@pactosigna/mcp-server 0.1.23 → 0.1.25

package/dist/index.js

@@ -21758,11 +21758,6 @@ var DEVICE_DOCUMENT_TYPES = [
   // Product (ISO 13485 §7.3)
   "product_development_plan",
   "intended_use",
-  // Release management (IEC 62304 §5.7)
-  "release_plan",
-  // Change management (ISO 13485 §7.3.5)
-  "design_review",
-  "release_notes",
   // Software test plan (IEC 62304 §5.7)
   "software_test_plan"
 ];
@@ -21813,11 +21808,6 @@ var DOCUMENT_TYPES = {
   // Product (ISO 13485 §7.3)
   product_development_plan: "Product Development Plan",
   intended_use: "Intended Use",
-  // Release management (IEC 62304 §5.7)
-  release_plan: "Release Plan",
-  // Change management (ISO 13485 §7.3.5)
-  design_review: "Design Review",
-  release_notes: "Release Notes",
   // Supplier management (ISO 13485 §7.4)
   supplier: "Supplier",
   // Internal audit management (ISO 13485 §8.2.2)
@@ -21844,9 +21834,6 @@ var REQUIRED_SECTIONS = {
   user_need: ["User Story", "Validation Criteria"],
   architecture: ["Purpose", "Architecture Overview", "Interfaces"],
   detailed_design: ["Purpose", "Detailed Design", "Interfaces"],
-  release_plan: ["Scope", "Applicable Plans", "Release-Specific Criteria", "Known Anomalies"],
-  design_review: ["Review Scope", "Attendees", "Findings", "Actions", "Conclusion"],
-  release_notes: ["Changes", "Known Issues"],
   audit_schedule: ["Scope", "Audit Criteria"],
   audit_report: ["Scope", "Methodology", "Findings", "Conclusion"],
   // Deprecated: management reviews are in-app entities, not git-native documents (#707)
@@ -22525,11 +22512,6 @@ var DocumentTypeSchema = external_exports.enum([
   // Product (ISO 13485 §7.3)
   "product_development_plan",
   "intended_use",
-  // Release management (IEC 62304 §5.7)
-  "release_plan",
-  // Change management (ISO 13485 §7.3.5)
-  "design_review",
-  "release_notes",
   // Supplier management (ISO 13485 §7.4)
   "supplier",
   // Internal audit management (ISO 13485 §8.2.2)
@@ -23224,63 +23206,9 @@ var DeviceDocumentTypeSchema = external_exports.enum([
   // Product (ISO 13485 §7.3)
   "product_development_plan",
   "intended_use",
-  // Release management (IEC 62304 §5.7)
-  "release_plan",
-  // Change management (ISO 13485 §7.3.5)
-  "design_review",
-  "release_notes",
   // Software test plan (IEC 62304 §5.7)
   "software_test_plan"
 ]);
-var ReleasePlanFrontmatterSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  title: external_exports.string().min(1),
-  type: external_exports.literal("release_plan").optional(),
-  status: external_exports.string().optional(),
-  author: external_exports.string().optional(),
-  reviewers: external_exports.array(external_exports.string()).optional(),
-  approvers: external_exports.array(external_exports.string()).optional(),
-  version: external_exports.string().optional(),
-  target_date: external_exports.string().optional(),
-  applicable_plans: external_exports.array(external_exports.string()).optional()
-});
-var SuspectedLinkDispositionSchema = external_exports.enum(["included_in_release", "not_impacted"]);
-var SuspectedLinkNeighborSchema = external_exports.object({
-  document: external_exports.string().min(1),
-  direction: external_exports.enum(["upstream", "downstream"]),
-  disposition: SuspectedLinkDispositionSchema,
-  /** Required when disposition is 'not_impacted' */
-  rationale: external_exports.string().min(1).optional()
-});
-var SuspectedLinkGroupSchema = external_exports.object({
-  triggered_by: external_exports.string().min(1),
-  neighbors: external_exports.array(SuspectedLinkNeighborSchema).min(1)
-});
-var DesignReviewFrontmatterSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  title: external_exports.string().min(1),
-  type: external_exports.literal("design_review").optional(),
-  status: external_exports.string().optional(),
-  author: external_exports.string().optional(),
-  reviewers: external_exports.array(external_exports.string()).optional(),
-  approvers: external_exports.array(external_exports.string()).optional(),
-  /** Optional link to a Release Plan document (e.g. "RP-001") */
-  release_plan: external_exports.string().optional(),
-  /** Acknowledged suspected links — one-up/one-down neighbor analysis */
-  suspected_links: external_exports.array(SuspectedLinkGroupSchema).optional()
-});
-var ReleaseNotesAudienceSchema = external_exports.enum(["customer", "technical"]);
-var ReleaseNotesFrontmatterSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  title: external_exports.string().min(1),
-  type: external_exports.literal("release_notes").optional(),
-  status: RiskDocumentStatusSchema,
-  author: external_exports.string().optional(),
-  reviewers: external_exports.array(external_exports.string()).optional(),
-  approvers: external_exports.array(external_exports.string()).optional(),
-  audience: ReleaseNotesAudienceSchema,
-  release_version: external_exports.string().min(1)
-});
 var RetentionPolicySchema = external_exports.object({
   /** Default retention period in years for all record types */
   defaultPeriodYears: external_exports.number().int().min(1).max(30).default(10),
@@ -23522,14 +23450,6 @@ var AuditActionSchema = external_exports.enum([
   "dco.obligation_fulfilled",
   "dco.approved",
   "dco.effective",
-  // Design Reviews
-  "design_review.created",
-  "design_review.updated",
-  "design_review.deleted",
-  "design_review.submitted",
-  "design_review.signature_added",
-  "design_review.signed",
-  "design_review.cancelled",
   // CAPAs
   "capa.created",
   "capa.updated",
@@ -23602,6 +23522,8 @@ var AuditActionSchema = external_exports.enum([
   // Review Types
   "review_type.created",
   "review_type.updated",
+  // Components (SOUP/SBOM enrichment)
+  "component.enriched",
   // Audit
   "audit_log.exported"
 ]);
@@ -23619,7 +23541,6 @@ var ResourceTypeSchema = external_exports.enum([
   "qms",
   "device",
   "dco",
-  "design_review",
   "signing_request",
   "capa",
   "complaint",
@@ -23635,7 +23556,8 @@ var ResourceTypeSchema = external_exports.enum([
   "qualityReview",
   "reviewType",
   "audit_log",
-  "risk_matrix"
+  "risk_matrix",
+  "component"
 ]);
 var DocumentSourceTypeSchema = external_exports.enum([
   "markdown",
@@ -23684,6 +23606,19 @@ var GetDeviceGapsQuerySchema = external_exports.object({
 var DocumentIdParamSchema = external_exports.object({
   documentId: external_exports.string().min(1)
 });
+var ComponentIdParamSchema = external_exports.object({
+  documentId: external_exports.string().min(1),
+  componentId: external_exports.string().min(1)
+});
+var UpdateComponentRequestSchema = external_exports.object({
+  organizationId: external_exports.string().min(1),
+  soupCategory: external_exports.enum(["package", "vendor", "runtime"]).optional(),
+  soupSafetyClass: external_exports.enum(["A", "B", "C"]).optional(),
+  functionalRequirements: external_exports.string().optional(),
+  hardwareRequirements: external_exports.string().optional(),
+  anomalyAssessment: external_exports.enum(["not_assessed", "assessed_acceptable", "assessed_mitigated", "monitoring"]).optional(),
+  anomalyNotes: external_exports.string().optional()
+});
 var ChangelogEntryResponseSchema = external_exports.object({
   id: external_exports.string(),
   changeType: ChangeTypeSchema,
@@ -23788,7 +23723,16 @@ var ComponentResponseSchema = external_exports.object({
   category: external_exports.string().optional(),
   supplierId: external_exports.string().optional(),
   sourceFormat: external_exports.enum(["markdown_table", "cyclonedx", "spdx"]),
-  purl: external_exports.string().optional()
+  purl: external_exports.string().optional(),
+  // SOUP enrichment fields (IEC 62304 §8.1.2)
+  soupCategory: external_exports.enum(["package", "vendor", "runtime"]).optional(),
+  dataSource: external_exports.enum(["sync", "sbom_api", "manual"]).optional(),
+  soupSafetyClass: external_exports.enum(["A", "B", "C"]).optional(),
+  functionalRequirements: external_exports.string().optional(),
+  hardwareRequirements: external_exports.string().optional(),
+  anomalyAssessment: external_exports.enum(["not_assessed", "assessed_acceptable", "assessed_mitigated", "monitoring"]).optional(),
+  anomalyNotes: external_exports.string().optional(),
+  lastReviewedAt: external_exports.string().optional()
 });
 var GetComponentsResponseSchema = external_exports.array(ComponentResponseSchema);
 var DocumentSignoffObligationSchema = external_exports.object({
@@ -24314,6 +24258,38 @@ var RiskListResponseSchema = external_exports.object({
   risks: external_exports.array(RiskListItemSchema),
   total: external_exports.number()
 });
+var KnownAnomalySeveritySchema = external_exports.enum(["cosmetic", "minor", "major"]);
+var KnownAnomalyEntrySchema = external_exports.object({
+  title: external_exports.string().min(1).max(200),
+  description: external_exports.string().min(1).max(2e3),
+  severity: KnownAnomalySeveritySchema,
+  acceptanceRationale: external_exports.string().min(1).max(2e3),
+  createdBy: external_exports.string().min(1),
+  createdAt: external_exports.string().datetime()
+});
+var ReviewFindingTypeSchema = external_exports.enum(["finding", "action", "observation"]);
+var ReviewFindingEntrySchema = external_exports.object({
+  type: ReviewFindingTypeSchema,
+  description: external_exports.string().min(1).max(2e3),
+  assignee: external_exports.string().max(200).optional(),
+  dueDate: external_exports.string().datetime().optional(),
+  resolvedAt: external_exports.string().datetime().optional(),
+  createdBy: external_exports.string().min(1),
+  createdAt: external_exports.string().datetime()
+});
+var DispositionDirectionSchema = external_exports.enum(["upstream", "downstream"]);
+var DispositionOutcomeSchema = external_exports.enum(["included_in_release", "not_impacted"]);
+var SuspectedLinkDispositionEntrySchema = external_exports.object({
+  triggeredByDocumentId: external_exports.string().min(1),
+  neighborDocumentId: external_exports.string().min(1),
+  direction: DispositionDirectionSchema,
+  disposition: DispositionOutcomeSchema,
+  rationale: external_exports.string().max(2e3).optional(),
+  confirmedBy: external_exports.string().min(1),
+  confirmedAt: external_exports.string().datetime()
+});
+var CustomerChangeSummarySchema = external_exports.string().max(5e3).optional();
+var CustomerKnownIssuesSchema = external_exports.string().max(5e3).optional();
 var ReleaseTypeSchema = external_exports.enum(["qms", "device"]);
 var ReleaseStatusSchema = external_exports.enum(["draft", "in_review", "approved", "published"]);
 var SignatureTypeSchema = external_exports.enum([
@@ -24380,9 +24356,6 @@ var CreateReleaseRequestSchema = external_exports.object({
   description: external_exports.string().max(2e3).optional(),
   type: ReleaseTypeSchema,
   deviceId: external_exports.string().optional(),
-  releasePlanDocumentId: external_exports.string().min(1).optional(),
-  designReviewId: external_exports.string().min(1).optional(),
-  releaseNotesDocumentId: external_exports.string().min(1).optional(),
   deviationNotes: external_exports.string().max(5e3).optional(),
   dhr: DHRMetadataSchema.optional(),
   reason: external_exports.string().max(500).optional()
@@ -24391,13 +24364,15 @@ var UpdateReleaseRequestSchema = external_exports.object({
   organizationId: external_exports.string().min(1),
   name: external_exports.string().min(1).max(200).optional(),
   description: external_exports.string().max(2e3).optional(),
-  releasePlanDocumentId: external_exports.string().min(1).nullable().optional(),
-  designReviewId: external_exports.string().min(1).nullable().optional(),
-  releaseNotesDocumentId: external_exports.string().min(1).nullable().optional(),
   deviationNotes: external_exports.string().max(5e3).optional(),
   dhr: DHRMetadataSchema.nullable().optional(),
   deploymentReferences: external_exports.array(DeploymentReferenceSchema).optional(),
   smokeTestEvidence: external_exports.array(DHRTestEvidenceEntrySchema).optional(),
+  knownAnomalies: external_exports.array(KnownAnomalyEntrySchema).optional(),
+  reviewFindings: external_exports.array(ReviewFindingEntrySchema).optional(),
+  suspectedLinkDispositions: external_exports.array(SuspectedLinkDispositionEntrySchema).optional(),
+  customerChangeSummary: CustomerChangeSummarySchema,
+  customerKnownIssues: CustomerKnownIssuesSchema,
   reason: external_exports.string().max(500).optional()
 }).strict();
 var AddSignatureRequestSchema = external_exports.object({
@@ -24533,7 +24508,11 @@ var ComponentSnapshotEntryResponseSchema = external_exports.object({
   version: external_exports.string(),
   license: external_exports.string().optional(),
   safetyRiskClass: external_exports.string().optional(),
-  sourceFormat: external_exports.enum(["markdown_table", "cyclonedx", "spdx"])
+  sourceFormat: external_exports.enum(["markdown_table", "cyclonedx", "spdx"]),
+  // SOUP enrichment fields captured in release snapshots
+  soupCategory: external_exports.enum(["package", "vendor", "runtime"]).optional(),
+  soupSafetyClass: external_exports.enum(["A", "B", "C"]).optional(),
+  anomalyAssessment: external_exports.enum(["not_assessed", "assessed_acceptable", "assessed_mitigated", "monitoring"]).optional()
 });
 var ReleaseSnapshotResponseSchema = external_exports.object({
   traceabilityLinks: external_exports.array(SnapshotLinkSchema),
@@ -24620,9 +24599,6 @@ var ReleaseSummaryResponseSchema = external_exports.object({
   obligationsDerivedAt: external_exports.string().optional(),
   obligationsDerivationVersion: external_exports.number().optional(),
   obligationsInputHash: external_exports.string().optional(),
-  releasePlanDocumentId: external_exports.string().optional(),
-  designReviewId: external_exports.string().optional(),
-  releaseNotesDocumentId: external_exports.string().optional(),
   deviationNotes: external_exports.string().optional(),
   dhr: DHRMetadataResponseSchema.optional(),
   version: external_exports.string().optional()
@@ -24639,7 +24615,12 @@ var ReleaseDetailResponseSchema = ReleaseSummaryResponseSchema.extend({
   deploymentReferences: external_exports.array(DeploymentReferenceResponseSchema).optional(),
   smokeTestEvidence: external_exports.array(external_exports.object({ label: external_exports.string(), url: external_exports.string() })).optional(),
   gateOverrides: external_exports.array(GateOverrideResponseSchema).default([]),
-  documentManifest: external_exports.array(ReleaseDocumentManifestEntrySchema).optional()
+  documentManifest: external_exports.array(ReleaseDocumentManifestEntrySchema).optional(),
+  knownAnomalies: external_exports.array(KnownAnomalyEntrySchema).optional(),
+  reviewFindings: external_exports.array(ReviewFindingEntrySchema).optional(),
+  suspectedLinkDispositions: external_exports.array(SuspectedLinkDispositionEntrySchema).optional(),
+  customerChangeSummary: external_exports.string().optional(),
+  customerKnownIssues: external_exports.string().optional()
 });
 var ListReleasesResponseSchema = external_exports.object({
   releases: external_exports.array(ReleaseSummaryResponseSchema),
@@ -24779,10 +24760,6 @@ var SignatureCaptureContextSchema = external_exports.discriminatedUnion("type",
     type: external_exports.literal("release"),
     id: external_exports.string().min(1)
   }),
-  external_exports.object({
-    type: external_exports.literal("design_review"),
-    id: external_exports.string().min(1)
-  }),
   external_exports.object({
     type: external_exports.literal("dco"),
     id: external_exports.string().min(1)
@@ -25696,10 +25673,6 @@ var SCHEMA_MAP = {
   // Test documents
   test_protocol: TestProtocolFrontmatterSchema,
   test_report: TestReportFrontmatterSchema,
-  // Change management (ISO 13485 §7.3.5)
-  release_plan: ReleasePlanFrontmatterSchema,
-  design_review: DesignReviewFrontmatterSchema,
-  release_notes: ReleaseNotesFrontmatterSchema,
   // Internal audit management (ISO 13485 §8.2.2)
   audit_schedule: AuditScheduleFrontmatterSchema,
   audit_report: AuditReportFrontmatterSchema,
@@ -25953,7 +25926,7 @@ var client = new PactoSignaApiClient({
   apiKey: PACTOSIGNA_API_KEY
 });
 var server = new Server(
-  { name: "pactosigna", version: "0.1.23" },
+  { name: "pactosigna", version: "0.1.25" },
   { capabilities: { tools: {} } }
 );
 server.setRequestHandler(ListToolsRequestSchema, async () => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pactosigna/mcp-server",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "type": "module",
   "description": "MCP server for PactoSigna QMS — connects Claude Desktop, Cursor, and other AI tools to your quality management system",
   "bin": {