myhotlunchbox-mcp 1.2.0 → 1.2.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for My Hot Lunchbox — order school lunches, manage students, and track payments via natural language",
-    "version": "1.2.0"
+    "version": "1.2.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "My Hot Lunchbox",
       "source": "./",
       "description": "MCP server for My Hot Lunchbox — school lunch calendar, ordering, and payments. Signs in server-side with the parent account credentials.",
-      "version": "1.2.0",
+      "version": "1.2.2",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myhotlunchbox-mcp",
   "displayName": "My Hot Lunchbox",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "MCP server for My Hot Lunchbox — order school lunches, manage students, and track payments via natural language",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -63,7 +63,9 @@ forced `zod` 4.6.2 bump — 20/20 green.
 `mhlb_list_subscriptions`, `mhlb_get_subscription_settings`,
 `mhlb_set_subscription_enabled`, `mhlb_unsubscribe_order`,
 `mhlb_list_gift_cards`, `mhlb_apply_gift_card`, `mhlb_get_coupon`,
-`mhlb_apply_coupon`, `mhlb_remove_coupon`
+`mhlb_apply_coupon`, `mhlb_remove_coupon`. `mhlb_list_gift_cards` masks each code to its
+last 4 characters (a code is redeemable money); pass `revealCodes: true` for
+the full code.
 
 **Checkout** — `mhlb_init_checkout`, `mhlb_checkout`
 

package/dist/bundle.js

@@ -59235,7 +59235,7 @@ var MhlbClient = class {
 };
 
 // src/version.ts
-var VERSION = "1.2.0";
+var VERSION = "1.2.2";
 
 // src/tools/_shared.ts
 var CONFIRMS = " Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).";
@@ -59679,11 +59679,16 @@ function registerBillingTools(server, client2) {
   server.registerTool(
     "mhlb_list_gift_cards",
     {
-      description: "List gift cards on the account \u2014 codes, balances and status.",
+      description: "List gift cards on the account \u2014 balances and status, with each code masked to its last 4 characters. Pass revealCodes: true only when the user needs a full code.",
       annotations: toolAnnotations({ title: "List gift cards", openWorld: true }),
-      inputSchema: external_exports.object({})
+      inputSchema: external_exports.object({
+        revealCodes: external_exports.boolean().optional().describe("Return full gift-card codes instead of masked ones. A code is redeemable money; default false.")
+      })
     },
-    async () => minifiedResult(await client2.get("/parent/giftCardDataTables"))
+    async ({ revealCodes }) => {
+      const data = await client2.get("/parent/giftCardDataTables");
+      return minifiedResult(revealCodes ? data : maskGiftCardCodes(data));
+    }
   );
   server.registerTool(
     "mhlb_apply_gift_card",
@@ -59755,6 +59760,23 @@ function registerBillingTools(server, client2) {
     }
   );
 }
+var GIFT_CARD_CODE_KEY = /^code$|^(?:gift_?)?card_?(?:code|number|no|num)$/i;
+function maskCode(code) {
+  const shown = Math.min(4, Math.floor(code.length / 2));
+  return `****${shown > 0 ? code.slice(-shown) : ""}`;
+}
+function maskGiftCardCodes(value) {
+  if (Array.isArray(value)) return value.map(maskGiftCardCodes);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([k, v]) => {
+      if (GIFT_CARD_CODE_KEY.test(k) && (typeof v === "string" || typeof v === "number")) {
+        return [k, maskCode(String(v))];
+      }
+      return [k, maskGiftCardCodes(v)];
+    })
+  );
+}
 
 // src/tools/checkout.ts
 import { randomUUID } from "node:crypto";

package/dist/tools/billing.js

@@ -74,10 +74,19 @@ export function registerBillingTools(server, client) {
         return minifiedResult(await client.write('/event/unsubcribeOrder', body));
     });
     server.registerTool('mhlb_list_gift_cards', {
-        description: 'List gift cards on the account — codes, balances and status.',
+        description: 'List gift cards on the account — balances and status, with each code masked to its last 4 characters. ' +
+            'Pass revealCodes: true only when the user needs a full code.',
         annotations: toolAnnotations({ title: 'List gift cards', openWorld: true }),
-        inputSchema: z.object({}),
-    }, async () => minifiedResult(await client.get('/parent/giftCardDataTables')));
+        inputSchema: z.object({
+            revealCodes: z
+                .boolean()
+                .optional()
+                .describe('Return full gift-card codes instead of masked ones. A code is redeemable money; default false.'),
+        }),
+    }, async ({ revealCodes }) => {
+        const data = await client.get('/parent/giftCardDataTables');
+        return minifiedResult(revealCodes ? data : maskGiftCardCodes(data));
+    });
     server.registerTool('mhlb_apply_gift_card', {
         description: 'Redeem a gift card code onto the account balance.' + CONFIRMS + UNVERIFIED,
         annotations: toolAnnotations({ title: 'Apply gift card', readOnly: false, openWorld: true, destructive: true }),
@@ -135,3 +144,36 @@ export function registerBillingTools(server, client) {
         return minifiedResult(await client.write('/parent/removeCoupon'));
     });
 }
+/**
+ * Keys that hold a gift-card code (a redeemable bearer value): `code`,
+ * `giftCardCode`, `cardNumber`, `giftCardNo`, … — but not `statusCode` and
+ * friends, which are enum values.
+ */
+const GIFT_CARD_CODE_KEY = /^code$|^(?:gift_?)?card_?(?:code|number|no|num)$/i;
+/**
+ * `'****' + last 4` — enough to tell cards apart, not enough to redeem one.
+ * A short code shows at most half its characters (rounded down), so a code of
+ * 4 or fewer is never revealed in full.
+ */
+export function maskCode(code) {
+    const shown = Math.min(4, Math.floor(code.length / 2));
+    return `****${shown > 0 ? code.slice(-shown) : ''}`;
+}
+/**
+ * Mask every gift-card code in a `/parent/giftCardDataTables` response,
+ * leaving every other field (ids, balances, status, dates) intact. Walks the
+ * whole value rather than assuming one row shape, so a DataTables envelope, a
+ * bare array, or a renamed field are all covered.
+ */
+export function maskGiftCardCodes(value) {
+    if (Array.isArray(value))
+        return value.map(maskGiftCardCodes);
+    if (value === null || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => {
+        if (GIFT_CARD_CODE_KEY.test(k) && (typeof v === 'string' || typeof v === 'number')) {
+            return [k, maskCode(String(v))];
+        }
+        return [k, maskGiftCardCodes(v)];
+    }));
+}

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Single source of truth for the server version; release-please rewrites it. */
-export const VERSION = '1.2.0'; // x-release-please-version
+export const VERSION = '1.2.2'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "myhotlunchbox-mcp",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "mcpName": "io.github.chrischall/myhotlunchbox-mcp",
   "description": "My Hot Lunchbox MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/myhotlunchbox-mcp",
     "source": "github"
   },
-  "version": "1.2.0",
+  "version": "1.2.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "myhotlunchbox-mcp",
-      "version": "1.2.0",
+      "version": "1.2.2",
       "transport": {
         "type": "stdio"
       },