@myspec/mcp-server 0.1.2-next.34 → 0.1.2-next.36

package/dist/index.js

@@ -818,6 +818,9 @@ var TokenManager = class {
 var RefreshRejectedError = class extends NeedsLoginError {
 };
 
+// src/platform/client.ts
+import { createHash } from "crypto";
+
 // ../../packages/platform-client/shared/types.ts
 var RETRYABLE_STATUS_CODES = [408, 429, 502, 503, 504];
 
@@ -1126,7 +1129,7 @@ function transformSpecFileResponse(raw) {
   return {
     id: raw.id,
     projectId: raw.project_id,
-    sessionId: raw.session_id,
+    sessionId: raw.session_id ?? null,
     org: raw.org,
     fileType: normalizeFileType(raw.file_type),
     filePath: raw.file_path,
@@ -1337,12 +1340,14 @@ var HttpFileClient = class {
   async initiateUpload(request, jwtToken) {
     const body = {
       project_id: request.projectId,
-      session_id: request.sessionId,
       file_type: request.fileType,
       file_path: request.filePath,
       file_size_bytes: request.fileSizeBytes,
       checksum: request.checksum
     };
+    if (request.sessionId) {
+      body.session_id = request.sessionId;
+    }
     const response = await this.httpClient.post(
       "/project/v1/files/initiate",
       body,
@@ -1830,6 +1835,82 @@ var PlatformClient = class {
       fileUri: uploaded.fileUri
     };
   }
+  /** Creates a new project. */
+  async createProject(request) {
+    return this.withTokenRetry((jwt, c) => c.project.createProject(request, jwt));
+  }
+  /** Updates an existing project's metadata (name, description, status, ...). */
+  async updateProject(projectId, updates) {
+    return this.withTokenRetry((jwt, c) => c.project.updateProject(projectId, updates, jwt));
+  }
+  /** Archives a project by setting its status to `archived`. */
+  async archiveProject(projectId) {
+    return this.updateProject(projectId, { status: "archived" });
+  }
+  /** Unarchives a project by setting its status to `active`. */
+  async unarchiveProject(projectId) {
+    return this.updateProject(projectId, { status: "active" });
+  }
+  /**
+   * Soft-deletes a project. The platform rejects this unless the project is
+   * already archived, surfacing a validation/conflict error the caller reports.
+   */
+  async deleteProject(projectId) {
+    await this.withTokenRetry((jwt, c) => c.project.deleteProject(projectId, jwt));
+  }
+  /**
+   * Two-phase upload of a new, session-less ("unbound") spec file. Reserves a
+   * file id (Phase 1, `sessionId` omitted so the file is unbound), then PUTs
+   * the content (Phase 2). Size and a `sha256:`-prefixed checksum are computed
+   * here from the bytes. Returns the created file's metadata.
+   */
+  async uploadSpecFile(args) {
+    const initiated = await this.withTokenRetry(
+      (jwt, c) => c.file.initiateUpload(
+        {
+          projectId: args.projectId,
+          filePath: args.filePath,
+          fileType: args.fileType,
+          fileSizeBytes: args.content.byteLength,
+          checksum: sha256Prefixed(args.content)
+        },
+        jwt
+      )
+    );
+    await this.withTokenRetry(
+      (jwt, c) => c.file.uploadContent(initiated.fileId, args.content, jwt)
+    );
+    return this.getFileMetadata(initiated.fileId);
+  }
+  /**
+   * Saves a new revision (overwrite) of an existing spec file by id. The
+   * platform computes the checksum server-side. Returns the file's updated
+   * metadata (including the bumped revision count).
+   */
+  async saveSpecFileRevision(fileId, content) {
+    await this.withTokenRetry((jwt, c) => c.file.saveManualRevision(fileId, content, jwt));
+    return this.getFileMetadata(fileId);
+  }
+  /**
+   * Finds a project's spec file by exact file_path, paging through the list.
+   * Returns null when no file matches. Used to enforce create-vs-overwrite
+   * semantics and to resolve a file reference by path.
+   */
+  async findSpecFileByPath(projectId, filePath) {
+    const pageSize = 100;
+    let offset = 0;
+    for (; ; ) {
+      const page = await this.listFiles(projectId, { limit: pageSize, offset });
+      const found = page.files.find((f) => f.filePath === filePath);
+      if (found) {
+        return found;
+      }
+      offset += page.files.length;
+      if (page.files.length < pageSize || offset >= page.total) {
+        return null;
+      }
+    }
+  }
   /**
    * Builds the HTTP clients on first use, resolving the base URL lazily. A
    * successful build is cached for the process lifetime; a failed resolution
@@ -1866,6 +1947,9 @@ var PlatformClient = class {
     }
   }
 };
+function sha256Prefixed(content) {
+  return "sha256:" + createHash("sha256").update(content).digest("hex");
+}
 function statusOf(err) {
   if (typeof err !== "object" || err === null) {
     return void 0;
@@ -1892,16 +1976,102 @@ function errorResult(message) {
   return { content: [{ type: "text", text: message }], isError: true };
 }
 
-// src/server/tools/get_attachment.ts
+// src/server/tools/archive_project.ts
 import { z } from "zod";
+
+// src/server/tools/project-output.ts
+function projectSummary(project) {
+  return {
+    id: project.id,
+    name: project.name,
+    description: project.description,
+    status: project.status,
+    project_type: project.projectType,
+    created_at: project.createdAt,
+    updated_at: project.updatedAt
+  };
+}
+
+// src/server/tools/archive_project.ts
 var inputSchema = {
-  attachment_id: z.string().min(1).describe("UUID of the attachment"),
-  include_download_url: z.number().int().nonnegative().optional().describe("Set to any positive value to include a signed download URL. Omit or 0 to skip.")
+  project_id: z.string().min(1).describe("UUID of the project to archive.")
+};
+var archiveProjectTool = {
+  name: "archive_project",
+  description: 'Archive a project (sets status to "archived"). Idempotent: archiving an already-archived project succeeds.',
+  inputSchema,
+  handler: async (args, ctx) => {
+    const project = await ctx.client.archiveProject(args.project_id);
+    return jsonResult({ project: projectSummary(project) });
+  }
+};
+
+// src/server/tools/create_project.ts
+import { z as z2 } from "zod";
+var inputSchema2 = {
+  name: z2.string().describe("Name of the project to create."),
+  description: z2.string().optional().describe("Optional project description.")
+};
+var createProjectTool = {
+  name: "create_project",
+  description: "Create a new project. Returns the created project id and metadata.",
+  inputSchema: inputSchema2,
+  handler: async (args, ctx) => {
+    const name = args.name.trim();
+    if (name === "") {
+      return errorResult("name is required and cannot be empty.");
+    }
+    const project = await ctx.client.createProject({
+      name,
+      description: args.description
+    });
+    return jsonResult({ project: projectSummary(project) });
+  }
+};
+
+// src/server/tools/delete_project.ts
+import { z as z3 } from "zod";
+var inputSchema3 = {
+  project_id: z3.string().min(1).describe("UUID of the project to delete.")
+};
+var deleteProjectTool = {
+  name: "delete_project",
+  description: "Soft-delete a project. Only a project that is already archived can be deleted. If the project is still active, this tool refuses and you must NOT archive it on the user's behalf to make the deletion go through \u2014 instead, reconfirm with the user whether deleting the project is truly intended.",
+  inputSchema: inputSchema3,
+  handler: async (args, ctx) => {
+    let status;
+    try {
+      const project = await ctx.client.getProject(args.project_id);
+      status = project.status;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return errorResult(`Failed to load project ${args.project_id}: ${message}`);
+    }
+    if (status !== "archived") {
+      return errorResult(
+        `Project ${args.project_id} (status '${status}') can't be deleted. Reconfirm with the user whether deleting this project is intended or a mistake before taking any further action.`
+      );
+    }
+    try {
+      await ctx.client.deleteProject(args.project_id);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return errorResult(`Failed to delete project ${args.project_id}: ${message}`);
+    }
+    return jsonResult({ deleted: true, project_id: args.project_id });
+  }
+};
+
+// src/server/tools/get_attachment.ts
+import { z as z4 } from "zod";
+var inputSchema4 = {
+  attachment_id: z4.string().min(1).describe("UUID of the attachment"),
+  include_download_url: z4.number().int().nonnegative().optional().describe("Set to any positive value to include a signed download URL. Omit or 0 to skip.")
 };
 var getAttachmentTool = {
   name: "get_attachment",
   description: "Get attachment metadata. With `include_download_url>0`, also returns a signed `download_url`.",
-  inputSchema,
+  inputSchema: inputSchema4,
   handler: async (args, ctx) => {
     const attachment = await ctx.client.getAttachmentMetadata(args.attachment_id);
     if (!attachment) {
@@ -1930,17 +2100,17 @@ var getAttachmentTool = {
 };
 
 // src/server/tools/get_file.ts
-import { z as z2 } from "zod";
-var inputSchema2 = {
-  file_id: z2.string().min(1).describe("UUID of the file"),
-  include_download_url: z2.number().int().nonnegative().optional().describe(
+import { z as z5 } from "zod";
+var inputSchema5 = {
+  file_id: z5.string().min(1).describe("UUID of the file"),
+  include_download_url: z5.number().int().nonnegative().optional().describe(
     "Revision number to include a download URL for. Returns a signed, time-limited URL for that revision (latest or historical) that needs no credentials. Omit or 0 to skip."
   )
 };
 var getFileTool = {
   name: "get_file",
   description: "Get file metadata. With `include_download_url=N`, also returns a signed, time-limited download URL for revision N (latest or historical). The URL is self-authenticating, so no credentials are returned.",
-  inputSchema: inputSchema2,
+  inputSchema: inputSchema5,
   handler: async (args, ctx) => {
     const meta = await ctx.client.getFileMetadata(args.file_id);
     const base = {
@@ -1976,14 +2146,14 @@ var getFileTool = {
 };
 
 // src/server/tools/get_project.ts
-import { z as z3 } from "zod";
-var inputSchema3 = {
-  project_id: z3.string().min(1).describe("UUID of the project to fetch")
+import { z as z6 } from "zod";
+var inputSchema6 = {
+  project_id: z6.string().min(1).describe("UUID of the project to fetch")
 };
 var getProjectTool = {
   name: "get_project",
   description: "Get details for a project including all active spec sessions, files (id + metadata), and attachments (id + metadata).",
-  inputSchema: inputSchema3,
+  inputSchema: inputSchema6,
   handler: async (args, ctx) => {
     const [project, sessions, files, attachments] = await Promise.all([
       ctx.client.getProject(args.project_id),
@@ -2029,18 +2199,18 @@ var getProjectTool = {
 };
 
 // src/server/tools/list_projects.ts
-import { z as z4 } from "zod";
-var inputSchema4 = {
-  query: z4.string().optional().describe(
+import { z as z7 } from "zod";
+var inputSchema7 = {
+  query: z7.string().optional().describe(
     "Search term to filter projects by name. Omit to list all projects."
   ),
-  limit: z4.number().int().positive().max(100).optional().describe("Max projects to return (default 20)"),
-  offset: z4.number().int().nonnegative().optional().describe("Pagination offset (default 0)")
+  limit: z7.number().int().positive().max(100).optional().describe("Max projects to return (default 20)"),
+  offset: z7.number().int().nonnegative().optional().describe("Pagination offset (default 0)")
 };
 var listProjectsTool = {
   name: "list_projects",
   description: "List or search MySpec projects accessible to the authenticated user.",
-  inputSchema: inputSchema4,
+  inputSchema: inputSchema7,
   handler: async (args, ctx) => {
     const result = await ctx.client.listProjects({
       query: args.query,
@@ -2066,7 +2236,7 @@ var listProjectsTool = {
 import { promises as fs3 } from "fs";
 import os3 from "os";
 import path3 from "path";
-import { z as z5 } from "zod";
+import { z as z8 } from "zod";
 
 // src/server/download-path.ts
 import { promises as fs2 } from "fs";
@@ -2133,14 +2303,14 @@ async function writeBytesAtomically(target, bytes) {
 
 // src/server/tools/read_file.ts
 var MAX_READ_BYTES = 1 * 1024 * 1024;
-var inputSchema5 = {
-  file_id: z5.string().min(1).describe("UUID of the file"),
-  revision: z5.number().int().positive().optional().describe("Specific revision number to read (defaults to the latest revision).")
+var inputSchema8 = {
+  file_id: z8.string().min(1).describe("UUID of the file"),
+  revision: z8.number().int().positive().optional().describe("Specific revision number to read (defaults to the latest revision).")
 };
 var readFileTool = {
   name: "read_file",
   description: "Return a file's UTF-8 content. Bytes are cached on disk under the configured cache root (default ~/.myspec) at `project/<projectId>/file/<fileId>/rev/<rev>/<basename>` and reused on subsequent reads of the same revision. Fails for binary files or files larger than 1 MiB \u2014 use get_file with `include_download_url` to obtain a download URL for those.",
-  inputSchema: inputSchema5,
+  inputSchema: inputSchema8,
   handler: async (args, ctx) => {
     const meta = await ctx.client.getFileMetadata(args.file_id);
     const targetRevision = args.revision ?? meta.revisionCount;
@@ -2225,11 +2395,116 @@ function isBinary(bytes) {
   return false;
 }
 
+// src/server/tools/unarchive_project.ts
+import { z as z9 } from "zod";
+var inputSchema9 = {
+  project_id: z9.string().min(1).describe("UUID of the project to unarchive.")
+};
+var unarchiveProjectTool = {
+  name: "unarchive_project",
+  description: 'Unarchive a project (sets status to "active"). Idempotent: unarchiving an already-active project succeeds.',
+  inputSchema: inputSchema9,
+  handler: async (args, ctx) => {
+    const project = await ctx.client.unarchiveProject(args.project_id);
+    return jsonResult({ project: projectSummary(project) });
+  }
+};
+
+// src/server/tools/update_project.ts
+import { z as z10 } from "zod";
+var inputSchema10 = {
+  project_id: z10.string().min(1).describe("UUID of the project to update."),
+  name: z10.string().min(1).optional().describe("New project name."),
+  description: z10.string().optional().describe("New project description."),
+  project_type: z10.enum(["greenfield", "brownfield", "auto"]).optional().describe(
+    "Codebase type. 'greenfield' or 'brownfield' sets it explicitly; 'auto' clears it so the workflow decides. Omit to leave unchanged."
+  )
+};
+var updateProjectTool = {
+  name: "update_project",
+  description: "Update a project's metadata (name, description, project_type). Returns the updated metadata.",
+  inputSchema: inputSchema10,
+  handler: async (args, ctx) => {
+    if (args.name === void 0 && args.description === void 0 && args.project_type === void 0) {
+      return errorResult(
+        "Provide at least one field to update (name, description, or project_type)."
+      );
+    }
+    let projectType;
+    if (args.project_type === "auto") {
+      projectType = "";
+    } else {
+      projectType = args.project_type;
+    }
+    const project = await ctx.client.updateProject(args.project_id, {
+      name: args.name,
+      description: args.description,
+      projectType
+    });
+    return jsonResult({ project: projectSummary(project) });
+  }
+};
+
+// src/server/tools/update_spec_file.ts
+import { z as z11 } from "zod";
+
+// src/server/tools/spec-file-output.ts
+function specFileSummary(file) {
+  return {
+    id: file.id,
+    project_id: file.projectId,
+    session_id: file.sessionId,
+    file_path: file.filePath,
+    file_type: file.fileType,
+    file_size_bytes: file.fileSizeBytes,
+    checksum: file.checksum,
+    revision_count: file.revisionCount,
+    created_at: file.createdAt,
+    updated_at: file.updatedAt
+  };
+}
+
+// src/server/tools/update_spec_file.ts
+var inputSchema11 = {
+  file_id: z11.string().min(1).optional().describe("UUID of the spec file to overwrite. Provide this or (project_id + file_path)."),
+  project_id: z11.string().min(1).optional().describe("UUID of the project. Required (with file_path) when file_id is not given."),
+  file_path: z11.string().min(1).optional().describe("Path of the spec file. Required (with project_id) when file_id is not given."),
+  content: z11.string().min(1).describe("Full UTF-8 replacement content (non-empty), saved as a new revision.")
+};
+var updateSpecFileTool = {
+  name: "update_spec_file",
+  description: "Overwrite an existing spec file by saving a new revision from full content. Reference the file by file_id or by (project_id + file_path).",
+  inputSchema: inputSchema11,
+  handler: async (args, ctx) => {
+    let fileId;
+    if (args.file_id) {
+      const meta = await ctx.client.getFileMetadata(args.file_id).catch(() => null);
+      if (!meta) {
+        return errorResult(`No spec file found with id ${args.file_id}.`);
+      }
+      fileId = meta.id;
+    } else if (args.project_id && args.file_path) {
+      const match = await ctx.client.findSpecFileByPath(args.project_id, args.file_path);
+      if (!match) {
+        return errorResult(
+          `No spec file found at ${args.file_path} in project ${args.project_id}.`
+        );
+      }
+      fileId = match.id;
+    } else {
+      return errorResult("Provide either file_id, or both project_id and file_path.");
+    }
+    const content = new TextEncoder().encode(args.content);
+    const file = await ctx.client.saveSpecFileRevision(fileId, content);
+    return jsonResult({ file: specFileSummary(file) });
+  }
+};
+
 // src/server/tools/upload_attachment.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { lstat, readFile } from "fs/promises";
 import { basename, extname, isAbsolute } from "path";
-import { z as z6 } from "zod";
+import { z as z12 } from "zod";
 var DEFAULT_MIME = "application/octet-stream";
 var MAX_ATTACHMENT_MB = MAX_ATTACHMENT_BYTES / (1024 * 1024);
 var STRUCTURED_EXTENSION_MIME = {
@@ -2329,23 +2604,23 @@ function inferMimeFromName(name) {
   }
   return DEFAULT_MIME;
 }
-var inputSchema6 = {
-  project_id: z6.string().min(1).describe("UUID of the project to attach the file to."),
-  file_path: z6.string().min(1).describe(
+var inputSchema12 = {
+  project_id: z12.string().min(1).describe("UUID of the project to attach the file to."),
+  file_path: z12.string().min(1).describe(
     "Absolute path to the local file to upload. The MCP server reads this path from its own host."
   ),
-  file_name: z6.string().min(1).optional().describe("Override the filename recorded on the attachment. Defaults to the path basename."),
-  mime_type: z6.string().min(1).optional().describe(
+  file_name: z12.string().min(1).optional().describe("Override the filename recorded on the attachment. Defaults to the path basename."),
+  mime_type: z12.string().min(1).optional().describe(
     "Override the MIME type sent to the platform. The platform re-detects from content, so this is only a hint. If omitted, inferred from the file extension \u2014 structured (.pdf, .docx, .xlsx) keep their canonical MIME; common UTF-8 text formats (.xml, .json, .yaml, .html, .csv, .md, source code, ...) are sent as text/plain."
   ),
-  override: z6.boolean().optional().describe(
+  override: z12.boolean().optional().describe(
     "When true, any existing (non-deleted) attachment on the project whose recorded filename exactly matches `file_name` (or the path basename) is soft-deleted before the new upload, so the new attachment keeps the original name instead of getting an auto-dedup `(1)` suffix. The platform has no in-place content-replace API, so the new upload always gets a new `attachment_id`; any replaced ids are returned as `overridden_attachment_ids` (array, possibly empty) so callers can refresh stored references. Defaults to false (let the platform auto-dedup)."
   )
 };
 var uploadAttachmentTool = {
   name: "upload_attachment",
   description: `Upload a local file as a new attachment on a project. Reads \`file_path\` from the host running the MCP server, computes its SHA256, then performs the two-phase platform upload. Max ${String(MAX_ATTACHMENT_MB)} MB. Supported content: PDF, DOCX, XLSX, and any UTF-8 text file (XML, JSON, YAML, HTML, Markdown, CSV, source code, ...). Binary files outside the structured types will be rejected by the platform.`,
-  inputSchema: inputSchema6,
+  inputSchema: inputSchema12,
   handler: async (args, ctx) => {
     if (!isAbsolute(args.file_path)) {
       return errorResult(`file_path must be an absolute path; got "${args.file_path}".`);
@@ -2402,7 +2677,7 @@ var uploadAttachmentTool = {
     }
     const fileName = args.file_name ?? basename(args.file_path);
     const mimeType = args.mime_type ?? inferMimeFromName(fileName);
-    const checksum = `sha256:${createHash("sha256").update(buf).digest("hex")}`;
+    const checksum = `sha256:${createHash2("sha256").update(buf).digest("hex")}`;
     const bytes = new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
     const existing = await ctx.client.listAttachments(args.project_id);
     const nameMatches = existing.filter((a) => a.name === fileName);
@@ -2468,6 +2743,94 @@ var uploadAttachmentTool = {
   }
 };
 
+// src/server/tools/upload_spec_file.ts
+import { z as z13 } from "zod";
+
+// src/server/spec-path.ts
+var MAX_SPEC_DIR_DEPTH = 3;
+function validateSpecFilePath(filePath) {
+  if (!filePath) {
+    return "file_path is required.";
+  }
+  if (filePath.startsWith("/")) {
+    return "file_path must be a relative path, not an absolute path.";
+  }
+  const segments = filePath.split("/");
+  if (segments.some((s) => s === "..")) {
+    return "file_path must not contain '..' (parent directory) segments.";
+  }
+  if (segments.some((s) => s === "" || s === ".")) {
+    return 'file_path must be a normalized path (no empty, "." or trailing-slash segments).';
+  }
+  if (segments[0] !== "specs") {
+    return "file_path must be rooted at 'specs' (e.g. specs/changes/add-oauth-login/proposal.md).";
+  }
+  if (segments.length < 2) {
+    return "file_path must include a filename under 'specs' (e.g. specs/proposal.md).";
+  }
+  const dirLevels = segments.length - 2;
+  if (dirLevels > MAX_SPEC_DIR_DEPTH) {
+    return `file_path must not nest deeper than ${String(MAX_SPEC_DIR_DEPTH)} directory levels below specs.`;
+  }
+  return null;
+}
+var FILE_TYPE_BY_BASENAME = {
+  constitution: "constitution",
+  requirements: "requirements",
+  solution: "solution",
+  tasks: "tasks",
+  proposal: "proposal"
+};
+function deriveFileType(filePath) {
+  const filename = filePath.split("/").pop() ?? "";
+  const base = filename.replace(/\.[^.]+$/, "").toLowerCase();
+  return FILE_TYPE_BY_BASENAME[base] ?? "openspec-spec";
+}
+
+// src/server/tools/upload_spec_file.ts
+var SPEC_FILE_TYPES = [
+  "constitution",
+  "requirements",
+  "solution",
+  "tasks",
+  "proposal",
+  "openspec-spec"
+];
+var inputSchema13 = {
+  project_id: z13.string().min(1).describe("UUID of the project to upload the file into."),
+  file_path: z13.string().min(1).describe(
+    'Path of the new spec file, rooted at "specs" with at most 3 directory levels below specs (e.g. specs/changes/add-oauth-login/proposal.md).'
+  ),
+  content: z13.string().min(1).describe("Full UTF-8 text content of the spec file (non-empty)."),
+  file_type: z13.enum(SPEC_FILE_TYPES).optional().describe("Spec file type. Omit to derive from the filename (e.g. proposal.md \u2192 proposal).")
+};
+var uploadSpecFileTool = {
+  name: "upload_spec_file",
+  description: "Upload a new, session-less spec file into a project from full content. Rejects if a file already exists at the same path (use update_spec_file to overwrite).",
+  inputSchema: inputSchema13,
+  handler: async (args, ctx) => {
+    const pathError = validateSpecFilePath(args.file_path);
+    if (pathError) {
+      return errorResult(pathError);
+    }
+    const existing = await ctx.client.findSpecFileByPath(args.project_id, args.file_path);
+    if (existing) {
+      return errorResult(
+        `A spec file already exists at ${args.file_path} in project ${args.project_id}. Use update_spec_file to overwrite it.`
+      );
+    }
+    const fileType = args.file_type ?? deriveFileType(args.file_path);
+    const content = new TextEncoder().encode(args.content);
+    const file = await ctx.client.uploadSpecFile({
+      projectId: args.project_id,
+      filePath: args.file_path,
+      fileType,
+      content
+    });
+    return jsonResult({ file: specFileSummary(file) });
+  }
+};
+
 // src/server/server.ts
 function buildServer(deps) {
   const server = new McpServer({
@@ -2480,6 +2843,13 @@ function buildServer(deps) {
   registerTool(server, readFileTool, deps.client);
   registerTool(server, getAttachmentTool, deps.client);
   registerTool(server, uploadAttachmentTool, deps.client);
+  registerTool(server, createProjectTool, deps.client);
+  registerTool(server, updateProjectTool, deps.client);
+  registerTool(server, archiveProjectTool, deps.client);
+  registerTool(server, unarchiveProjectTool, deps.client);
+  registerTool(server, deleteProjectTool, deps.client);
+  registerTool(server, uploadSpecFileTool, deps.client);
+  registerTool(server, updateSpecFileTool, deps.client);
   return server;
 }
 async function startStdioServer(deps) {
@@ -2633,7 +3003,7 @@ async function canonicaliseRoot(root) {
 import { promises as fs4 } from "fs";
 import { join as join2, relative } from "path";
 import { spawn } from "child_process";
-import { z as z7 } from "zod";
+import { z as z14 } from "zod";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 
 // src/reverse/ignore.ts
@@ -2712,7 +3082,7 @@ function ripgrepIgnoreGlobs() {
 }
 
 // src/reverse/pack-codebase.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { mkdtemp, readFile as readFile2, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
@@ -2783,7 +3153,7 @@ function computeOutputId(inputs) {
     i: inputs.includePatterns ?? "",
     x: inputs.ignorePatterns ?? ""
   });
-  const digest = createHash2("sha256").update(payload).digest("hex").slice(0, 12);
+  const digest = createHash3("sha256").update(payload).digest("hex").slice(0, 12);
   return `pack-${digest}`;
 }
 function readPage(cache, outputId, page) {
@@ -2883,37 +3253,37 @@ var READ_FILE_MAX_LINES = 2e3;
 var LIST_DIR_HARD_CAP = 5e3;
 var LIST_DIR_DEFAULT_CAP = 1e3;
 var GREP_MAX_MATCHES_DEFAULT = 200;
-var listDirInput = z7.object({
-  path: z7.string(),
-  recursive: z7.boolean().optional(),
-  maxEntries: z7.number().int().positive().optional(),
-  includeIgnored: z7.boolean().optional()
+var listDirInput = z14.object({
+  path: z14.string(),
+  recursive: z14.boolean().optional(),
+  maxEntries: z14.number().int().positive().optional(),
+  includeIgnored: z14.boolean().optional()
 });
-var readFileInput = z7.object({
-  path: z7.string(),
-  offset: z7.number().int().nonnegative().optional(),
-  limit: z7.number().int().positive().optional(),
-  includeIgnored: z7.boolean().optional()
+var readFileInput = z14.object({
+  path: z14.string(),
+  offset: z14.number().int().nonnegative().optional(),
+  limit: z14.number().int().positive().optional(),
+  includeIgnored: z14.boolean().optional()
 });
-var grepInput = z7.object({
-  pattern: z7.string().describe(
+var grepInput = z14.object({
+  pattern: z14.string().describe(
     "Search pattern. Interpreted as a regular expression by default (ripgrep syntax), e.g. `foo|bar` or `[Rr]ole`. Set `isRegex: false` to match the pattern as an exact literal string instead."
   ),
-  path: z7.string().optional().describe("File or directory under --root to search. Defaults to the whole root."),
-  isRegex: z7.boolean().optional().describe("Treat `pattern` as a regex (default true). Set false for literal-string search."),
-  caseSensitive: z7.boolean().optional(),
-  maxMatches: z7.number().int().positive().optional(),
-  contextLines: z7.number().int().nonnegative().optional(),
-  includeIgnored: z7.boolean().optional()
+  path: z14.string().optional().describe("File or directory under --root to search. Defaults to the whole root."),
+  isRegex: z14.boolean().optional().describe("Treat `pattern` as a regex (default true). Set false for literal-string search."),
+  caseSensitive: z14.boolean().optional(),
+  maxMatches: z14.number().int().positive().optional(),
+  contextLines: z14.number().int().nonnegative().optional(),
+  includeIgnored: z14.boolean().optional()
 });
-var packCodebaseInput = z7.object({
-  subpath: z7.string().optional(),
-  includePatterns: z7.string().optional(),
-  ignorePatterns: z7.string().optional()
+var packCodebaseInput = z14.object({
+  subpath: z14.string().optional(),
+  includePatterns: z14.string().optional(),
+  ignorePatterns: z14.string().optional()
 });
-var packCodebaseReadPageInput = z7.object({
-  outputId: z7.string(),
-  page: z7.number().int().positive()
+var packCodebaseReadPageInput = z14.object({
+  outputId: z14.string(),
+  page: z14.number().int().positive()
 });
 function structuredError(error, message, extra) {
   const payload = { error, message, ...extra ?? {} };
@@ -3441,7 +3811,7 @@ function jsonSchemaFromZod(schema) {
   return zodToJson(schema);
 }
 function zodToJson(schema) {
-  if (schema instanceof z7.ZodObject) {
+  if (schema instanceof z14.ZodObject) {
     const shape = schema.shape;
     const properties = {};
     const required = [];
@@ -3456,19 +3826,19 @@ function zodToJson(schema) {
     if (required.length > 0) out.required = required;
     return out;
   }
-  if (schema instanceof z7.ZodOptional) {
+  if (schema instanceof z14.ZodOptional) {
     return zodToJson(schema.unwrap());
   }
-  if (schema instanceof z7.ZodString) {
+  if (schema instanceof z14.ZodString) {
     return { type: "string" };
   }
-  if (schema instanceof z7.ZodNumber) {
+  if (schema instanceof z14.ZodNumber) {
     return { type: "number" };
   }
-  if (schema instanceof z7.ZodBoolean) {
+  if (schema instanceof z14.ZodBoolean) {
     return { type: "boolean" };
   }
-  if (schema instanceof z7.ZodEnum) {
+  if (schema instanceof z14.ZodEnum) {
     return { type: "string", enum: schema.options };
   }
   return { type: "string" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "0.1.2-next.34",
+  "version": "0.1.2-next.36",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {