@taiga-ai/mcp-server 0.2.3 → 0.3.0-dev.296

package/dist/index.js

@@ -1,67 +1,424 @@
 #!/usr/bin/env node
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { TaigaClient } from './client.js';
-import { registerAllTools } from './tools/index.js';
-const DEFAULT_API_URL = 'https://api.taiga.app';
+import { createRequire } from "node:module";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+const SERVER_VERSION = createRequire(import.meta.url)("../package.json").version;
+//#endregion
+//#region src/client.ts
+/**
+* HTTP client for the Taiga API.
+* Used by the MCP server to proxy tool calls to the backend.
+*/
+var TaigaClient = class {
+	baseUrl;
+	apiKey;
+	introspection = null;
+	constructor(opts) {
+		this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+		this.apiKey = opts.apiKey;
+	}
+	async request(method, path, body) {
+		const url = `${this.baseUrl}/v1${path}`;
+		const headers = {
+			Authorization: `Bearer ${this.apiKey}`,
+			"Content-Type": "application/json",
+			"User-Agent": `taiga-ai-mcp-server/${SERVER_VERSION}`
+		};
+		const response = await fetch(url, {
+			method,
+			headers,
+			body: body ? JSON.stringify(body) : void 0
+		});
+		if (!response.ok) {
+			const text = await response.text().catch(() => "");
+			throw new Error(`Taiga API ${method} ${path} failed (${response.status}): ${text}`);
+		}
+		return response.json();
+	}
+	async introspect() {
+		const result = await this.request("GET", "/auth/introspect");
+		this.introspection = result.data;
+		return result.data;
+	}
+	getIntrospection() {
+		return this.introspection;
+	}
+	hasCapability(capability) {
+		if (!this.introspection) return false;
+		return this.introspection.capabilities.includes(capability);
+	}
+	async listProjects(opts) {
+		const params = new URLSearchParams();
+		if (opts?.teamId) params.set("factoryId", opts.teamId);
+		if (opts?.status) params.set("status", opts.status);
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/products${qs ? `?${qs}` : ""}`);
+	}
+	async getProject(id) {
+		return this.request("GET", `/products/${id}`);
+	}
+	async listTenantDocuments(opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/tenants/current/documents${qs ? `?${qs}` : ""}`);
+	}
+	async getTenantDocument(type) {
+		return this.request("GET", `/tenants/current/documents/${type}`);
+	}
+	async saveTenantDocumentDraft(type, body) {
+		return this.request("PUT", `/tenants/current/documents/${type}/draft`, body);
+	}
+	async listTeamDocuments(teamId, opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/factories/${teamId}/documents${qs ? `?${qs}` : ""}`);
+	}
+	async getTeamDocument(teamId, type) {
+		return this.request("GET", `/factories/${teamId}/documents/${type}`);
+	}
+	async saveTeamDocumentDraft(teamId, type, body) {
+		return this.request("PUT", `/factories/${teamId}/documents/${type}/draft`, body);
+	}
+	async listProjectDocuments(projectId, opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/products/${projectId}/documents${qs ? `?${qs}` : ""}`);
+	}
+	async getProjectDocument(projectId, type) {
+		return this.request("GET", `/products/${projectId}/documents/${type}`);
+	}
+	/**
+	* Fetch the full context for a project in parallel: project metadata,
+	* team documents and project documents.
+	* Returns a structured bundle optimized for coding agent consumption.
+	*/
+	async getProjectContext(projectId) {
+		const project = await this.request("GET", `/products/${projectId}`);
+		const teamId = project.data.factoryId;
+		const [projectDocs, teamDocs] = await Promise.all([this.listProjectDocuments(projectId, { limit: 20 }).catch(() => ({ data: [] })), teamId ? this.listTeamDocuments(teamId, { limit: 20 }).catch(() => ({ data: [] })) : Promise.resolve({ data: [] })]);
+		const keyProjectDocTypes = [
+			"specification",
+			"architecture",
+			"technology_decisions"
+		];
+		const keyTeamDocTypes = [
+			"domain_context",
+			"tech_preferences",
+			"architecture_constraints"
+		];
+		const docFetches = [];
+		for (const docType of keyProjectDocTypes) if (projectDocs.data.some((d) => d.type === docType && !d.isDraft)) docFetches.push(this.getProjectDocument(projectId, docType).then((r) => ({
+			type: docType,
+			scope: "project",
+			data: r.data
+		})).catch(() => ({
+			type: docType,
+			scope: "project",
+			data: null
+		})));
+		if (teamId) {
+			for (const docType of keyTeamDocTypes) if (teamDocs.data.some((d) => d.type === docType && !d.isDraft)) docFetches.push(this.getTeamDocument(teamId, docType).then((r) => ({
+				type: docType,
+				scope: "team",
+				data: r.data
+			})).catch(() => ({
+				type: docType,
+				scope: "team",
+				data: null
+			})));
+		}
+		const fetchedDocs = await Promise.all(docFetches);
+		return {
+			project: project.data,
+			documents: {
+				project: Object.fromEntries(fetchedDocs.filter((d) => d.scope === "project" && d.data).map((d) => [d.type, d.data])),
+				team: Object.fromEntries(fetchedDocs.filter((d) => d.scope === "team" && d.data).map((d) => [d.type, d.data]))
+			},
+			available_documents: {
+				project: projectDocs.data.map((d) => ({
+					type: d.type,
+					name: d.name,
+					version: d.version,
+					isDraft: d.isDraft
+				})),
+				team: teamDocs.data.map((d) => ({
+					type: d.type,
+					name: d.name,
+					version: d.version,
+					isDraft: d.isDraft
+				}))
+			}
+		};
+	}
+	async listBacklogItems(projectId, opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/products/${projectId}/backlog${qs ? `?${qs}` : ""}`);
+	}
+	async getBacklogItem(itemId) {
+		return this.request("GET", `/backlog/${itemId}`);
+	}
+	async listEnvironments(projectId) {
+		return this.request("GET", `/products/${projectId}/environments`);
+	}
+	async listTeams(opts) {
+		const params = new URLSearchParams();
+		if (opts?.limit) params.set("limit", String(opts.limit));
+		const qs = params.toString();
+		return this.request("GET", `/factories${qs ? `?${qs}` : ""}`);
+	}
+};
+//#endregion
+//#region src/tools/summarize.ts
+/**
+* Strip heavy content from list responses to avoid context window bloat.
+*
+* List endpoints return summaries (id, name, description, metadata).
+* Get endpoints return the full content.
+*
+* This keeps list calls cheap (~100 tokens per item) and lets the AI
+* selectively load full content only for the items it needs.
+*/
+/** Fields to strip from list responses -- these contain the bulk content. */
+const HEAVY_FIELDS = [
+	"content",
+	"data",
+	"sections"
+];
+/**
+* Remove heavy content fields from each item in an array.
+* Preserves all metadata (id, name, description, type, dates, etc).
+*/
+function summarizeList(items) {
+	return items.map((item) => {
+		const summary = { ...item };
+		for (const field of HEAVY_FIELDS) if (field in summary) delete summary[field];
+		return summary;
+	});
+}
+//#endregion
+//#region src/tools/projects.ts
+function registerProjectTools(server, client) {
+	if (client.hasCapability("teams:read")) server.tool("taiga_list_teams", "List all teams in the organization. Use this to find team IDs for reading team documents and understanding team structure. Teams own domain context, tech preferences, and architecture constraints.", { limit: z.number().min(1).max(100).optional().describe("Max results (default 25)") }, {
+		readOnlyHint: true,
+		openWorldHint: false
+	}, async (params) => {
+		const result = await client.listTeams(params);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result.data, null, 2)
+		}] };
+	});
+	if (client.hasCapability("projects:read")) {
+		server.tool("taiga_list_projects", "List projects in the organization. Use this to find the project you are working on so you can read its specification, architecture, and threat model. Can filter by team; a status filter also exists but no longer distinguishes anything (see its description).", {
+			teamId: z.string().uuid().optional().describe("Filter by team ID -- get team IDs from taiga_list_teams"),
+			status: z.enum([
+				"draft",
+				"active",
+				"archived"
+			]).optional().describe("Filter by status. Taiga no longer surfaces project status in its UI (PRO-543), so every project is currently \"draft\" and filtering by \"active\" or \"archived\" returns nothing. Omit this unless you are working with data set through the API directly."),
+			limit: z.number().min(1).max(100).optional().describe("Max results (default 25)")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.listProjects(params);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+		server.tool("taiga_list_project_documents", "List documents for a specific project (names and types only). Project documents are generated during intake: specification (requirements), architecture (system design), technology decisions, data flow, privacy assessment, threat model (security risks), risk register, and user flow. Use taiga_get_project_document to read the full content.", {
+			projectId: z.string().uuid().describe("Project ID -- get from taiga_list_projects"),
+			limit: z.number().min(1).max(100).optional().describe("Max results (default 25)")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const summaries = summarizeList((await client.listProjectDocuments(params.projectId, { limit: params.limit })).data);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(summaries, null, 2)
+			}] };
+		});
+		server.tool("taiga_get_project_document", "Get the full content of a specific project document. Use this when you need to understand what to build (specification), how the system is designed (architecture), what security risks exist (threat model), or what technology choices were made (technology_decisions). Types: specification, architecture, technology_decisions, data_flow, privacy_assessment, threat_model, risk_register, user_flow.", {
+			projectId: z.string().uuid().describe("Project ID -- get from taiga_list_projects"),
+			type: z.string().describe("Document type -- get available types from taiga_list_project_documents. Common: specification, architecture, threat_model, technology_decisions")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.getProjectDocument(params.projectId, params.type);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+	}
+}
+//#endregion
+//#region src/tools/documents.ts
+function registerDocumentTools(server, client) {
+	if (client.hasCapability("tenant:documents:read")) {
+		server.tool("taiga_list_documents", "List company-level policy documents (names and types only). Policies define security, data privacy, SDLC, operations, architecture, and compliance rules that apply across all teams and projects. Use taiga_get_document with the document type to read the full policy content.", { limit: z.number().min(1).max(100).optional().describe("Max results (default 25)") }, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const summaries = summarizeList((await client.listTenantDocuments(params)).data);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(summaries, null, 2)
+			}] };
+		});
+		server.tool("taiga_get_document", "Get the full content of a company policy document. Use this when you need to understand security requirements, data handling rules, architecture standards, or compliance controls that apply to your code. Types: policy_security, policy_data, policy_sdlc, policy_ops, policy_tic, policy_risk, policy_architecture, policy_supply_chain, policy_cloud_governance, policy_acceptable_use, policy_ip.", { type: z.string().describe("Document type -- get available types from taiga_list_documents. Common: policy_security, policy_data, policy_sdlc, policy_architecture") }, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.getTenantDocument(params.type);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+	}
+	if (client.hasCapability("tenant:documents:write")) server.tool("taiga_update_document", "Update the draft content of a company policy document. Only updates the draft -- does not publish. Use this when you notice a policy is outdated or needs corrections while reviewing code.", {
+		type: z.string().describe("Document type (e.g. policy_security, policy_sdlc)"),
+		data: z.record(z.string(), z.unknown()).describe("Document content to save as JSON")
+	}, {
+		readOnlyHint: false,
+		destructiveHint: false,
+		idempotentHint: true,
+		openWorldHint: false
+	}, async (params) => {
+		const { type, ...body } = params;
+		const result = await client.saveTenantDocumentDraft(type, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result.data, null, 2)
+		}] };
+	});
+	if (client.hasCapability("teams:read")) {
+		server.tool("taiga_list_team_documents", "List documents for a specific team (names and types only). Team documents define how the team works: domain context (entities, ubiquitous language), tech preferences (approved stack), architecture constraints, SLO targets, definition of done, and team charter. Use taiga_get_team_document to read the full content.", {
+			teamId: z.string().uuid().describe("Team ID -- get from taiga_list_teams"),
+			limit: z.number().min(1).max(100).optional().describe("Max results (default 25)")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const summaries = summarizeList((await client.listTeamDocuments(params.teamId, { limit: params.limit })).data);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(summaries, null, 2)
+			}] };
+		});
+		server.tool("taiga_get_team_document", "Get the full content of a specific team document. Use this when you need the team domain context (ubiquitous language, entities, business rules), tech preferences (approved stack, patterns), or architecture constraints. Types: team_charter, definition_of_done, tech_preferences, architecture_constraints, slo_targets, domain_context.", {
+			teamId: z.string().uuid().describe("Team ID -- get from taiga_list_teams"),
+			type: z.string().describe("Document type -- get available types from taiga_list_team_documents. Most useful: domain_context (entities, language), tech_preferences (stack, patterns)")
+		}, {
+			readOnlyHint: true,
+			openWorldHint: false
+		}, async (params) => {
+			const result = await client.getTeamDocument(params.teamId, params.type);
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(result.data, null, 2)
+			}] };
+		});
+	}
+	if (client.hasCapability("teams:read") && client.hasCapability("tenant:documents:write")) server.tool("taiga_update_team_document", "Update the draft content of a team document. Only updates the draft -- does not publish. Use this when you notice team conventions, domain context, or tech preferences need updating while working on the codebase.", {
+		teamId: z.string().uuid().describe("Team ID -- get from taiga_list_teams"),
+		type: z.string().describe("Document type (e.g. domain_context, tech_preferences)"),
+		data: z.record(z.string(), z.unknown()).describe("Document content to save as JSON")
+	}, {
+		readOnlyHint: false,
+		destructiveHint: false,
+		idempotentHint: true,
+		openWorldHint: false
+	}, async (params) => {
+		const { teamId, type, ...body } = params;
+		const result = await client.saveTeamDocumentDraft(teamId, type, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result.data, null, 2)
+		}] };
+	});
+}
+//#endregion
+//#region src/tools/index.ts
+/**
+* Register all MCP tools based on the API key's effective capabilities.
+* Only tools matching the key's scopes are registered -- the AI assistant
+* never sees tools it can't use.
+*
+* Beta scope: Knowledge base access (policies and team documents).
+* Post-beta: Projects, backlog items, environments, composite tools.
+*/
+function registerAllTools(server, client) {
+	registerProjectTools(server, client);
+	registerDocumentTools(server, client);
+}
+//#endregion
+//#region src/index.ts
+const DEFAULT_API_URL = "https://api.taiga.app";
 async function main() {
-    const apiKey = process.env.TAIGA_API_KEY;
-    if (!apiKey) {
-        console.error('Error: TAIGA_API_KEY environment variable is required.');
-        console.error('Create an API key at https://app.taiga.app/settings/api-keys');
-        process.exit(1);
-    }
-    const apiUrl = process.env.TAIGA_API_URL ?? DEFAULT_API_URL;
-    const client = new TaigaClient({ baseUrl: apiUrl, apiKey });
-    // Introspect the API key to discover available capabilities
-    const introspection = await client.introspect().catch((error) => {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`Error: Failed to validate API key: ${message}`);
-        console.error('Check that your TAIGA_API_KEY is valid and not expired.');
-        process.exit(1);
-    });
-    // Create MCP server with dynamic tool registration and instructions
-    const server = new McpServer({
-        name: 'taiga',
-        version: '0.0.1',
-    }, {
-        instructions: [
-            'You have access to Taiga -- a policy-aware software development platform.',
-            "Taiga provides your organization's engineering knowledge base:",
-            '',
-            '**Company policies** (taiga_list_documents / taiga_get_document):',
-            'Security, data privacy, SDLC, architecture, and compliance rules that apply to all code.',
-            'Read the relevant policy BEFORE writing code that touches security, data handling, or infrastructure.',
-            '',
-            '**Team documents** (taiga_list_team_documents / taiga_get_team_document):',
-            'Domain context (ubiquitous language, entities, business rules), tech preferences (approved stack, patterns),',
-            'architecture constraints, and SLO targets. Read these to understand HOW this team builds software.',
-            '',
-            '**Project documents** (taiga_list_project_documents / taiga_get_project_document):',
-            "Specification (what to build), architecture (how it's designed), threat model (security risks),",
-            'technology decisions, and data flow. Read these to understand the specific project context.',
-            '',
-            '**Skills** (taiga_list_skills / taiga_get_skill):',
-            'Coding standards, security requirements, API design patterns, testing strategy, database patterns,',
-            'and more. These are detailed engineering guidelines with code examples.',
-            '',
-            "Workflow: Start with taiga_list_teams to find your team, then read the team's domain_context",
-            'and tech_preferences. For project-specific work, use taiga_list_projects to find the project,',
-            'then read its specification and architecture. Use skills for coding patterns.',
-            '',
-            'When you notice a policy, skill, or team document is outdated, use the update tools',
-            '(taiga_update_document, taiga_update_skill, taiga_update_team_document) to fix it.',
-            'This keeps the knowledge base accurate for everyone.',
-        ].join('\n'),
-    });
-    registerAllTools(server, client);
-    const toolCount = introspection.capabilities.length;
-    console.error(`Taiga MCP server started (${toolCount} capabilities, user: ${introspection.email}, role: ${introspection.role})`);
-    // Connect via stdio transport
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
+	const apiKey = process.env.TAIGA_API_KEY;
+	if (!apiKey) {
+		console.error("Error: TAIGA_API_KEY environment variable is required.");
+		console.error("Create an API key at https://app.taiga.app/settings/api-keys");
+		process.exit(1);
+	}
+	const client = new TaigaClient({
+		baseUrl: process.env.TAIGA_API_URL ?? DEFAULT_API_URL,
+		apiKey
+	});
+	const introspection = await client.introspect().catch((error) => {
+		const message = error instanceof Error ? error.message : String(error);
+		console.error(`Error: Failed to validate API key: ${message}`);
+		console.error("Check that your TAIGA_API_KEY is valid and not expired.");
+		process.exit(1);
+	});
+	const server = new McpServer({
+		name: "taiga",
+		version: SERVER_VERSION
+	}, { instructions: [
+		"You have access to Taiga -- a policy-aware software development platform.",
+		"Taiga provides your organization's engineering knowledge base:",
+		"",
+		"**Company policies** (taiga_list_documents / taiga_get_document):",
+		"Security, data privacy, SDLC, architecture, and compliance rules that apply to all code.",
+		"Read the relevant policy BEFORE writing code that touches security, data handling, or infrastructure.",
+		"",
+		"**Team documents** (taiga_list_team_documents / taiga_get_team_document):",
+		"Domain context (ubiquitous language, entities, business rules), tech preferences (approved stack, patterns),",
+		"architecture constraints, and SLO targets. Read these to understand HOW this team builds software.",
+		"",
+		"**Project documents** (taiga_list_project_documents / taiga_get_project_document):",
+		"Specification (what to build), architecture (how it's designed), threat model (security risks),",
+		"technology decisions, and data flow. Read these to understand the specific project context.",
+		"",
+		"Workflow: Start with taiga_list_teams to find your team, then read the team's domain_context",
+		"and tech_preferences. For project-specific work, use taiga_list_projects to find the project,",
+		"then read its specification and architecture.",
+		"",
+		"When you notice a policy or team document is outdated, use the update tools",
+		"(taiga_update_document, taiga_update_team_document) to fix it.",
+		"This keeps the knowledge base accurate for everyone."
+	].join("\n") });
+	registerAllTools(server, client);
+	const toolCount = introspection.capabilities.length;
+	console.error(`Taiga MCP server started (${toolCount} capabilities, user: ${introspection.email}, role: ${introspection.role})`);
+	const transport = new StdioServerTransport();
+	await server.connect(transport);
 }
 main().catch((error) => {
-    console.error('Fatal error:', error);
-    process.exit(1);
+	console.error("Fatal error:", error);
+	process.exit(1);
 });
+//#endregion
+export {};

package/package.json

@@ -1,34 +1,36 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.2.3",
-  "description": "MCP server for Taiga -- gives AI assistants access to documents, skills, and projects",
+  "version": "0.3.0-dev.296",
+  "description": "MCP server for Taiga -- gives AI assistants access to documents and projects",
   "type": "module",
   "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
   "bin": {
     "taiga-mcp-server": "./dist/index.js"
   },
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     }
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc --noEmit && node scripts/build.mjs",
+    "typecheck": "tsc --noEmit",
     "dev": "tsc --watch",
-    "lint": "eslint src/",
+    "lint": "oxlint src",
+    "format": "oxfmt --check \"**/*.{ts,tsx,js,jsx,mjs,cjs,json,md}\"",
+    "format:fix": "oxfmt \"**/*.{ts,tsx,js,jsx,mjs,cjs,json,md}\"",
     "test": "vitest run"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "zod": "^3.25.76"
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.19.17",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.5"
+    "@types/node": "^22.20.1",
+    "rolldown": "^1.2.3",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11"
   },
   "publishConfig": {
     "access": "public"

package/scripts/build.mjs

@@ -0,0 +1,37 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { rolldown } from 'rolldown';
+
+const OUTFILE = 'dist/index.js';
+const SHEBANG = '#!/usr/bin/env node';
+
+/**
+ * Bundle the MCP server into a single self-contained ESM file.
+ *
+ * The published npm artifact must not reference private workspace packages, so
+ * `@taiga/*` (notably `@taiga/feature-flags`, a runtime value) is inlined. The
+ * genuinely-published deps — the MCP SDK and zod — stay external and are
+ * installed normally by consumers. Node built-ins are external via platform.
+ */
+const external = [/^@modelcontextprotocol\/sdk(\/|$)/, /^zod(\/|$)/, /^node:/];
+
+const bundle = await rolldown({
+  input: 'src/index.ts',
+  platform: 'node',
+  external,
+});
+
+await bundle.write({
+  file: OUTFILE,
+  format: 'esm',
+});
+
+await bundle.close();
+
+// Guarantee the bin shebang survived bundling. Rolldown preserves the entry's
+// shebang today, but bundlers commonly strip them — without a `#!` line the
+// published bin fails to exec under `npx` even when chmod +x. This makes the
+// contract explicit and robust to future bundler changes (no-op if present).
+const code = readFileSync(OUTFILE, 'utf8');
+if (!code.startsWith('#!')) {
+  writeFileSync(OUTFILE, `${SHEBANG}\n${code}`);
+}

package/scripts/prepare-publish.cjs

@@ -5,10 +5,14 @@
  *
  * - Removes `private: true` so npm allows publishing
  * - Sets publishConfig to public access
- * - Strips workspace-only dependencies (@taiga/types is compile-time only)
- * - Marks the bin entry executable. tsc emits dist/index.js with mode 0644,
- *   so without this `npx -y @taiga-ai/mcp-server` fails with EACCES because
- *   the kernel cannot exec a non-executable file regardless of the shebang.
+ * - Strips workspace-only dependencies. `@taiga/types` is compile-time only
+ *   (erased); `@taiga/feature-flags` is a runtime value but is bundled into
+ *   dist/index.js by the rolldown build, so neither is a real runtime dep.
+ * - Drops the `types` entry points — the published artifact is a bundled CLI
+ *   and ships no `.d.ts` (the build runs `tsc --noEmit`).
+ * - Marks the bin entry executable. The bundler emits dist/index.js with mode
+ *   0644, so without this `npx -y @taiga-ai/mcp-server` fails with EACCES
+ *   because the kernel cannot exec a non-executable file despite the shebang.
  */
 
 const fs = require('fs');
@@ -24,9 +28,13 @@ try {
   delete pkg.private;
   pkg.publishConfig = { access: 'public' };
 
-  if (pkg.dependencies?.['@taiga/types']) {
-    delete pkg.dependencies['@taiga/types'];
-  }
+  // Workspace deps are inlined by the bundle — drop them from the published deps.
+  delete pkg.dependencies?.['@taiga/types'];
+  delete pkg.dependencies?.['@taiga/feature-flags'];
+
+  // No declarations are shipped for the bundled CLI.
+  delete pkg.types;
+  delete pkg.exports?.['.']?.types;
 
   fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf8');
   console.log('prepare-publish: package.json updated');