@seldonframe/mcp 1.22.0 → 1.24.0

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "@seldonframe/mcp",
-  "version": "1.22.0",
+  "version": "1.24.0",
+  "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.24.0: ONE SOURCE OF TRUTH — operator portal /contacts /deals /bookings now render the EXACT SAME COMPONENTS as the admin dashboard equivalents. Pre-1.24.0 the operator portal mirrors I shipped in v1.22 were simpler bespoke versions (basic Twenty-CRM-style tables) that visually didn't match the admin pages. v1.24.0 refactors so /contacts, /deals, and /bookings each have ONE shared view component used by BOTH admin route AND operator portal route — same data fetching, same UI, same UX. ARCHITECTURAL CHANGES: (1) Data primitives accept orgId override. listContacts(options.orgId), listDeals(orgId), listBookings(orgId), listAppointmentTypes(orgId), getDefaultPipeline(orgId), getSoul(orgId), getLabels(orgId), getPersonality(orgId) — all gain optional orgId parameter. When set, skips the session-based getOrgId() call; when null, falls through to the existing session resolution. This is the seam that lets the same query helpers serve both the admin's NextAuth-resolved orgId AND the operator-portal's sf_operator_session-resolved orgId. (2) Three new shared components: <ContactsListPageView orgId searchParams baseHref contactDetailHrefBase dealDetailHrefBase readonly>, <DealsListPageView orgId searchParams readonly>, <BookingsListPageView orgId readonly>. Each does the entire page load + render. The admin /contacts /deals /bookings pages are now 5-line thin wrappers that resolve session→orgId and pass through. (3) ContactsTableView gains contactDetailHrefBase + dealDetailHrefBase + readonly props. /contacts row clicks route to /contacts/<id> (admin) or /portal/<slug>/contacts/<id> (operator) based on the prop. SidePanel + DealsTab + OverviewTab thread these props down. (4) Operator portal mirror pages are now 5-line wrappers too: resolve operator session → orgId → render the same shared component with `readonly` set + workspace-aware hrefBase props. The v1.22 bespoke operator pages (smaller Twenty-CRM tables) are deleted. READ-ONLY MODE: v1.24.0 ships read-only operator mirrors. Inline edit, drag-drop, status changes, bulk-select are wired to NextAuth-backed server actions (e.g. updateContactFieldAction calls getOrgId() which reads NextAuth) that the operator-portal session can't satisfy. ContactsListPageView passes readonly=true from operator routes; the ContactsPageActions header (CSV import + add new) is hidden in readonly mode. v1.24.1 will refactor the write actions for dual-auth so operator-portal users can edit too. DEFERRED TO v1.24.1: /dashboard mirror (1,359-line page; needs careful extraction to avoid regressions); /contacts/<id> detail mirror (Overview/Activity/Deals/Emails/Bookings/Documents/Notes tabs); dual-auth refactor of write server actions so operator portal becomes write-capable. NO migrations, NO new env vars, NO new MCP tools. Backend redeploy required.",
+  "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.23.0: month-calendar reschedule + operator dashboard cleanup. WHAT SHIPS: (1) RESCHEDULE NOW USES THE SAME CALENDAR AS /book. v1.22 shipped a date-tabs + slot-grid layout that worked but visually didn't match the /book/<slug> calendar (3-step indicator, full month-grid). v1.23 swaps in CustomerRescheduleCalendar (React) — 3-step indicator (Pick a date / Choose a time / Confirm reschedule), MON-SUN month grid with prev/next navigation, today highlight, past dates disabled, click-day → time-slots fetched via new /api/v1/public/booking-slots endpoint, click-slot → confirmation panel → atomic rescheduleBookingAction. Same backend (single source of truth via listPublicBookingSlotsAction); just better-matched UX surface. New thin GET endpoint /api/v1/public/booking-slots wraps the existing slot enumerator so client-side calendars can fetch availability without re-running the full /book renderer. (2) OPERATOR DASHBOARD CLEANUP. Removed the stale 'Coming in v1.21' card from /portal/<orgSlug> dashboard — those mirror pages (/contacts /deals /bookings) shipped in v1.22 so the placeholder was incorrect. The 'last 8' / 'v1.21 — full activity feed' label on Recent activity replaced with a count-based subtitle ('last N'). Customer-reschedule-client (v1.22 date-tabs implementation) deleted. NO migrations, NO new env vars, NO new MCP tools. Backend redeploy required. v1.24 queued: extract admin /contacts /deals /bookings/<id> into shared components, wire operator portal mirrors to render the same components — true one-source-of-truth so /portal/<slug>/contacts looks IDENTICAL to /contacts (just scoped). Currently the operator-portal mirrors are simpler bespoke versions; v1.24 makes them indistinguishable from the admin pages.",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.22.0: WHITE-LABEL CRM PHASE 4 — operator-portal /contacts /deals /bookings mirrors + agency support sessions + TRUE self-service reschedule. WHAT SHIPS: (1) OPERATOR PORTAL MIRRORS — /portal/<orgSlug>/contacts (Twenty-CRM-style table: Name, Email, Phone, Company, Status pill, Score, Added date, scoped to operator session.orgId), /portal/<orgSlug>/deals (pipeline-grouped view with stage totals, contact links, expected close date, deal value formatted with Intl.NumberFormat), /portal/<orgSlug>/bookings (Upcoming + Past sections, status pills, contact links, scoped queries with ne(template) filter). All three pages use the existing OperatorPortalShell so agency-branded chrome + light Twenty-CRM aesthetic carry through. Sidebar nav refactored from layout-level hardcoded active-state to a client-component (operator-portal-sidebar-nav.tsx) that reads usePathname() — placeholders ('v1.21' badges) gone. (2) AGENCY SUPPORT SESSIONS — migration 0043 adds the agency_support_sessions audit table (agency_id + workspace_id + origin_user_id + started_at + ended_at + ip_hash + user_agent + notes; three indexes for hot-path queries). New lib/operator-portal/support-session.ts with createAgencySupportSession (verifies caller owns the agency via partner_agencies.owner_user_id, mints OperatorTokenPayload kind=session with supportOriginUserId set + 2-hour TTL, writes audit row, returns the support-magic URL) + consumeAgencySupportSession (verifies the support token, sets the operator session cookie). New /portal/<slug>/support-magic route consumes tokens. New /agency dashboard page lists the caller's owned agencies + their attached workspaces with 'Open portal' button per workspace (opens new tab). The existing v1.20 yellow 'Agency support session active' banner in the operator portal layout already lights up automatically when supportOriginUserId is set on the session token. (3) TRUE SELF-SERVICE RESCHEDULE — new /customer/<orgSlug>/reschedule/<bookingId> page with date-tabs + slot-button-grid that reuses the EXISTING listPublicBookingSlotsAction (the same generator that powers /book/<slug> — single source of truth for availability + workday hours + buffer + max-bookings-per-day enforcement). Customer picks a real slot, the new rescheduleBookingAction in lib/customer-portal/appointment-actions.ts atomically validates the slot is in the live availability set, computes new endsAt preserving original duration, UPDATEs bookings.startsAt + endsAt, writes activities row type='booking_rescheduled' with old/new ISO in metadata, emits portal.booking_rescheduled event. After the update every operator surface (contact activity timeline, /portal/<slug>/bookings, /deals pipeline) reflects the new time without any extra wiring — bookings.startsAt is the single field everyone reads from. Customer-portal Reschedule button changed from inline date+time picker to a link out to the new slot-picker page (replacing v1.21.1 'request' semantics with atomic v1.22 self-service). Cancel flow keeps the inline reason textarea — that path was already correct. NO new MCP tools. Migration 0043 already applied to prod via Neon MCP. Test count unchanged (existing 46 tests cover the v1.19-1.21 invariants). Backend redeploy required. Deferred to v1.23: agency support session ended_at tracking on logout; operator-side inline edit + status changes on the mirror tables; /portal/<slug>/contacts/<id> contact-detail page with full activity timeline; rate limit + abuse detection on agency support sessions.",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.21.2: HOTFIX-OF-HOTFIX — v1.21.1's activity-bridge insert was silently skipped on workspaces whose owning user has role != 'owner'. Pre-1.21.1 customer messages didn't appear in operator's contact activity feed (the original bug). v1.21.1 added the bridge but the lookup `eq(users.role, 'owner')` was too strict — Cypress & Pine HVAC's owning user (Maxime, created via manual users-row INSERT during the v1.18 unblock) has role='member' or null, so the activity insert silently no-op'd. v1.21.2: drop the role filter; pick the FIRST user in the workspace, matching the existing booking-activity pattern in lib/bookings/api.ts that's been working since v1.0. Customer-side activity rows (portal_message / booking_cancelled / reschedule_requested) now land reliably regardless of role-string variance across workspaces. NO migrations, NO env vars. Backend hotfix only. v1.22 still queued: operator-portal /contacts /deals /bookings table mirrors; agency 'Open <workspace> portal' support sessions; TRUE self-service reschedule (slot picker integrated with /book).",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.21.1: HOTFIX — customer-portal actions now bridge to operator's contact activity feed + reschedule UI upgraded from free-text textarea to structured date+time picker. TWO BUG CLASSES FIXED: (1) ACTIVITY BRIDGE. Pre-1.21.1 when a customer sent a message via /customer/<orgSlug>/messages, it inserted a row into portal_messages but NOT into activities. The contact's /contacts/<id>?tab=activity feed reads from activities, so customer messages were silently invisible to operators. Same gap existed for booking cancellations (cancelBookingAction) and reschedule requests (requestRescheduleAction) shipped in v1.21.0. v1.21.1: every customer-side action now ALSO inserts an activities row anchored to the workspace owner's userId (since activities.userId is NOT NULL and the actor is a contact, not a user). Activity types added: 'portal_message' (customer sent a message), 'booking_cancelled' (customer cancelled), 'reschedule_requested' (customer asked to reschedule). Each row carries metadata.source='customer_portal' so a future ops view can filter customer-side vs operator-side actions. Subject lines are scannable ('Customer cancelled: Booked consultation' vs operator-CRM 'Booking scheduled'). (2) RESCHEDULE PICKER. Pre-1.21.1 the reschedule action exposed a single free-text textarea ('When would you like to reschedule? e.g. next Tuesday afternoon'). v1.21.1 replaces this with a STRUCTURED DATE + TIME picker (HTML date input min'd to today, HTML time input stepped to 15-min) plus an optional notes textarea. The composed reason saved on the activity row carries both human-readable text + machine-parseable ISO ('Preferred: 2026-05-14 at 14:30. Note: afternoon works best (iso=2026-05-14T14:30)'), so v1.22 can plug this directly into the calendar slot validator and auto-create the new booking on operator approval. The cancel flow keeps the simple textarea ('Reason — optional'). NO migrations, NO new env vars, NO new MCP tools — backend hotfix only. Backend redeploy required. v1.22 still queued for: operator-portal /contacts /deals /bookings table mirrors; agency 'Open <workspace> portal' support sessions + agency_support_sessions audit table; TRUE self-service reschedule (slot picker integrated with /book — atomic update of bookings.startsAt with availability check, replacing the v1.21.1 'request' semantics).",