rpcError(res, status, code, message) {
+    res.status(status).json({ jsonrpc: "2.0", error: { code, message }, id: null });
+}
+const unauthorized = (message) => ({
+    ok: false,
+    status: 401,
+    code: -32001,
+    message,
+});
+function headerValue(req, name) {
+    const value = req.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+/** Resolve the principal for a request. Exported for tests. */
+export function resolveAuth(req, config) {
+    const entries = loadTokenEntries();
+    const token = authenticateToken(req.headers.authorization, entries);
+    const clientPublic = headerValue(req, "x-cw-public-key");
+    const clientPrivate = headerValue(req, "x-cw-private-key");
+    const clientMember = headerValue(req, "x-cw-member-id");
+    if (clientPublic || clientPrivate) {
+        if (config.clientKeyMode === "disabled") {
+            return unauthorized("Client-supplied ConnectWise keys are disabled on this server (CLIENT_CW_KEYS=disabled).");
+        }
+        if (!clientPublic || !clientPrivate) {
+            return unauthorized("Both x-cw-public-key and x-cw-private-key headers are required.");
+        }
+        const keyHash = sha256(`${clientPublic}:${clientPrivate}`);
+        const byokLabel = `byok:${keyHash.slice(0, 8)}`;
+        if (config.clientKeyMode === "with-token" && entries.length > 0 && !token) {
+            return unauthorized("A valid bearer token is required alongside your ConnectWise keys (CLIENT_CW_KEYS=with-token).");
+        }
+        const label = token ? `${token.label}+${byokLabel}` : byokLabel;
+        // BYOK sessions get the full tool surface; the member's own ConnectWise
+        // security role is the effective access control.
+        return {
+            ok: true,
+            role: "admin",
+            label,
+            credentials: {
+                publicKey: clientPublic,
+                privateKey: clientPrivate,
+                memberIdentifier: clientMember,
+            },
+            keyHash,
+        };
+    }
+    const serverCredentials = config.publicKey && config.privateKey
+        ? {
+            publicKey: config.publicKey,
+            privateKey: config.privateKey,
+            memberIdentifier: config.memberIdentifier,
+        }
+        : null;
+    if (entries.length === 0) {
+        if (!serverCredentials) {
+            return unauthorized("No ConnectWise keys available — set CW_PUBLIC_KEY/CW_PRIVATE_KEY on the server or send x-cw-public-key/x-cw-private-key.");
+        }
+        return { ok: true, role: "admin", label: "dev-unauthenticated", credentials: serverCredentials, keyHash: null };
+    }
+    if (!token) {
+        return unauthorized("Unauthorized: invalid or missing bearer token.");
+    }
+    if (!serverCredentials) {
+        return unauthorized("This server has no shared ConnectWise keys — supply your own via the x-cw-public-key/x-cw-private-key headers.");
+    }
+    return { ok: true, role: token.role, label: token.label, credentials: serverCredentials, keyHash: null };
+}
+function principalMatches(session, auth) {
+    return (session.role === auth.role && session.label === auth.label && session.keyHash === auth.keyHash);
+}
+export function createApp(config) {
+    const app = express();
+    app.use(express.json({ limit: "2mb" }));
+    const sessions = new Map();
+    app.get("/health", (_req, res) => {
+        res.json({ status: "ok", name: SERVER_NAME, version: SERVER_VERSION });
+    });
+    app.post("/mcp", (req, res) => {
+        void (async () => {
+            const auth = resolveAuth(req, config);
+            if (!auth.ok)
+                return rpcError(res, auth.status, auth.code, auth.message);
+            const sessionId = headerValue(req, "mcp-session-id");
+            if (sessionId) {
+                const session = sessions.get(sessionId);
+                if (!session)
+                    return rpcError(res, 404, -32000, "Session not found");
+                if (!principalMatches(session, auth)) {
+                    return rpcError(res, 403, -32003, "Forbidden: credentials do not match this session");
+                }
+                await session.transport.handleRequest(req, res, req.body);
+                return;
+            }
+            if (!isInitializeRequest(req.body)) {
+                return rpcError(res, 400, -32600, "Bad request: expected an initialize request");
+            }
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID(),
+                onsessioninitialized: (newSessionId) => {
+                    sessions.set(newSessionId, {
+                        transport,
+                        role: auth.role,
+                        label: auth.label,
+                        keyHash: auth.keyHash,
+                    });
+                    console.error(`[rbac] session ${newSessionId} created for ${auth.label} (${auth.role})`);
+                },
+            });
+            transport.onclose = () => {
+                if (transport.sessionId)
+                    sessions.delete(transport.sessionId);
+            };
+            const server = createServer(config, {
+                role: auth.role,
+                label: auth.label,
+                credentials: auth.credentials,
+            });
+            await server.connect(transport);
+            await transport.handleRequest(req, res, req.body);
+        })().catch((err) => {
+            console.error(`[http] POST /mcp failed: ${String(err)}`);
+            if (!res.headersSent)
+                rpcError(res, 500, -32603, "Internal server error");
+        });
+    });
+    const handleSessionRequest = (req, res) => {
+        void (async () => {
+            const auth = resolveAuth(req, config);
+            if (!auth.ok)
+                return rpcError(res, auth.status, auth.code, auth.message);
+            const sessionId = headerValue(req, "mcp-session-id");
+            const session = sessionId ? sessions.get(sessionId) : undefined;
+            if (!session)
+                return rpcError(res, 404, -32000, "Session not found");
+            if (!principalMatches(session, auth)) {
+                return rpcError(res, 403, -32003, "Forbidden: credentials do not match this session");
+            }
+            await session.transport.handleRequest(req, res);
+        })().catch((err) => {
+            console.error(`[http] ${req.method} /mcp failed: ${String(err)}`);
+            if (!res.headersSent)
+                rpcError(res, 500, -32603, "Internal server error");
+        });
+    };
+    app.get("/mcp", handleSessionRequest);
+    app.delete("/mcp", handleSessionRequest);
+    return app;
+}

package/dist/index.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+/** CLI entry point — runs the MCP server over stdio (default) or HTTP. */
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ConfigError, loadConfig } from "./config.js";
+import { loadTokenEntries } from "./auth/tokens.js";
+import { createServer, SERVER_NAME, SERVER_VERSION } from "./server.js";
+import { createApp } from "./http/app.js";
+const USAGE = `${SERVER_NAME} v${SERVER_VERSION}
+
+Usage: mcp-connectwise-psa [options]
+
+Options:
+  --transport stdio|http   Transport (default: stdio; env TRANSPORT)
+  --port <n>               HTTP port (default: 3000; env PORT)
+  --site <host>            ConnectWise host (env CW_SITE)
+  --help                   Show this help
+
+Environment:
+  CW_SITE                  ConnectWise host (e.g. na.myconnectwise.net)
+  CW_COMPANY_ID            Login company id
+  CW_CLIENT_ID             Integration clientId (developer.connectwise.com)
+  CW_PUBLIC_KEY            Server-wide API member public key (optional with BYOK)
+  CW_PRIVATE_KEY           Server-wide API member private key
+  CW_MEMBER_IDENTIFIER     Member the server-wide keys belong to (my-tickets/my-time)
+  MCP_TOKENS_VIEWER        label:token[,label:token…] — read-only access (HTTP)
+  MCP_TOKENS_EDITOR        label:token[,…] — read + tickets/notes/time writes
+  MCP_TOKENS_ADMIN         label:token[,…] — reserved for future destructive tools
+  CLIENT_CW_KEYS           disabled|with-token|open — client-supplied CW keys (default: with-token)
+`;
+function logStartupSummary(config) {
+    const entries = loadTokenEntries();
+    if (entries.length === 0) {
+        console.error("[auth] WARNING: no MCP_TOKENS_* configured — all HTTP requests are accepted with FULL access. " +
+            "Set MCP_TOKENS_VIEWER / MCP_TOKENS_EDITOR / MCP_TOKENS_ADMIN in production.");
+    }
+    else {
+        console.error(`[auth] ${entries.length} token(s) configured: ${entries.map((e) => `${e.label}(${e.role})`).join(", ")}`);
+    }
+    console.error(`[auth] Client-supplied ConnectWise keys: ${config.clientKeyMode}`);
+    console.error(config.publicKey
+        ? `[cw] Server-wide keys configured${config.memberIdentifier ? ` (member: ${config.memberIdentifier})` : " (no CW_MEMBER_IDENTIFIER — my-tickets/my-time unavailable for token-only sessions)"}`
+        : "[cw] No server-wide keys — sessions must bring their own via x-cw-public-key/x-cw-private-key.");
+}
+async function runStdio(config) {
+    const server = createServer(config, {
+        role: "admin",
+        label: "stdio",
+        credentials: {
+            publicKey: config.publicKey,
+            privateKey: config.privateKey,
+            memberIdentifier: config.memberIdentifier,
+        },
+    });
+    await server.connect(new StdioServerTransport());
+    console.error(`${SERVER_NAME} v${SERVER_VERSION} running on stdio (${config.site})`);
+}
+async function runHttp(config) {
+    logStartupSummary(config);
+    const app = createApp(config);
+    await new Promise((resolve) => {
+        app.listen(config.port, "0.0.0.0", () => resolve());
+    });
+    console.error(`${SERVER_NAME} v${SERVER_VERSION} listening on :${config.port} (${config.site})`);
+}
+async function main() {
+    const argv = process.argv.slice(2);
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(USAGE);
+        return;
+    }
+    let config;
+    try {
+        config = loadConfig(argv);
+    }
+    catch (err) {
+        if (err instanceof ConfigError) {
+            console.error(`Configuration error: ${err.message}\n`);
+            console.error(USAGE);
+            process.exit(1);
+        }
+        throw err;
+    }
+    if (config.transport === "http")
+        await runHttp(config);
+    else
+        await runStdio(config);
+}
+main().catch((err) => {
+    console.error(`Fatal: ${String(err)}`);
+    process.exit(1);
+});

package/dist/server.js

@@ -0,0 +1,49 @@
+/**
+ * Builds an McpServer for one session. A session is defined by:
+ *  - the ConnectWise credentials it uses (server-wide keys or client-supplied)
+ *  - the role that gates which tools are registered
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { createRequire } from "node:module";
+import { ToolRegistrar } from "./auth/roles.js";
+import { CWClient } from "./cw/client.js";
+import { registerTicketTools } from "./tools/tickets.js";
+import { registerTimeTools } from "./tools/time.js";
+import { registerCompanyTools } from "./tools/companies.js";
+import { registerConfigurationTools } from "./tools/configurations.js";
+const require = createRequire(import.meta.url);
+const pkg = require("../package.json");
+export const SERVER_NAME = pkg.name;
+export const SERVER_VERSION = pkg.version;
+const INSTRUCTIONS = `# ConnectWise PSA MCP server
+
+## Finding things
+- Typical flow: cw_search_companies → cw_search_tickets / cw_list_configurations → cw_get_ticket.
+- cw_my_tickets and cw_list_my_time act as the member whose API keys this session uses.
+- Ticket searches default to OPEN tickets; pass open_only:false for closed ones.
+- Status/board/priority filters use exact names; summary and name filters match substrings.
+
+## Working tickets
+- cw_add_ticket_note: discussion notes are CUSTOMER-VISIBLE; set internal:true for internal analysis.
+- cw_update_ticket status names must exist on the ticket's board.
+- cw_create_time_entry needs time_start plus time_end or hours; notes describe the work done.
+- Writes are attributed to the API keys' member — that's the point: use your own keys.
+
+## Notes
+- Lists are paginated; ask for more pages rather than huge page sizes.
+- Some tools may be unavailable depending on this session's access level.`;
+export function createServer(config, session) {
+    const client = new CWClient({
+        site: config.site,
+        companyId: config.companyId,
+        clientId: config.clientId,
+        credentials: session.credentials,
+    });
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { instructions: INSTRUCTIONS });
+    const reg = new ToolRegistrar(server, session.role);
+    registerTicketTools(reg, client);
+    registerTimeTools(reg, client);
+    registerCompanyTools(reg, client);
+    registerConfigurationTools(reg, client);
+    return server;
+}

package/dist/tools/companies.js

@@ -0,0 +1,109 @@
+/** Company and contact lookup tools (read-only). */
+import { z } from "zod";
+import { allOf, q } from "../cw/client.js";
+import { clip, failure, json, pageFooter, pageNumberField, pageSizeField, responseFormatField, text, } from "./shared.js";
+const COMPANY_FIELDS = "id,identifier,name,status/name,city,state,phoneNumber,website";
+const CONTACT_FIELDS = "id,firstName,lastName,title,company/name,company/id,defaultPhoneNbr,inactiveFlag";
+export function registerCompanyTools(reg, client) {
+    reg.register({
+        name: "cw_search_companies",
+        title: "Search ConnectWise Companies",
+        description: "Search companies by name (substring). Use this to find the company ID needed by ticket and configuration tools.",
+        inputSchema: {
+            name_contains: z.string().optional().describe("Text the company name contains"),
+            active_only: z.boolean().default(true).describe('Only status "Active" companies (default true)'),
+            page_number: pageNumberField,
+            page_size: pageSizeField,
+            response_format: responseFormatField,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, async (args) => {
+        try {
+            const page = await client.getList("/company/companies", {
+                conditions: allOf("deletedFlag=false", args.active_only && `status/name=${q("Active")}`, args.name_contains && `name contains ${q(args.name_contains)}`),
+                orderBy: "name asc",
+                fields: COMPANY_FIELDS,
+                page: args.page_number,
+                pageSize: args.page_size,
+            });
+            if (page.items.length === 0)
+                return text("No companies found.");
+            if (args.response_format === "json")
+                return text(clip(json(page)));
+            const lines = [`# Companies (${page.items.length} on this page)`, ""];
+            for (const c of page.items) {
+                lines.push(`- **${c.name}** (ID: ${c.id})${c.status?.name ? ` — ${c.status.name}` : ""}${c.city ? ` — ${c.city}, ${c.state ?? ""}` : ""}`);
+            }
+            lines.push("", pageFooter(page.page, page.hasMore));
+            return text(clip(lines.join("\n")));
+        }
+        catch (error) {
+            return failure(error);
+        }
+    });
+    reg.register({
+        name: "cw_get_company",
+        title: "Get ConnectWise Company",
+        description: "Get one company by ID.",
+        inputSchema: {
+            company_id: z.number().int().positive().describe("The company ID"),
+            response_format: responseFormatField,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, async (args) => {
+        try {
+            const company = await client.getOne(`/company/companies/${args.company_id}`, COMPANY_FIELDS + ",addressLine1,territory/name,market/name");
+            if (args.response_format === "json")
+                return text(json(company));
+            const lines = [
+                `# ${company.name} (ID: ${company.id})`,
+                `- **Status**: ${company.status?.name ?? "?"}`,
+                `- **Address**: ${[company.addressLine1, company.city, company.state].filter(Boolean).join(", ") || "—"}`,
+                `- **Phone**: ${company.phoneNumber ?? "—"}`,
+                `- **Website**: ${company.website ?? "—"}`,
+            ];
+            return text(lines.join("\n"));
+        }
+        catch (error) {
+            return failure(error);
+        }
+    });
+    reg.register({
+        name: "cw_search_contacts",
+        title: "Search ConnectWise Contacts",
+        description: "Search contacts by name, optionally within one company.",
+        inputSchema: {
+            name_contains: z.string().optional().describe("Text the first or last name contains"),
+            company_id: z.number().int().positive().optional().describe("Restrict to one company"),
+            active_only: z.boolean().default(true).describe("Exclude inactive contacts (default true)"),
+            page_number: pageNumberField,
+            page_size: pageSizeField,
+            response_format: responseFormatField,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, async (args) => {
+        try {
+            const page = await client.getList("/company/contacts", {
+                conditions: allOf(args.active_only && "inactiveFlag=false", args.company_id !== undefined && `company/id=${args.company_id}`, args.name_contains &&
+                    `(firstName contains ${q(args.name_contains)} OR lastName contains ${q(args.name_contains)})`),
+                orderBy: "lastName asc",
+                fields: CONTACT_FIELDS,
+                page: args.page_number,
+                pageSize: args.page_size,
+            });
+            if (page.items.length === 0)
+                return text("No contacts found.");
+            if (args.response_format === "json")
+                return text(clip(json(page)));
+            const lines = [`# Contacts (${page.items.length} on this page)`, ""];
+            for (const c of page.items) {
+                lines.push(`- **${c.firstName ?? ""} ${c.lastName ?? ""}** (ID: ${c.id}) — ${c.company?.name ?? "?"}${c.title ? ` — ${c.title}` : ""}${c.defaultPhoneNbr ? ` — ${c.defaultPhoneNbr}` : ""}`);
+            }
+            lines.push("", pageFooter(page.page, page.hasMore));
+            return text(clip(lines.join("\n")));
+        }
+        catch (error) {
+            return failure(error);
+        }
+    });
+}

package/dist/tools/configurations.js

@@ -0,0 +1,80 @@
+/** Configuration (device) lookup tools (read-only). */
+import { z } from "zod";
+import { allOf, q } from "../cw/client.js";
+import { clip, failure, json, pageFooter, pageNumberField, pageSizeField, responseFormatField, text, } from "./shared.js";
+const CONFIG_LIST_FIELDS = "id,name,type/name,status/name,company/name,serialNumber,ipAddress";
+const CONFIG_DETAIL_FIELDS = CONFIG_LIST_FIELDS +
+    ",company/id,contact/name,modelNumber,tagNumber,macAddress,osType,osInfo,warrantyExpirationDate,activeFlag,notes";
+export function registerConfigurationTools(reg, client) {
+    reg.register({
+        name: "cw_list_configurations",
+        title: "List ConnectWise Configurations",
+        description: "List configurations (devices/assets) — servers, firewalls, workstations — optionally filtered by " +
+            "company, name, or type. Useful during troubleshooting to find serials, IPs, and warranty info.",
+        inputSchema: {
+            company_id: z.number().int().positive().optional().describe("Restrict to one company"),
+            name_contains: z.string().optional().describe("Text the configuration name contains"),
+            type: z.string().optional().describe('Configuration type name (e.g. "Managed Server", "Firewall")'),
+            active_only: z.boolean().default(true).describe("Only active configurations (default true)"),
+            page_number: pageNumberField,
+            page_size: pageSizeField,
+            response_format: responseFormatField,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, async (args) => {
+        try {
+            const page = await client.getList("/company/configurations", {
+                conditions: allOf(args.active_only && "activeFlag=true", args.company_id !== undefined && `company/id=${args.company_id}`, args.name_contains && `name contains ${q(args.name_contains)}`, args.type && `type/name=${q(args.type)}`),
+                orderBy: "name asc",
+                fields: CONFIG_LIST_FIELDS,
+                page: args.page_number,
+                pageSize: args.page_size,
+            });
+            if (page.items.length === 0)
+                return text("No configurations found.");
+            if (args.response_format === "json")
+                return text(clip(json(page)));
+            const lines = [`# Configurations (${page.items.length} on this page)`, ""];
+            for (const c of page.items) {
+                lines.push(`- **${c.name}** (ID: ${c.id}) — ${c.type?.name ?? "?"} @ ${c.company?.name ?? "?"}` +
+                    `${c.serialNumber ? ` — SN ${c.serialNumber}` : ""}${c.ipAddress ? ` — ${c.ipAddress}` : ""}`);
+            }
+            lines.push("", pageFooter(page.page, page.hasMore));
+            return text(clip(lines.join("\n")));
+        }
+        catch (error) {
+            return failure(error);
+        }
+    });
+    reg.register({
+        name: "cw_get_configuration",
+        title: "Get ConnectWise Configuration",
+        description: "Get one configuration with full details (serial, model, network, OS, warranty, notes).",
+        inputSchema: {
+            configuration_id: z.number().int().positive().describe("The configuration ID"),
+            response_format: responseFormatField,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, async (args) => {
+        try {
+            const c = await client.getOne(`/company/configurations/${args.configuration_id}`, CONFIG_DETAIL_FIELDS);
+            if (args.response_format === "json")
+                return text(clip(json(c)));
+            const lines = [
+                `# ${c.name} (ID: ${c.id})`,
+                `- **Type**: ${c.type?.name ?? "?"} | **Status**: ${c.status?.name ?? "?"} | **Active**: ${c.activeFlag ? "yes" : "no"}`,
+                `- **Company**: ${c.company?.name ?? "?"} | **Contact**: ${c.contact?.name ?? "—"}`,
+                `- **Serial**: ${c.serialNumber ?? "—"} | **Model**: ${c.modelNumber ?? "—"} | **Tag**: ${c.tagNumber ?? "—"}`,
+                `- **IP**: ${c.ipAddress ?? "—"} | **MAC**: ${c.macAddress ?? "—"}`,
+                `- **OS**: ${[c.osType, c.osInfo].filter(Boolean).join(" ") || "—"}`,
+                `- **Warranty until**: ${c.warrantyExpirationDate ?? "—"}`,
+            ];
+            if (c.notes)
+                lines.push("", "## Notes", "", String(c.notes));
+            return text(clip(lines.join("\n")));
+        }
+        catch (error) {
+            return failure(error);
+        }
+    });
+}

package/dist/tools/shared.js

@@ -0,0 +1,48 @@
+/** Shared zod fragments and result helpers for tool implementations. */
+import { z } from "zod";
+import { describeError } from "../cw/client.js";
+/** Hard cap on tool response size, to protect the model's context window. */
+export const RESPONSE_CHAR_LIMIT = 25_000;
+export const responseFormatField = z
+    .enum(["markdown", "json"])
+    .default("markdown")
+    .describe("Output format: human-readable markdown (default) or structured JSON");
+export const pageNumberField = z
+    .number()
+    .int()
+    .positive()
+    .default(1)
+    .describe("Page number (default 1)");
+export const pageSizeField = z
+    .number()
+    .int()
+    .positive()
+    .max(1000)
+    .default(25)
+    .describe("Results per page (default 25, max 1000)");
+export function text(value) {
+    return { content: [{ type: "text", text: value }] };
+}
+export function failure(error) {
+    return { content: [{ type: "text", text: describeError(error) }], isError: true };
+}
+export function json(value) {
+    return JSON.stringify(value, null, 2);
+}
+export function clip(value, hint) {
+    if (value.length <= RESPONSE_CHAR_LIMIT)
+        return value;
+    const note = hint ?? "Use pagination or filters to narrow the result.";
+    return (value.slice(0, RESPONSE_CHAR_LIMIT) +
+        `\n\n---\n[Truncated at ${RESPONSE_CHAR_LIMIT.toLocaleString()} characters. ${note}]`);
+}
+export function pageFooter(page, hasMore) {
+    const lines = ["---", `Page ${page}`];
+    if (hasMore)
+        lines.push(`More available — request page_number: ${page + 1}`);
+    return lines.join("\n");
+}
+/** Message returned when a "my …" tool cannot determine the acting member. */
+export const UNKNOWN_MEMBER_MESSAGE = "Error: cannot determine which ConnectWise member this session acts as. " +
+    "Provide the member identifier: the x-cw-member-id header (with your own API keys) " +
+    "or the CW_MEMBER_IDENTIFIER environment variable (server-wide keys).";