@cyanheads/workflows-mcp-server 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/AGENTS.md +381 -0
  2. package/CLAUDE.md +14 -8
  3. package/Dockerfile +20 -9
  4. package/LICENSE +1 -1
  5. package/README.md +2 -2
  6. package/changelog/0.3.x/0.3.0.md +40 -0
  7. package/changelog/template.md +60 -19
  8. package/dist/mcp-server/tools/definitions/index.d.ts +75 -75
  9. package/dist/mcp-server/tools/definitions/index.d.ts.map +1 -1
  10. package/dist/mcp-server/tools/definitions/workflow-get.tool.d.ts +1 -1
  11. package/dist/services/workflow-index/workflow-index-service.d.ts.map +1 -1
  12. package/package.json +19 -16
  13. package/server.json +3 -3
package/AGENTS.md ADDED
@@ -0,0 +1,381 @@
1
+ # Agent Protocol
2
+
3
+ **Server:** @cyanheads/workflows-mcp-server
4
+ **Version:** 0.3.0
5
+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.12.3`
6
+ **Engines:** Bun ≥1.3.0, Node ≥24.0.0
7
+ **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0
8
+ **Zod:** ^4.4.3
9
+
10
+ > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
11
+
12
+ ---
13
+
14
+ ## What's Next?
15
+
16
+ When the user asks what's next or needs direction, suggest options based on the current project state. Common next steps:
17
+
18
+ 1. **Re-run the `setup` skill** — ensures CLAUDE.md, skills, structure, and metadata are populated and up to date with the current codebase
19
+ 2. **Run the `design-mcp-server` skill** — if the tool/resource surface hasn't been mapped yet, work through domain design
20
+ 3. **Add tools/resources/prompts** — scaffold new definitions using the `add-tool`, `add-app-tool`, `add-resource`, `add-prompt` skills
21
+ 4. **Add services** — scaffold domain service integrations using the `add-service` skill
22
+ 5. **Add tests** — scaffold tests for existing definitions using the `add-test` skill
23
+ 6. **Field-test definitions** — exercise tools/resources/prompts with real inputs using the `field-test` skill, get a report of issues and pain points
24
+ 7. **Run `devcheck`** — lint, format, typecheck, and security audit
25
+ 8. **Run the `security-pass` skill** — audit handlers for MCP-specific security gaps: output injection, scope blast radius, input sinks, tenant isolation
26
+ 9. **Run the `polish-docs-meta` skill** — finalize README, CHANGELOG, metadata, and agent protocol for shipping
27
+ 10. **Run the `maintenance` skill** — investigate changelogs, adopt upstream changes, and sync skills after `bun update --latest`
28
+
29
+ Tailor suggestions to what's actually missing or stale — don't recite the full list every time.
30
+
31
+ ---
32
+
33
+ ## Core Rules
34
+
35
+ - **Logic throws, framework catches.** Tool/resource handlers are pure — throw on failure, no `try/catch`. Plain `Error` is fine; the framework catches, classifies, and formats. Use error factories (`notFound()`, `validationError()`, etc.) when the error code matters.
36
+ - **Use `ctx.log`** for request-scoped logging. No `console` calls.
37
+ - **Use `ctx.state`** for tenant-scoped storage. Never access persistence directly.
38
+ - **Need caller input?** Return `ctx.requestInput(...)`; the handler is re-entered with answers in `ctx.inputs`. Never await input mid-handler.
39
+ - **Secrets in env vars only** — never hardcoded.
40
+ - **Close the loop on issues.** When implementing work tracked by a GitHub issue, comment on the issue with what landed and close it. Do both — a comment without a close leaves stale issues open; a close without a comment leaves no record of what shipped. The comment is for future readers — state the concrete changes, not the conversation that produced them.
41
+
42
+ ---
43
+
44
+ ## Patterns
45
+
46
+ ### Tool
47
+
48
+ ```ts
49
+ import { tool, z } from '@cyanheads/mcp-ts-core';
50
+ import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
51
+ import { getWorkflowIndexService } from '@/services/workflow-index/workflow-index-service.js';
52
+
53
+ export const workflowList = tool('workflow_list', {
54
+ description: 'List all permanent workflows in the index. Supports optional filtering by category and tags (AND match).',
55
+ annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
56
+ input: z.object({
57
+ category: z.string().optional().describe('Filter by category (case-insensitive substring).'),
58
+ tags: z.array(z.string()).optional().describe('Filter to workflows that have ALL of these tags.'),
59
+ includeTools: z.boolean().optional().describe('When true, include unique server/tool pairs per workflow.'),
60
+ }),
61
+ output: z.object({
62
+ workflows: z.array(z.object({ name: z.string().describe('Workflow name.'), /* ... */ })).describe('Matching workflows.'),
63
+ totalCount: z.number().describe('Total number of matching workflows.'),
64
+ }),
65
+ errors: [
66
+ { reason: 'index_unavailable', code: JsonRpcErrorCode.ServiceUnavailable,
67
+ when: 'The workflow index has not finished building yet.',
68
+ recovery: 'Retry after the server has finished initializing its workflow index.' },
69
+ ],
70
+ handler(input, ctx) {
71
+ const svc = getWorkflowIndexService();
72
+ if (!svc.ready) throw ctx.fail('index_unavailable', 'Index not ready', ctx.recoveryFor('index_unavailable'));
73
+ // ... filter and return results
74
+ return { workflows: [], totalCount: 0 };
75
+ },
76
+ format: (result) => [{ type: 'text', text: `**Total:** ${result.totalCount}` }],
77
+ });
78
+ ```
79
+
80
+ ### Server config
81
+
82
+ ```ts
83
+ // src/config/server-config.ts — lazy-parsed, separate from framework config
84
+ import { z } from '@cyanheads/mcp-ts-core';
85
+ import { parseEnvConfig } from '@cyanheads/mcp-ts-core/config';
86
+
87
+ const ServerConfigSchema = z.object({
88
+ workflowsDir: z
89
+ .string()
90
+ .default('./workflows-yaml')
91
+ .describe('Absolute or relative path to the workflows root directory'),
92
+ globalInstructionsPath: z
93
+ .string()
94
+ .default('')
95
+ .describe('Path to the global instructions markdown file. Empty string means derive from WORKFLOWS_DIR.'),
96
+ watcherDebounceMs: z.coerce
97
+ .number()
98
+ .default(500)
99
+ .describe('Milliseconds to debounce filesystem change events before rebuilding the index'),
100
+ });
101
+
102
+ let _config: z.infer<typeof ServerConfigSchema> | undefined;
103
+ export function getServerConfig() {
104
+ _config ??= parseEnvConfig(ServerConfigSchema, {
105
+ workflowsDir: 'WORKFLOWS_DIR',
106
+ globalInstructionsPath: 'GLOBAL_INSTRUCTIONS_PATH',
107
+ watcherDebounceMs: 'WATCHER_DEBOUNCE_MS',
108
+ });
109
+ return _config;
110
+ }
111
+ ```
112
+
113
+ `parseEnvConfig` maps Zod schema paths → env var names so errors name the variable (`WORKFLOWS_DIR`) not the path (`workflowsDir`). Throws `ConfigurationError`, which the framework prints as a clean startup banner.
114
+
115
+ ---
116
+
117
+ ## Context
118
+
119
+ Handlers receive a unified `ctx` object. Key properties:
120
+
121
+ | Property | Description |
122
+ |:---------|:------------|
123
+ | `ctx.log` | Request-scoped logger — `.debug()`, `.info()`, `.notice()`, `.warning()`, `.error()`. Auto-correlates requestId, traceId, tenantId. |
124
+ | `ctx.state` | Tenant-scoped KV — `.get(key)`, `.set(key, value, { ttl? })`, `.delete(key)`, `.getMany(keys)`, `.list(prefix, { cursor, limit })`. |
125
+ | `ctx.enrich` | Success-path agent context that reaches both `structuredContent` and `content[]` when the definition declares an `enrichment` block. |
126
+ | `ctx.signal` | `AbortSignal` for cancellation. |
127
+ | `ctx.requestId` | Unique request ID. |
128
+ | `ctx.tenantId` | Tenant ID from JWT or `'default'` for stdio. |
129
+ | `ctx.fail` | Typed error factory for declared error contracts — `ctx.fail('reason', msg, ctx.recoveryFor('reason'))`. |
130
+
131
+ ---
132
+
133
+ ## Errors
134
+
135
+ Handlers throw — the framework catches, classifies, and formats.
136
+
137
+ **Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable? }]` on `tool()` / `resource()` to receive `ctx.fail(reason, …)` typed against the reason union. TypeScript catches typos at compile time, `data.reason` is auto-populated for observability, linter enforces conformance against the handler body. `recovery` is required (≥ 5 words, lint-validated) and is the single source of truth for the agent's next move. Pass `ctx.recoveryFor('reason')` as the throw's data to put it on the wire (`data.recovery.hint`, mirrored into `content[]` text); override it explicitly when dynamic runtime context matters. Baseline codes (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) bubble freely and don't need declaring.
138
+
139
+ ```ts
140
+ errors: [
141
+ { reason: 'no_match', code: JsonRpcErrorCode.NotFound,
142
+ when: 'No item matched the query',
143
+ recovery: 'Broaden the query or check the spelling and try again.' },
144
+ ],
145
+ async handler(input, ctx) {
146
+ const item = await db.find(input.id);
147
+ if (!item) throw ctx.fail('no_match', `No item ${input.id}`);
148
+ return item;
149
+ }
150
+ ```
151
+
152
+ **Declare contracts inline on each tool.** The contract is part of the tool's public surface — one file should give the full picture. Don't extract a shared `errors[]` constant; per-tool repetition is the intended cost of locality.
153
+
154
+ **Fallback (no contract entry fits):** throw via factories or plain `Error`.
155
+
156
+ ```ts
157
+ // Error factories — explicit code
158
+ import { notFound, serviceUnavailable } from '@cyanheads/mcp-ts-core/errors';
159
+ throw notFound('Item not found', { itemId });
160
+ throw serviceUnavailable('API unavailable', { url }, { cause: err });
161
+
162
+ // Plain Error — framework auto-classifies from message patterns
163
+ throw new Error('Item not found'); // → NotFound
164
+ throw new Error('Invalid query format'); // → ValidationError
165
+
166
+ // McpError — when no factory exists for the code
167
+ import { McpError, JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
168
+ throw new McpError(JsonRpcErrorCode.DatabaseError, 'Connection failed', { pool: 'primary' });
169
+ ```
170
+
171
+ See framework CLAUDE.md and the `api-errors` skill for the full auto-classification table, all available factories, and the contract reference.
172
+
173
+ ---
174
+
175
+ ## Structure
176
+
177
+ ```text
178
+ src/
179
+ index.ts # createApp() entry point — registers tools, inits WorkflowIndexService
180
+ config/
181
+ server-config.ts # Server-specific env vars (WORKFLOWS_DIR, GLOBAL_INSTRUCTIONS_PATH, WATCHER_DEBOUNCE_MS)
182
+ services/
183
+ workflow-index/
184
+ workflow-index-service.ts # WorkflowIndexService — index build, watcher, semver lookup, write helpers
185
+ types.ts # ParsedWorkflow, WorkflowEntry, WorkflowIndex types
186
+ mcp-server/
187
+ tools/definitions/
188
+ workflow-list.tool.ts # workflow_list — list permanent workflows with filters
189
+ workflow-get.tool.ts # workflow_get — retrieve full workflow + global instructions
190
+ workflow-create.tool.ts # workflow_create — write permanent workflow YAML
191
+ workflow-create-temp.tool.ts # workflow_create_temp — write temporary workflow
192
+ index.ts # Barrel export
193
+ workflows-yaml/ # Workflow library root (configurable via WORKFLOWS_DIR)
194
+ categories/ # Permanent workflows organized by category
195
+ temp/ # Temporary workflows (gitignored)
196
+ global_instructions.md # Global instructions injected into every workflow_get response
197
+ _index.json # Auto-generated snapshot (gitignored)
198
+ ```
199
+
200
+ ---
201
+
202
+ ## Naming
203
+
204
+ | What | Convention | Example |
205
+ |:-----|:-----------|:--------|
206
+ | Files | kebab-case with suffix | `search-docs.tool.ts` |
207
+ | Tool/resource/prompt names | snake_case | `search_docs` |
208
+ | Directories | kebab-case | `src/services/doc-search/` |
209
+ | Descriptions | Single string or template literal, no `+` concatenation | `'Search items by query and filter.'` |
210
+
211
+ ---
212
+
213
+ ## Skills
214
+
215
+ Skills are modular instructions in `skills/` at the project root. Read them directly when a task matches — e.g., `skills/add-tool/SKILL.md` when adding a tool. `bun run list-skills` prints the full registry.
216
+
217
+ **Agent skill directory:** Copy skills into the directory your agent discovers (Claude Code: `.claude/skills/`, others: equivalent). Skills then load as context without referencing `skills/` paths. After framework updates, run the `maintenance` skill — Phase B re-syncs the agent directory.
218
+
219
+ Available skills:
220
+
221
+ | Skill | Purpose |
222
+ |:------|:--------|
223
+ | `setup` | Post-init project orientation |
224
+ | `design-mcp-server` | Design tool surface, resources, and services for a new server |
225
+ | `add-tool` | Scaffold a new tool definition |
226
+ | `add-app-tool` | Scaffold an MCP App tool + paired UI resource |
227
+ | `add-resource` | Scaffold a new resource definition |
228
+ | `add-prompt` | Scaffold a new prompt definition |
229
+ | `add-service` | Scaffold a new service integration |
230
+ | `add-test` | Scaffold test file for a tool, resource, or service |
231
+ | `add-export` | Add or evolve a public framework export without leaking internal module paths |
232
+ | `add-provider` | Add a provider integration with config, lifecycle, errors, and tests |
233
+ | `field-test` | Exercise tools/resources/prompts with real inputs, verify behavior, report issues |
234
+ | `tool-defs-analysis` | Read-only audit of MCP definition language across the surface — voice, leaks, defaults, recovery hints, output descriptions |
235
+ | `security-pass` | Audit server for MCP-flavored security gaps: output injection, scope blast radius, input sinks, tenant isolation |
236
+ | `code-simplifier` | Post-session cleanup against `git diff` — modernize syntax, consolidate duplication, align with the codebase |
237
+ | `devcheck` | Lint, format, typecheck, audit |
238
+ | `polish-docs-meta` | Finalize docs, README, metadata, and agent protocol for shipping |
239
+ | `git-wrapup` | Land working-tree changes as a versioned commit + annotated tag — version bump, changelog, verify, tag. Local only. |
240
+ | `release-and-publish` | Push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
241
+ | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
242
+ | `orchestrations` | Chain task skills into a gated multi-phase pipeline when sub-agents are available |
243
+ | `report-issue-framework` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
244
+ | `report-issue-local` | File a bug or feature request against this server's own repo via `gh` CLI |
245
+ | `api-auth` | Auth modes, scopes, JWT/OAuth |
246
+ | `api-canvas` | DataCanvas: register tabular data, run SQL, export, plus the `spillover()` helper for big result sets — Tier 3 opt-in |
247
+ | `api-config` | AppConfig, parseConfig, env vars |
248
+ | `api-context` | Context interface, logger, state, and multi-round-trip input |
249
+ | `api-errors` | McpError, JsonRpcErrorCode, error patterns |
250
+ | `api-linter` | Definition linter rule catalog — invoked by `bun run lint:mcp` and `devcheck` |
251
+ | `api-mirror` | MirrorService for a persistent, self-refreshing local mirror of a bulk upstream dataset |
252
+ | `api-services` | LLM, Speech, Graph services |
253
+ | `api-testing` | createMockContext, fixtures, fetch mocks, and definition contract tests |
254
+ | `api-utils` | Formatting, parsing, security, pagination, scheduling, telemetry helpers |
255
+ | `api-telemetry` | OTel catalog: spans, metrics, completion logs, env config, cardinality rules |
256
+ | `api-workers` | Cloudflare Workers runtime |
257
+
258
+ When you complete a skill's checklist, check the boxes and add a completion timestamp at the end (e.g., `Completed: 2026-03-11`).
259
+
260
+ ---
261
+
262
+ ## Commands
263
+
264
+ | Command | Purpose |
265
+ |:--------|:--------|
266
+ | `bun run build` | Compile TypeScript |
267
+ | `bun run rebuild` | Clean + build |
268
+ | `bun run clean` | Remove build artifacts |
269
+ | `bun run devcheck` | Lint + format + typecheck + security + changelog sync |
270
+ | `bun run audit:refresh` | Delete `bun.lock`, reinstall, re-audit. Use when `devcheck` flags a transitive advisory — stale lockfile can mask already-patched deps. If advisory survives, it's real. |
271
+ | `bun run tree` | Generate directory structure doc |
272
+ | `bun run format` | Auto-fix formatting |
273
+ | `bun run test` | Run tests |
274
+ | `bun run start:stdio` | Production mode (stdio) |
275
+ | `bun run start:http` | Production mode (HTTP) |
276
+ | `bun run changelog:build` | Regenerate `CHANGELOG.md` from `changelog/*.md` |
277
+ | `bun run changelog:check` | Verify `CHANGELOG.md` is in sync (used by devcheck) |
278
+ | `bun run bundle` | Build and pack as `.mcpb` for one-click Claude Desktop install |
279
+
280
+ ---
281
+
282
+ ## Bundling
283
+
284
+ `bun run bundle` produces a `.mcpb` extension bundle for one-click install in Claude Desktop. MCPB is stdio-only — HTTP and Cloudflare Workers deployments are unaffected. Consumers who don't need it can delete `manifest.json` and `.mcpbignore`; `lint:packaging` skips cleanly.
285
+
286
+ **Adding an env var requires both files:** `server.json` (registry discovery, `environmentVariables[]`) and `manifest.json` (bundle install UX, `mcp_config.env` + `user_config`). `lint:packaging` (run by `devcheck`) verifies the env var names match.
287
+
288
+ **README install badges.** Drop these into the project README to give users one-click install paths. Fill in `<OWNER>` / `<REPO>` / `<PACKAGE_NAME>` and encode the per-server config. Cursor + VS Code badges assume the server is published to npm; Claude Desktop downloads the `.mcpb` directly so npm publishing isn't required.
289
+
290
+ | Client | Mechanism |
291
+ |:-------|:----------|
292
+ | Claude Desktop | Browser downloads the `.mcpb` from the latest GitHub Release; OS file handler routes it to Claude Desktop, which opens the install dialog. No deep-link URL scheme yet — this is the canonical path. |
293
+ | Cursor | Official `https://cursor.com/en/install-mcp` endpoint with base64 JSON config. |
294
+ | VS Code / Insiders | Official `vscode:mcp/install?...` deep link, wrapped in `https://vscode.dev/redirect?url=` so GitHub-rendered markdown doesn't strip the non-HTTP scheme. |
295
+ | Claude Code / Codex | CLI only (`claude mcp add` / `codex mcp add`); no URL scheme. |
296
+
297
+ ```markdown
298
+ [![Install in Claude Desktop](https://img.shields.io/badge/Install_in-Claude_Desktop-D97757?style=for-the-badge&logo=anthropic&logoColor=white)](https://github.com/<OWNER>/<REPO>/releases/latest/download/<PACKAGE_NAME>.mcpb)
299
+ [![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=<PACKAGE_NAME>&config=<BASE64_CONFIG>)
300
+ [![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_Server-0098FF?style=for-the-badge&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect?url=vscode:mcp/install?<URLENCODED_JSON>)
301
+ ```
302
+
303
+ Both install links route through HTTPS endpoints (`cursor.com/en/install-mcp` and `vscode.dev/redirect`) — GitHub-rendered markdown strips non-HTTP URL schemes from anchors, so a raw `cursor://` or `vscode:` link won't click through from github.com.
304
+
305
+ Generate the encoded configs (replace `<PACKAGE_NAME>` and add env vars for any required API keys):
306
+
307
+ ```bash
308
+ # Cursor: base64-encoded JSON. Split command/args, add env when keys are needed.
309
+ echo -n '{"command":"npx","args":["-y","<PACKAGE_NAME>"],"env":{"API_KEY":"your-api-key"}}' | base64
310
+ # Without env (no required keys):
311
+ echo -n '{"command":"npx","args":["-y","<PACKAGE_NAME>"]}' | base64
312
+
313
+ # VS Code: URL-encoded JSON. Same shape plus a `name` field.
314
+ node -p 'encodeURIComponent(JSON.stringify({name:"<SHORT_NAME>",command:"npx",args:["-y","<PACKAGE_NAME>"],env:{API_KEY:"your-api-key"}}))'
315
+ # Without env:
316
+ node -p 'encodeURIComponent(JSON.stringify({name:"<SHORT_NAME>",command:"npx",args:["-y","<PACKAGE_NAME>"]}))'
317
+ ```
318
+
319
+ Both clients use the same `{command, args, env}` shape (matching `mcp.json` schema). VS Code adds a top-level `name` field. Omit `env` entirely when no API keys are needed — don't include empty objects or framework-only vars like `MCP_TRANSPORT_TYPE`.
320
+
321
+ The Claude Desktop badge requires the bundle to ship with a stable filename — `bun run bundle` outputs `dist/<PACKAGE_NAME>.mcpb`, and `release-and-publish` attaches that file to the GitHub Release. `releases/latest/download/<PACKAGE_NAME>.mcpb` then redirects to the most recent release.
322
+
323
+ ---
324
+
325
+ ## Changelog
326
+
327
+ Directory-based, grouped by minor series via the `.x` semver-wildcard convention. Source of truth: `changelog/<major.minor>.x/<version>.md` (e.g. `changelog/0.1.x/0.1.0.md`) — one file per release, shipped in the npm package. At release, author the per-version file with a concrete version and date, then run `bun run changelog:build` to regenerate the rollup. `changelog/template.md` is a **pristine format reference** — never edited or moved; read it for the frontmatter + section layout when scaffolding. `CHANGELOG.md` is a **navigation index** (header + link + summary per version), regenerated by `bun run changelog:build` — devcheck hard-fails on drift; never hand-edit it.
328
+
329
+ Each per-version file opens with YAML frontmatter:
330
+
331
+ ```markdown
332
+ ---
333
+ summary: "One-line headline, ≤350 chars" # required — powers the rollup index
334
+ breaking: false # optional — true flags breaking changes
335
+ security: false # optional — true flags security fixes
336
+ ---
337
+
338
+ # 0.1.0 — YYYY-MM-DD
339
+ ...
340
+ ```
341
+
342
+ `breaking: true` renders a `· ⚠️ Breaking` badge — use it when consumers must update code on upgrade (signature changes, removed APIs, config renames). `security: true` renders a `· 🛡️ Security` badge and pairs with a `## Security` body section. When both are set, badges render `· ⚠️ Breaking · 🛡️ Security`.
343
+
344
+ `agent-notes` is an optional free-form field for maintenance agents processing the release downstream. Content here won't appear in the rendered CHANGELOG — it's consumed by agents running the `maintenance` skill. Use it for adoption instructions that don't fit the human-facing sections: new files to create, fields to populate, one-time migration steps. Omit entirely when there's nothing to say.
345
+
346
+ **Section order** (Keep a Changelog): Added, Changed, Deprecated, Removed, Fixed, Security. Include only sections with entries — don't ship empty headers.
347
+
348
+ **Tag annotations** render as GitHub Release bodies via `--notes-from-tag`. They must be structured markdown — never a flat comma-separated string. Subject omits the version number (GitHub prepends it). See `changelog/template.md` for the full format reference.
349
+
350
+ ---
351
+
352
+ ## Imports
353
+
354
+ ```ts
355
+ // Framework — z is re-exported, no separate zod import needed
356
+ import { tool, z } from '@cyanheads/mcp-ts-core';
357
+ import { McpError, JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
358
+
359
+ // Server's own code — via path alias
360
+ import { getMyService } from '@/services/my-domain/my-service.js';
361
+ ```
362
+
363
+ ---
364
+
365
+ ## Checklist
366
+
367
+ - [ ] Zod schemas: all fields have `.describe()`, only JSON-Schema-serializable types (no `z.custom()`, `z.date()`, `z.transform()`, `z.bigint()`, `z.symbol()`, `z.void()`, `z.map()`, `z.set()`, `z.function()`, `z.nan()`)
368
+ - [ ] Optional nested objects: handler guards for empty inner values from form-based clients (`if (input.obj?.field && ...)`, not just `if (input.obj)`). When regex/length constraints matter, use `z.union([z.literal(''), z.string().regex(...).describe(...)])` — literal variants are exempt from `describe-on-fields`.
369
+ - [ ] JSDoc `@fileoverview` + `@module` on every file
370
+ - [ ] `ctx.log` for logging, `ctx.state` for storage
371
+ - [ ] Handlers throw on failure — error factories or plain `Error`, no try/catch
372
+ - [ ] `format()` renders all data the LLM needs — different clients forward different surfaces (Claude Code → `structuredContent`, Claude Desktop → `content[]`); both must carry the same data
373
+ - [ ] If wrapping external API: raw/domain/output schemas reviewed against real upstream sparsity/nullability before finalizing required vs optional fields
374
+ - [ ] If wrapping external API: normalization and `format()` preserve uncertainty; do not fabricate facts from missing upstream data
375
+ - [ ] If wrapping external API: tests include at least one sparse payload case with omitted upstream fields
376
+ - [ ] Registered in `createApp()` arrays (directly or via barrel exports)
377
+ - [ ] Tests use `createMockContext()` from `@cyanheads/mcp-ts-core/testing`
378
+ - [ ] `.codex-plugin/plugin.json` populated — `name`, `version`, `description`, `repository`, `license` from `package.json`; `interface.displayName` = package name; `interface.shortDescription` from `package.json` description
379
+ - [ ] `.codex-plugin/mcp.json` updated — server name key matches `package.json` name; env vars added for any required API keys
380
+ - [ ] `.claude-plugin/plugin.json` populated — `name`, `version`, `description`, `repository`, `license` from `package.json`; inline `mcpServers` entry with server name key, env vars for any required API keys
381
+ - [ ] `bun run devcheck` passes
package/CLAUDE.md CHANGED
@@ -1,10 +1,10 @@
1
1
  # Agent Protocol
2
2
 
3
3
  **Server:** @cyanheads/workflows-mcp-server
4
- **Version:** 0.2.0
5
- **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.10.10`
4
+ **Version:** 0.3.0
5
+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.12.3`
6
6
  **Engines:** Bun ≥1.3.0, Node ≥24.0.0
7
- **MCP SDK:** `@modelcontextprotocol/sdk` ^1.29.0
7
+ **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0
8
8
  **Zod:** ^4.4.3
9
9
 
10
10
  > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -35,7 +35,7 @@ Tailor suggestions to what's actually missing or stale — don't recite the full
35
35
  - **Logic throws, framework catches.** Tool/resource handlers are pure — throw on failure, no `try/catch`. Plain `Error` is fine; the framework catches, classifies, and formats. Use error factories (`notFound()`, `validationError()`, etc.) when the error code matters.
36
36
  - **Use `ctx.log`** for request-scoped logging. No `console` calls.
37
37
  - **Use `ctx.state`** for tenant-scoped storage. Never access persistence directly.
38
- - **Check `ctx.elicit` / `ctx.sample`** for presence before calling.
38
+ - **Need caller input?** Return `ctx.requestInput(...)`; the handler is re-entered with answers in `ctx.inputs`. Never await input mid-handler.
39
39
  - **Secrets in env vars only** — never hardcoded.
40
40
  - **Close the loop on issues.** When implementing work tracked by a GitHub issue, comment on the issue with what landed and close it. Do both — a comment without a close leaves stale issues open; a close without a comment leaves no record of what shipped. The comment is for future readers — state the concrete changes, not the conversation that produced them.
41
41
 
@@ -121,6 +121,8 @@ Handlers receive a unified `ctx` object. Key properties:
121
121
  | Property | Description |
122
122
  |:---------|:------------|
123
123
  | `ctx.log` | Request-scoped logger — `.debug()`, `.info()`, `.notice()`, `.warning()`, `.error()`. Auto-correlates requestId, traceId, tenantId. |
124
+ | `ctx.state` | Tenant-scoped KV — `.get(key)`, `.set(key, value, { ttl? })`, `.delete(key)`, `.getMany(keys)`, `.list(prefix, { cursor, limit })`. |
125
+ | `ctx.enrich` | Success-path agent context that reaches both `structuredContent` and `content[]` when the definition declares an `enrichment` block. |
124
126
  | `ctx.signal` | `AbortSignal` for cancellation. |
125
127
  | `ctx.requestId` | Unique request ID. |
126
128
  | `ctx.tenantId` | Tenant ID from JWT or `'default'` for stdio. |
@@ -132,7 +134,7 @@ Handlers receive a unified `ctx` object. Key properties:
132
134
 
133
135
  Handlers throw — the framework catches, classifies, and formats.
134
136
 
135
- **Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable? }]` on `tool()` / `resource()` to receive `ctx.fail(reason, …)` typed against the reason union. TypeScript catches typos at compile time, `data.reason` is auto-populated for observability, linter enforces conformance against the handler body. `recovery` is required descriptive metadata for the agent's next move (≥ 5 words, lint-validated); for the wire `data.recovery.hint` (mirrored into `content[]` text), pass explicitly at the throw site when dynamic context matters: `ctx.fail('reason', msg, { recovery: { hint: '...' } })`. Baseline codes (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) bubble freely and don't need declaring.
137
+ **Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable? }]` on `tool()` / `resource()` to receive `ctx.fail(reason, …)` typed against the reason union. TypeScript catches typos at compile time, `data.reason` is auto-populated for observability, linter enforces conformance against the handler body. `recovery` is required (≥ 5 words, lint-validated) and is the single source of truth for the agent's next move. Pass `ctx.recoveryFor('reason')` as the throw's data to put it on the wire (`data.recovery.hint`, mirrored into `content[]` text); override it explicitly when dynamic runtime context matters. Baseline codes (`InternalError`, `ServiceUnavailable`, `Timeout`, `ValidationError`, `SerializationError`) bubble freely and don't need declaring.
136
138
 
137
139
  ```ts
138
140
  errors: [
@@ -210,7 +212,7 @@ workflows-yaml/ # Workflow library root (configurable vi
210
212
 
211
213
  ## Skills
212
214
 
213
- Skills are modular instructions in `skills/` at the project root. Read them directly when a task matches — e.g., `skills/add-tool/SKILL.md` when adding a tool.
215
+ Skills are modular instructions in `skills/` at the project root. Read them directly when a task matches — e.g., `skills/add-tool/SKILL.md` when adding a tool. `bun run list-skills` prints the full registry.
214
216
 
215
217
  **Agent skill directory:** Copy skills into the directory your agent discovers (Claude Code: `.claude/skills/`, others: equivalent). Skills then load as context without referencing `skills/` paths. After framework updates, run the `maintenance` skill — Phase B re-syncs the agent directory.
216
218
 
@@ -226,6 +228,8 @@ Available skills:
226
228
  | `add-prompt` | Scaffold a new prompt definition |
227
229
  | `add-service` | Scaffold a new service integration |
228
230
  | `add-test` | Scaffold test file for a tool, resource, or service |
231
+ | `add-export` | Add or evolve a public framework export without leaking internal module paths |
232
+ | `add-provider` | Add a provider integration with config, lifecycle, errors, and tests |
229
233
  | `field-test` | Exercise tools/resources/prompts with real inputs, verify behavior, report issues |
230
234
  | `tool-defs-analysis` | Read-only audit of MCP definition language across the surface — voice, leaks, defaults, recovery hints, output descriptions |
231
235
  | `security-pass` | Audit server for MCP-flavored security gaps: output injection, scope blast radius, input sinks, tenant isolation |
@@ -235,16 +239,18 @@ Available skills:
235
239
  | `git-wrapup` | Land working-tree changes as a versioned commit + annotated tag — version bump, changelog, verify, tag. Local only. |
236
240
  | `release-and-publish` | Push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
237
241
  | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
242
+ | `orchestrations` | Chain task skills into a gated multi-phase pipeline when sub-agents are available |
238
243
  | `report-issue-framework` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
239
244
  | `report-issue-local` | File a bug or feature request against this server's own repo via `gh` CLI |
240
245
  | `api-auth` | Auth modes, scopes, JWT/OAuth |
241
246
  | `api-canvas` | DataCanvas: register tabular data, run SQL, export, plus the `spillover()` helper for big result sets — Tier 3 opt-in |
242
247
  | `api-config` | AppConfig, parseConfig, env vars |
243
- | `api-context` | Context interface, logger, state, progress |
248
+ | `api-context` | Context interface, logger, state, and multi-round-trip input |
244
249
  | `api-errors` | McpError, JsonRpcErrorCode, error patterns |
245
250
  | `api-linter` | Definition linter rule catalog — invoked by `bun run lint:mcp` and `devcheck` |
251
+ | `api-mirror` | MirrorService for a persistent, self-refreshing local mirror of a bulk upstream dataset |
246
252
  | `api-services` | LLM, Speech, Graph services |
247
- | `api-testing` | createMockContext, test patterns |
253
+ | `api-testing` | createMockContext, fixtures, fetch mocks, and definition contract tests |
248
254
  | `api-utils` | Formatting, parsing, security, pagination, scheduling, telemetry helpers |
249
255
  | `api-telemetry` | OTel catalog: spans, metrics, completion logs, env config, cardinality rules |
250
256
  | `api-workers` | Cloudflare Workers runtime |
package/Dockerfile CHANGED
@@ -4,15 +4,17 @@
4
4
  # This stage installs all dependencies (including dev), builds the TypeScript
5
5
  # source code into JavaScript, and prepares the production assets.
6
6
  # ==============================================================================
7
- FROM oven/bun:1.3 AS build
7
+ FROM --platform=$BUILDPLATFORM oven/bun:1.4.0 AS build
8
8
 
9
9
  WORKDIR /usr/src/app
10
10
 
11
11
  # Copy dependency manifests for optimized layer caching
12
12
  COPY package.json bun.lock ./
13
13
 
14
- # Install all dependencies (including dev dependencies for building)
15
- RUN bun install --frozen-lockfile
14
+ # Install all dependencies (including dev dependencies for building).
15
+ # The BuildKit cache mount persists Bun's global package cache across builds.
16
+ RUN --mount=type=cache,target=/root/.bun/install/cache \
17
+ bun install --frozen-lockfile --ignore-scripts
16
18
 
17
19
  # Copy the rest of the source code
18
20
  COPY . .
@@ -28,7 +30,7 @@ RUN bun run build
28
30
  # application. It uses a slim base image and only includes production
29
31
  # dependencies and build artifacts.
30
32
  # ==============================================================================
31
- FROM oven/bun:1.3-slim AS production
33
+ FROM oven/bun:1.4.0-slim AS production
32
34
 
33
35
  WORKDIR /usr/src/app
34
36
 
@@ -37,24 +39,30 @@ WORKDIR /usr/src/app
37
39
  ENV NODE_ENV=production
38
40
 
39
41
  # OCI image metadata (https://github.com/opencontainers/image-spec/blob/main/annotations.md)
40
- LABEL org.opencontainers.image.title="@cyanheads/workflows-mcp-server"
42
+ ARG APP_VERSION
43
+ LABEL org.opencontainers.image.title="workflows-mcp-server"
41
44
  LABEL org.opencontainers.image.description="Store, query, and create YAML workflow playbooks for LLM agents via MCP."
42
45
  LABEL org.opencontainers.image.source="https://github.com/cyanheads/workflows-mcp-server"
43
46
  LABEL org.opencontainers.image.licenses="Apache-2.0"
47
+ LABEL org.opencontainers.image.version="${APP_VERSION}"
48
+ LABEL io.modelcontextprotocol.server.name="io.github.cyanheads/workflows-mcp-server"
44
49
 
45
50
  # Copy dependency manifests
46
51
  COPY package.json bun.lock ./
47
52
 
48
53
  # Install only production dependencies, ignoring any lifecycle scripts (like 'prepare')
49
- # that are not needed in the final production image.
50
- RUN bun install --production --frozen-lockfile --ignore-scripts
54
+ # that are not needed in the final production image. `--omit=peer` drops the
55
+ # framework's optional service/test tiers; runtime imports remain direct deps.
56
+ RUN --mount=type=cache,target=/root/.bun/install/cache \
57
+ bun install --production --omit=peer --frozen-lockfile --ignore-scripts
51
58
 
52
59
  # Conditionally install OpenTelemetry optional peer dependencies (Tier 3).
53
60
  # These are not bundled by default to keep the base image lean. Enable at build time
54
61
  # with: docker build --build-arg OTEL_ENABLED=true
55
62
  ARG OTEL_ENABLED=true
56
- RUN if [ "$OTEL_ENABLED" = "true" ]; then \
57
- bun add @hono/otel \
63
+ RUN --mount=type=cache,target=/root/.bun/install/cache \
64
+ if [ "$OTEL_ENABLED" = "true" ]; then \
65
+ bun add --omit=dev --omit=peer --ignore-scripts @hono/otel \
58
66
  @opentelemetry/instrumentation-http \
59
67
  @opentelemetry/exporter-metrics-otlp-http \
60
68
  @opentelemetry/exporter-trace-otlp-http \
@@ -95,5 +103,8 @@ ENV MCP_FORCE_CONSOLE_LOGGING="true"
95
103
  # Expose the port the server listens on
96
104
  EXPOSE ${MCP_HTTP_PORT}
97
105
 
106
+ # Health check using a bun-native fetch (slim image ships no curl/wget)
107
+ HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD bun -e "fetch('http://localhost:'+(process.env.MCP_HTTP_PORT??'3010')+'/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
108
+
98
109
  # The command to start the server
99
110
  CMD ["bun", "run", "dist/index.js"]
package/LICENSE CHANGED
@@ -186,7 +186,7 @@ Apache License
186
186
  same "printed page" as the copyright notice for easier
187
187
  identification within third-party archives.
188
188
 
189
- Copyright 2025 Casey Hand @cyanheads
189
+ Copyright 2026 Casey Hand @cyanheads
190
190
 
191
191
  Licensed under the Apache License, Version 2.0 (the "License");
192
192
  you may not use this file except in compliance with the License.
package/README.md CHANGED
@@ -7,7 +7,7 @@
7
7
 
8
8
  <div align="center">
9
9
 
10
- [![Version](https://img.shields.io/badge/Version-0.2.0-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/workflows-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/workflows-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/workflows-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^6.0.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.2-blueviolet.svg?style=flat-square)](https://bun.sh/)
10
+ [![Version](https://img.shields.io/badge/Version-0.3.0-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/workflows-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-v2-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/workflows-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/workflows-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.4.0-blueviolet.svg?style=flat-square)](https://bun.sh/)
11
11
 
12
12
  </div>
13
13
 
@@ -191,7 +191,7 @@ The repository ships a `workflows-yaml/` directory with example workflows organi
191
191
 
192
192
  ### Prerequisites
193
193
 
194
- - [Bun v1.3.2](https://bun.sh/) or higher (or Node.js v24+).
194
+ - [Bun v1.3.0](https://bun.sh/) or higher (or Node.js v24+).
195
195
  - A local directory containing YAML workflow files (or use the bundled `workflows-yaml/` seed).
196
196
 
197
197
  ### Installation
package/changelog/0.3.x/0.3.0.md ADDED
@@ -0,0 +1,40 @@
1
+ ---
2
+ summary: "MCP SDK v2 maintenance with strict tool inputs, modern advertised schemas, TypeScript 7, Bun 1.4, supply-chain guards, and refreshed packaging and agent guidance."
3
+ breaking: true
4
+ security: false
5
+ ---
6
+
7
+ # 0.3.0 — 2026-08-21
8
+
9
+ ## Added
10
+
11
+ - **Supply-chain controls** — installs hold newly published third-party packages for three days and run the Socket security scanner; first-party `@cyanheads/mcp-ts-core` releases remain exempt from the age hold.
12
+ - **Community health files** — adds contribution, conduct, funding, and private vulnerability-reporting guidance, plus repository-wide line-ending and generated-file attributes.
13
+
14
+ ## Changed
15
+
16
+ - **MCP SDK v2** — `@cyanheads/mcp-ts-core` now serves protocol revision `2026-07-28` alongside 2025-era clients. Root tool inputs reject unknown keys instead of stripping them, and advertised input/output schemas use the SDK v2 contract, including the structured error envelope.
17
+ - **TypeScript and test gate** — TypeScript 7 now typechecks both `src/` and `tests/`; test fixtures and handler assertions follow the framework's current async and output-schema types.
18
+ - **Runtime packaging** — Bun 1.4 images use BuildKit caches, omit optional peer tiers in production, carry OCI/MCP identity labels and a health check, and build for the requested target platform.
19
+ - **MCPB and release tooling** — bundle cleanup strips platform-specific DuckDB native bindings as well as dependency-shipped agent docs; packaging lint verifies both classes, and GitHub Release creation uses the repository release script.
20
+ - **Framework maintenance surface** — development scripts, changelog conventions, and agent skills are synchronized with `@cyanheads/mcp-ts-core` 0.12.3, including SDK v2 context, testing, schema, cache-hint, and header-parameter guidance.
21
+ - **Project metadata** — package authorship and MCPB author metadata use Casey Hand's canonical identity, and the Apache-2.0 copyright year is 2026.
22
+
23
+ ## Dependencies
24
+
25
+ Runtime:
26
+
27
+ - `@cyanheads/mcp-ts-core` `^0.10.10` → `^0.12.3`
28
+
29
+ Development:
30
+
31
+ - `@biomejs/biome` `^2.5.1` → `2.5.9`
32
+ - `@socketsecurity/bun-security-scanner` added at `^1.1.2`
33
+ - `@types/node` `^25.9.3` → `26.2.0`
34
+ - `@types/semver` `^7.7.1` → `^7.8.0`
35
+ - `@vitest/coverage-istanbul` `^4.1.9` → `4.1.11`
36
+ - `fast-check` `^4.8.0` → `^4.9.0`
37
+ - `ignore` `^7.0.5` → `^7.0.6`
38
+ - `tsc-alias` `^1.8.17` → `^1.9.2`
39
+ - `typescript` `^6.0.3` → `^7.0.2`
40
+ - `vitest` `^4.1.9` → `^4.1.11`
package/changelog/template.md CHANGED
@@ -4,10 +4,11 @@
4
4
  # to author a new release. Set that file's H1 to `# <version> — YYYY-MM-DD`
5
5
  # with a concrete date.
6
6
 
7
- # Required. One-line GitHub Release-style headline. 350 character cap.
8
- # Default short and scannable. Don't pad, don't stitch unrelated changes with
9
- # semicolons — pick the headline. Quotes required: unquoted YAML treats `: `
10
- # inside the value as a key separator and fails GitHub's strict parser.
7
+ # Required. One-line GitHub Release-style headline. 350 character cap — a
8
+ # ceiling, not a target. Default short and scannable. Don't pad, don't stitch
9
+ # unrelated changes with commas/semicolons into an inventory — pick the
10
+ # headline, like a tag's theme line. Quotes required: unquoted YAML treats
11
+ # `: ` inside the value as a key separator and fails GitHub's strict parser.
11
12
  summary: ""
12
13
 
13
14
  # Set `true` when consumers must change code to upgrade: API removals,
@@ -15,16 +16,19 @@ summary: ""
15
16
  # usage. Flagged as `Breaking` in the rollup.
16
17
  breaking: false
17
18
 
18
- # Set `true` if this release contains any security fix. Pairs with the
19
- # `## Security` section below. Flagged as `Security` in the rollup so
20
- # users can triage upgrade urgency at a glance.
19
+ # Set `true` ONLY for a security fix in THIS project's own source code — a
20
+ # vulnerability or hardening in code you ship. A dependency or transitive CVE
21
+ # bump is routine maintenance, NOT a security release: record it under
22
+ # `## Dependencies` (with the advisory ID) and leave this `false`. When true,
23
+ # pairs with the `## Security` section below and flags `Security` in the rollup.
21
24
  security: false
22
25
 
23
26
  # Optional free-form notes for maintenance agents processing this release.
24
27
  # Not rendered in CHANGELOG — consumed by agents running `maintenance` on
25
- # downstream servers. Use for adoption instructions that don't fit the
26
- # human-facing sections: new files to create, fields to populate, one-time
27
- # migration steps. Omit the field entirely when there's nothing to say.
28
+ # downstream servers. ADOPTION STEPS ONLY — new files to create, fields to
29
+ # populate, one-time migration steps. Never a second rendering of the body:
30
+ # if a body bullet already says it, name the bullet's symbol instead of
31
+ # re-explaining. Omit the field entirely when there's nothing to say.
28
32
  # agent-notes: |
29
33
  # <instructions for downstream maintenance agents>
30
34
  ---
@@ -39,17 +43,54 @@ security: false
39
43
  each bullet with the symbol or concept name in **bold** so they can skip
40
44
  what's irrelevant and zoom in on what's not.
41
45
 
42
- Tone: terse, fact-dense, not verbose. Default to one sentence per bullet —
43
- name the symbol, state what changed, stop. Use a second sentence only when
44
- it carries weight. If a bullet feels long, it is.
45
-
46
- Cut: mechanism walkthroughs (those belong in JSDoc, CLAUDE.md/AGENTS.md, or the
47
- relevant skill), ceremonial framings ("This release introduces…",
48
- backwards-compat paragraphs), file-by-file test enumerations, internal
49
- implementation notes. Prefer code/symbol names over English re-explanations.
46
+ Tone: terse, fact-dense, not verbose. Bullet shape: **symbol** + what
47
+ changed + at most one consumer-facing caveat. One sentence by default, two
48
+ when the second carries weight — a bullet past ~40 words or three sentences
49
+ is wrong. The depth lives one hop away: the linked issue carries the why,
50
+ the commit diff carries the how. The changelog names what changed and what
51
+ a consumer does about it; a reader who wants mechanism opens the link.
52
+
53
+ Model length on THIS guide, never on the previous entry — entries modeled
54
+ on entries compound.
55
+
56
+ Cut (each has shipped as a wall of text; these are the cruft):
57
+ - History/justification narration — how the bug worked, why the old
58
+ behavior was wrong. One short clause at most; the issue carries the story.
59
+ - Design-rationale defense — "chosen over Y because…", "guarding the
60
+ getter is not enough…". That is the author arguing with a reviewer;
61
+ reviewers read the PR, not the changelog.
62
+ - Defensive unchanged-clauses — "X is unchanged", "byte-identical to
63
+ <prev>". Keep one only where its absence would cause a real misread,
64
+ as a short parenthetical.
65
+ - Edge-case inventories — marker lists, not-flagged lists, escape tables.
66
+ Tests and the issue carry those.
67
+ - Mechanism walkthroughs (JSDoc, CLAUDE.md/AGENTS.md, or the relevant
68
+ skill own those), ceremonial framings ("This release introduces…"),
69
+ backwards-compat paragraphs, file-by-file test enumerations. Prefer
70
+ code/symbol names over English re-explanations.
71
+
72
+ Verified ≠ included: the every-claim-verified-from-the-diff rule bounds
73
+ the TRUTH of what you write, never the AMOUNT.
74
+
75
+ Example — same fact, right size:
76
+
77
+ TOO LONG: **`fetchWithTimeout`'s `timeoutMs` bounds the whole exchange**
78
+ (#341). `fetch` resolves once headers arrive and the deadline was
79
+ cleared as the helper returned, so a peer that answered promptly and
80
+ then stalled the stream held the request open indefinitely. A 2xx
81
+ carrying a body now comes back as a passthrough wrapper that disarms
82
+ the deadline when the body closes, errors, or is cancelled; …
83
+ [+90 more words of mechanism and edge cases]
84
+
85
+ RIGHT: **`fetchWithTimeout`'s `timeoutMs` now bounds the whole
86
+ exchange, not just the headers** (#341). A stalled body aborts with
87
+ the same `Timeout` error; the returned `Response` is a wrapper, so
88
+ identity assertions (`toBe(response)`) no longer hold.
50
89
 
51
90
  Narrative intro: skip by default. Add one short sentence only when the
52
- release theme genuinely needs framing the bullets can't carry.
91
+ release theme genuinely needs framing the bullets can't carry. When many
92
+ bullets share one upgrade consequence, state it ONCE — intro line or
93
+ agent-notes — never per bullet.
53
94
 
54
95
  Sections: Keep a Changelog order — Added, Changed, Deprecated, Removed,
55
96
  Fixed, Security. Include only sections with entries; delete the rest
package/dist/mcp-server/tools/definitions/index.d.ts CHANGED
@@ -8,43 +8,6 @@ export { workflowDelete } from './workflow-delete.tool.js';
8
8
  export { workflowGet } from './workflow-get.tool.js';
9
9
  export { workflowList } from './workflow-list.tool.js';
10
10
  export declare const allToolDefinitions: (import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
11
- name: import("zod").ZodString;
12
- version: import("zod").ZodString;
13
- description: import("zod").ZodString;
14
- author: import("zod").ZodString;
15
- category: import("zod").ZodString;
16
- tags: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
17
- steps: import("zod").ZodArray<import("zod").ZodObject<{
18
- server: import("zod").ZodString;
19
- tool: import("zod").ZodString;
20
- action: import("zod").ZodOptional<import("zod").ZodString>;
21
- description: import("zod").ZodOptional<import("zod").ZodString>;
22
- name: import("zod").ZodOptional<import("zod").ZodString>;
23
- params: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
24
- forEach: import("zod").ZodOptional<import("zod").ZodString>;
25
- }, import("zod/v4/core").$strip>>;
26
- }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
27
- status: import("zod").ZodLiteral<"created">;
28
- filePath: import("zod").ZodString;
29
- key: import("zod").ZodString;
30
- created_date: import("zod").ZodString;
31
- last_updated_date: import("zod").ZodString;
32
- }, import("zod/v4/core").$strip>, readonly [{
33
- readonly reason: "invalid_input";
34
- readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
35
- readonly when: "A field passed schema validation but is semantically invalid: a blank/whitespace-only category, a category that slugifies to empty, or a name that slugifies to empty or exceeds the filename length limit.";
36
- readonly recovery: "Provide a category and workflow name that each contain alphanumeric characters, and keep the name under 200 characters after slugification.";
37
- }, {
38
- readonly reason: "already_exists";
39
- readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.Conflict;
40
- readonly when: "A permanent workflow with this name@version already exists in the index.";
41
- readonly recovery: "Change the version field or use a different name to avoid the conflict.";
42
- }, {
43
- readonly reason: "write_failed";
44
- readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.InternalError;
45
- readonly when: "Filesystem write error such as insufficient permissions or a full disk.";
46
- readonly recovery: "Check that the workflows directory is writable and has sufficient disk space, then retry.";
47
- }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
48
11
  name: import("zod").ZodString;
49
12
  version: import("zod").ZodString;
50
13
  description: import("zod").ZodString;
@@ -76,33 +39,29 @@ export declare const allToolDefinitions: (import("@cyanheads/mcp-ts-core").ToolD
76
39
  readonly when: "Filesystem write error such as insufficient permissions or a full disk.";
77
40
  readonly recovery: "Check that the workflows directory is writable and has sufficient disk space, then retry.";
78
41
  }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
79
- name: import("zod").ZodString;
80
- version: import("zod").ZodOptional<import("zod").ZodString>;
42
+ query: import("zod").ZodOptional<import("zod").ZodString>;
43
+ category: import("zod").ZodOptional<import("zod").ZodString>;
44
+ tags: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
45
+ includeTools: import("zod").ZodOptional<import("zod").ZodBoolean>;
81
46
  }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
82
- status: import("zod").ZodLiteral<"deleted">;
83
- name: import("zod").ZodString;
84
- version: import("zod").ZodString;
47
+ workflows: import("zod").ZodArray<import("zod").ZodObject<{
48
+ name: import("zod").ZodString;
49
+ version: import("zod").ZodString;
50
+ description: import("zod").ZodString;
51
+ author: import("zod").ZodString;
52
+ category: import("zod").ZodOptional<import("zod").ZodString>;
53
+ tags: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
54
+ tools: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
55
+ }, import("zod/v4/core").$strip>>;
56
+ totalCount: import("zod").ZodNumber;
85
57
  }, import("zod/v4/core").$strip>, readonly [{
86
- readonly reason: "not_found";
87
- readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.NotFound;
88
- readonly when: "No permanent workflow matches the given name, or the given name and version.";
89
- readonly recovery: "Use workflow_list to see available workflow names and versions, then retry; omit version to target the latest.";
90
- }, {
91
- readonly reason: "temp_not_allowed";
92
- readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
93
- readonly when: "The resolved workflow is temporary, and temporary workflows cannot be deleted.";
94
- readonly recovery: "Leave temporary workflows to expire on their own — only permanent workflows can be deleted here.";
95
- }, {
96
- readonly reason: "delete_failed";
97
- readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.InternalError;
98
- readonly when: "Filesystem error while removing the workflow file, such as insufficient permissions.";
99
- readonly recovery: "Check that the workflows directory is writable, then retry the deletion.";
100
- }, {
101
58
  readonly reason: "index_unavailable";
102
59
  readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ServiceUnavailable;
103
60
  readonly when: "The workflow index has not finished building yet.";
104
61
  readonly recovery: "Retry after the server has finished initializing its workflow index.";
105
- }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
62
+ }], {
63
+ readonly notice: import("zod").ZodOptional<import("zod").ZodString>;
64
+ }> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
106
65
  name: import("zod").ZodString;
107
66
  version: import("zod").ZodOptional<import("zod").ZodString>;
108
67
  }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
@@ -128,8 +87,8 @@ export declare const allToolDefinitions: (import("@cyanheads/mcp-ts-core").ToolD
128
87
  }, import("zod/v4/core").$strip>;
129
88
  globalInstructions: import("zod").ZodNullable<import("zod").ZodString>;
130
89
  source: import("zod").ZodEnum<{
131
- temp: "temp";
132
90
  permanent: "permanent";
91
+ temp: "temp";
133
92
  }>;
134
93
  }, import("zod/v4/core").$strip>, readonly [{
135
94
  readonly reason: "not_found";
@@ -147,27 +106,68 @@ export declare const allToolDefinitions: (import("@cyanheads/mcp-ts-core").ToolD
147
106
  readonly when: "The workflow index has not finished building yet.";
148
107
  readonly recovery: "Retry after the server has finished initializing its workflow index.";
149
108
  }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
150
- query: import("zod").ZodOptional<import("zod").ZodString>;
151
- category: import("zod").ZodOptional<import("zod").ZodString>;
109
+ name: import("zod").ZodString;
110
+ version: import("zod").ZodString;
111
+ description: import("zod").ZodString;
112
+ author: import("zod").ZodString;
113
+ category: import("zod").ZodString;
152
114
  tags: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
153
- includeTools: import("zod").ZodOptional<import("zod").ZodBoolean>;
154
- }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
155
- workflows: import("zod").ZodArray<import("zod").ZodObject<{
156
- name: import("zod").ZodString;
157
- version: import("zod").ZodString;
158
- description: import("zod").ZodString;
159
- author: import("zod").ZodString;
160
- category: import("zod").ZodOptional<import("zod").ZodString>;
161
- tags: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
162
- tools: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
115
+ steps: import("zod").ZodArray<import("zod").ZodObject<{
116
+ server: import("zod").ZodString;
117
+ tool: import("zod").ZodString;
118
+ action: import("zod").ZodOptional<import("zod").ZodString>;
119
+ description: import("zod").ZodOptional<import("zod").ZodString>;
120
+ name: import("zod").ZodOptional<import("zod").ZodString>;
121
+ params: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
122
+ forEach: import("zod").ZodOptional<import("zod").ZodString>;
163
123
  }, import("zod/v4/core").$strip>>;
164
- totalCount: import("zod").ZodNumber;
124
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
125
+ status: import("zod").ZodLiteral<"created">;
126
+ filePath: import("zod").ZodString;
127
+ key: import("zod").ZodString;
128
+ created_date: import("zod").ZodString;
129
+ last_updated_date: import("zod").ZodString;
165
130
  }, import("zod/v4/core").$strip>, readonly [{
131
+ readonly reason: "invalid_input";
132
+ readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
133
+ readonly when: "A field passed schema validation but is semantically invalid: a blank/whitespace-only category, a category that slugifies to empty, or a name that slugifies to empty or exceeds the filename length limit.";
134
+ readonly recovery: "Provide a category and workflow name that each contain alphanumeric characters, and keep the name under 200 characters after slugification.";
135
+ }, {
136
+ readonly reason: "already_exists";
137
+ readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.Conflict;
138
+ readonly when: "A permanent workflow with this name@version already exists in the index.";
139
+ readonly recovery: "Change the version field or use a different name to avoid the conflict.";
140
+ }, {
141
+ readonly reason: "write_failed";
142
+ readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.InternalError;
143
+ readonly when: "Filesystem write error such as insufficient permissions or a full disk.";
144
+ readonly recovery: "Check that the workflows directory is writable and has sufficient disk space, then retry.";
145
+ }], undefined> | import("@cyanheads/mcp-ts-core").ToolDefinition<import("zod").ZodObject<{
146
+ name: import("zod").ZodString;
147
+ version: import("zod").ZodOptional<import("zod").ZodString>;
148
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
149
+ status: import("zod").ZodLiteral<"deleted">;
150
+ name: import("zod").ZodString;
151
+ version: import("zod").ZodString;
152
+ }, import("zod/v4/core").$strip>, readonly [{
153
+ readonly reason: "not_found";
154
+ readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.NotFound;
155
+ readonly when: "No permanent workflow matches the given name, or the given name and version.";
156
+ readonly recovery: "Use workflow_list to see available workflow names and versions, then retry; omit version to target the latest.";
157
+ }, {
158
+ readonly reason: "temp_not_allowed";
159
+ readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ValidationError;
160
+ readonly when: "The resolved workflow is temporary, and temporary workflows cannot be deleted.";
161
+ readonly recovery: "Leave temporary workflows to expire on their own — only permanent workflows can be deleted here.";
162
+ }, {
163
+ readonly reason: "delete_failed";
164
+ readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.InternalError;
165
+ readonly when: "Filesystem error while removing the workflow file, such as insufficient permissions.";
166
+ readonly recovery: "Check that the workflows directory is writable, then retry the deletion.";
167
+ }, {
166
168
  readonly reason: "index_unavailable";
167
169
  readonly code: import("@cyanheads/mcp-ts-core/errors").JsonRpcErrorCode.ServiceUnavailable;
168
170
  readonly when: "The workflow index has not finished building yet.";
169
171
  readonly recovery: "Retry after the server has finished initializing its workflow index.";
170
- }], {
171
- readonly notice: import("zod").ZodOptional<import("zod").ZodString>;
172
- }>)[];
172
+ }], undefined>)[];
173
173
  //# sourceMappingURL=index.d.ts.map
package/dist/mcp-server/tools/definitions/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAQvD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAM9B,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/mcp-server/tools/definitions/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAQvD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAM9B,CAAC"}
package/dist/mcp-server/tools/definitions/workflow-get.tool.d.ts CHANGED
@@ -30,8 +30,8 @@ export declare const workflowGet: import("@cyanheads/mcp-ts-core").ToolDefinitio
30
30
  }, z.core.$strip>;
31
31
  globalInstructions: z.ZodNullable<z.ZodString>;
32
32
  source: z.ZodEnum<{
33
- temp: "temp";
34
33
  permanent: "permanent";
34
+ temp: "temp";
35
35
  }>;
36
36
  }, z.core.$strip>, readonly [{
37
37
  readonly reason: "not_found";
package/dist/services/workflow-index/workflow-index-service.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"workflow-index-service.d.ts","sourceRoot":"","sources":["../../../src/services/workflow-index/workflow-index-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,KAAK,EAAiB,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA+C9F,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK7C;AA0CD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,kBAAkB,CAA8B;IACxD,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,YAAY,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM;IAQ3F,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED,mCAAmC;IACnC,IAAI,KAAK,IAAI,aAAa,CAEzB;IAED,oEAAoE;IAC9D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAW3B,6BAA6B;IAC7B,QAAQ,IAAI,IAAI;IAOhB,8DAA8D;IAC9D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE;IAQzC,oFAAoF;IACpF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAUvE,yEAAyE;IACnE,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUtD,6DAA6D;IACvD,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAuD/D,6DAA6D;IACvD,SAAS,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1D;;;;;;;;;;;OAWG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;YA6BlF,OAAO;YAuBP,aAAa;YAwBb,QAAQ;YAwCR,aAAa;IAsB3B,OAAO,CAAC,YAAY;IAiCpB,OAAO,CAAC,gBAAgB;CAKzB;AAQD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,SAAS,EAClB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,sBAAsB,EAAE,MAAM,EAC9B,iBAAiB,EAAE,MAAM,GACxB,IAAI,CAKN;AAED,wBAAgB,uBAAuB,IAAI,oBAAoB,CAO9D"}
1
+ {"version":3,"file":"workflow-index-service.d.ts","sourceRoot":"","sources":["../../../src/services/workflow-index/workflow-index-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,KAAK,EAAiB,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA+C9F,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK7C;AA0CD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,kBAAkB,CAA8B;IACxD,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAE3C,YAAY,YAAY,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAI1F;IAID,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED,mCAAmC;IACnC,IAAI,KAAK,IAAI,aAAa,CAEzB;IAED,oEAAoE;IAC9D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAS1B;IAED,6BAA6B;IAC7B,QAAQ,IAAI,IAAI,CAGf;IAID,8DAA8D;IAC9D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAMxC;IAED,oFAAoF;IACpF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAQtE;IAED,yEAAyE;IACnE,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMrD;IAID,6DAA6D;IACvD,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAqD9D;IAED,6DAA6D;IACvD,SAAS,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAezD;IAED;;;;;;;;;;;OAWG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAyB/F;YAIa,OAAO;YAuBP,aAAa;YAwBb,QAAQ;YAwCR,aAAa;IAsB3B,OAAO,CAAC,YAAY;IAiCpB,OAAO,CAAC,gBAAgB;CAKzB;AAQD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,SAAS,EAClB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,sBAAsB,EAAE,MAAM,EAC9B,iBAAiB,EAAE,MAAM,GACxB,IAAI,CAKN;AAED,wBAAgB,uBAAuB,IAAI,oBAAoB,CAO9D"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cyanheads/workflows-mcp-server",
3
- "version": "0.2.0",
3
+ "version": "0.3.0",
4
4
  "mcpName": "io.github.cyanheads/workflows-mcp-server",
5
5
  "description": "Store, query, and create YAML workflow playbooks for LLM agents via MCP. STDIO or Streamable HTTP.",
6
6
  "type": "module",
@@ -21,7 +21,7 @@
21
21
  ],
22
22
  "scripts": {
23
23
  "build": "bun run scripts/build.ts",
24
- "rebuild": "bun run scripts/clean.ts && bun run build",
24
+ "rebuild": "bun run scripts/clean.ts && bun run scripts/build.ts",
25
25
  "clean": "bun run scripts/clean.ts",
26
26
  "devcheck": "bun run scripts/devcheck.ts",
27
27
  "audit:refresh": "rm -f bun.lock && bun install && bun audit",
@@ -34,8 +34,10 @@
34
34
  "bundle": "bun run build && npx -y @anthropic-ai/mcpb pack . dist/workflows-mcp-server.mcpb && bun run scripts/clean-mcpb.ts dist/workflows-mcp-server.mcpb",
35
35
  "changelog:build": "bun run scripts/build-changelog.ts",
36
36
  "changelog:check": "bun run scripts/build-changelog.ts --check",
37
+ "release:github": "bun run scripts/release-github.ts",
37
38
  "publish-mcp": "mcp-publisher login github -token \"$(security find-generic-password -a \"$USER\" -s mcp-publisher-github-pat -w)\" && mcp-publisher publish",
38
- "test": "bunx vitest run",
39
+ "test": "vitest run",
40
+ "test:coverage": "vitest run --coverage",
39
41
  "start:stdio": "MCP_TRANSPORT_TYPE=stdio bun ./dist/index.js",
40
42
  "start:http": "MCP_TRANSPORT_TYPE=http bun ./dist/index.js"
41
43
  },
@@ -62,7 +64,7 @@
62
64
  "bugs": {
63
65
  "url": "https://github.com/cyanheads/workflows-mcp-server/issues"
64
66
  },
65
- "author": "cyanheads <casey@caseyjhand.com> (https://github.com/cyanheads/workflows-mcp-server#readme)",
67
+ "author": "Casey Hand <casey@caseyjhand.com> (https://caseyjhand.com)",
66
68
  "funding": [
67
69
  {
68
70
  "type": "github",
@@ -74,31 +76,32 @@
74
76
  }
75
77
  ],
76
78
  "license": "Apache-2.0",
77
- "packageManager": "bun@1.3.2",
79
+ "packageManager": "bun@1.4.0",
78
80
  "engines": {
79
- "bun": ">=1.3.2",
81
+ "bun": ">=1.3.0",
80
82
  "node": ">=24.0.0"
81
83
  },
82
84
  "publishConfig": {
83
85
  "access": "public"
84
86
  },
85
87
  "dependencies": {
86
- "@cyanheads/mcp-ts-core": "^0.10.10",
88
+ "@cyanheads/mcp-ts-core": "^0.12.3",
87
89
  "pino-pretty": "^13.1.3",
88
90
  "semver": "^7.8.5",
89
91
  "yaml": "^2.9.0",
90
92
  "zod": "^4.4.3"
91
93
  },
92
94
  "devDependencies": {
93
- "@biomejs/biome": "^2.5.1",
94
- "@types/node": "^25.9.3",
95
- "@types/semver": "^7.7.1",
96
- "@vitest/coverage-istanbul": "^4.1.9",
95
+ "@biomejs/biome": "2.5.9",
96
+ "@socketsecurity/bun-security-scanner": "^1.1.2",
97
+ "@types/node": "26.2.0",
98
+ "@types/semver": "^7.8.0",
99
+ "@vitest/coverage-istanbul": "4.1.11",
97
100
  "depcheck": "^1.4.7",
98
- "fast-check": "^4.8.0",
99
- "ignore": "^7.0.5",
100
- "tsc-alias": "^1.8.17",
101
- "typescript": "^6.0.3",
102
- "vitest": "^4.1.9"
101
+ "fast-check": "^4.9.0",
102
+ "ignore": "^7.0.6",
103
+ "tsc-alias": "^1.9.2",
104
+ "typescript": "^7.0.2",
105
+ "vitest": "^4.1.11"
103
106
  }
104
107
  }
package/server.json CHANGED
@@ -6,14 +6,14 @@
6
6
  "url": "https://github.com/cyanheads/workflows-mcp-server",
7
7
  "source": "github"
8
8
  },
9
- "version": "0.2.0",
9
+ "version": "0.3.0",
10
10
  "packages": [
11
11
  {
12
12
  "registryType": "npm",
13
13
  "registryBaseUrl": "https://registry.npmjs.org",
14
14
  "identifier": "@cyanheads/workflows-mcp-server",
15
15
  "runtimeHint": "bun",
16
- "version": "0.2.0",
16
+ "version": "0.3.0",
17
17
  "packageArguments": [
18
18
  { "type": "positional", "value": "run" },
19
19
  { "type": "positional", "value": "start:stdio" }
@@ -57,7 +57,7 @@
57
57
  "registryBaseUrl": "https://registry.npmjs.org",
58
58
  "identifier": "@cyanheads/workflows-mcp-server",
59
59
  "runtimeHint": "bun",
60
- "version": "0.2.0",
60
+ "version": "0.3.0",
61
61
  "packageArguments": [
62
62
  { "type": "positional", "value": "run" },
63
63
  { "type": "positional", "value": "start:http" }