chore(deps): Bump fast-uri from 3.1.0 to 3.1.2 in /packages/mcp

.env.example

@@ -1,16 +1,96 @@
-# PostgreSQL (로컬)
-DATABASE_URL=postgresql://postgres:postgres@localhost:5432/fractional
+# Practiq — self-host environment template.
+#
+# Copy to .env.local before `docker compose up`:
+#   cp .env.example .env.local
+#
+# Required values are marked REQUIRED. Everything else is optional —
+# Practiq runs in degraded-but-functional mode when optional services
+# are unavailable.
 
-# Claude AI — Claude Code 구독 CLI 사용 시 API 키 불필요. API 직접 사용 시만 설정.
-# ANTHROPIC_API_KEY=
+# ─── REQUIRED ──────────────────────────────────────────────────────────
 
-# NextAuth.js
+# Cookie HMAC secret. Generate with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+NEXTAUTH_SECRET=
+
+# At least one LLM provider key. Practiq routes all LLM calls through this.
+# Sign up: https://openrouter.ai/ (recommended — single key, multi-provider)
+#       or https://console.anthropic.com/ (Anthropic direct)
+OPENROUTER_API_KEY=
+ANTHROPIC_API_KEY=
+
+# ─── OPTIONAL — Database ───────────────────────────────────────────────
+# Default values match the docker-compose.yml internal network. Override
+# only if you're running an external Postgres (cloud-managed, etc.).
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=postgres
+POSTGRES_DB=practiq
+POSTGRES_PORT=5432
+
+# ─── OPTIONAL — Public URL ─────────────────────────────────────────────
+# Set this when deploying behind a domain (e.g. https://practiq.yourcompany.com).
+# Defaults to http://localhost:3000 for local dev.
 NEXTAUTH_URL=http://localhost:3000
-NEXTAUTH_SECRET=your-random-secret-here
+WEB_PORT=3000
 
-# Google OAuth (NextAuth Provider)
+# ─── OPTIONAL — OAuth Sign-in providers ────────────────────────────────
+# If unset, sign-in falls back to credentials (email+password).
+# Each provider is conditionally registered — missing CLIENT_ID + SECRET
+# silently drops it from the sign-in page.
+
+# Google OAuth — https://console.cloud.google.com/apis/credentials
+# Authorized redirect URI: ${NEXTAUTH_URL}/api/auth/callback/google
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 
-# FastAPI Document Service
-DOCUMENT_SERVICE_URL=http://localhost:8000
+# LinkedIn OAuth — https://www.linkedin.com/developers/apps
+# Authorized redirect URI: ${NEXTAUTH_URL}/api/auth/callback/linkedin
+LINKEDIN_CLIENT_ID=
+LINKEDIN_CLIENT_SECRET=
+
+# Microsoft Entra ID (Azure AD) — https://entra.microsoft.com/
+# Authorized redirect URI: ${NEXTAUTH_URL}/api/auth/callback/microsoft-entra-id
+MICROSOFT_ENTRA_ID_CLIENT_ID=
+MICROSOFT_ENTRA_ID_CLIENT_SECRET=
+MICROSOFT_ENTRA_ID_TENANT_ID=
+
+# ─── OPTIONAL — Stripe billing ─────────────────────────────────────────
+# Most self-hosters can ignore these. Practiq's billing UI is hidden
+# when STRIPE_SECRET_KEY is unset, and all features remain available
+# (since you self-host, you're not paying us anyway).
+#
+# If you want to expose paid tiers to your own users (multi-tenant SaaS
+# scenario), follow docs/self-host/billing.md.
+STRIPE_SECRET_KEY=
+STRIPE_WEBHOOK_SECRET=
+NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
+
+# ─── OPTIONAL — Telemetry ──────────────────────────────────────────────
+# OFF by default for self-hosters. If enabled, sends anonymized usage
+# pings to telemetry.practiq.dev (you can self-host the receiver too —
+# see docs/self-host/telemetry.md). No PII. No client data. Just:
+#   • Practiq version
+#   • Number of active users (count, not identities)
+#   • Number of clients in the system (count)
+#   • Crash reports (sanitized stack traces, no payloads)
+#
+# Set to "on" to opt in. Anything else (including empty) means OFF.
+PRACTIQ_TELEMETRY=off
+
+# ─── OPTIONAL — Email ─────────────────────────────────────────────────
+# When unset, password-reset and email-verification fall back to a console-
+# log "magic link" you can copy from `docker compose logs web`. Fine for
+# single-user self-host; you'll want a real provider for a team deploy.
+#
+# Resend is what practiq.dev uses; any SMTP works via the standard env vars.
+RESEND_API_KEY=
+RESEND_FROM_EMAIL=
+
+# ─── OPTIONAL — Pixels / analytics (zero by default) ──────────────────
+# These ad pixels exist for practiq.dev's growth funnel. Self-hosters
+# leave them empty — components render nothing with zero runtime cost.
+NEXT_PUBLIC_POSTHOG_KEY=
+NEXT_PUBLIC_POSTHOG_HOST=
+NEXT_PUBLIC_META_PIXEL_ID=
+NEXT_PUBLIC_LINKEDIN_PARTNER_ID=
+NEXT_PUBLIC_X_PIXEL_ID=

.gitattributes

@@ -0,0 +1,23 @@
+# Force LF for line-ending-sensitive files. Without this, Windows checkouts
+# convert to CRLF and Tailwind v4 / lightningcss / some serializers refuse
+# to parse the file.
+*.css            text eol=lf
+*.scss           text eol=lf
+*.json           text eol=lf
+*.md             text eol=lf
+*.yaml           text eol=lf
+*.yml            text eol=lf
+*.sh             text eol=lf
+*.bash           text eol=lf
+Dockerfile*      text eol=lf
+*.dockerfile     text eol=lf
+*.tgz            binary
+*.gz             binary
+*.zip            binary
+*.png            binary
+*.jpg            binary
+*.jpeg           binary
+*.ico            binary
+*.pdf            binary
+*.node           binary
+*.dll            binary

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,48 @@
+---
+name: Bug report
+about: Something is broken
+title: "[bug] "
+labels: bug
+assignees: ''
+---
+
+## What happened
+
+A clear, concise description of the bug.
+
+## Expected behavior
+
+What you expected to happen.
+
+## Reproduction
+
+Minimum steps to reproduce:
+1. ...
+2. ...
+3. ...
+
+## Environment
+
+- **Where**: cloud (practiq.dev) / self-hosted Docker / `@cliwant/practiq-mcp` npm / dev clone
+- **MCP client** (if relevant): Claude Desktop X.Y / Claude Code X.Y / Cursor X.Y / other
+- **OS**: macOS X.Y / Ubuntu X.Y / Windows X
+- **Node version** (if relevant): `node -v`
+- **Practiq version**: `npm view @cliwant/practiq-mcp version` or commit SHA
+- **Browser** (if web app): Chrome X / Firefox X / Safari X
+
+## Logs / error output
+
+```
+paste relevant log snippet, stack trace, or screenshot here
+```
+
+If on self-hosted Docker: `docker compose logs --tail=200 web`
+If `@cliwant/practiq-mcp`: stderr from the MCP server (Claude Desktop logs it).
+
+## Anything else
+
+Optional — links to related issues, hypotheses about root cause, etc.
+
+---
+
+**Security?** Do not file a public issue for security bugs. See [SECURITY.md](../../SECURITY.md).

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,36 @@
+---
+name: Feature request
+about: Propose a new feature or improvement
+title: "[feat] "
+labels: enhancement
+assignees: ''
+---
+
+## Problem
+
+What problem does this solve? Why is the current state inadequate?
+
+(Bad: "Add X." Good: "When I'm managing 120 clients during tax season, I currently
+can't see <Y>, which means <Z>.")
+
+## Proposed solution
+
+What you'd like to see happen. Be specific — UI sketches, API shapes, tool signatures
+all welcome.
+
+## Alternatives considered
+
+What else have you tried? What's the workaround today?
+
+## Who benefits
+
+Solo CPAs / mid-size accounting firms / law firms / HR advisory / consulting / agency / all?
+Are you that user? (We weight feature requests from real practitioners heavily.)
+
+## Scope / non-scope
+
+What's explicitly NOT included in this proposal? (Helps reviewers calibrate.)
+
+## Anything else
+
+Links to similar features in other products, prior art, etc.

.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,23 @@
+---
+name: Question / help
+about: Ask a question about using or self-hosting Practiq
+title: "[q] "
+labels: question
+assignees: ''
+---
+
+> Please check first: **README.md**, **practiq.dev/docs**, and existing closed issues
+> with the [`question`](https://github.com/cliwant/practiq-oss/issues?q=is%3Aissue+label%3Aquestion+is%3Aclosed) label.
+
+## Question
+
+What do you want to know?
+
+## Context
+
+What are you trying to do? What have you tried? What's confusing about the docs?
+(Confusing docs are a bug — please tell us where you got stuck.)
+
+## Environment (if relevant)
+
+Same as the bug template — where you're running Practiq, which MCP client, OS, version.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,39 @@
+<!-- Thanks for the PR! See CONTRIBUTING.md for the full rules.
+     A few quick reminders so this PR can land fast: -->
+
+## What & why
+
+<!-- 1-3 sentences. The maintainer reads this first.
+     Bad: "Improved morning_briefing."
+     Good: "morning_briefing previously returned only the first 10 clients sorted
+            alphabetically. Now it sorts by priority score so a 120-client firm sees
+            their urgent clients first." -->
+
+## How tested
+
+<!-- Be honest about what you actually exercised.
+     - [ ] Manual smoke against my own ~/.practiq/ data
+     - [ ] Vitest unit test (commit hash)
+     - [ ] Playwright e2e (commit hash)
+     - [ ] CI green
+     - [ ] None — please review carefully -->
+
+## Breaking change?
+
+<!-- - [ ] No
+     - [ ] Yes — describe what callers must change.
+     If yes, also add the `breaking` label and bump the next release accordingly. -->
+
+## Linked issue(s)
+
+<!-- Closes #N / Refs #N -->
+
+## Checklist
+
+- [ ] Followed Conventional Commits in the PR title (`feat:`, `fix:`, `docs:`, ...)
+- [ ] `npm run type-check` passes
+- [ ] `npm run lint` passes
+- [ ] New code has tests (or there's a good reason it doesn't)
+- [ ] Docs updated if behavior changed
+- [ ] No `.env`, secrets, or customer data added to the diff
+- [ ] AGPL-3.0 compatible (no closed-source deps, no binary blobs without source)

.github/workflows/ci.yml

@@ -0,0 +1,100 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  type-check:
+    name: Type check (TypeScript)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm install --no-audit --no-fund
+      # The Prisma client generates to src/generated/prisma (custom output);
+      # tsc needs it present or every prisma.* call resolves to `any`.
+      - run: npx prisma generate
+      - run: npm run type-check
+
+  lint:
+    name: Lint (eslint)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm install --no-audit --no-fund
+      - run: npm run lint
+
+  build:
+    name: Build (all workspaces)
+    runs-on: ubuntu-22.04
+    env:
+      # `next build` of this heavy app (pdfjs/exceljs/pptxgenjs/tiptap/...)
+      # exceeds the default V8 heap on the 7 GB runner → OOM. Raise it.
+      NODE_OPTIONS: --max-old-space-size=6144
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm install --no-audit --no-fund
+      - run: npm run build
+
+  test:
+    name: Test (vitest)
+    runs-on: ubuntu-22.04
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: practiq_test
+        ports: ['5432:5432']
+        options: >-
+          --health-cmd="pg_isready -U postgres"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/practiq_test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm install --no-audit --no-fund
+      - run: npx prisma generate
+      - run: npm run test --if-present
+
+  mcp-pack-check:
+    name: '@cliwant/practiq-mcp — npm pack dry-run'
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm install --no-audit --no-fund
+      - run: npm run build --workspace=packages/mcp
+      - name: Verify tarball contents
+        run: |
+          cd packages/mcp
+          npm pack --dry-run --json > /tmp/pack.json
+          echo "Tarball size: $(jq -r '.[0].size' /tmp/pack.json) bytes"
+          # Fail if tarball > 200KB — sanity check that we didn't accidentally ship src/
+          test "$(jq -r '.[0].size' /tmp/pack.json)" -lt 204800 || (echo "Tarball too large — check files/.npmignore" && exit 1)