somtoday-mcp 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 somtoday-mcp contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,221 @@
-# Temporary Holding Version
+# somtoday-mcp
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/barzoj/somtoday-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/barzoj/somtoday-mcp/actions/workflows/ci.yml)
+[![Coverage](https://codecov.io/gh/barzoj/somtoday-mcp/graph/badge.svg)](https://codecov.io/gh/barzoj/somtoday-mcp)
+[![npm version](https://img.shields.io/npm/v/somtoday-mcp)](https://www.npmjs.com/package/somtoday-mcp)
+[![License: MIT](https://img.shields.io/github/license/barzoj/somtoday-mcp)](LICENSE)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D22-brightgreen)](https://nodejs.org/)
+
+Read-only [MCP](https://modelcontextprotocol.io/) server for the Somtoday parent portal. It lets an AI assistant such as Cursor or Claude Desktop look up your child's timetable, homework, and grades from your own parent account.
+
+It runs locally on your computer over stdio. Nothing is sent anywhere except to Somtoday itself.
+
+> **Disclaimer.** This is an unofficial community project. It is not affiliated with, endorsed by, or supported by Somtoday or Topicus. It works by interoperating with the undocumented internal web API that the official parent portal uses, so it may stop working or behave differently at any time without notice. It is intended for use with your own account, only reads data, and is provided as-is, without warranty of any kind (see [LICENSE](LICENSE)); use it at your own risk and in line with Somtoday's terms of use. "Somtoday" and "Topicus" are trademarks of their respective owners and are used here only to describe what the software works with.
+
+## What it does
+
+| Tool                  | What you get                                                                                                                                                                                                                                                             |
+| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `whoami`              | Your school label, the linked children with their numeric ids, and which portal sections are visible to you.                                                                                                                                                             |
+| `lessons`             | The timetable for one day, and whether that day is a school holiday.                                                                                                                                                                                                     |
+| `homework`            | What to do and learn on which day: every study-planner item for a date range (default today + 6 days, max 42), grouped by day, with description, learning goals, time estimate, test type, attachments (links), external links, hand-in window/status and the done tick. |
+| `grades`              | The most recent results (up to 30) and averages per subject.                                                                                                                                                                                                             |
+| `assignments`         | All hand-in assignments with window, status (upcoming, to do, waiting for review, approved), late flag, description, attachments and links. `status=open` keeps the ones still to do.                                                                                    |
+| `assignment_detail`   | Submissions (date, status, file or link) and teacher reactions for one assignment.                                                                                                                                                                                       |
+| `study_material`      | Study material per subject: lesson material from the planner by date, year attachments by folder (file links), external links, and methods/publisher links. No arguments lists the subjects; `vak` picks one; `all=true` fetches every subject.                          |
+| `schedule`            | Timetable for a date range (default today + 6 days, max 42): time, lesson hour, subject, room, teachers, type (test, exam, parent evening …), lesson notes, changes and cancellations, attachments, holidays.                                                            |
+| `grades_latest`       | Newest results first with subject, column, description, grade, weight, test type, period, date, remarks and resits; `limit` (default 50, max 1000) and `dossier=examen` for SE results.                                                                                  |
+| `grades_overview`     | Full grade overview for a school year: every subject, every result per period, report grades, weights and remarks. `schooljaar` picks an earlier year.                                                                                                                   |
+| `subject_grades`      | Everything for one subject: every result column with weights and remarks, column definitions (also not yet graded), composite-test parts, for the progress and exam dossier. No `vak` lists the subjects.                                                                |
+| `exam_grades`         | School-exam dossier (PTA/SE): per subject the SE average, every SE result, tests still to come and test-type averages.                                                                                                                                                   |
+| `absence`             | Absence and registrations for the school year or grading period (absent, late, removed, homework/materials not in order) with counts and entries, plus active measures.                                                                                                  |
+| `messages`            | Messages, read-only: newest conversations (subject, sender, date, unread, preview; `zoek`/`ongelezen` filters) or one full thread with `conversatieId`. Never marks anything as read.                                                                                    |
+| `news`                | School news items (newest first, as text) and the unread count.                                                                                                                                                                                                          |
+| `announcements`       | Somtoday-wide announcements shown in the portal.                                                                                                                                                                                                                         |
+| `children`            | Linked children with profile, class, school data (mentors, year, programme), current placement and visible portal sections.                                                                                                                                              |
+| `school_info`         | School contact data and the school's information pages; `paginaId` opens one page.                                                                                                                                                                                       |
+| `teachers`            | Staff you can message, with the subjects they teach your child.                                                                                                                                                                                                          |
+| `signing_requests`    | Digital signing requests (read-only; nothing is signed).                                                                                                                                                                                                                 |
+| `parent_evening`      | Parent-evening details (slots, teachers); finds invitations in your messages (read-only; nothing is booked).                                                                                                                                                             |
+| `consents`            | Consents such as use of photos, as set in the portal (read-only).                                                                                                                                                                                                        |
+| `download_attachment` | Read an attachment by `fileUrl`: https Somtoday hosts only (extend with `SOMTODAY_MCP_ATTACHMENT_HOSTS`), max 10 MB, no token sent; text from PDF/text/HTML/CSV/JSON.                                                                                                    |
+| `auth_status`         | Whether a session is stored, where, and how the last token renewal went. Never returns tokens.                                                                                                                                                                           |
+
+- `lessons` takes an optional `date` (`YYYY-MM-DD`, Europe/Amsterdam) and defaults to **tomorrow**. Range tools take `date`, or `from`/`to`.
+- If more than one child is linked to your account, pass `leerlingId` (the numeric id from `whoami`).
+- If a section is switched off for your account, the tool says so and does not call that part of the API.
+
+Not included: news, messages, absence reporting, parent-evening scheduling, uploads, or anything that changes data.
+
+## Read-only and privacy
+
+- Tools only send `GET` requests. Nothing is written, submitted, or marked as read.
+- The server talks only to Somtoday's login and API servers.
+- No telemetry or analytics.
+- Your password is typed only into the Somtoday login page in a browser window. No tool, CLI flag, environment variable, or prompt ever asks for it.
+- Tools never return tokens.
+
+Timetables, homework, and grades are personal data about children. Keep the output on your own devices, use only accounts you are entitled to use, and do not share or republish it. Under the GDPR you are responsible for what you do with data you export.
+
+## Install
+
+Requires Node.js 22 or newer.
+
+> The package is not published to npm yet. Until it is, use the "From a checkout" steps below; `npx somtoday-mcp` will not find it.
+
+```bash
+npx -y somtoday-mcp            # start the MCP server (used by your MCP client)
+npx -y somtoday-mcp login      # sign in, once, in a terminal
+```
+
+Login opens a normal browser window. When **Google Chrome** (or else **Microsoft Edge**) is installed, that browser is used, with a fresh temporary profile that is deleted afterwards; it passes Somtoday's Cloudflare "Verify you are human" check more reliably. Only without Chrome/Edge does it fall back to Playwright's bundled Chromium; install that once in that case:
+
+```bash
+npx playwright install chromium
+```
+
+The window is started without the "controlled by automated software" markers; nothing else about the browser is changed.
+
+From a checkout:
+
+```bash
+git clone https://github.com/barzoj/somtoday-mcp.git
+cd somtoday-mcp
+npm install
+npm run build
+npx playwright install chromium   # only needed without Chrome/Edge
+node dist/cli.js login
+```
+
+## MCP client config
+
+### Cursor
+
+`~/.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "somtoday": {
+      "command": "npx",
+      "args": ["-y", "somtoday-mcp"]
+    }
+  }
+}
+```
+
+### Claude Desktop
+
+`claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "somtoday": {
+      "command": "npx",
+      "args": ["-y", "somtoday-mcp"]
+    }
+  }
+}
+```
+
+### From a local checkout
+
+```json
+{
+  "mcpServers": {
+    "somtoday": {
+      "command": "node",
+      "args": ["/absolute/path/to/somtoday-mcp/dist/cli.js"]
+    }
+  }
+}
+```
+
+## Signing in
+
+Run login in a terminal, not from inside your MCP client:
+
+```bash
+npx -y somtoday-mcp login
+```
+
+1. A browser window (your installed Chrome or Edge, else Playwright Chromium) opens on the regular Somtoday login page. Search for your school there, the same way as in the official app.
+2. Sign in as you normally would, including any two-step verification. You have 10 minutes (the Cloudflare check and school search count too).
+3. When the window closes, the session is saved on your computer and the MCP server can use it.
+
+If you know your school's tenant UUID you can skip the school search with `npx -y somtoday-mcp login --school-uuid <uuid>`.
+
+If a tool is called before you have signed in, or after the saved session stops working, it returns:
+
+`run `npx somtoday-mcp login` in a terminal`
+
+Run login again in that case. If Somtoday cannot be reached, tools say so instead of asking you to log in.
+
+### Commands
+
+```bash
+npx -y somtoday-mcp status           # where the session is stored, last renewal result (no tokens)
+npx -y somtoday-mcp status --check   # also renews the token and calls the API once
+npx -y somtoday-mcp logout           # delete the stored session from this computer
+```
+
+The same diagnostics are available to your MCP client through the `auth_status` tool.
+
+Several MCP clients (for example two Cursor windows) can share one session: token renewal is serialized with a lock file in the config directory, and each renewal re-reads the stored session first.
+
+<details>
+<summary>Technical details</summary>
+
+- OAuth 2.0 authorization code flow with PKCE (S256), using the public (secret-less) client id and redirect URI of Somtoday's native app. There is no client secret and nothing uses the Somtoday Connect partner API.
+- The login page redirects to a custom `somtoday://` URL; Playwright reads the authorization code from that request inside the browser window. No local web server is started.
+- Short-lived access tokens are kept in memory only.
+- The school is chosen on Somtoday's own login page. The school's tenant comes from the token response (`somtoday_tenant`), and the label shown by `whoami` and `status` from the `orgname` claim (or, failing that, the school data of your account).
+
+</details>
+
+### Where the session is stored
+
+| Platform        | Location                                                                                                                                                         |
+| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| macOS           | Login Keychain, service `somtoday-mcp`. Every write is read back and checked; if that fails, or `SOMTODAY_MCP_DISABLE_KEYCHAIN=1` is set, the file below is used |
+| Linux / Windows | `session.json` with `0600` permissions in `$XDG_CONFIG_HOME/somtoday-mcp/` (default `~/.config/somtoday-mcp/`)                                                   |
+
+To sign out, run `npx -y somtoday-mcp logout`.
+
+### Environment variables
+
+| Variable                        | Effect                                                         |
+| ------------------------------- | -------------------------------------------------------------- |
+| `XDG_CONFIG_HOME`               | Base directory for the file fallback (default `~/.config`).    |
+| `SOMTODAY_MCP_CONFIG_DIR`       | Use this directory instead of `$XDG_CONFIG_HOME/somtoday-mcp`. |
+| `SOMTODAY_MCP_DISABLE_KEYCHAIN` | Set to `1` to skip the macOS Keychain and always use the file. |
+
+Logs go to stderr (stdout is reserved for the MCP protocol) and redact token-like values.
+
+## Development
+
+```bash
+npm install
+npm run lint
+npm run format:check
+npm run typecheck
+npm run build
+npm test
+```
+
+Tests never touch the network: `fetch` and the keychain are mocked, and requests to Somtoday hosts fail on purpose. See [CONTRIBUTING.md](CONTRIBUTING.md) for the rules on test data and privacy, and [SECURITY.md](SECURITY.md) for reporting vulnerabilities.
+
+`ouder-portal.openapi.yaml` describes the parts of the parent-portal API this project relies on, as observed from the portal; it is not an official specification.
+
+### Manual check against a real account
+
+Not part of CI. Write down HTTP status codes only; never paste tokens, codes, names, or API responses.
+
+1. `node dist/cli.js login` and complete the sign-in.
+2. Call `whoami`, `lessons`, `homework`, and `grades` from your MCP client.
+3. Restart the MCP server and call a tool again, to check that the saved session is picked up.
+
+## License
+
+[MIT](LICENSE). Not affiliated with Somtoday or Topicus.

package/dist/api/absence.d.ts

@@ -0,0 +1,19 @@
+import type { ApiClient } from "./client.js";
+export declare const REGISTRATION_CATEGORIES: readonly ["ongeoorloofdAfwezig", "geoorloofdAfwezig", "afwezigWaarnemingen", "teLaat", "verwijderd", "huiswerkNietGemaakt", "materiaalNietInOrde"];
+export declare function fetchRegistrations(client: ApiClient, leerlingId: number, periode: "SCHOOLJAAR" | "CIJFERPERIODE"): Promise<{
+    periode: "SCHOOLJAAR" | "CIJFERPERIODE";
+    aantallen: Record<string, number>;
+    registraties: Record<string, unknown[]>;
+}>;
+export declare function fetchActiveMeasures(client: ApiClient, leerlingId: number): Promise<{
+    id: number | undefined;
+    datum: string | undefined;
+    maatregel: string | undefined;
+    opmerkingen: string | undefined;
+    nagekomen: boolean | undefined;
+    automatisch: boolean | undefined;
+    aanleiding: {
+        omschrijving: string | undefined;
+        begin: string | undefined;
+    } | undefined;
+}[]>;

package/dist/api/absence.js

@@ -0,0 +1,66 @@
+import { htmlToPlain } from "../html.js";
+import { linkId } from "./simplify.js";
+import { compact } from "./studiewijzer.js";
+export const REGISTRATION_CATEGORIES = [
+    "ongeoorloofdAfwezig",
+    "geoorloofdAfwezig",
+    "afwezigWaarnemingen",
+    "teLaat",
+    "verwijderd",
+    "huiswerkNietGemaakt",
+    "materiaalNietInOrde",
+];
+function mapLes(afspraak) {
+    return compact({
+        begin: afspraak.beginDatumTijd,
+        lesuur: afspraak.beginLesuur,
+        vak: afspraak.vak?.naam,
+        titel: afspraak.titel,
+    });
+}
+export async function fetchRegistrations(client, leerlingId, periode) {
+    const { body } = await client.get(`/leerlingen/${leerlingId}/registratieOverzicht`, new URLSearchParams({ periode }));
+    const categories = {};
+    const aantallen = {};
+    const keys = new Set([
+        ...REGISTRATION_CATEGORIES,
+        ...Object.keys(body).filter((key) => Array.isArray(body[key])),
+    ]);
+    for (const key of keys) {
+        const entries = body[key] ?? [];
+        aantallen[key] = entries.length;
+        categories[key] = entries
+            .map((entry) => compact({
+            id: entry.registratieId,
+            soort: entry.registratieSoort,
+            begin: entry.begin,
+            eind: entry.eind,
+            omschrijving: htmlToPlain(entry.omschrijving) || undefined,
+            geoorloofd: entry.geoorloofd,
+            afgehandeld: entry.afgehandeld,
+            lessen: [
+                ...(entry.afspraak ? [entry.afspraak] : []),
+                ...(entry.afspraken ?? []),
+            ].map(mapLes),
+        }))
+            .sort((a, b) => (b.begin ?? "").localeCompare(a.begin ?? ""));
+    }
+    return { periode, aantallen, registraties: categories };
+}
+export async function fetchActiveMeasures(client, leerlingId) {
+    const { items } = await client.getAll(`/maatregeltoekenningen/actief/${leerlingId}`);
+    return items.map((item) => compact({
+        id: linkId(item),
+        datum: item.maatregelDatum,
+        maatregel: item.maatregel?.omschrijving,
+        opmerkingen: item.opmerkingen,
+        nagekomen: item.nagekomen,
+        automatisch: item.automatischToegekend,
+        aanleiding: item.veroorzaaktDoor
+            ? compact({
+                omschrijving: item.veroorzaaktDoor.omschrijving,
+                begin: item.veroorzaaktDoor.beginDatumTijd,
+            })
+            : undefined,
+    }));
+}

package/dist/api/account.d.ts

@@ -0,0 +1,22 @@
+import type { ApiClient } from "./client.js";
+export type ChildAccess = {
+    leerlingId: number;
+    huiswerkBekijkenAan: boolean;
+    roosterBekijkenAan: boolean;
+    cijfersBekijkenAan: boolean;
+    vestigingsId?: number;
+    /** Every boolean in the school's restricties for this child (portal section switches). */
+    rights: Record<string, boolean>;
+};
+export declare function loadChildren(client: ApiClient): Promise<ChildAccess[]>;
+/**
+ * Whether the school shows a portal section for this child. Unknown flags
+ * count as allowed (the API itself still answers 403 when not).
+ */
+export declare function hasRight(child: ChildAccess, flag: string): boolean;
+export declare function resolveChild(children: ChildAccess[], requested?: string): ChildAccess;
+export declare class MultipleChildrenError extends Error {
+    readonly children: ChildAccess[];
+    constructor(children: ChildAccess[]);
+}
+export declare function describeChildren(children: ChildAccess[]): unknown;

package/dist/api/account.js

@@ -0,0 +1,58 @@
+export async function loadChildren(client) {
+    const query = new URLSearchParams();
+    query.append("additional", "restricties");
+    const { body } = await client.get("/account/me", query);
+    const items = body.additionalObjects?.restricties?.items ?? [];
+    return items
+        .filter((item) => {
+        return typeof item.leerlingId === "number";
+    })
+        .map((item) => ({
+        leerlingId: item.leerlingId,
+        huiswerkBekijkenAan: item.huiswerkBekijkenAan === true,
+        roosterBekijkenAan: item.roosterBekijkenAan === true,
+        cijfersBekijkenAan: item.cijfersBekijkenAan === true,
+        vestigingsId: typeof item.vestigingsId === "number" ? item.vestigingsId : undefined,
+        rights: Object.fromEntries(Object.entries(item).filter((entry) => typeof entry[1] === "boolean")),
+    }));
+}
+/**
+ * Whether the school shows a portal section for this child. Unknown flags
+ * count as allowed (the API itself still answers 403 when not).
+ */
+export function hasRight(child, flag) {
+    return child.rights[flag] !== false;
+}
+export function resolveChild(children, requested) {
+    if (children.length === 0) {
+        throw new Error("No linked leerling ids on this account");
+    }
+    if (requested) {
+        const id = Number(requested);
+        const match = children.find((child) => child.leerlingId === id);
+        if (!match) {
+            throw new Error(`Unknown leerlingId ${requested}`);
+        }
+        return match;
+    }
+    if (children.length === 1) {
+        return children[0];
+    }
+    throw new MultipleChildrenError(children);
+}
+export class MultipleChildrenError extends Error {
+    children;
+    constructor(children) {
+        super("Multiple linked students; pass leerlingId");
+        this.children = children;
+        this.name = "MultipleChildrenError";
+    }
+}
+export function describeChildren(children) {
+    return children.map((child) => ({
+        leerlingId: child.leerlingId,
+        huiswerkBekijkenAan: child.huiswerkBekijkenAan,
+        roosterBekijkenAan: child.roosterBekijkenAan,
+        cijfersBekijkenAan: child.cijfersBekijkenAan,
+    }));
+}

package/dist/api/assignments.d.ts

@@ -0,0 +1,49 @@
+import type { ApiClient } from "./client.js";
+import { type AttachmentView, type StudiewijzerItemView } from "./studiewijzer.js";
+export type AssignmentCategory = "AANKOMEND" | "IN_TE_LEVEREN" | "IN_AFWACHTING" | "AKKOORD";
+export type AssignmentView = StudiewijzerItemView & {
+    categorie?: AssignmentCategory;
+    teLaat?: boolean;
+};
+/** Same buckets as the portal's assignment list. */
+export declare function categorize(item: StudiewijzerItemView, now: Date): {
+    categorie?: AssignmentCategory;
+    teLaat?: boolean;
+};
+export declare function fetchAssignments(client: ApiClient, leerlingId: number, now: Date): Promise<AssignmentView[]>;
+/**
+ * One assignment from exactly the list `assignments` returns (same request,
+ * all Range pages, same mapping and filter). Ids are compared as strings.
+ */
+export declare function findAssignment(client: ApiClient, leerlingId: number, toekenningId: string | number, now: Date): Promise<{
+    item?: AssignmentView;
+    total: number;
+}>;
+export type SubmissionView = {
+    id?: number;
+    verzendDatum?: string;
+    status: string;
+    statusGewijzigd?: string;
+    naam?: string;
+    fileUrl?: string;
+    fileExtension?: string;
+    url?: string;
+    ingeleverdDoor?: string;
+};
+/**
+ * Submissions and teacher reactions. Student sessions only: the portal calls
+ * this solely when the current context is a student, and a parent session
+ * gets HTTP 400. Not used by the parent tools; kept for a future student mode.
+ */
+export declare function fetchAssignmentDetail(client: ApiClient, toekenningId: number): Promise<{
+    aantalInleveringenInVerwerking: number;
+    inleveringen: SubmissionView[];
+    reacties: Array<{
+        verzendDatum?: string;
+        van?: string;
+        doorJou?: boolean;
+        onderwerp?: string;
+        inhoud?: string;
+        bijlagen?: AttachmentView[];
+    }>;
+}>;

package/dist/api/assignments.js

@@ -0,0 +1,93 @@
+import { amsterdamYmd } from "../dates.js";
+import { htmlToPlain } from "../html.js";
+import { handInQuery } from "./homework.js";
+import { linkId } from "./simplify.js";
+import { compact, compactItem, mapAttachment, mapStudiewijzerItem, } from "./studiewijzer.js";
+/** Same buckets as the portal's assignment list. */
+export function categorize(item, now) {
+    const start = item.inlevermoment?.start
+        ? new Date(item.inlevermoment.start)
+        : undefined;
+    const eind = item.inlevermoment?.eind
+        ? new Date(item.inlevermoment.eind)
+        : undefined;
+    if (!start)
+        return {};
+    if (start > now)
+        return { categorie: "AANKOMEND" };
+    const status = item.inleverStatus;
+    if (!status || status === "HEROPEND") {
+        return {
+            categorie: "IN_TE_LEVEREN",
+            teLaat: eind ? eind < now : undefined,
+        };
+    }
+    if (status === "TE_BEOORDELEN" || status === "IN_BEHANDELING") {
+        return { categorie: "IN_AFWACHTING" };
+    }
+    if (status === "AKKOORD")
+        return { categorie: "AKKOORD" };
+    return {};
+}
+export async function fetchAssignments(client, leerlingId, now) {
+    const { items } = await client.getAll("/studiewijzeritemdagtoekenningen", handInQuery(leerlingId));
+    return (items
+        .map((raw) => ({
+        raw,
+        view: mapStudiewijzerItem(raw, leerlingId, amsterdamYmd),
+    }))
+        // Like the portal: group assignments only count once the child is in a group.
+        .filter(({ raw, view }) => !(raw.studiewijzerItem?.projectgroepen && !view.projectgroep))
+        .map(({ view }) => compactItem({ ...view, ...categorize(view, now) }))
+        .sort((a, b) => (a.inlevermoment?.eind ?? "").localeCompare(b.inlevermoment?.eind ?? "")));
+}
+/**
+ * One assignment from exactly the list `assignments` returns (same request,
+ * all Range pages, same mapping and filter). Ids are compared as strings.
+ */
+export async function findAssignment(client, leerlingId, toekenningId, now) {
+    const all = await fetchAssignments(client, leerlingId, now);
+    const wanted = String(toekenningId).trim();
+    return {
+        item: all.find((entry) => String(entry.toekenningId) === wanted),
+        total: all.length,
+    };
+}
+/**
+ * Submissions and teacher reactions. Student sessions only: the portal calls
+ * this solely when the current context is a student, and a parent session
+ * gets HTTP 400. Not used by the parent tools; kept for a future student mode.
+ */
+export async function fetchAssignmentDetail(client, toekenningId) {
+    const { body } = await client.get(`/studiewijzeritemdagtoekenningen/inleverdetails/${toekenningId}`);
+    return {
+        aantalInleveringenInVerwerking: body.aantalInleveringenInVerwerking ?? 0,
+        inleveringen: (body.inleveringen ?? []).map((inlevering) => {
+            const file = mapAttachment({
+                assemblyResults: inlevering.assemblyResults,
+            });
+            const isLink = !file && !inlevering.uploadContext && inlevering.inhoud;
+            return compact({
+                id: linkId(inlevering),
+                verzendDatum: inlevering.verzendDatum,
+                status: inlevering.status ?? "TE_BEOORDELEN",
+                statusGewijzigd: inlevering.wijzigingsDatum,
+                naam: file?.fileName ?? (isLink ? inlevering.inhoud : undefined),
+                fileUrl: file?.fileUrl,
+                fileExtension: file?.fileExtension,
+                url: isLink ? inlevering.inhoud : undefined,
+                ingeleverdDoor: inlevering.additionalObjects?.GROEP_INLEVERAAR,
+            });
+        }),
+        reacties: (body.conversatie?.boodschappen ?? []).map((boodschap) => compact({
+            verzendDatum: boodschap.verzendDatum,
+            van: boodschap.additionalObjects?.verzenderCorrespondent?.naam,
+            doorJou: boodschap.additionalObjects?.verzondenDoorGebruiker,
+            onderwerp: boodschap.onderwerp,
+            inhoud: htmlToPlain(boodschap.inhoud) || undefined,
+            bijlagen: (boodschap.bijlages ?? [])
+                .map(mapAttachment)
+                .filter((value) => Boolean(value)),
+        })),
+    };
+}

package/dist/api/client.d.ts

@@ -0,0 +1,64 @@
+import type { SessionManager } from "../auth/session.js";
+import type { FetchFn } from "../auth/tokens.js";
+export type ApiResponse<T> = {
+    status: number;
+    body: T;
+    contentRange?: string;
+};
+export type GetOptions = {
+    /** `json` for the endpoints that expect plain application/json (news, school info, signing). */
+    accept?: "platinum" | "json";
+    /** Inclusive item range, sent as `Range: items=start-end`. */
+    range?: {
+        start: number;
+        end: number;
+    };
+};
+export type AllOptions = {
+    accept?: "platinum" | "json";
+    /** Items per request (the server allows at most 100). */
+    pageSize?: number;
+    /** Stop after this many items. */
+    maxItems?: number;
+    /** Sees every page body (for top-level fields next to `items`). */
+    onPage?: (body: unknown) => void;
+};
+export declare const PAGE_SIZE = 100;
+export declare const MAX_PAGES = 100;
+/**
+ * The API answered with a real "no": a 403 with a body (for example no
+ * study planner yet, or a section the school switched off) or a 404.
+ * Tools report this as `available: false` instead of an error.
+ */
+export declare class ApiNotAvailableError extends Error {
+    readonly status: number;
+    readonly path: string;
+    constructor(status: number, path: string);
+}
+export declare class ApiClient {
+    private readonly session;
+    private readonly fetchFn;
+    constructor(session: SessionManager, fetchFn?: FetchFn);
+    get<T>(path: string, query?: URLSearchParams, options?: GetOptions): Promise<ApiResponse<T>>;
+    /**
+     * Fetch every item of a list endpoint the way the portal does: request
+     * `Range: items=a-b` in pages of at most 100 and continue while
+     * `Content-Range: items a-b/total` says there is more. A response without
+     * Content-Range is complete. Accepts `{items: [...]}` and top-level arrays.
+     */
+    getAll<T>(path: string, query?: URLSearchParams, options?: AllOptions): Promise<{
+        items: T[];
+        total?: number;
+    }>;
+    private url;
+    private send;
+    private read;
+}
+export declare function listItems<T>(body: unknown): T[];
+export declare function parseContentRange(header?: string): {
+    start: number;
+    end: number;
+    total?: number;
+} | undefined;
+export declare function parseContentRangeTotal(header?: string): number | undefined;
+export declare function repeatedParams(key: string, values: readonly string[], into?: import("url").URLSearchParams): URLSearchParams;