queenscoach 1.1.0__tar.gz

queenscoach-1.1.0/.dockerignore

@@ -0,0 +1,15 @@
+.git
+.github
+.venv
+.env
+**/__pycache__
+**/*.py[cod]
+.pytest_cache
+.mypy_cache
+.ruff_cache
+build
+dist
+*.egg-info
+deploy
+scripts
+tests

queenscoach-1.1.0/.env.example

@@ -0,0 +1,23 @@
+# HTTP transport with Google OAuth. Copy to .env and fill in; .env is gitignored.
+# Not needed for the stdio transport.
+
+QUEENSCOACH_TRANSPORT=http
+
+# From an OAuth 2.0 "Web application" client at
+# https://console.cloud.google.com/apis/credentials
+# Its authorized redirect URI must be exactly <QUEENSCOACH_PUBLIC_URL>/auth/google/callback
+QUEENSCOACH_GOOGLE_CLIENT_ID=
+QUEENSCOACH_GOOGLE_CLIENT_SECRET=
+
+# Who may use the server. At least one of these three is required; without one
+# the server refuses to start rather than admitting every Google account.
+QUEENSCOACH_ALLOWED_EMAILS=you@example.com
+# QUEENSCOACH_ALLOWED_DOMAINS=example.com
+# QUEENSCOACH_ALLOW_ANY_GOOGLE_ACCOUNT=false
+
+# The externally reachable origin: what clients dial, and this server's OAuth
+# issuer. Must be https unless it is loopback.
+QUEENSCOACH_PUBLIC_URL=https://queenscoach.example.com
+
+# QUEENSCOACH_HTTP_HOST=127.0.0.1
+# QUEENSCOACH_HTTP_PORT=8000

queenscoach-1.1.0/.github/workflows/ci.yml

@@ -0,0 +1,104 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  # So the release workflow can gate a publish on this same suite.
+  workflow_call:
+
+permissions:
+  contents: read
+
+# A newer push to the same branch makes an in-flight run redundant.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - run: pip install -e ".[dev]"
+      - run: pytest
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          # The version pyproject targets for ruff and mypy.
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - run: pip install -e ".[dev]"
+      - run: ruff check
+      - run: ruff format --check
+      - run: mypy
+
+  # stdio exactly as a PyPI or MCP-registry user gets it: no optional extras.
+  stdio-plain-install:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - run: pip install . pytest pytest-asyncio
+      - name: The gcp extra must not arrive with a plain install
+        run: |
+          python - <<'PY'
+          import importlib.util, sys
+
+          try:
+              found = importlib.util.find_spec("google.cloud.firestore") is not None
+          except ModuleNotFoundError:
+              found = False
+          sys.exit("google-cloud-firestore is installed without the gcp extra" if found else 0)
+          PY
+      - run: queenscoach --version
+      - run: pytest tests/test_stdio.py
+
+  # The Firestore token store against the emulator; the main suite skips it.
+  firestore:
+    runs-on: ubuntu-latest
+    env:
+      FIRESTORE_EMULATOR_HOST: 127.0.0.1:8085
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      # The emulator is a Java program shipped as a gcloud component.
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+      - uses: google-github-actions/setup-gcloud@v2
+        with:
+          install_components: beta,cloud-firestore-emulator
+      - run: pip install -e ".[dev]"
+      - name: Start the Firestore emulator
+        run: |
+          gcloud emulators firestore start --host-port="$FIRESTORE_EMULATOR_HOST" > emulator.log 2>&1 &
+          for _ in $(seq 1 60); do
+            curl -sf "http://$FIRESTORE_EMULATOR_HOST" > /dev/null && exit 0
+            sleep 1
+          done
+          cat emulator.log
+          exit 1
+      - run: pytest tests/test_token_store.py

queenscoach-1.1.0/.github/workflows/release.yml

@@ -0,0 +1,119 @@
+name: Release
+
+# Cutting a version means pushing a tag: `git tag v1.0.1 && git push origin v1.0.1`.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  # PyPI refuses a re-upload, so a version mismatch is unrecoverable under that
+  # tag. Catch it before anything is built.
+  check-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          # tomllib needs 3.11+; don't depend on the runner's default.
+          python-version: "3.11"
+      - name: Tag must match pyproject.toml, server.json, and SERVER_VERSION
+        run: |
+          python - <<'PY'
+          import json, os, re, sys, tomllib
+
+          tag = os.environ["GITHUB_REF_NAME"].removeprefix("v")
+          server = json.load(open("server.json"))
+          # What the server reports to clients in its MCP initialize response.
+          init = open("src/queenscoach/__init__.py").read()
+          reported = re.search(r'^SERVER_VERSION = "([^"]+)"', init, re.MULTILINE)
+          found = {
+              "pyproject.toml": tomllib.load(open("pyproject.toml", "rb"))["project"]["version"],
+              "server.json (version)": server["version"],
+              "server.json (packages[0].version)": server["packages"][0]["version"],
+              "src/queenscoach/__init__.py (SERVER_VERSION)": reported.group(1) if reported else None,
+          }
+          bad = {where: got for where, got in found.items() if got != tag}
+          for where, got in bad.items():
+              print(f"::error::tag is {tag} but {where} is {got}")
+          sys.exit(1 if bad else 0)
+          PY
+
+  test:
+    needs: check-version
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    # Must match the environment named in the PyPI trusted publisher.
+    environment: pypi
+    permissions:
+      # Mints the short-lived OIDC token PyPI trusts. No API token to store.
+      id-token: write
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - run: pip install build
+      - run: python -m build
+      - name: Check the built distributions
+        run: pipx run twine check --strict dist/*
+      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish-registry:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      # mcp-publisher trades this for a registry token; no secret to store.
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+      - name: Wait for the release to be visible on PyPI
+        # The registry verifies the mcp-name marker by reading the package
+        # description off PyPI, so it has to be able to see this version.
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          for attempt in $(seq 1 20); do
+            if curl -sf "https://pypi.org/pypi/queenscoach/$version/json" > /dev/null; then
+              echo "queenscoach $version is on PyPI"
+              exit 0
+            fi
+            echo "attempt $attempt: not visible yet, retrying in 15s"
+            sleep 15
+          done
+          echo "::error::queenscoach $version never appeared on PyPI"
+          exit 1
+      - name: Install mcp-publisher
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+      - name: Authenticate to the MCP Registry
+        run: ./mcp-publisher login github-oidc
+      - name: Publish to the MCP Registry
+        run: ./mcp-publisher publish
+
+  github-release:
+    needs: [publish, publish-registry]
+    runs-on: ubuntu-latest
+    permissions:
+      # Creating the release writes to the repo.
+      contents: write
+    steps:
+      # Only so gh infers the repository; the notes come from the API.
+      - uses: actions/checkout@v5
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Create the GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" dist/* --generate-notes

queenscoach-1.1.0/.gitignore

@@ -0,0 +1,14 @@
+__pycache__/
+*.py[cod]
+.venv/
+build/
+dist/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+*.log
+.env
+
+# Local working notes and prompts, never committed.
+*scratchpad*.md

queenscoach-1.1.0/Dockerfile

@@ -0,0 +1,27 @@
+# The HTTP transport for a hosted deployment, as scripts/deploy-gcp.sh builds it
+# on Cloud Build. The stdio server does not need this: `pip install queenscoach`.
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+WORKDIR /app
+COPY pyproject.toml README.md LICENSE ./
+COPY src ./src
+# The gcp extra adds the Firestore token store (QUEENSCOACH_TOKEN_STORE=firestore).
+RUN pip install '.[gcp]' \
+ && useradd --system --no-create-home --uid 10001 queenscoach
+
+USER queenscoach
+
+# Cloud Run delivers traffic to port 8080 by default. The server binds every
+# interface because the platform's front end is the only way in; it still
+# requires QUEENSCOACH_PUBLIC_URL, the Google client, and an allow list at runtime.
+ENV QUEENSCOACH_TRANSPORT=http \
+    QUEENSCOACH_HTTP_HOST=0.0.0.0 \
+    QUEENSCOACH_HTTP_PORT=8080
+
+EXPOSE 8080
+CMD ["queenscoach"]

queenscoach-1.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Adam Wanninger
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.