pipebrain-mcp 0.59.3 → 0.61.0

package/README.md

@@ -1,8 +1,8 @@
 # pipebrain-mcp
 
 The [Pipebrain](https://pipebrain.dev) MCP server: issues, requirements, decision records,
-conventions, prompts, content drafts and deliverables, assets, milestones, metadata-only
-secrets, and more of the platform's modules, exposed to Claude Code and Claude Desktop
+conventions, content drafts and deliverables, milestones, metadata-only secrets,
+and more of the platform's modules, exposed to Claude Code and Claude Desktop
 over stdio.
 
 This package is the **server only**. The command line tool is a separate package,

package/dist/main.js

@@ -365,8 +365,8 @@ import { join } from "node:path";
 // ../../libs/agent-shared/dist/agent-config-manifest.js
 var AGENT_CONFIG_ENTRIES = [
   { target: "agents/blind-spot-pass.md", sha256: "564751a751f7896e89c67e0d20788aff873e599766a3c30360073ba74e4c6099" },
-  { target: "agents/code-verifier.md", sha256: "fa2035d4df949fc002b45db228b4d48dcd479c9959b902d6332cddb3348350aa" },
-  { target: "agents/heavy-implementer.md", sha256: "7d3af78d4241aaa67c283db245dd4065af6e8f55efce54c2f8623c1f83879830" },
+  { target: "agents/code-verifier.md", sha256: "64adc28c68cf1e95d50b1ed31e6d8671ac685f9a12055bf5eff15a1d3de32dba" },
+  { target: "agents/heavy-implementer.md", sha256: "ab758dc7fe3da32f58b79f1d5869e66382f94aff8a7d704e7a256b6ef9f71c1b" },
   { target: "agents/issue-header-writer.md", sha256: "185d8c656216bfd755f23391761f172d80e23b0d8a10d58acea0110df91d5c84" },
   { target: "agents/spec-reviewer.md", sha256: "a46dc637006d1f810081046c57edcd731406727810ccc5e0b1c7d7b9b98be5ef" },
   { target: "agents/surgical-editor.md", sha256: "c8b7fe2ec8d76c396c0c698f36b0523be430b31e4b73b902409479a52d42ea5c" },
@@ -384,9 +384,9 @@ var AGENT_CONFIG_ENTRIES = [
   { target: "skills/capture-correction/SKILL.md", sha256: "43155819d172d2cd32474312df6244cc710f23cc76eeb8c0aa77664bd81dd9ca" },
   { target: "skills/pipebrain-header-pass/SKILL.md", sha256: "ef163f0530def7ba90b1014a47efb98f86e4ba222c6ab4d4c6bfb549dfed10f1" },
   { target: "skills/pipebrain-secrets/SKILL.md", sha256: "6fa6e648175a4c7e26d392a4bbe7681c42a0604e027c29ca625ab127bc8a7c0b" },
-  { target: "skills/pipebrain-work-session/SKILL.md", sha256: "b4316a1e017ac40933d3f51b71ba5f4b3cc2129821c3b77fb886856546da5082" },
+  { target: "skills/pipebrain-work-session/SKILL.md", sha256: "474e26ffec6ccf12ac24394402aa73f968225a19653c7f9704e3b60f134241d8" },
   { target: "skills/pipebrain-writing/SKILL.md", sha256: "c3733974aef5d61ed85ce94b37d34d5bb3a9fa3c487fb7a492e7b89c990758fd" },
-  { target: "skills/pipebrain/SKILL.md", sha256: "71c287f905af2ed9207d4d2829bbb5b2aa51f5abb486210c78a6a65d4da8f5e2" },
+  { target: "skills/pipebrain/SKILL.md", sha256: "193c30f695496020359a17340a85f3b95141dc1d35337b3ab9daf7a7ec7bc015" },
   { target: "skills/requirements-altitude/SKILL.md", sha256: "ffe20eb73fbc73e1fd9bfaec5f9759736a4375dce5fedb015754b135fc12f225" }
 ];
 
@@ -432,74 +432,6 @@ function agentConfigNotice(status) {
   return status === "behind" ? `This machine's shared agent configuration is not the one this build ships \u2014 run \`${UPDATE_COMMAND}\` to see what would change and update it.` : null;
 }
 
-// ../../libs/agent-shared/dist/asset-transfer.js
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "node:fs";
-import { basename, extname } from "node:path";
-var MIME_BY_EXT = {
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".pdf": "application/pdf",
-  ".txt": "text/plain",
-  ".md": "text/markdown",
-  ".json": "application/json",
-  ".csv": "text/csv",
-  ".html": "text/html",
-  ".mp4": "video/mp4",
-  ".mov": "video/quicktime",
-  ".zip": "application/zip"
-};
-function guessContentType(filename) {
-  return MIME_BY_EXT[extname(filename).toLowerCase()] ?? "application/octet-stream";
-}
-async function uploadAssetFromPath(client2, apiBaseUrl, input) {
-  if (!existsSync2(input.path))
-    throw new Error(`file not found: ${input.path}`);
-  const bytes = readFileSync2(input.path);
-  const filename = basename(input.path);
-  const contentType = input.contentType ?? guessContentType(filename);
-  const sha256 = createHash2("sha256").update(bytes).digest("hex");
-  const { asset, uploadUrl } = await client2.createAsset({
-    project: input.project,
-    filename,
-    contentType,
-    size: bytes.length,
-    sha256
-  });
-  const base = apiBaseUrl.replace(/\/+$/, "");
-  const target = uploadUrl.startsWith("http") ? uploadUrl : base + uploadUrl;
-  const put = await fetch(target, {
-    method: "PUT",
-    headers: { "content-type": contentType },
-    body: bytes
-  });
-  if (!put.ok) {
-    throw new Error(`upload PUT failed (${put.status} ${put.statusText}).`);
-  }
-  const verified = await client2.completeAsset(asset.id);
-  if (verified.status !== "active") {
-    throw new Error(`verification failed (${verified.status}${verified.rejectReason ? `: ${verified.rejectReason}` : ""}).`);
-  }
-  return verified;
-}
-async function downloadAssetToPath(client2, input) {
-  const asset = await client2.getAsset(input.asset);
-  if (asset.status !== "active") {
-    throw new Error(`asset ${input.asset} is ${asset.status}, not active \u2014 no bytes to download.`);
-  }
-  const buf = Buffer.from(await client2.downloadAsset(input.asset));
-  const got = createHash2("sha256").update(buf).digest("hex");
-  if (got !== asset.sha256) {
-    throw new Error(`integrity check failed: downloaded sha256 ${got} != recorded ${asset.sha256}.`);
-  }
-  writeFileSync(input.path, buf);
-  return { asset, path: input.path, bytesWritten: buf.length };
-}
-
 // ../../libs/agent-shared/dist/binding.js
 function apiBindingLabel(apiBaseUrl) {
   return /\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(:|\/|$)/.test(apiBaseUrl) ? "LOCAL dev" : "production/remote";
@@ -15078,17 +15010,6 @@ var inviteRoleSchema = external_exports.enum(["ADMIN", "CONTRIBUTOR"]);
 var requirementLifecycleSchema = external_exports.enum(["draft", "approved", "amended"]);
 var decisionStatusSchema = external_exports.enum(["proposed", "accepted", "superseded"]);
 var platformSchema = external_exports.enum(["bsky", "x", "reddit", "hn", "blog"]);
-var assetStatusSchema = external_exports.enum(["pending", "active", "rejected"]);
-var assetLinkTargetSchema = external_exports.enum([
-  "deliverable_revision",
-  "content_draft",
-  "issue",
-  "requirement",
-  "chat_message",
-  "run",
-  "criterion"
-]);
-var chatEntityTypeSchema = external_exports.enum(["project", "issue", "requirement", "asset"]);
 var instructionScopeSchema = external_exports.enum([
   "general",
   "requirements",
@@ -15101,8 +15022,7 @@ var instructionScopeSchema = external_exports.enum([
 var notificationEventKindSchema = external_exports.enum([
   "question_asked",
   "work_at_verify",
-  "feedback_received",
-  "chat_message"
+  "feedback_received"
 ]);
 var NOTIFICATION_EVENT_KINDS = notificationEventKindSchema.options;
 
@@ -15144,9 +15064,6 @@ var SECRET_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
 var secretNameSchema = external_exports.string().regex(SECRET_NAME_RE, {
   message: "secret name must be UPPER_SNAKE_CASE: start with A\u2013Z or _, then only A\u2013Z, 0\u20139, or _ (e.g. API_KEY)"
 }).max(128, { message: "secret name must be at most 128 characters" });
-var sha256Schema = external_exports.string().regex(/^[a-fA-F0-9]{64}$/, {
-  message: "expected a hex-encoded SHA-256 (64 hex characters)"
-});
 var metadataSchema = external_exports.object({
   system: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
   client: external_exports.record(external_exports.string(), external_exports.unknown()).default({})
@@ -15160,9 +15077,6 @@ var requirementRefSchema = external_exports.string().min(1, {
 var conventionRefSchema = external_exports.string().min(1, {
   message: "convention reference must not be empty \u2014 use a display id (`CONV-3`) or uuid"
 });
-var promptRefSchema = external_exports.string().min(1, {
-  message: "prompt reference must not be empty \u2014 use a display id (`PROMPT-3`) or uuid"
-});
 var decisionRefSchema = external_exports.string().min(1, {
   message: "decision reference must not be empty \u2014 use a display id (`DWB-D7`) or uuid"
 });
@@ -15714,29 +15628,6 @@ var conventionApprovalSchema = external_exports.object({
   supersededId: uuidSchema.nullable(),
   createdAt: external_exports.iso.datetime({ offset: true })
 });
-var promptSchema = external_exports.object({
-  id: uuidSchema,
-  displayId: external_exports.string().min(1),
-  orgId: uuidSchema,
-  number: positiveIntSchema,
-  projectId: uuidSchema.nullable(),
-  createdBy: uuidSchema.nullable(),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  updatedAt: external_exports.iso.datetime({ offset: true }),
-  deletedAt: external_exports.iso.datetime({ offset: true }).nullable()
-});
-var promptRevisionSchema = external_exports.object({
-  id: uuidSchema,
-  orgId: uuidSchema,
-  promptId: uuidSchema,
-  revisionNumber: positiveIntSchema,
-  title: external_exports.string().min(1),
-  body: markdownSchema,
-  note: external_exports.string().nullable(),
-  createdBy: uuidSchema.nullable(),
-  viaTokenId: uuidSchema.nullable(),
-  createdAt: external_exports.iso.datetime({ offset: true })
-});
 var issueRequirementLinkSchema = external_exports.object({
   id: uuidSchema,
   orgId: uuidSchema,
@@ -15828,96 +15719,6 @@ var issueDeliverableLinkSchema = external_exports.object({
   createdAt: external_exports.iso.datetime({ offset: true }),
   deletedAt: external_exports.iso.datetime({ offset: true }).nullable()
 });
-var assetSchema = external_exports.object({
-  id: uuidSchema,
-  // The asset's own identifier (PIPE-362), `ASSET-{n}`: numbered per ORGANISATION, the
-  // way prompts are, because an asset may belong to no project and may move between
-  // projects — a per-project number would be impossible for one and stale for the other.
-  displayId: external_exports.string().min(1),
-  orgId: uuidSchema,
-  // Null for an ORG-level asset (a chat attachment, PIPE-15): assets were
-  // project-scoped until chat introduced org-level files. Project assets keep a
-  // uuid; the DB column and every read path (assetToWire) carry the null through.
-  projectId: uuidSchema.nullable(),
-  filename: external_exports.string().min(1),
-  contentType: external_exports.string().min(1),
-  size: positiveIntSchema,
-  sha256: sha256Schema,
-  status: assetStatusSchema,
-  // Set only when `status === 'rejected'`: one of object_missing / size_mismatch /
-  // digest_mismatch / too_large.
-  rejectReason: external_exports.string().nullable(),
-  // Whether a server-generated thumbnail object exists for this asset (images only,
-  // best-effort at verify). The key itself is internal, like storageKey — the bytes
-  // are served through a separate presigned-GET route, never a value field here.
-  hasThumbnail: external_exports.boolean(),
-  // Count of live (non-soft-deleted) asset_links referencing this asset — derived
-  // server-side; 0 when unlinked (and only then is the asset safe to delete).
-  linkCount: external_exports.number().int().nonnegative(),
-  createdBy: uuidSchema.nullable(),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  verifiedAt: external_exports.iso.datetime({ offset: true }).nullable(),
-  deletedAt: external_exports.iso.datetime({ offset: true }).nullable()
-});
-var assetLinkSchema = external_exports.object({
-  id: uuidSchema,
-  orgId: uuidSchema,
-  assetId: uuidSchema,
-  targetType: assetLinkTargetSchema,
-  targetId: uuidSchema,
-  createdBy: uuidSchema.nullable(),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  deletedAt: external_exports.iso.datetime({ offset: true }).nullable()
-});
-var chatMessageReferenceSchema = external_exports.object({
-  id: uuidSchema,
-  entityType: chatEntityTypeSchema,
-  entityId: uuidSchema,
-  revision: positiveIntSchema.nullable(),
-  displayId: external_exports.string().nullable(),
-  title: external_exports.string().nullable(),
-  summary: external_exports.string().nullable().optional(),
-  headerStale: external_exports.boolean().optional()
-});
-var chatAttachmentSchema = external_exports.object({
-  assetId: uuidSchema,
-  linkId: uuidSchema,
-  filename: external_exports.string().min(1),
-  contentType: external_exports.string().min(1),
-  size: positiveIntSchema,
-  status: assetStatusSchema,
-  hasThumbnail: external_exports.boolean()
-});
-var chatReactionSchema = external_exports.object({
-  emoji: external_exports.string().min(1),
-  userId: uuidSchema
-});
-var chatMessageSchema = external_exports.object({
-  id: uuidSchema,
-  seq: positiveIntSchema,
-  authorUserId: uuidSchema,
-  authorName: external_exports.string(),
-  body: markdownSchema,
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  editedAt: external_exports.iso.datetime({ offset: true }).nullable(),
-  references: external_exports.array(chatMessageReferenceSchema),
-  attachments: external_exports.array(chatAttachmentSchema),
-  reactions: external_exports.array(chatReactionSchema)
-});
-var chatReadStateSchema = external_exports.object({
-  userId: uuidSchema,
-  userName: external_exports.string(),
-  lastReadSeq: nonNegativeIntSchema,
-  updatedAt: external_exports.iso.datetime({ offset: true })
-});
-var chatMentionSchema = external_exports.object({
-  messageId: uuidSchema,
-  seq: positiveIntSchema,
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  authorUserId: uuidSchema,
-  authorName: external_exports.string(),
-  excerpt: external_exports.string()
-});
 var statusHistoryEntrySchema = external_exports.object({
   id: uuidSchema,
   orgId: uuidSchema,
@@ -16331,32 +16132,6 @@ var updateConventionInputSchema = external_exports.strictObject({
 var listConventionsFilterSchema = external_exports.strictObject({
   text: external_exports.string().optional()
 });
-var createPromptInputSchema = external_exports.strictObject({
-  title: external_exports.string().min(1, { message: "prompt title must not be empty" }),
-  body: markdownSchema.min(1, { message: "prompt body must not be empty" }),
-  note: external_exports.string().min(1, { message: "note must not be empty \u2014 omit it if there is nothing to record" }).optional(),
-  // The OPTIONAL project attachment. Omitted = a prompt that belongs to the organisation
-  // and no project, which is the common case for a prompt about how to work.
-  project: projectRefSchema.optional()
-});
-var updatePromptInputSchema = external_exports.strictObject({
-  prompt: promptRefSchema,
-  title: external_exports.string().min(1, { message: "prompt title must not be empty" }).optional(),
-  body: markdownSchema.min(1, { message: "prompt body must not be empty" }).optional(),
-  note: external_exports.string().min(1, { message: "note must not be empty \u2014 omit it if there is nothing to record" }).optional(),
-  // `null` DETACHES the prompt from its project; omitted leaves the attachment alone.
-  // Moving the attachment is a record-level change and writes NO revision — the
-  // revision chain is the history of the text, and a project move changes no text.
-  project: projectRefSchema.nullable().optional()
-}).refine((v) => v.title !== void 0 || v.body !== void 0 || v.project !== void 0, {
-  message: "empty edit: supply at least one of `title`, `body`, or `project`"
-});
-var listPromptsFilterSchema = external_exports.strictObject({
-  // Filters to prompts attached to this project. Omitted returns EVERY prompt in the
-  // organisation, attached or not — the org-wide library is the default view.
-  project: projectRefSchema.optional(),
-  text: external_exports.string().optional()
-});
 var createDecisionInputSchema = external_exports.strictObject({
   project: projectRefSchema,
   title: external_exports.string().min(1, { message: "decision title must not be empty" }),
@@ -16581,73 +16356,6 @@ var listContentFilterSchema = external_exports.strictObject({
   limit: external_exports.number().int().min(1, { message: "limit must be at least 1" }).max(500, { message: "limit must be at most 500" }).optional(),
   offset: external_exports.number().int().nonnegative().optional()
 });
-var createAssetInputSchema = external_exports.strictObject({
-  // Optional since PIPE-15: omit for an ORG-level asset (a chat attachment, stored
-  // under `staging/org/{orgId}/…`). A project ref scopes the asset to that project.
-  project: projectRefSchema.optional(),
-  filename: external_exports.string().min(1, { message: "filename must not be empty" }),
-  contentType: external_exports.string().min(1, { message: "content type must not be empty" }),
-  size: positiveIntSchema,
-  sha256: sha256Schema
-});
-var uploadAssetInputSchema = external_exports.strictObject({
-  // Optional since PIPE-15: omit to upload an ORG-level asset (not scoped to any
-  // project). A project ref scopes the upload to that project.
-  project: projectRefSchema.optional(),
-  path: external_exports.string().min(1, { message: "path must not be empty \u2014 give the local file to upload" }),
-  contentType: external_exports.string().min(1, { message: "content type must not be empty" }).optional()
-});
-var downloadAssetInputSchema = external_exports.strictObject({
-  asset: uuidSchema,
-  path: external_exports.string().min(1, { message: "path must not be empty \u2014 give the local file to write" })
-});
-var linkAssetInputSchema = external_exports.strictObject({
-  asset: external_exports.string().min(1, { message: "asset reference must not be empty" }),
-  targetType: external_exports.enum(["deliverable_revision", "content_draft"]),
-  targetId: uuidSchema
-});
-var unlinkAssetInputSchema = external_exports.strictObject({
-  linkId: uuidSchema
-});
-var assetCategorySchema = external_exports.enum(["image", "video", "document"]);
-var assetSortSchema = external_exports.enum(["date", "size"]);
-var sortDirSchema = external_exports.enum(["asc", "desc"]);
-var listAssetsFilterSchema = external_exports.strictObject({
-  project: projectRefSchema.optional(),
-  status: external_exports.array(assetStatusSchema).optional(),
-  category: assetCategorySchema.optional(),
-  sort: assetSortSchema.optional(),
-  dir: sortDirSchema.optional(),
-  text: external_exports.string().optional(),
-  limit: external_exports.number().int().min(1, { message: "limit must be at least 1" }).max(500, { message: "limit must be at most 500" }).optional(),
-  offset: external_exports.number().int().nonnegative().optional()
-});
-var createChatMessageReferenceInputSchema = external_exports.strictObject({
-  entityType: chatEntityTypeSchema,
-  entityId: uuidSchema,
-  // → requirement_revisions.revision_number, an `integer` column (PIPE-149).
-  revision: int4Schema.optional()
-});
-var createChatMessageInputSchema = external_exports.strictObject({
-  body: external_exports.string().min(1, { message: "message body must not be empty" }).max(8e3, { message: "message body must be at most 8000 characters" }),
-  references: external_exports.array(createChatMessageReferenceInputSchema).max(20).optional(),
-  assetIds: external_exports.array(uuidSchema).max(10).optional()
-});
-var updateChatMessageInputSchema = external_exports.strictObject({
-  body: external_exports.string().min(1, { message: "message body must not be empty" }).max(8e3, { message: "message body must be at most 8000 characters" })
-});
-var addChatReactionInputSchema = external_exports.strictObject({
-  emoji: external_exports.string().min(1, { message: "emoji must not be empty" }).max(32, { message: "emoji must be at most 32 characters" })
-});
-var advanceChatReadInputSchema = external_exports.strictObject({
-  lastReadSeq: nonNegativeIntSchema
-});
-var listChatMessagesFilterSchema = external_exports.strictObject({
-  before: positiveIntSchema.optional(),
-  after: positiveIntSchema.optional(),
-  limit: external_exports.number().int().min(1, { message: "limit must be at least 1" }).max(200, { message: "limit must be at most 200" }).optional(),
-  project: projectRefSchema.optional()
-});
 var setOrgInstructionInputSchema = external_exports.strictObject({
   scope: instructionScopeSchema,
   body: external_exports.string().min(1, { message: "instruction body must not be empty \u2014 clear the scope instead" }).max(4e3, { message: "instruction body must be at most 4000 characters" })
@@ -17129,44 +16837,6 @@ var ApiClient = class _ApiClient {
       body: fields
     });
   }
-  // --- prompts (PIPE-196) ----------------------------------------------------
-  //
-  // FOUR methods, and the absence of a fifth is the design here too: there is deliberately
-  // NO `deletePrompt`, and there must not be one. Nothing removes a prompt on any surface
-  // — an edit APPENDS a revision, so the text a prompt used to carry stays readable, and a
-  // prompt nobody runs any more is one whose newest revision says so. There is no route
-  // for such a method to call.
-  /**
-   * The whole organization's library, filtered by `project` and/or `text`.
-   *
-   * `requestList`, like every other list on this client, and NOT {@link listConventions}'s
-   * named object: the convention response is a bespoke envelope because it carries the
-   * delivered count and the threshold that warns about it beside the list — every approved
-   * convention rides along on every work-item read. A prompt is delivered to nobody
-   * automatically, so there is no second number to carry and the plain §9 `{ items }`
-   * envelope is the whole shape. Going through `requestList` is what turns a proxy's
-   * malformed 2xx into a typed `invalid_response` here rather than an opaque TypeError at
-   * whichever caller first maps the result.
-   */
-  listPrompts(filter = {}) {
-    return this.requestList("GET", "/api/v1/prompts", { query: filter });
-  }
-  getPrompt(ref) {
-    return this.request("GET", `/api/v1/prompts/${enc(ref)}`);
-  }
-  createPrompt(input) {
-    return this.request("POST", "/api/v1/prompts", { body: input });
-  }
-  /**
-   * `title`/`body` APPEND a revision; `note` records why. Supplying none of the three
-   * editable fields is an empty edit, refused by the API (400) — a note alone amends
-   * nothing.
-   */
-  updatePrompt(ref, fields) {
-    return this.request("PATCH", `/api/v1/prompts/${enc(ref)}`, {
-      body: fields
-    });
-  }
   // --- decision records (PIPE-84) --------------------------------------------
   //
   // Five routes, no DELETE: PIPE-73 made four record kinds deletable and this epic
@@ -17236,107 +16906,6 @@ var ApiClient = class _ApiClient {
     const { contentRef, platform } = splitDeliverableRef(deliverableRef);
     return this.request("POST", `/api/v1/content/${enc(contentRef)}/deliverables/${enc(platform)}/promote`, { body: input });
   }
-  // --- assets ----------------------------------------------------------------
-  createAsset(input) {
-    return this.request("POST", "/api/v1/assets", { body: input });
-  }
-  completeAsset(id) {
-    return this.request("POST", `/api/v1/assets/${enc(id)}/complete`);
-  }
-  listAssets(filter = {}) {
-    return this.requestList("GET", "/api/v1/assets", { query: filter });
-  }
-  getAsset(id) {
-    return this.request("GET", `/api/v1/assets/${enc(id)}`);
-  }
-  /**
-   * The presigned-GET download route (reveal plane) — navigate/fetch with auth; server
-   * 302s to S3. Prefixed with `baseUrl` (PIPE-180): relative under the web's
-   * same-origin '' base, absolute when the client targets a separate API origin.
-   */
-  assetDownloadPath(id) {
-    return `${this.baseUrl}/api/v1/assets/${enc(id)}/download`;
-  }
-  /**
-   * Fetches an active asset's raw bytes via the download route, following the 302 to
-   * the presigned GET (a cross-origin redirect drops the auth header, so S3 gets a
-   * clean presigned request). Returns the bytes for a caller to write to a file — the
-   * MCP `download_asset` tool and the CLI write to a local path and surface metadata
-   * only, so bytes never cross a tool boundary. `active` assets only (409 otherwise).
-   */
-  async downloadAsset(id) {
-    let response;
-    try {
-      response = await this.fetchImpl(this.buildUrl(`/api/v1/assets/${enc(id)}/download`, void 0), {
-        method: "GET",
-        headers: this.authHeaders(),
-        redirect: "follow",
-        signal: AbortSignal.timeout(this.timeoutMs)
-      });
-    } catch (err) {
-      throw toTransportError(err, this.timeoutMs);
-    }
-    if (!response.ok) {
-      const rawText = await response.text();
-      throw toApiError(response.status, rawText.length === 0 ? void 0 : safeJsonParse(rawText), rawText);
-    }
-    return response.arrayBuffer();
-  }
-  /**
-   * The presigned-GET thumbnail route (reveal plane) — an `<img src>` follows the 302;
-   * 404 ⇒ no thumbnail. Prefixed with `baseUrl` like {@link assetDownloadPath}.
-   */
-  assetThumbnailPath(id) {
-    return `${this.baseUrl}/api/v1/assets/${enc(id)}/thumbnail`;
-  }
-  /** Soft-delete an asset — 409 if it still has live references (delete is web/CLI only). */
-  deleteAsset(id) {
-    return this.request("DELETE", `/api/v1/assets/${enc(id)}`);
-  }
-  /** The live references TO an asset, resolved to display labels (the asset-detail panel). */
-  listAssetLinks(id) {
-    return this.requestList("GET", `/api/v1/assets/${enc(id)}/links`);
-  }
-  linkAsset(input) {
-    return this.request("POST", "/api/v1/asset-links", { body: input });
-  }
-  unlinkAsset(linkId) {
-    return this.request("DELETE", `/api/v1/asset-links/${enc(linkId)}`);
-  }
-  // --- chat ------------------------------------------------------------------
-  createChatMessage(input) {
-    return this.request("POST", "/api/v1/chat/messages", { body: input });
-  }
-  /** A page of messages (newest first) + the stream's latest seq. `before`/`after` are exclusive seq bounds. */
-  listChatMessages(filter = {}) {
-    return this.request("GET", "/api/v1/chat/messages", { query: filter });
-  }
-  updateChatMessage(id, input) {
-    return this.request("PATCH", `/api/v1/chat/messages/${enc(id)}`, { body: input });
-  }
-  deleteChatMessage(id) {
-    return this.request("DELETE", `/api/v1/chat/messages/${enc(id)}`);
-  }
-  addChatReaction(id, input) {
-    return this.request("POST", `/api/v1/chat/messages/${enc(id)}/reactions`, {
-      body: input
-    });
-  }
-  removeChatReaction(id, emoji3) {
-    return this.request("DELETE", `/api/v1/chat/messages/${enc(id)}/reactions/${enc(emoji3)}`);
-  }
-  /** Advance the caller's read pointer (server clamps it monotonically). */
-  advanceChatRead(input) {
-    return this.request("PUT", "/api/v1/chat/read", { body: input });
-  }
-  /** Every member's read pointer + the stream's latest seq (receipts + unread badge). */
-  getChatRead() {
-    return this.request("GET", "/api/v1/chat/read");
-  }
-  /** The live chat messages that mention an entity (backlinks), newest first. */
-  getEntityMentions(entityType, entityId) {
-    return this.requestList("GET", `/api/v1/entities/${enc(entityType)}/${enc(entityId)}/mentions`);
-  }
   // --- projects --------------------------------------------------------------
   createProject(input) {
     return this.request("POST", "/api/v1/projects", { body: input });
@@ -17842,7 +17411,6 @@ function createMcpServer(baseClient, apiBaseUrl, orgInstructions2 = /* @__PURE__
   return createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2, opts).server;
 }
 function createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2 = /* @__PURE__ */ new Map(), opts = {}) {
-  const surface = opts.surface ?? "local";
   const registry2 = [];
   const scope = new AsyncLocalStorage();
   function client2() {
@@ -18342,33 +17910,6 @@ function createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2 =
       note: external_exports.string().min(1).optional()
     }
   }, ({ convention, ...fields }) => run(() => client2().updateConvention(convention, fields)));
-  registerStrict("list_prompts", {
-    description: "List the organization\u2019s prompt library (`PROMPT-{n}`): display id, title, current text, latest revision and any attached project. With no filter this returns the whole library. `project` narrows to the ones attached there \u2014 an attachment says what a prompt is about, not who may run it. `text` matches title and body.",
-    inputSchema: listPromptsFilterSchema.shape
-  }, (args) => run(() => client2().listPrompts(args), GUIDANCE_POINTER));
-  registerStrict("get_prompt", {
-    description: "Get one prompt by display id (`PROMPT-{n}`) or uuid: its current text, which is the latest revision, plus every earlier one with who saved it, when and why.",
-    inputSchema: { prompt: promptRefSchema }
-  }, (args) => run(() => client2().getPrompt(args.prompt), GUIDANCE_POINTER));
-  registerStrict("create_prompt", {
-    description: "Write a prompt: reusable text held by the organization (`PROMPT-{n}`). `body` is the prompt and must not be empty; `title` names it; `note` says why. Optional `project` records what the prompt is about, not who may use it. Nothing approves or deletes a prompt; later wording is a new revision.",
-    inputSchema: createPromptInputSchema.shape
-  }, (args) => run(() => client2().createPrompt(args)));
-  registerStrict("update_prompt", {
-    description: "Amend a prompt. `title` and `body` append a new revision \u2014 nothing is edited in place \u2014 and `note` records why. `project` moves the attachment and `project: null` detaches it; neither writes a revision. Naming none of the three is an empty edit (400). See \u201CHow to write here\u201D in the doctrine `get_work_context` returns.",
-    // Inline shape (updatePromptInputSchema is a refine, so it has no `.shape`),
-    // mirroring that schema's fields — it is the wording this copy follows, `.min(1)`
-    // bounds included, so a caller learns a blank body is refused from the advertised
-    // schema rather than from a round trip. The ONE rule this shape cannot state is the
-    // empty edit, which lives in the schema's `.refine`; the API enforces it.
-    inputSchema: {
-      prompt: promptRefSchema,
-      title: external_exports.string().min(1).optional(),
-      body: markdownSchema.min(1).optional(),
-      note: external_exports.string().min(1).optional(),
-      project: projectRefSchema.nullable().optional()
-    }
-  }, ({ prompt, ...fields }) => run(() => client2().updatePrompt(prompt, fields)));
   registerStrict("create_decision", {
     description: "Record one decision as a project-scoped record (`KEY-D{n}`): `title` names it, `body` says what was decided and why. It starts `proposed` and is frozen once accepted; changing it then means a new record plus `supersede_decision`. See \u201CA decision record is written once\u201D in the doctrine `get_work_context` returns.",
     inputSchema: createDecisionInputSchema.shape
@@ -18402,7 +17943,7 @@ function createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2 =
     inputSchema: listContentFilterSchema.shape
   }, (args) => run(() => client2().listContent(args), GUIDANCE_POINTER));
   registerStrict("get_content", {
-    description: "Get a content draft by display id (`KEY-C{n}`) or uuid: its revisions, latest or the `revision` you name, plus every deliverable, linked issue and linked asset.",
+    description: "Get a content draft by display id (`KEY-C{n}`) or uuid: its revisions, latest or the `revision` you name, plus every deliverable and linked issue.",
     inputSchema: { content: contentRefSchema, revision: positiveIntSchema.optional() }
   }, (args) => run(() => client2().getContent(args.content, args.revision), GUIDANCE_POINTER));
   registerStrict("create_content", {
@@ -18451,32 +17992,6 @@ function createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2 =
       ...refusedIssueHeaderFields
     }
   }, ({ deliverable, ...fields }) => run(() => client2().promoteDeliverable(deliverable, fields)));
-  registerStrict("list_assets", {
-    description: "List project assets, filtered by status (pending/active/rejected), category (image/video/document) and filename text, sorted by date or size. No bytes cross this result.",
-    inputSchema: listAssetsFilterSchema.shape
-  }, (args) => run(() => client2().listAssets(args), GUIDANCE_POINTER));
-  registerStrict("get_asset", {
-    description: "Get an asset\u2019s metadata by uuid: filename, contentType, size, sha256, status and linkCount. No bytes and no URL come back; use `download_asset` or `ppb assets download`.",
-    inputSchema: { asset: uuidSchema }
-  }, (args) => run(() => client2().getAsset(args.asset), GUIDANCE_POINTER));
-  if (surface === "local") {
-    registerStrict("upload_asset", {
-      description: "Upload a local file as a project asset and activate it. Only the `path` crosses the wire \u2014 never base64 or file contents. `contentType` is guessed from the extension when omitted. Returns the asset metadata; `link_asset` then attaches it to a draft or a deliverable revision.",
-      inputSchema: uploadAssetInputSchema.shape
-    }, (args) => run(() => uploadAssetFromPath(client2(), apiBaseUrl, args)));
-    registerStrict("download_asset", {
-      description: "Write an ACTIVE asset\u2019s bytes to a local file at `path`, created or overwritten. Addressed by asset uuid. The bytes are checked against the recorded sha256; the result is metadata and the path.",
-      inputSchema: downloadAssetInputSchema.shape
-    }, (args) => run(() => downloadAssetToPath(client2(), args)));
-  }
-  registerStrict("link_asset", {
-    description: "Reference an active asset from a `deliverable_revision` (a content_deliverable_revision uuid) or a `content_draft` (a content_draft uuid, copied onto later deliverables). A non-active asset or a cross-project link is rejected.",
-    inputSchema: linkAssetInputSchema.shape
-  }, (args) => run(() => client2().linkAsset(args)));
-  registerStrict("unlink_asset", {
-    description: "Remove an asset reference by its link id. This drops the reference only; the asset itself is untouched. A link on a chat message is author-only \u2014 anyone else is refused `not_message_author`. Every other target type any member can remove.",
-    inputSchema: unlinkAssetInputSchema.shape
-  }, (args) => run(() => client2().unlinkAsset(args.linkId)));
   registerStrict("set_secret", {
     description: "Create a secret or add a new version under a project and environment. Do not send a sensitive value here \u2014 it lands in the chat transcript before the server can encrypt it; use `ppb secrets set` from stdin or `--from-file`. `name` is UPPER_SNAKE_CASE, `environment` is a slug (dev/prod). See \u201CA secret value never travels in a tool call\u201D in the doctrine `get_work_context` returns.",
     inputSchema: {
@@ -18616,7 +18131,7 @@ function loadMcpConfig() {
 }
 
 // src/version.ts
-var VERSION = "0.59.3";
+var VERSION = "0.61.0";
 
 // src/main.ts
 async function scopedClient(base, org) {
@@ -18640,7 +18155,6 @@ var client = await scopedClient(
 var orgInstructions = await fetchOrgInstructionsSafe(client);
 var server = createMcpServer(client, config2.apiUrl, orgInstructions, {
   version: VERSION,
-  surface: "local",
   // The writing rules follow the organization the CALL acts in (PIPE-410). Without this,
   // a `get_work_context` naming another organization returns that organization's work,
   // requirements and conventions under THIS one's rules, in one document, with nothing in

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pipebrain-mcp",
-  "version": "0.59.3",
-  "description": "Pipebrain MCP server for Claude Code and Claude Desktop — issues, requirements, decision records, conventions, prompts, content, assets, metadata-only secrets, and more of the platform's modules over the Pipebrain API.",
+  "version": "0.61.0",
+  "description": "Pipebrain MCP server for Claude Code and Claude Desktop — issues, requirements, decision records, conventions, content, metadata-only secrets, and more of the platform's modules over the Pipebrain API.",
   "type": "module",
   "license": "MIT",
   "main": "./dist/main.js",