@seldonframe/mcp 1.21.2 → 1.22.0

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@seldonframe/mcp",
-  "version": "1.21.2",
+  "version": "1.22.0",
+  "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.22.0: WHITE-LABEL CRM PHASE 4 — operator-portal /contacts /deals /bookings mirrors + agency support sessions + TRUE self-service reschedule. WHAT SHIPS: (1) OPERATOR PORTAL MIRRORS — /portal/<orgSlug>/contacts (Twenty-CRM-style table: Name, Email, Phone, Company, Status pill, Score, Added date, scoped to operator session.orgId), /portal/<orgSlug>/deals (pipeline-grouped view with stage totals, contact links, expected close date, deal value formatted with Intl.NumberFormat), /portal/<orgSlug>/bookings (Upcoming + Past sections, status pills, contact links, scoped queries with ne(template) filter). All three pages use the existing OperatorPortalShell so agency-branded chrome + light Twenty-CRM aesthetic carry through. Sidebar nav refactored from layout-level hardcoded active-state to a client-component (operator-portal-sidebar-nav.tsx) that reads usePathname() — placeholders ('v1.21' badges) gone. (2) AGENCY SUPPORT SESSIONS — migration 0043 adds the agency_support_sessions audit table (agency_id + workspace_id + origin_user_id + started_at + ended_at + ip_hash + user_agent + notes; three indexes for hot-path queries). New lib/operator-portal/support-session.ts with createAgencySupportSession (verifies caller owns the agency via partner_agencies.owner_user_id, mints OperatorTokenPayload kind=session with supportOriginUserId set + 2-hour TTL, writes audit row, returns the support-magic URL) + consumeAgencySupportSession (verifies the support token, sets the operator session cookie). New /portal/<slug>/support-magic route consumes tokens. New /agency dashboard page lists the caller's owned agencies + their attached workspaces with 'Open portal' button per workspace (opens new tab). The existing v1.20 yellow 'Agency support session active' banner in the operator portal layout already lights up automatically when supportOriginUserId is set on the session token. (3) TRUE SELF-SERVICE RESCHEDULE — new /customer/<orgSlug>/reschedule/<bookingId> page with date-tabs + slot-button-grid that reuses the EXISTING listPublicBookingSlotsAction (the same generator that powers /book/<slug> — single source of truth for availability + workday hours + buffer + max-bookings-per-day enforcement). Customer picks a real slot, the new rescheduleBookingAction in lib/customer-portal/appointment-actions.ts atomically validates the slot is in the live availability set, computes new endsAt preserving original duration, UPDATEs bookings.startsAt + endsAt, writes activities row type='booking_rescheduled' with old/new ISO in metadata, emits portal.booking_rescheduled event. After the update every operator surface (contact activity timeline, /portal/<slug>/bookings, /deals pipeline) reflects the new time without any extra wiring — bookings.startsAt is the single field everyone reads from. Customer-portal Reschedule button changed from inline date+time picker to a link out to the new slot-picker page (replacing v1.21.1 'request' semantics with atomic v1.22 self-service). Cancel flow keeps the inline reason textarea — that path was already correct. NO new MCP tools. Migration 0043 already applied to prod via Neon MCP. Test count unchanged (existing 46 tests cover the v1.19-1.21 invariants). Backend redeploy required. Deferred to v1.23: agency support session ended_at tracking on logout; operator-side inline edit + status changes on the mirror tables; /portal/<slug>/contacts/<id> contact-detail page with full activity timeline; rate limit + abuse detection on agency support sessions.",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.21.2: HOTFIX-OF-HOTFIX — v1.21.1's activity-bridge insert was silently skipped on workspaces whose owning user has role != 'owner'. Pre-1.21.1 customer messages didn't appear in operator's contact activity feed (the original bug). v1.21.1 added the bridge but the lookup `eq(users.role, 'owner')` was too strict — Cypress & Pine HVAC's owning user (Maxime, created via manual users-row INSERT during the v1.18 unblock) has role='member' or null, so the activity insert silently no-op'd. v1.21.2: drop the role filter; pick the FIRST user in the workspace, matching the existing booking-activity pattern in lib/bookings/api.ts that's been working since v1.0. Customer-side activity rows (portal_message / booking_cancelled / reschedule_requested) now land reliably regardless of role-string variance across workspaces. NO migrations, NO env vars. Backend hotfix only. v1.22 still queued: operator-portal /contacts /deals /bookings table mirrors; agency 'Open <workspace> portal' support sessions; TRUE self-service reschedule (slot picker integrated with /book).",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.21.1: HOTFIX — customer-portal actions now bridge to operator's contact activity feed + reschedule UI upgraded from free-text textarea to structured date+time picker. TWO BUG CLASSES FIXED: (1) ACTIVITY BRIDGE. Pre-1.21.1 when a customer sent a message via /customer/<orgSlug>/messages, it inserted a row into portal_messages but NOT into activities. The contact's /contacts/<id>?tab=activity feed reads from activities, so customer messages were silently invisible to operators. Same gap existed for booking cancellations (cancelBookingAction) and reschedule requests (requestRescheduleAction) shipped in v1.21.0. v1.21.1: every customer-side action now ALSO inserts an activities row anchored to the workspace owner's userId (since activities.userId is NOT NULL and the actor is a contact, not a user). Activity types added: 'portal_message' (customer sent a message), 'booking_cancelled' (customer cancelled), 'reschedule_requested' (customer asked to reschedule). Each row carries metadata.source='customer_portal' so a future ops view can filter customer-side vs operator-side actions. Subject lines are scannable ('Customer cancelled: Booked consultation' vs operator-CRM 'Booking scheduled'). (2) RESCHEDULE PICKER. Pre-1.21.1 the reschedule action exposed a single free-text textarea ('When would you like to reschedule? e.g. next Tuesday afternoon'). v1.21.1 replaces this with a STRUCTURED DATE + TIME picker (HTML date input min'd to today, HTML time input stepped to 15-min) plus an optional notes textarea. The composed reason saved on the activity row carries both human-readable text + machine-parseable ISO ('Preferred: 2026-05-14 at 14:30. Note: afternoon works best (iso=2026-05-14T14:30)'), so v1.22 can plug this directly into the calendar slot validator and auto-create the new booking on operator approval. The cancel flow keeps the simple textarea ('Reason — optional'). NO migrations, NO new env vars, NO new MCP tools — backend hotfix only. Backend redeploy required. v1.22 still queued for: operator-portal /contacts /deals /bookings table mirrors; agency 'Open <workspace> portal' support sessions + agency_support_sessions audit table; TRUE self-service reschedule (slot picker integrated with /book — atomic update of bookings.startsAt with availability check, replacing the v1.21.1 'request' semantics).",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.21.0: CUSTOMER PORTAL GROUND-UP REBUILD — light Twenty-CRM aesthetic, industry-aware copy, end-customer-focused information architecture. Pre-1.21 the customer portal at /customer/<orgSlug> was a dark-mode stat grid (Messages: 0 / Resources: 0 / Viewed Resources: 0) with operator-jargon nav (Pipeline / My Pipeline / Bookings / Resources). The end customer audience — homeowner who called HVAC, patient at the dentist, client of the coach — has zero use for any of that. v1.21 starts from first principles: what does the END customer actually need? (1) Their next appointment — when, where, who's coming, can I reschedule, can I cancel. (2) Quick way to reach the business — tap-to-call + tap-to-email. (3) History of their relationship with the business. (4) Documents shared with them. The portal is rebuilt around those needs. WHAT SHIPS: (1) Industry-aware copy packs (lib/customer-portal/copy-packs.ts) keyed by organizations.soul.industry — HVAC says 'service visit', dental says 'appointment', coaching says 'session', legal says 'consultation', accounting says 'meeting', medspa says 'appointment', agency says 'meeting'. Provider labels calibrated too (technician / doctor / coach / attorney / accountant / specialist / account manager). General fallback pack for unknown industries. 11 contract tests cover the picker shape (case-insensitive lookup, complete-pack invariant, no copy/paste pluralization bugs). (2) CustomerPortalShell (light mode FORCED regardless of workspace theme.mode — Twenty-CRM-quality customer experiences are light, neutral, dense). Sidebar nav on sm+ (Home / Appointments / Documents / Messages / Account); mobile top-tabs row below sm. Agency-branded chrome via deriveEffectiveBranding (Acme AI logo + 'on Acme AI' subtitle when active partner agency exists). Powered-by-SF footer respects agency.hide_powered_by_badge. Inter-style sans, 1px hairline borders (#E5E5E1), neutral grays (#F7F7F5 bg, #111 text). (3) NEW OVERVIEW page — hero NEXT APPOINTMENT card (date, time, notes, View details / Reschedule / Cancel buttons) + QUICK CONTACT card (tap-to-call + tap-to-email, mobile-first since this is overwhelmingly a phone surface) + RECENT ACTIVITY (2-3 most recent past bookings). 'Welcome back, <name>' with industry-aware subtitle. Empty state for new customers with zero appointments. (4) NEW APPOINTMENTS page (replaces /pipeline + /bookings). Upcoming + Past sections. Each upcoming row exposes inline Reschedule + Cancel actions powered by lib/customer-portal/appointment-actions.ts (cancelBookingAction = atomic update bookings.status='cancelled' scoped to session.contact.id; requestRescheduleAction = emits portal.reschedule_requested event for operator follow-up. Both enforce contact-scope so a customer can't touch another customer's bookings even with a guessed booking_id). (5) NEW ACCOUNT page — read-only contact info on file + tap-to-call/email business + signed-in-as block with sign-out. v1.22 will add self-edit. (6) DOCUMENTS page redesigned (renamed from /resources). Files (uploaded) + Links sections, light-mode rows, download/open buttons. (7) MESSAGES page redesigned with light shell. Same PortalMessagesClient component (data plumbing untouched). (8) Drop /pipeline (operator-jargon meaningless to customers) and /bookings (folded into /appointments). PIPELINE TAB REMOVED FROM NAV — customers don't have pipelines. (9) Auth + data plumbing UNCHANGED — same requirePortalSessionForOrg, listPortalBookings, listPortalDocuments, listPortalMessages, clearPortalSessionAction. Only the chrome + IA + copy change. NO MIGRATIONS, NO new env vars. Test count: +11 (copy pack picker invariants). Backend redeploy required. Deferred to v1.22: full /contacts /deals /bookings table mirrors inside operator portal; agency support sessions ('Open Cypress portal'); customer self-edit on Account page; true self-service reschedule (customer picks new slot from workspace availability) — currently the reschedule action emits an operator-followup event.",