@aioproductoscom/mcp 0.15.9 → 0.16.0

package/dist/server.d.ts

@@ -0,0 +1,20 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { type RestCall } from "./registry.js";
+/** What the server needs from the outside world — injected so tests can stub
+ *  the platform without a network. */
+export interface ServerDeps {
+    version: string;
+    /** Execute one REST call against the platform. Never throws for HTTP errors —
+     *  only for transport failures (which the dispatcher catches). */
+    request: (call: RestCall) => Promise<{
+        ok: boolean;
+        status: number;
+        text: string;
+    }>;
+    /** Optional decorator over every tool result's content — the update banner
+     *  rides through here (index.ts owns the once-only bookkeeping). */
+    decorate?: (content: ContentBlock[]) => ContentBlock[];
+}
+type ContentBlock = Record<string, unknown>;
+export declare function createPmServer(deps: ServerDeps): Server;
+export {};

package/dist/server.js

@@ -0,0 +1,128 @@
+// The stdio MCP server, DERIVED from the shared tool registry (registry.ts) —
+// the same single source of truth the hosted /api/mcp connector serves. That
+// is the whole architecture: one registry entry per tool, and both transports
+// (hosted HTTP and this stdio process) read it, so the two surfaces cannot
+// drift in tool set, descriptions, schemas, or annotations. Before this file,
+// parity was 872 hand-written lines kept in sync by discipline alone.
+//
+// tools/list mirrors the hosted dispatcher exactly: title, description, input
+// schema (with worked-example arguments folded into JSON-Schema `examples`),
+// behaviour annotations (readOnlyHint / destructiveHint / …), and the examples
+// array. tools/call executes the registry's transport-agnostic RestCall
+// through the injected platform client, and attaches the tool's rich ui://
+// card when one is defined — text first, always, so hosts without MCP-UI
+// rendering lose nothing.
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { annotationsFor, MCP_TOOLS, MCP_TOOLS_BY_NAME } from "./registry.js";
+const INSTRUCTIONS = "You manage product work on AIOProductOS for the connected member — board, insights, features, and " +
+    "analytics all hang off one spine. Call get_pm_playbook first for how to operate: ground in " +
+    "get_product_brain, keep work tied to the spine (insight→feature→task→outcome), and prioritize on " +
+    "evidence (affected accounts + MRR + reach), never an invented score. Resolve names to ids with " +
+    "pm_meta before create_task / update_task; never guess an id. Confirm what you changed in plain " +
+    "language, and claim only writes you actually made.";
+/** The slash-command routines. Stdio-only on purpose: prompts surface as host
+ *  slash commands (e.g. /productos:standup), a concept of the local host; the
+ *  hosted connector's clients drive routines through their own UX. */
+const PROMPTS = [
+    {
+        name: "standup",
+        description: "Board standup — what moved, what's blocked, what needs you today (read-only).",
+        body: "Run the product standup for the connected org. Read-only — don't change anything.\n" +
+            "1) pm_meta to resolve lists / statuses / members.\n" +
+            "2) list_tasks to read the active board.\n" +
+            "Report briefly: what's in progress, what's blocked (and why), what's gone stale with no movement, and the 1–3 " +
+            "decisions that need a human today. Pull get_product_brain if revenue/account context sharpens the call. " +
+            "End with the single most important thing to do next.",
+    },
+    {
+        name: "triage",
+        description: "Triage — turn fresh customer signal into prioritized, spine-linked work.",
+        body: "Run intake triage for the connected org. Follow get_pm_playbook.\n" +
+            "1) get_product_brain — ground in revenue, top accounts, recent verbatim signal, and open work.\n" +
+            "2) Review the board (list_tasks, pm_meta) and any fresh insights.\n" +
+            "3) Prioritize on EVIDENCE — affected accounts + MRR + reach — never an invented score.\n" +
+            "4) Make the writes you're confident in: create_task / update_task, linking insight→feature→task; " +
+            "assign owners; place the clear ones in the current sprint. SURFACE the judgment calls for a human instead of guessing.\n" +
+            "Confirm only the writes you actually made.",
+    },
+    {
+        name: "daily",
+        description: "Daily PM briefing — your plate, blockers, and the one thing to do next.",
+        body: "Give the connected member their daily briefing.\n" +
+            "1) get_product_brain for context.\n" +
+            "2) list_tasks + pm_meta — what's assigned to them, what's blocked, what's overdue or stale.\n" +
+            "3) Scan the support inbox (list_conversations) and upcoming calls (list_bookings) for anything urgent.\n" +
+            "Output a tight briefing: top priorities today, blockers needing a decision, and ONE recommended next action. " +
+            "Read-only unless they ask you to act.",
+    },
+];
+export function createPmServer(deps) {
+    const server = new Server({ name: "AIOProductOS", version: deps.version }, { capabilities: { tools: {}, prompts: {} }, instructions: INSTRUCTIONS });
+    const decorate = deps.decorate ?? ((c) => c);
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: MCP_TOOLS.map((t) => {
+            // Same derivation as the hosted dispatcher: worked-example arguments fold
+            // into JSON-Schema `examples`; no-arg examples ({}) are dropped as noise.
+            const argExamples = (t.examples ?? []).map((e) => e.arguments).filter((a) => Object.keys(a).length > 0);
+            const inputSchema = (argExamples.length ? { ...t.inputSchema, examples: argExamples } : t.inputSchema);
+            return {
+                name: t.name,
+                ...(t.title ? { title: t.title } : {}),
+                description: t.description,
+                inputSchema,
+                annotations: annotationsFor(t),
+            };
+        }),
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const name = req.params.name;
+        const args = req.params.arguments ?? {};
+        const tool = MCP_TOOLS_BY_NAME[name];
+        if (!tool) {
+            return { content: decorate([{ type: "text", text: `Unknown tool: ${name}` }]), isError: true };
+        }
+        if (tool.kind === "static") {
+            return { content: decorate([{ type: "text", text: tool.run(args) }]) };
+        }
+        try {
+            const res = await deps.request(tool.rest(args));
+            const content = [
+                { type: "text", text: res.text || (res.ok ? "(no content)" : `HTTP ${res.status}`) },
+            ];
+            // Rich ui:// card when the tool defines one — purely additive, text is
+            // always first, and a render failure never breaks the call.
+            if (res.ok && tool.htmlView) {
+                try {
+                    const html = tool.htmlView(res.text);
+                    if (html) {
+                        content.push({
+                            type: "resource",
+                            resource: { uri: `ui://aioproductos/${tool.name}`, mimeType: "text/html", text: html },
+                        });
+                    }
+                }
+                catch {
+                    /* text already carries the data */
+                }
+            }
+            return { content: decorate(content), ...(res.ok ? {} : { isError: true }) };
+        }
+        catch (e) {
+            return { content: decorate([{ type: "text", text: `Tool call failed: ${String(e)}` }]), isError: true };
+        }
+    });
+    server.setRequestHandler(ListPromptsRequestSchema, async () => ({
+        prompts: PROMPTS.map((p) => ({ name: p.name, description: p.description })),
+    }));
+    server.setRequestHandler(GetPromptRequestSchema, async (req) => {
+        const p = PROMPTS.find((x) => x.name === req.params.name);
+        if (!p)
+            throw new Error(`Unknown prompt: ${req.params.name}`);
+        return {
+            description: p.description,
+            messages: [{ role: "user", content: { type: "text", text: p.body } }],
+        };
+    });
+    return server;
+}

package/dist/ui-views.d.ts

@@ -0,0 +1,15 @@
+/**
+ * #65 — MCP Apps `ui://` rich artifacts. A REST tool can attach a self-contained
+ * HTML card to its result; the dispatch embeds it as a `ui://` resource AFTER the
+ * text block. Hosts that support MCP-UI render the card; every other host shows
+ * the text — so this is a progressive enhancement, never a facade (the data is
+ * always present). Each view parses the tool's JSON and returns standalone HTML
+ * (inline styles, host-neutral tokens) or null if the shape doesn't render.
+ *
+ * SECURITY: all dynamic values are HTML-escaped — the card is rendered in the
+ * host's webview, so even the org's own text must never break out of markup.
+ */
+export declare function escapeHtml(s: unknown): string;
+/** Rich card for get_weekly_signal_memo. Handles both the stored row (inputs_count)
+ *  and the on-the-fly build (inputsCount). Returns null on any shape mismatch. */
+export declare function weeklyMemoHtml(raw: string): string | null;

package/dist/ui-views.js

@@ -0,0 +1,71 @@
+/**
+ * #65 — MCP Apps `ui://` rich artifacts. A REST tool can attach a self-contained
+ * HTML card to its result; the dispatch embeds it as a `ui://` resource AFTER the
+ * text block. Hosts that support MCP-UI render the card; every other host shows
+ * the text — so this is a progressive enhancement, never a facade (the data is
+ * always present). Each view parses the tool's JSON and returns standalone HTML
+ * (inline styles, host-neutral tokens) or null if the shape doesn't render.
+ *
+ * SECURITY: all dynamic values are HTML-escaped — the card is rendered in the
+ * host's webview, so even the org's own text must never break out of markup.
+ */
+export function escapeHtml(s) {
+    return String(s ?? "")
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+/** Wrap card body in a self-contained, host-neutral shell (works light or dark). */
+function shell(title, body) {
+    return `<!doctype html><meta charset="utf-8"><div style="font:14px/1.5 ui-sans-serif,system-ui,sans-serif;color:#1a1a1a;background:#fff;border:1px solid #e5e5e5;border-radius:12px;padding:18px;max-width:560px">
+<div style="font-size:11px;letter-spacing:.04em;text-transform:uppercase;color:#8a8a8a">${escapeHtml(title)}</div>
+${body}
+<div style="margin-top:14px;border-top:1px solid #efefef;padding-top:8px;font-size:11px;color:#aaa">AIOProductOS · every number off real product data</div>
+</div>`;
+}
+function num(v) {
+    const n = typeof v === "number" ? v : Number(v);
+    return Number.isFinite(n) ? n : 0;
+}
+/** Rich card for get_weekly_signal_memo. Handles both the stored row (inputs_count)
+ *  and the on-the-fly build (inputsCount). Returns null on any shape mismatch. */
+export function weeklyMemoHtml(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const memo = parsed?.memo;
+    if (!memo || typeof memo !== "object")
+        return null;
+    const week = typeof memo.week === "string" ? memo.week : "";
+    if (!week)
+        return null;
+    const inputs = memo.inputsCount ?? memo.inputs_count ?? {};
+    const themes = Array.isArray(memo.themes) ? memo.themes : [];
+    const stat = (label, value) => `<div><div style="font-size:22px;font-weight:600;font-variant-numeric:tabular-nums">${value}</div><div style="font-size:11px;color:#8a8a8a">${escapeHtml(label)}</div></div>`;
+    const statsRow = `<div style="display:flex;gap:28px;margin:12px 0 4px">
+${stat("Insights", num(inputs.insights))}
+${stat("Themes", themes.length)}
+${stat("Shipped", num(inputs.releases))}
+</div>`;
+    const themeRows = themes
+        .slice(0, 6)
+        .map((t) => {
+        const tt = t;
+        const count = num(tt.evidenceCount);
+        return `<li style="display:flex;justify-content:space-between;gap:12px;border-top:1px solid #efefef;padding:7px 0">
+<span style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap">${escapeHtml(tt.label)}</span>
+<span style="color:#8a8a8a;font-variant-numeric:tabular-nums;flex:none">${count} signal${count === 1 ? "" : "s"}</span>
+</li>`;
+    })
+        .join("");
+    const themesBlock = themes.length
+        ? `<ul style="list-style:none;margin:8px 0 0;padding:0">${themeRows}</ul>`
+        : `<p style="color:#8a8a8a;margin:8px 0 0">No themes surfaced this week — not enough recent signal to cluster.</p>`;
+    return shell(`Weekly signal · ${week}`, statsRow + themesBlock);
+}

package/dist/update-notifier.d.ts

@@ -0,0 +1,6 @@
+/** true when `latest` is a higher release than `current` (patch/minor/major; pre-release tags ignored). */
+export declare function isNewer(latest: string, current: string): boolean;
+/** Latest published version if it's newer than `current`, else null. Never throws. */
+export declare function checkForUpdate(current: string): Promise<string | null>;
+/** The one-line banner appended to a tool result when an update is available. */
+export declare function updateBanner(latest: string, current: string): string;

package/dist/update-notifier.js

@@ -9,8 +9,8 @@
  * and it's disabled under CI.
  */
 import { readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { tmpdir } from "node:os";
+import { join } from "node:path";
 const PKG = "@aioproductoscom/mcp";
 const CACHE = join(tmpdir(), "aioproductos-mcp-update.json");
 const TTL_MS = 24 * 60 * 60 * 1000; // check npm at most once a day

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aioproductoscom/mcp",
-  "version": "0.15.9",
+  "version": "0.16.0",
   "mcpName": "com.aioproductos/mcp",
   "description": "AIOProductOS MCP — manage the board, read your product brain + analytics, and run the support inbox from Claude Code, Cursor, Codex, and any MCP host.",
   "type": "module",
@@ -27,6 +27,17 @@
   "bin": {
     "productos": "dist/index.js"
   },
+  "exports": {
+    ".": "./dist/index.js",
+    "./registry": {
+      "types": "./dist/registry.d.ts",
+      "default": "./dist/registry.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    }
+  },
   "files": [
     "dist",
     "README.md"
@@ -40,7 +51,9 @@
   "scripts": {
     "build": "tsc",
     "prepublishOnly": "npm run build",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "test": "npm run build && node --test 'test/**/*.test.mjs'",
+    "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",

package/dist/pm-skill.js

@@ -1,40 +0,0 @@
-// The PM operating playbook — OUR product logic, handed to the customer's PM-side
-// agent via get_pm_playbook() so it works like a great PM grounded in AIOProductOS,
-// not a generic ticket bot. The server's `instructions` points at it; the agent
-// pulls the full doctrine on demand (keeps it out of every session's context).
-//
-// Bump PM_SKILL_VERSION on any behavioural change so a run traces to a playbook.
-export const PM_SKILL_VERSION = "0.1.0";
-export const PM_PLAYBOOK = `# AIOProductOS · Product Manager
-
-You operate the product on AIOProductOS for the connected member. The board, insights, features, and
-analytics all hang off one spine — your job is to keep work tied to the real why and to decide from evidence.
-
-## Ground yourself first
-Call \`get_product_brain\` before you reason about priorities: a live, read-only snapshot of THIS product —
-revenue and top accounts, web + product analytics, features, recent verbatim customer signals, and the open
-work. Decide from it, not from memory. Use \`pm_meta\` to resolve names → ids before any write; never guess an id.
-
-## The spine logic — keep everything connected
-Customer signal (insight) → the bet (feature) → the work (task) → the result (outcome). Don't create orphans:
-- A task that exists because a customer asked → link its \`insight_id\`. Because it serves a bet → link its \`feature_id\`.
-- When you capture feedback, tie it to the account and the feature it's about, in the customer's own words —
-  a specific verbatim beats your paraphrase.
-- Work with no why is the thing to question, not to dutifully schedule.
-
-## Prioritize on evidence — never on a score you invented
-This org has its OWN prioritization framework (RICE, ICE, MoSCoW, WSJF, value/effort, Kano — whatever they set).
-Do NOT assume one, and do NOT compute the score yourself. Attach the EVIDENCE and let their framework do the math:
-- Which accounts are affected, and the MRR behind them (the revenue weight).
-- The reach/usage from analytics (\`analyze_funnel\`, \`get_retention\`, \`analyze_paths\`, the brain).
-- The customer signals that back it.
-Hand work off as an opportunity with that evidence attached — a human (or their configured model) does the ranking.
-You ground the call; you never fake the number.
-
-## Decide from data, not vibes
-Before you assert a priority or a problem, pull the number — funnel drop, retention curve, the path users take,
-the MRR behind a segment — and quote it. "Signups drop 38% on the company-size field" beats "the form feels long".
-
-## Output discipline
-Concise and honest. Confirm only the writes you actually made, in plain language. Resolve ids via \`pm_meta\`.
-Keep titles and descriptions concrete and scoped — a task a teammate can pick up cold.`;