pipebrain-mcp 0.60.0 → 0.61.0

package/README.md

@@ -1,7 +1,7 @@
 # pipebrain-mcp
 
 The [Pipebrain](https://pipebrain.dev) MCP server: issues, requirements, decision records,
-conventions, content drafts and deliverables, assets, milestones, metadata-only secrets,
+conventions, content drafts and deliverables, milestones, metadata-only secrets,
 and more of the platform's modules, exposed to Claude Code and Claude Desktop
 over stdio.
 

package/dist/main.js

@@ -432,74 +432,6 @@ function agentConfigNotice(status) {
   return status === "behind" ? `This machine's shared agent configuration is not the one this build ships \u2014 run \`${UPDATE_COMMAND}\` to see what would change and update it.` : null;
 }
 
-// ../../libs/agent-shared/dist/asset-transfer.js
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "node:fs";
-import { basename, extname } from "node:path";
-var MIME_BY_EXT = {
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".pdf": "application/pdf",
-  ".txt": "text/plain",
-  ".md": "text/markdown",
-  ".json": "application/json",
-  ".csv": "text/csv",
-  ".html": "text/html",
-  ".mp4": "video/mp4",
-  ".mov": "video/quicktime",
-  ".zip": "application/zip"
-};
-function guessContentType(filename) {
-  return MIME_BY_EXT[extname(filename).toLowerCase()] ?? "application/octet-stream";
-}
-async function uploadAssetFromPath(client2, apiBaseUrl, input) {
-  if (!existsSync2(input.path))
-    throw new Error(`file not found: ${input.path}`);
-  const bytes = readFileSync2(input.path);
-  const filename = basename(input.path);
-  const contentType = input.contentType ?? guessContentType(filename);
-  const sha256 = createHash2("sha256").update(bytes).digest("hex");
-  const { asset, uploadUrl } = await client2.createAsset({
-    project: input.project,
-    filename,
-    contentType,
-    size: bytes.length,
-    sha256
-  });
-  const base = apiBaseUrl.replace(/\/+$/, "");
-  const target = uploadUrl.startsWith("http") ? uploadUrl : base + uploadUrl;
-  const put = await fetch(target, {
-    method: "PUT",
-    headers: { "content-type": contentType },
-    body: bytes
-  });
-  if (!put.ok) {
-    throw new Error(`upload PUT failed (${put.status} ${put.statusText}).`);
-  }
-  const verified = await client2.completeAsset(asset.id);
-  if (verified.status !== "active") {
-    throw new Error(`verification failed (${verified.status}${verified.rejectReason ? `: ${verified.rejectReason}` : ""}).`);
-  }
-  return verified;
-}
-async function downloadAssetToPath(client2, input) {
-  const asset = await client2.getAsset(input.asset);
-  if (asset.status !== "active") {
-    throw new Error(`asset ${input.asset} is ${asset.status}, not active \u2014 no bytes to download.`);
-  }
-  const buf = Buffer.from(await client2.downloadAsset(input.asset));
-  const got = createHash2("sha256").update(buf).digest("hex");
-  if (got !== asset.sha256) {
-    throw new Error(`integrity check failed: downloaded sha256 ${got} != recorded ${asset.sha256}.`);
-  }
-  writeFileSync(input.path, buf);
-  return { asset, path: input.path, bytesWritten: buf.length };
-}
-
 // ../../libs/agent-shared/dist/binding.js
 function apiBindingLabel(apiBaseUrl) {
   return /\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(:|\/|$)/.test(apiBaseUrl) ? "LOCAL dev" : "production/remote";
@@ -15078,15 +15010,6 @@ var inviteRoleSchema = external_exports.enum(["ADMIN", "CONTRIBUTOR"]);
 var requirementLifecycleSchema = external_exports.enum(["draft", "approved", "amended"]);
 var decisionStatusSchema = external_exports.enum(["proposed", "accepted", "superseded"]);
 var platformSchema = external_exports.enum(["bsky", "x", "reddit", "hn", "blog"]);
-var assetStatusSchema = external_exports.enum(["pending", "active", "rejected"]);
-var assetLinkTargetSchema = external_exports.enum([
-  "deliverable_revision",
-  "content_draft",
-  "issue",
-  "requirement",
-  "run",
-  "criterion"
-]);
 var instructionScopeSchema = external_exports.enum([
   "general",
   "requirements",
@@ -15141,9 +15064,6 @@ var SECRET_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
 var secretNameSchema = external_exports.string().regex(SECRET_NAME_RE, {
   message: "secret name must be UPPER_SNAKE_CASE: start with A\u2013Z or _, then only A\u2013Z, 0\u20139, or _ (e.g. API_KEY)"
 }).max(128, { message: "secret name must be at most 128 characters" });
-var sha256Schema = external_exports.string().regex(/^[a-fA-F0-9]{64}$/, {
-  message: "expected a hex-encoded SHA-256 (64 hex characters)"
-});
 var metadataSchema = external_exports.object({
   system: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
   client: external_exports.record(external_exports.string(), external_exports.unknown()).default({})
@@ -15799,47 +15719,6 @@ var issueDeliverableLinkSchema = external_exports.object({
   createdAt: external_exports.iso.datetime({ offset: true }),
   deletedAt: external_exports.iso.datetime({ offset: true }).nullable()
 });
-var assetSchema = external_exports.object({
-  id: uuidSchema,
-  // The asset's own identifier (PIPE-362), `ASSET-{n}`: numbered per ORGANISATION, the
-  // way conventions are, because an asset may belong to no project and may move between
-  // projects — a per-project number would be impossible for one and stale for the other.
-  displayId: external_exports.string().min(1),
-  orgId: uuidSchema,
-  // Null for an ORG-level asset (a chat attachment, PIPE-15): assets were
-  // project-scoped until chat introduced org-level files. Project assets keep a
-  // uuid; the DB column and every read path (assetToWire) carry the null through.
-  projectId: uuidSchema.nullable(),
-  filename: external_exports.string().min(1),
-  contentType: external_exports.string().min(1),
-  size: positiveIntSchema,
-  sha256: sha256Schema,
-  status: assetStatusSchema,
-  // Set only when `status === 'rejected'`: one of object_missing / size_mismatch /
-  // digest_mismatch / too_large.
-  rejectReason: external_exports.string().nullable(),
-  // Whether a server-generated thumbnail object exists for this asset (images only,
-  // best-effort at verify). The key itself is internal, like storageKey — the bytes
-  // are served through a separate presigned-GET route, never a value field here.
-  hasThumbnail: external_exports.boolean(),
-  // Count of live (non-soft-deleted) asset_links referencing this asset — derived
-  // server-side; 0 when unlinked (and only then is the asset safe to delete).
-  linkCount: external_exports.number().int().nonnegative(),
-  createdBy: uuidSchema.nullable(),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  verifiedAt: external_exports.iso.datetime({ offset: true }).nullable(),
-  deletedAt: external_exports.iso.datetime({ offset: true }).nullable()
-});
-var assetLinkSchema = external_exports.object({
-  id: uuidSchema,
-  orgId: uuidSchema,
-  assetId: uuidSchema,
-  targetType: assetLinkTargetSchema,
-  targetId: uuidSchema,
-  createdBy: uuidSchema.nullable(),
-  createdAt: external_exports.iso.datetime({ offset: true }),
-  deletedAt: external_exports.iso.datetime({ offset: true }).nullable()
-});
 var statusHistoryEntrySchema = external_exports.object({
   id: uuidSchema,
   orgId: uuidSchema,
@@ -16477,47 +16356,6 @@ var listContentFilterSchema = external_exports.strictObject({
   limit: external_exports.number().int().min(1, { message: "limit must be at least 1" }).max(500, { message: "limit must be at most 500" }).optional(),
   offset: external_exports.number().int().nonnegative().optional()
 });
-var createAssetInputSchema = external_exports.strictObject({
-  // Optional since PIPE-15: omit for an ORG-level asset (a chat attachment, stored
-  // under `staging/org/{orgId}/…`). A project ref scopes the asset to that project.
-  project: projectRefSchema.optional(),
-  filename: external_exports.string().min(1, { message: "filename must not be empty" }),
-  contentType: external_exports.string().min(1, { message: "content type must not be empty" }),
-  size: positiveIntSchema,
-  sha256: sha256Schema
-});
-var uploadAssetInputSchema = external_exports.strictObject({
-  // Optional since PIPE-15: omit to upload an ORG-level asset (not scoped to any
-  // project). A project ref scopes the upload to that project.
-  project: projectRefSchema.optional(),
-  path: external_exports.string().min(1, { message: "path must not be empty \u2014 give the local file to upload" }),
-  contentType: external_exports.string().min(1, { message: "content type must not be empty" }).optional()
-});
-var downloadAssetInputSchema = external_exports.strictObject({
-  asset: uuidSchema,
-  path: external_exports.string().min(1, { message: "path must not be empty \u2014 give the local file to write" })
-});
-var linkAssetInputSchema = external_exports.strictObject({
-  asset: external_exports.string().min(1, { message: "asset reference must not be empty" }),
-  targetType: external_exports.enum(["deliverable_revision", "content_draft"]),
-  targetId: uuidSchema
-});
-var unlinkAssetInputSchema = external_exports.strictObject({
-  linkId: uuidSchema
-});
-var assetCategorySchema = external_exports.enum(["image", "video", "document"]);
-var assetSortSchema = external_exports.enum(["date", "size"]);
-var sortDirSchema = external_exports.enum(["asc", "desc"]);
-var listAssetsFilterSchema = external_exports.strictObject({
-  project: projectRefSchema.optional(),
-  status: external_exports.array(assetStatusSchema).optional(),
-  category: assetCategorySchema.optional(),
-  sort: assetSortSchema.optional(),
-  dir: sortDirSchema.optional(),
-  text: external_exports.string().optional(),
-  limit: external_exports.number().int().min(1, { message: "limit must be at least 1" }).max(500, { message: "limit must be at most 500" }).optional(),
-  offset: external_exports.number().int().nonnegative().optional()
-});
 var setOrgInstructionInputSchema = external_exports.strictObject({
   scope: instructionScopeSchema,
   body: external_exports.string().min(1, { message: "instruction body must not be empty \u2014 clear the scope instead" }).max(4e3, { message: "instruction body must be at most 4000 characters" })
@@ -17068,73 +16906,6 @@ var ApiClient = class _ApiClient {
     const { contentRef, platform } = splitDeliverableRef(deliverableRef);
     return this.request("POST", `/api/v1/content/${enc(contentRef)}/deliverables/${enc(platform)}/promote`, { body: input });
   }
-  // --- assets ----------------------------------------------------------------
-  createAsset(input) {
-    return this.request("POST", "/api/v1/assets", { body: input });
-  }
-  completeAsset(id) {
-    return this.request("POST", `/api/v1/assets/${enc(id)}/complete`);
-  }
-  listAssets(filter = {}) {
-    return this.requestList("GET", "/api/v1/assets", { query: filter });
-  }
-  getAsset(id) {
-    return this.request("GET", `/api/v1/assets/${enc(id)}`);
-  }
-  /**
-   * The presigned-GET download route (reveal plane) — navigate/fetch with auth; server
-   * 302s to S3. Prefixed with `baseUrl` (PIPE-180): relative under the web's
-   * same-origin '' base, absolute when the client targets a separate API origin.
-   */
-  assetDownloadPath(id) {
-    return `${this.baseUrl}/api/v1/assets/${enc(id)}/download`;
-  }
-  /**
-   * Fetches an active asset's raw bytes via the download route, following the 302 to
-   * the presigned GET (a cross-origin redirect drops the auth header, so S3 gets a
-   * clean presigned request). Returns the bytes for a caller to write to a file — the
-   * MCP `download_asset` tool and the CLI write to a local path and surface metadata
-   * only, so bytes never cross a tool boundary. `active` assets only (409 otherwise).
-   */
-  async downloadAsset(id) {
-    let response;
-    try {
-      response = await this.fetchImpl(this.buildUrl(`/api/v1/assets/${enc(id)}/download`, void 0), {
-        method: "GET",
-        headers: this.authHeaders(),
-        redirect: "follow",
-        signal: AbortSignal.timeout(this.timeoutMs)
-      });
-    } catch (err) {
-      throw toTransportError(err, this.timeoutMs);
-    }
-    if (!response.ok) {
-      const rawText = await response.text();
-      throw toApiError(response.status, rawText.length === 0 ? void 0 : safeJsonParse(rawText), rawText);
-    }
-    return response.arrayBuffer();
-  }
-  /**
-   * The presigned-GET thumbnail route (reveal plane) — an `<img src>` follows the 302;
-   * 404 ⇒ no thumbnail. Prefixed with `baseUrl` like {@link assetDownloadPath}.
-   */
-  assetThumbnailPath(id) {
-    return `${this.baseUrl}/api/v1/assets/${enc(id)}/thumbnail`;
-  }
-  /** Soft-delete an asset — 409 if it still has live references (delete is web/CLI only). */
-  deleteAsset(id) {
-    return this.request("DELETE", `/api/v1/assets/${enc(id)}`);
-  }
-  /** The live references TO an asset, resolved to display labels (the asset-detail panel). */
-  listAssetLinks(id) {
-    return this.requestList("GET", `/api/v1/assets/${enc(id)}/links`);
-  }
-  linkAsset(input) {
-    return this.request("POST", "/api/v1/asset-links", { body: input });
-  }
-  unlinkAsset(linkId) {
-    return this.request("DELETE", `/api/v1/asset-links/${enc(linkId)}`);
-  }
   // --- projects --------------------------------------------------------------
   createProject(input) {
     return this.request("POST", "/api/v1/projects", { body: input });
@@ -17640,7 +17411,6 @@ function createMcpServer(baseClient, apiBaseUrl, orgInstructions2 = /* @__PURE__
   return createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2, opts).server;
 }
 function createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2 = /* @__PURE__ */ new Map(), opts = {}) {
-  const surface = opts.surface ?? "local";
   const registry2 = [];
   const scope = new AsyncLocalStorage();
   function client2() {
@@ -18173,7 +17943,7 @@ function createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2 =
     inputSchema: listContentFilterSchema.shape
   }, (args) => run(() => client2().listContent(args), GUIDANCE_POINTER));
   registerStrict("get_content", {
-    description: "Get a content draft by display id (`KEY-C{n}`) or uuid: its revisions, latest or the `revision` you name, plus every deliverable, linked issue and linked asset.",
+    description: "Get a content draft by display id (`KEY-C{n}`) or uuid: its revisions, latest or the `revision` you name, plus every deliverable and linked issue.",
     inputSchema: { content: contentRefSchema, revision: positiveIntSchema.optional() }
   }, (args) => run(() => client2().getContent(args.content, args.revision), GUIDANCE_POINTER));
   registerStrict("create_content", {
@@ -18222,32 +17992,6 @@ function createMcpServerWithRegistry(baseClient, apiBaseUrl, orgInstructions2 =
       ...refusedIssueHeaderFields
     }
   }, ({ deliverable, ...fields }) => run(() => client2().promoteDeliverable(deliverable, fields)));
-  registerStrict("list_assets", {
-    description: "List project assets, filtered by status (pending/active/rejected), category (image/video/document) and filename text, sorted by date or size. No bytes cross this result.",
-    inputSchema: listAssetsFilterSchema.shape
-  }, (args) => run(() => client2().listAssets(args), GUIDANCE_POINTER));
-  registerStrict("get_asset", {
-    description: "Get an asset\u2019s metadata by uuid: filename, contentType, size, sha256, status and linkCount. No bytes and no URL come back; use `download_asset` or `ppb assets download`.",
-    inputSchema: { asset: uuidSchema }
-  }, (args) => run(() => client2().getAsset(args.asset), GUIDANCE_POINTER));
-  if (surface === "local") {
-    registerStrict("upload_asset", {
-      description: "Upload a local file as a project asset and activate it. Only the `path` crosses the wire \u2014 never base64 or file contents. `contentType` is guessed from the extension when omitted. Returns the asset metadata; `link_asset` then attaches it to a draft or a deliverable revision.",
-      inputSchema: uploadAssetInputSchema.shape
-    }, (args) => run(() => uploadAssetFromPath(client2(), apiBaseUrl, args)));
-    registerStrict("download_asset", {
-      description: "Write an ACTIVE asset\u2019s bytes to a local file at `path`, created or overwritten. Addressed by asset uuid. The bytes are checked against the recorded sha256; the result is metadata and the path.",
-      inputSchema: downloadAssetInputSchema.shape
-    }, (args) => run(() => downloadAssetToPath(client2(), args)));
-  }
-  registerStrict("link_asset", {
-    description: "Reference an active asset from a `deliverable_revision` (a content_deliverable_revision uuid) or a `content_draft` (a content_draft uuid, copied onto later deliverables). A non-active asset or a cross-project link is rejected.",
-    inputSchema: linkAssetInputSchema.shape
-  }, (args) => run(() => client2().linkAsset(args)));
-  registerStrict("unlink_asset", {
-    description: "Remove an asset reference by its link id. This drops the reference only; the asset itself is untouched. Any member can remove any link.",
-    inputSchema: unlinkAssetInputSchema.shape
-  }, (args) => run(() => client2().unlinkAsset(args.linkId)));
   registerStrict("set_secret", {
     description: "Create a secret or add a new version under a project and environment. Do not send a sensitive value here \u2014 it lands in the chat transcript before the server can encrypt it; use `ppb secrets set` from stdin or `--from-file`. `name` is UPPER_SNAKE_CASE, `environment` is a slug (dev/prod). See \u201CA secret value never travels in a tool call\u201D in the doctrine `get_work_context` returns.",
     inputSchema: {
@@ -18387,7 +18131,7 @@ function loadMcpConfig() {
 }
 
 // src/version.ts
-var VERSION = "0.60.0";
+var VERSION = "0.61.0";
 
 // src/main.ts
 async function scopedClient(base, org) {
@@ -18411,7 +18155,6 @@ var client = await scopedClient(
 var orgInstructions = await fetchOrgInstructionsSafe(client);
 var server = createMcpServer(client, config2.apiUrl, orgInstructions, {
   version: VERSION,
-  surface: "local",
   // The writing rules follow the organization the CALL acts in (PIPE-410). Without this,
   // a `get_work_context` naming another organization returns that organization's work,
   // requirements and conventions under THIS one's rules, in one document, with nothing in

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pipebrain-mcp",
-  "version": "0.60.0",
-  "description": "Pipebrain MCP server for Claude Code and Claude Desktop — issues, requirements, decision records, conventions, content, assets, metadata-only secrets, and more of the platform's modules over the Pipebrain API.",
+  "version": "0.61.0",
+  "description": "Pipebrain MCP server for Claude Code and Claude Desktop — issues, requirements, decision records, conventions, content, metadata-only secrets, and more of the platform's modules over the Pipebrain API.",
   "type": "module",
   "license": "MIT",
   "main": "./dist/main.js",