@taiga-ai/mcp-server 0.25.0-rc.472 → 0.26.0-dev.479

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.25.0-rc.472",
-  "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
+  "version": "0.26.0-dev.479",
+  "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
+  "mcpName": "ga.tai/mcp-server",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
@@ -16,6 +17,18 @@
   "engines": {
     "node": ">=20"
   },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "taiga",
+    "ai",
+    "claude"
+  ],
+  "homepage": "https://docs.tai.ga",
   "scripts": {
     "build": "tsc --noEmit && node scripts/build.mjs",
     "typecheck": "tsc --noEmit",

package/scripts/build.mjs

@@ -1,37 +0,0 @@
-import { readFileSync, writeFileSync } from 'node:fs';
-import { rolldown } from 'rolldown';
-
-const OUTFILE = 'dist/index.js';
-const SHEBANG = '#!/usr/bin/env node';
-
-/**
- * Bundle the MCP server into a single self-contained ESM file.
- *
- * The published npm artifact must not reference private workspace packages, so
- * `@taiga/*` (notably `@taiga/feature-flags`, a runtime value) is inlined. The
- * genuinely-published deps — the MCP server SDK and zod — stay external and are
- * installed normally by consumers. Node built-ins are external via platform.
- */
-const external = [/^@modelcontextprotocol\/server(\/|$)/, /^zod(\/|$)/, /^node:/];
-
-const bundle = await rolldown({
-  input: 'src/index.ts',
-  platform: 'node',
-  external,
-});
-
-await bundle.write({
-  file: OUTFILE,
-  format: 'esm',
-});
-
-await bundle.close();
-
-// Guarantee the bin shebang survived bundling. Rolldown preserves the entry's
-// shebang today, but bundlers commonly strip them — without a `#!` line the
-// published bin fails to exec under `npx` even when chmod +x. This makes the
-// contract explicit and robust to future bundler changes (no-op if present).
-const code = readFileSync(OUTFILE, 'utf8');
-if (!code.startsWith('#!')) {
-  writeFileSync(OUTFILE, `${SHEBANG}\n${code}`);
-}

package/scripts/prepare-publish.cjs

@@ -1,49 +0,0 @@
-'use strict';
-
-/**
- * Prepare package.json for npm publish.
- *
- * - Removes `private: true` so npm allows publishing
- * - Sets publishConfig to public access
- * - Strips workspace-only dependencies. `@taiga/types` and
- *   `@taiga/feature-flags` carry runtime code, but the rolldown build bundles
- *   both into dist/index.js, so neither is a real runtime dep. The `zod` that
- *   `@taiga/types` imports stays external: it is a declared dependency.
- * - Drops the `types` entry points — the published artifact is a bundled CLI
- *   and ships no `.d.ts` (the build runs `tsc --noEmit`).
- * - Marks the bin entry executable. The bundler emits dist/index.js with mode
- *   0644, so without this `npx -y @taiga-ai/mcp-server` fails with EACCES
- *   because the kernel cannot exec a non-executable file despite the shebang.
- */
-
-const fs = require('fs');
-const path = require('path');
-
-const pkgPath = path.join(__dirname, '..', 'package.json');
-const binPath = path.join(__dirname, '..', 'dist', 'index.js');
-
-try {
-  const raw = fs.readFileSync(pkgPath, 'utf8');
-  const pkg = JSON.parse(raw);
-
-  delete pkg.private;
-  pkg.publishConfig = { access: 'public' };
-
-  // Workspace deps are inlined by the bundle — drop them from the published deps.
-  delete pkg.dependencies?.['@taiga/types'];
-  delete pkg.dependencies?.['@taiga/feature-flags'];
-
-  // No declarations are shipped for the bundled CLI.
-  delete pkg.types;
-  delete pkg.exports?.['.']?.types;
-
-  fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf8');
-  console.log('prepare-publish: package.json updated');
-
-  fs.chmodSync(binPath, 0o755);
-  console.log('prepare-publish: dist/index.js marked executable');
-} catch (err) {
-  console.error('prepare-publish: failed');
-  console.error(err.stack || err);
-  process.exit(1);
-}

package/src/client.test.ts

@@ -1,424 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { TaigaApiError, TaigaClient, withoutTenant } from './client.js';
-
-// Read independently of src/version.ts, so the test checks the real file.
-const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version: string };
-
-// ---------------------------------------------------------------------------
-// Helpers -- thin wrappers to reduce boilerplate, not to obscure intent
-// ---------------------------------------------------------------------------
-
-function stubFetch(status: number, body: unknown) {
-  const spy = vi.fn().mockResolvedValue({
-    ok: status >= 200 && status < 300,
-    status,
-    json: () => Promise.resolve(body),
-    text: () => Promise.resolve(JSON.stringify(body)),
-  });
-  vi.stubGlobal('fetch', spy);
-  return spy;
-}
-
-function makeClient(opts?: { baseUrl?: string; apiKey?: string }) {
-  return new TaigaClient({
-    baseUrl: opts?.baseUrl ?? 'https://api.test.com',
-    apiKey: opts?.apiKey ?? 'taiga_sk_live_testkey123',
-  });
-}
-
-async function clientWithCapabilities(caps: string[]) {
-  stubFetch(200, { data: { capabilities: caps } });
-  const client = makeClient();
-  await client.introspect();
-  return client;
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('TaigaClient', () => {
-  beforeEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  // -------------------------------------------------------------------------
-  // Authentication -- the client must always identify itself correctly
-  // -------------------------------------------------------------------------
-
-  describe('authentication', () => {
-    it('should authenticate every request with the provided API key', async () => {
-      // Arrange
-      const spy = stubFetch(200, { data: [] });
-      const client = makeClient({ apiKey: 'taiga_sk_live_secret42' });
-
-      // Act
-      await client.listProducts();
-
-      // Assert
-      const headers = spy.mock.calls[0]![1].headers;
-      expect(headers.Authorization).toBe('Bearer taiga_sk_live_secret42');
-    });
-
-    it('should identify itself as taiga-ai-mcp-server in every request', async () => {
-      const spy = stubFetch(200, { data: [] });
-
-      await makeClient().listProducts();
-
-      expect(spy.mock.calls[0]![1].headers['User-Agent']).toBe(`taiga-ai-mcp-server/${pkg.version}`);
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // Error handling -- failures must surface clearly, never silently swallow
-  // -------------------------------------------------------------------------
-
-  describe('error handling', () => {
-    it('should reject with status code and body when API returns an error', async () => {
-      stubFetch(403, { error: 'Forbidden' });
-      const client = makeClient();
-
-      await expect(client.listProducts()).rejects.toThrow(/403.*Forbidden/);
-    });
-
-    it('should reject with status code even when response body is unreadable', async () => {
-      vi.stubGlobal(
-        'fetch',
-        vi.fn().mockResolvedValue({
-          ok: false,
-          status: 500,
-          text: () => Promise.reject(new Error('stream error')),
-        })
-      );
-
-      await expect(makeClient().listProducts()).rejects.toThrow(/500/);
-    });
-
-    it('should reject when fetch itself throws (network failure)', async () => {
-      vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('ECONNREFUSED')));
-
-      await expect(makeClient().listProducts()).rejects.toThrow(/ECONNREFUSED/);
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // URL construction -- trailing slashes, optional params, nested paths
-  // -------------------------------------------------------------------------
-
-  describe('URL construction', () => {
-    it('should normalize trailing slashes in base URL', async () => {
-      const spy = stubFetch(200, { data: [] });
-      const client = makeClient({ baseUrl: 'https://api.test.com///' });
-
-      await client.listProducts();
-
-      expect(spy.mock.calls[0]![0]).toBe('https://api.test.com/v1/products');
-    });
-
-    it('should omit query string when no optional params are provided', async () => {
-      const spy = stubFetch(200, { data: [], nextCursor: null });
-
-      await makeClient().listProducts();
-
-      expect(spy.mock.calls[0]![0]).toBe('https://api.test.com/v1/products');
-    });
-
-    it('should include all optional filters as query params', async () => {
-      const spy = stubFetch(200, { data: [], nextCursor: null });
-
-      await makeClient().listProducts({ factoryId: 't1', status: 'active', limit: 10 });
-
-      const url = spy.mock.calls[0]![0] as string;
-      expect(url).toContain('factoryId=t1');
-      expect(url).toContain('status=active');
-      expect(url).toContain('limit=10');
-    });
-
-    it('should nest backlog items under the product path', async () => {
-      const spy = stubFetch(200, { data: [], nextCursor: null });
-
-      await makeClient().listBacklogItems('proj-1', { limit: 20 });
-
-      const url = spy.mock.calls[0]![0] as string;
-      expect(url).toContain('/v1/products/proj-1/backlog');
-      expect(url).toContain('limit=20');
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // Introspection -- the foundation for capability-gated tool registration
-  // -------------------------------------------------------------------------
-
-  describe('withoutTenant', () => {
-    it('drops tenantId at every depth and keeps an own __proto__ key as data', () => {
-      const parsed = JSON.parse(
-        '{"__proto__": {"x": 1}, "tenantId": "t", "a": {"tenantId": "t", "b": [{"tenantId": "t", "c": 1}, 2, null]}, "d": "s"}'
-      ) as { tenantId: string; a: unknown; d: string };
-
-      const out = withoutTenant(parsed);
-
-      expect(JSON.stringify(out)).not.toContain('tenantId');
-      expect(out.a).toEqual({ b: [{ c: 1 }, 2, null] });
-      expect(out.d).toBe('s');
-      expect(Object.prototype.hasOwnProperty.call(out, '__proto__')).toBe(true);
-      expect(Object.getPrototypeOf(out)).toBe(Object.prototype);
-      expect((out as { x?: unknown }).x).toBeUndefined();
-    });
-
-    it('walks a body nested deeper than a recursive copy could', () => {
-      const depth = 20_000;
-      const nested = JSON.parse(`${'{"a":['.repeat(depth)}{"tenantId":"t","v":1}${']}'.repeat(depth)}`) as unknown;
-
-      const out = withoutTenant(nested);
-
-      // Walked, not stringified: JSON.stringify recurses and would overflow where the copy did not.
-      let cursor: unknown = out;
-      for (let level = 0; level < depth; level += 1) {
-        expect(Object.keys(cursor as object)).toEqual(['a']);
-        cursor = (cursor as { a: unknown[] }).a[0];
-      }
-      expect(cursor).toEqual({ v: 1 });
-    });
-
-    it('keeps key order, which is the order sections render in', () => {
-      const out = withoutTenant({ z: 1, tenantId: 't', a: { y: 2, x: [3, { tenantId: 't', w: 4 }] }, m: 5 });
-
-      expect(Object.keys(out)).toEqual(['z', 'a', 'm']);
-      expect(Object.keys(out.a)).toEqual(['y', 'x']);
-      expect(out.a.x).toEqual([3, { w: 4 }]);
-    });
-  });
-
-  describe('introspection', () => {
-    it('should return and store the introspection result', async () => {
-      const expected = {
-        userId: 'u1',
-        tenantId: 't1',
-        email: 'test@example.com',
-        role: 'member',
-        capabilities: ['products:read', 'factories:read'],
-      };
-      stubFetch(200, { data: expected });
-      const client = makeClient();
-
-      // Act
-      const result = await client.introspect();
-
-      // Assert -- both return value and stored state
-      expect(result).toEqual(expected);
-      expect(client.getIntrospection()).toEqual(expected);
-    });
-
-    it('should report no capabilities before introspect is called', () => {
-      const client = makeClient();
-
-      expect(client.hasCapability('products:read')).toBe(false);
-    });
-
-    it('should correctly report granted vs missing capabilities', async () => {
-      const client = await clientWithCapabilities(['products:read', 'factories:read']);
-
-      expect(client.hasCapability('products:read')).toBe(true);
-      expect(client.hasCapability('factories:read')).toBe(true);
-      expect(client.hasCapability('backlog:read')).toBe(false);
-      expect(client.hasCapability('tenant:documents:write')).toBe(false);
-    });
-
-    it('should report no capabilities when key has empty scope', async () => {
-      const client = await clientWithCapabilities([]);
-
-      expect(client.hasCapability('products:read')).toBe(false);
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // API methods -- each method hits the right endpoint with the right verb
-  // These are the HTTP contracts the Taiga API expects.
-  // -------------------------------------------------------------------------
-
-  describe('API contracts', () => {
-    it('should GET a single product by id', async () => {
-      const spy = stubFetch(200, { data: { id: 'p1', name: 'Alpha' } });
-
-      const result = await makeClient().getProduct('p1');
-
-      expect(spy.mock.calls[0]![0]).toBe('https://api.test.com/v1/products/p1');
-      expect(result.data).toEqual({ id: 'p1', name: 'Alpha' });
-    });
-
-    it('should GET a single document by type from tenant path', async () => {
-      const spy = stubFetch(200, { data: { id: 'd1' } });
-
-      await makeClient().getTenantDocument('security_policy');
-
-      expect(spy.mock.calls[0]![0]).toBe('https://api.test.com/v1/tenants/current/documents/security_policy');
-    });
-
-    it('should PUT a document draft with the provided body', async () => {
-      const spy = stubFetch(200, { data: { id: 'd1' } });
-
-      await makeClient().saveTenantDocumentDraft('security_policy', { data: { title: 'New' } });
-
-      expect(spy.mock.calls[0]![1].method).toBe('PUT');
-      expect(spy.mock.calls[0]![0]).toContain('/tenants/current/documents/security_policy/draft');
-      expect(JSON.parse(spy.mock.calls[0]![1].body)).toEqual({
-        data: { title: 'New' },
-      });
-      expect(spy.mock.calls[0]![1].headers['Content-Type']).toBe('application/json');
-    });
-
-    it('should keep every path segment inside its route', async () => {
-      const spy = stubFetch(200, { data: {} });
-      const client = makeClient();
-
-      await client.getTenantDocument('../products/x');
-      await client.getFactoryDocument('f/1', 'a b');
-      await client.getProduct('p/1');
-      await client.getBacklogItem('b/1');
-      await client.listBacklogItems('e/1');
-      await client.getProductDocument('p/1', 'spec/x');
-
-      const paths = spy.mock.calls.map((c) => new URL(c[0] as string).pathname);
-      expect(paths).toEqual([
-        '/v1/tenants/current/documents/..%2Fproducts%2Fx',
-        '/v1/factories/f%2F1/documents/a%20b',
-        '/v1/products/p%2F1',
-        '/v1/backlog/b%2F1',
-        '/v1/products/e%2F1/backlog',
-        '/v1/products/p%2F1/documents/spec%2Fx',
-      ]);
-    });
-
-    it('should refuse the dot segments encodeURIComponent cannot neutralise', async () => {
-      // `/documents/../publish` would collapse to `/tenants/current/publish`.
-      const spy = stubFetch(200, { data: {} });
-      const client = makeClient();
-
-      await expect(client.publishTenantDocument('..')).rejects.toThrow(/Invalid path segment/);
-      await expect(client.getTenantDocumentDraft('.')).rejects.toThrow(/Invalid path segment/);
-      await expect(client.getTenantDocument('')).rejects.toThrow(/Invalid path segment/);
-      expect(spy).not.toHaveBeenCalled();
-    });
-
-    it('should POST a publish with no body and no JSON content type', async () => {
-      // Fastify answers 400 "Body cannot be empty" to a JSON content type
-      // without a body, which is what the publish routes would otherwise get.
-      const spy = stubFetch(200, { data: { id: 'd1', version: 2 } });
-
-      await makeClient().publishTenantDocument('policy_security');
-
-      expect(spy.mock.calls[0]![1].method).toBe('POST');
-      expect(spy.mock.calls[0]![0]).toContain('/tenants/current/documents/policy_security/publish');
-      expect(spy.mock.calls[0]![1].body).toBeNull();
-      expect(spy.mock.calls[0]![1].headers).not.toHaveProperty('Content-Type');
-    });
-
-    it('should expose the API status, code and message on a failed request', async () => {
-      stubFetch(400, { error: 'Bad Request', code: 'VALIDATION_ERROR', message: 'Draft contains template residue' });
-
-      const error = await makeClient()
-        .publishTenantDocument('policy_security')
-        .catch((e: unknown) => e as TaigaApiError);
-
-      expect(error).toBeInstanceOf(TaigaApiError);
-      expect(error).toMatchObject({
-        status: 400,
-        code: 'VALIDATION_ERROR',
-        apiMessage: 'Draft contains template residue',
-      });
-    });
-
-    it('should send the backlog filters the route reads, with includeArchived as the literal true', async () => {
-      const spy = stubFetch(200, { data: [], nextCursor: null });
-
-      await makeClient().listBacklogItems('p1', { status: 'done', planningStatus: 'planned', includeArchived: true });
-
-      const url = new URL(spy.mock.calls[0]![0] as string);
-      expect(url.pathname).toBe('/v1/products/p1/backlog');
-      expect(url.searchParams.get('status')).toBe('done');
-      expect(url.searchParams.get('planningStatus')).toBe('planned');
-      expect(url.searchParams.get('includeArchived')).toBe('true');
-    });
-
-    it('should leave includeArchived out when false, since the route treats any value but true as false', async () => {
-      const spy = stubFetch(200, { data: [], nextCursor: null });
-
-      await makeClient().listBacklogItems('p1', { includeArchived: false });
-
-      expect(spy.mock.calls[0]![0]).toBe('https://api.test.com/v1/products/p1/backlog');
-    });
-
-    it('should GET runs under the product and a run with its steps by id', async () => {
-      const spy = stubFetch(200, { data: [] });
-      const client = makeClient();
-
-      await client.listBuildRuns('p1', { backlogItemId: 'i1', limit: 5 });
-      await client.getBuildRun('b/1');
-      await client.listBuildRunSteps('b/1');
-
-      const paths = spy.mock.calls.map((c) => {
-        const url = new URL(c[0] as string);
-        return url.pathname + url.search;
-      });
-      expect(paths).toEqual([
-        '/v1/products/p1/builds?backlogItemId=i1&limit=5',
-        '/v1/builds/b%2F1',
-        '/v1/builds/b%2F1/steps',
-      ]);
-    });
-
-    it('should send the repository filter and host when resolving a product', async () => {
-      const spy = stubFetch(200, { data: [], nextCursor: null });
-
-      await makeClient().listProducts({ repository: 'acme/web', repositoryHost: 'https://github.com' });
-
-      const url = new URL(spy.mock.calls[0]![0] as string);
-      expect(url.searchParams.get('repository')).toBe('acme/web');
-      expect(url.searchParams.get('repositoryHost')).toBe('https://github.com');
-    });
-
-    it('should read a product document from the asked timeline and list one timeline at a time', async () => {
-      const spy = stubFetch(200, { data: [] });
-      const client = makeClient();
-
-      await client.getProductDocument('p1', 'architecture', 'reality');
-      await client.getProductDocument('p1', 'architecture');
-      await client.listProductDocuments('p1', { origin: 'reality', limit: 100 });
-
-      const paths = spy.mock.calls.map((c) => {
-        const url = new URL(c[0] as string);
-        return url.pathname + url.search;
-      });
-      expect(paths).toEqual([
-        '/v1/products/p1/documents/architecture?origin=reality',
-        '/v1/products/p1/documents/architecture',
-        '/v1/products/p1/documents?origin=reality&limit=100',
-      ]);
-    });
-
-    it('should GET a single backlog item by id (flat path)', async () => {
-      const spy = stubFetch(200, { data: { id: 'item-1' } });
-
-      await makeClient().getBacklogItem('item-1');
-
-      expect(spy.mock.calls[0]![0]).toBe('https://api.test.com/v1/backlog/item-1');
-    });
-
-    it('should GET factories with optional limit', async () => {
-      const spy = stubFetch(200, { data: [], nextCursor: null });
-
-      await makeClient().listFactories({ limit: 50 });
-
-      expect(spy.mock.calls[0]![0]).toContain('/v1/factories?limit=50');
-    });
-
-    it('should GET documents from tenant path with optional limit', async () => {
-      const spy = stubFetch(200, { data: [], nextCursor: null });
-
-      await makeClient().listTenantDocuments({ limit: 5 });
-
-      expect(spy.mock.calls[0]![0]).toContain('/v1/tenants/current/documents?limit=5');
-    });
-  });
-});