specguard-mcp 0.1.7 → 0.1.9

package/README.md

@@ -541,8 +541,9 @@ It reads `SPECGUARD_USER_API_KEY` (`sgu_…`), the same credential as `list_repo
 
 ### `list_repository_members`
 
-Lists who has access to a SpecGuard repository: one row per member with their `handle`,
-`permissions`, `granted_by` (who last set them) and `created_at`, ordered by handle.
+Lists who has access to a SpecGuard repository: one row per member with their `id` (the
+**membership id** `update_repository_member_permissions` and `remove_repository_member` name),
+`handle`, `permissions`, `granted_by` (who last set them) and `created_at`, ordered by handle.
 
 | argument | |
 | --- | --- |
@@ -550,7 +551,9 @@ Lists who has access to a SpecGuard repository: one row per member with their `h
 
 The list answers **memberships only** and never reports how many CI keys a member has minted
 (`keys_minted`) — that is a separate `keys.manage` disclosure this endpoint deliberately withholds;
-the API-keys tools are the surface for it. The response carries **no membership id**, by design.
+the API-keys tools are the surface for it. Each row's `id` is the membership id — the identifier
+`update_repository_member_permissions` and `remove_repository_member` name; ids are scoped to the
+repository, and a foreign id is refused `404`.
 
 Authorization is the `members.manage` capability: a caller who is not a member is refused `404`
 (the repository's existence stays hidden), and a member without `members.manage` is refused `403`
@@ -575,9 +578,11 @@ handle is ambiguous, the handle is not a login — arrives as a **distinguishabl
 naming the exact next move. The grantor recorded on the membership is always the person behind
 `SPECGUARD_USER_API_KEY`; no argument can name a different one.
 
-On success (`201`) the response carries a `member` block (`handle`, `permissions`, `granted_by`,
-`created_at`) — and **no membership id**, by design. Authorization is the `members.manage`
-capability; a member without it is refused `403` with SpecGuard's own sentence, verbatim.
+On success (`201`) the response carries a `member` block whose **`id` is the membership id**
+(alongside `handle`, `permissions`, `granted_by`, `created_at`) — the identifier
+`update_repository_member_permissions` and `remove_repository_member` name. Authorization is the
+`members.manage` capability; a member without it is refused `403` with SpecGuard's own sentence,
+verbatim.
 
 It reads `SPECGUARD_USER_API_KEY` (`sgu_…`), the same credential as `list_repositories` and
 `add_repository` and a different one from the `sgk_…` key `get_repository_overview` uses.
@@ -595,9 +600,12 @@ Replaces one member's permission set on a SpecGuard repository.
 **`permissions` replaces the whole set** — name every permission the member should end with.
 Values are validated by SpecGuard; an unknown value is refused with its own sentence, verbatim.
 
-**Known limitation:** no API endpoint serves the membership id — the member list and the
-add-member response both omit it by design — so the id must be obtained from the platform (today
-via the repository's web members page). There is no name-based lookup. Authorization is the
+**The membership id:** `member_id` comes straight off the API — every member response serves it
+as `id`: the rows `list_repository_members` returns, the `add_repository_member` 201 body, and
+this tool's own response. The server serves that `id` as a JSON number (the column is a bigint),
+while `member_id` is a string argument refused by name before any request is made — pass a
+numeric-looking id such as `7` as a string, not as a number. There is no name-based lookup, and
+ids are scoped to the repository (a foreign id is refused `404`). Authorization is the
 `members.manage` capability; a member without it is refused `403` with SpecGuard's own sentence,
 verbatim.
 
@@ -618,10 +626,11 @@ it is revoked.
 repository keep authenticating by design; the lever for those is the API-keys surface
 (`revoke_repository_api_key`), not this one. Self-revocation is permitted — after it, the caller's
 next request to the member routes answers `404`, not `403`. The repository owner's membership
-cannot be removed at all. The same known limitation as the edit tool applies to `member_id`: no
-endpoint serves it, so it comes from the platform's web members page today. Authorization is the
-`members.manage` capability; a member without it is refused `403` with SpecGuard's own sentence,
-verbatim.
+cannot be removed at all. The same source as the edit tool serves `member_id`: it is the `id`
+field on the member rows `list_repository_members` and `add_repository_member` return — a JSON
+number on the wire, so pass it as a string, not as a number (see the edit tool above).
+Authorization is the `members.manage` capability; a member without it is refused `403` with
+SpecGuard's own sentence, verbatim.
 
 It reads `SPECGUARD_USER_API_KEY` (`sgu_…`), the same credential as `list_repositories` and
 `add_repository` and a different one from the `sgk_…` key `get_repository_overview` uses.

package/dist/src/tools/add-repository-member.d.ts

@@ -20,12 +20,13 @@ import type { ToolDefinition } from "./types.js";
  * deliberately absent from the permitted params. The tool therefore takes no
  * grantor argument, and no caller can name one.
  *
- * == The 201 body omits the membership id, by server design
+ * == The 201 body carries the membership id
  *
- * `#serialize` serves `handle`, `permissions`, `granted_by`, `created_at` —
- * and no id, because ids are not portable between repositories and serving
- * one invites treating it as portable. See
- * `update_repository_member_permissions` for where the id comes from today.
+ * `#serialize` serves `id`, `handle`, `permissions`, `granted_by`,
+ * `created_at` — and the `id` is the MEMBERSHIP id, the very identifier
+ * `update_repository_member_permissions` and `remove_repository_member` name.
+ * It is not portable: lookup is scoped through the repository, so a foreign
+ * id is refused 404 server-side.
  */
 declare const addRepositoryMember: ToolDefinition;
 export default addRepositoryMember;

package/dist/src/tools/add-repository-member.js

@@ -21,12 +21,13 @@ import { optionalStringArray, requireString } from "./args.js";
  * deliberately absent from the permitted params. The tool therefore takes no
  * grantor argument, and no caller can name one.
  *
- * == The 201 body omits the membership id, by server design
+ * == The 201 body carries the membership id
  *
- * `#serialize` serves `handle`, `permissions`, `granted_by`, `created_at` —
- * and no id, because ids are not portable between repositories and serving
- * one invites treating it as portable. See
- * `update_repository_member_permissions` for where the id comes from today.
+ * `#serialize` serves `id`, `handle`, `permissions`, `granted_by`,
+ * `created_at` — and the `id` is the MEMBERSHIP id, the very identifier
+ * `update_repository_member_permissions` and `remove_repository_member` name.
+ * It is not portable: lookup is scoped through the repository, so a foreign
+ * id is refused 404 server-side.
  */
 const addRepositoryMember = {
     name: "add_repository_member",
@@ -39,10 +40,11 @@ const addRepositoryMember = {
         "arrives as a distinguishable 400 message naming the exact next move. " +
         "The grantor recorded on the membership is always the person behind this server's user API " +
         "key — the server stamps it, and no argument can name a different one. " +
-        "On success (201) the response carries a `member` block (`handle`, `permissions`, " +
-        "`granted_by`, `created_at`). It carries NO membership id, by design: ids are not portable " +
-        "between repositories, and editing or revoking a membership names a membership id obtained " +
-        "from the platform (today only via the web members page) — see the edit/revoke tools. " +
+        "On success (201) the response carries a `member` block whose `id` is the MEMBERSHIP id " +
+        "(`handle`, `permissions`, `granted_by`, `created_at` alongside) — the very identifier " +
+        "`update_repository_member_permissions` and `remove_repository_member` name. The id is not " +
+        "portable between repositories (a foreign id is refused 404), so use it within this " +
+        "repository. " +
         "Permissions are strings from SpecGuard's own set (`view`, `keys.manage`, `members.manage`, " +
         "`repo.delete`); an unknown value is refused in SpecGuard's own words, and omitting the " +
         "list grants access with no additional permissions. The repository owner cannot be added " +

package/dist/src/tools/add-repository-member.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-repository-member.js","sourceRoot":"","sources":["../../../src/tools/add-repository-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,mBAAmB,GAAmB;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,4FAA4F;QAC5F,uBAAuB;QACvB,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,uEAAuE;QACvE,4FAA4F;QAC5F,wEAAwE;QACxE,mFAAmF;QACnF,4FAA4F;QAC5F,4FAA4F;QAC5F,uFAAuF;QACvF,6FAA6F;QAC7F,yFAAyF;QACzF,0FAA0F;QAC1F,0CAA0C;QAC1C,2FAA2F;QAC3F,yBAAyB;QACzB,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,0EAA0E;oBAC1E,qEAAqE;aACxE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,mFAAmF;oBACnF,uCAAuC;aAC1C;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,2EAA2E;oBAC3E,mFAAmF;oBACnF,oFAAoF;oBACpF,mBAAmB;aACtB;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;QACrC,4EAA4E;QAC5E,wEAAwE;QACxE,oCAAoC;QACpC,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAE5E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAClE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAChE,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,yDAAyD;QACzD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"add-repository-member.js","sourceRoot":"","sources":["../../../src/tools/add-repository-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,mBAAmB,GAAmB;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,4FAA4F;QAC5F,uBAAuB;QACvB,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,uEAAuE;QACvE,4FAA4F;QAC5F,wEAAwE;QACxE,yFAAyF;QACzF,wFAAwF;QACxF,4FAA4F;QAC5F,qFAAqF;QACrF,cAAc;QACd,6FAA6F;QAC7F,yFAAyF;QACzF,0FAA0F;QAC1F,0CAA0C;QAC1C,2FAA2F;QAC3F,yBAAyB;QACzB,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,0EAA0E;oBAC1E,qEAAqE;aACxE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,mFAAmF;oBACnF,uCAAuC;aAC1C;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,2EAA2E;oBAC3E,mFAAmF;oBACnF,oFAAoF;oBACpF,mBAAmB;aACtB;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;QACrC,4EAA4E;QAC5E,wEAAwE;QACxE,oCAAoC;QACpC,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAE5E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAClE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAChE,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,yDAAyD;QACzD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,mBAAmB,CAAC"}

package/dist/src/tools/index.d.ts

@@ -124,12 +124,12 @@ import type { ToolDefinition } from "./types.js";
  * routes through `requestJson` like `postJson` rather than `deleteJson`'s
  * raw-body handling.
  *
- * A known limitation rides with them and is stated in the edit/revoke tool
- * descriptions rather than papered over: PATCH and DELETE name a membership by
- * id, but no endpoint serves that id (the platform's `#serialize` deliberately
- * omits it), so the id comes from the platform's web members page today. That
- * is a platform-side follow-up, not a client-side workaround — there is no
- * name-based lookup.
+ * PATCH and DELETE name a membership by id, and the platform serves that id on
+ * every member response (SPGD-894): the list, the add 201 and the edit 200 all
+ * carry it, so an agent that listed or added a member already holds it — the
+ * edit/revoke tool descriptions say so rather than leaving it implicit. Lookup
+ * stays scoped to the repository (a foreign id is refused 404), and there is
+ * no name-based lookup.
  *
  * == The thirteenth: rename
  *

package/dist/src/tools/index.js

@@ -137,12 +137,12 @@ import updateRepositoryMemberPermissions from "./update-repository-member-permis
  * routes through `requestJson` like `postJson` rather than `deleteJson`'s
  * raw-body handling.
  *
- * A known limitation rides with them and is stated in the edit/revoke tool
- * descriptions rather than papered over: PATCH and DELETE name a membership by
- * id, but no endpoint serves that id (the platform's `#serialize` deliberately
- * omits it), so the id comes from the platform's web members page today. That
- * is a platform-side follow-up, not a client-side workaround — there is no
- * name-based lookup.
+ * PATCH and DELETE name a membership by id, and the platform serves that id on
+ * every member response (SPGD-894): the list, the add 201 and the edit 200 all
+ * carry it, so an agent that listed or added a member already holds it — the
+ * edit/revoke tool descriptions say so rather than leaving it implicit. Lookup
+ * stays scoped to the repository (a foreign id is refused 404), and there is
+ * no name-based lookup.
  *
  * == The thirteenth: rename
  *

package/dist/src/tools/list-repository-members.d.ts

@@ -6,20 +6,23 @@ import type { ToolDefinition } from "./types.js";
  *
  * == Memberships only, never `keys_minted`
  *
- * The endpoint answers the same rows the web members page renders — `handle`,
- * `permissions`, `granted_by`, `created_at`, ordered by handle — and
- * deliberately NOTHING else. `keys_minted` is a `keys.manage` disclosure that
- * page gates separately; this read answers memberships to a `members.manage`
- * holder and no more. A tool that promised counts here would be promising
- * something the endpoint refuses to say.
+ * The endpoint answers five fields per row — `id`, `handle`, `permissions`,
+ * `granted_by`, `created_at`, ordered by handle — and deliberately NOTHING
+ * else. Four of the five are the rows the web members page renders
+ * (`handle`, `permissions`, `granted_by`, `created_at`, under the same
+ * names); `id` is served to the API caller alone — that page has no id
+ * column, the id appears there only inside edit and revoke links.
+ * `keys_minted` is a `keys.manage` disclosure
+ * that page gates separately; this read answers memberships to a
+ * `members.manage` holder and no more. A tool that promised counts here would
+ * be promising something the endpoint refuses to say.
  *
- * == No membership id, by design
+ * == The membership `id` is served
  *
- * The body carries no membership id: ids are not portable between
- * repositories, and serving one would invite treating it as portable. PATCH
- * and DELETE still name rows by that id — see
- * `update_repository_member_permissions` and `remove_repository_member` for
- * where the id comes from today.
+ * Each row's `id` is the MEMBERSHIP id — the very identifier
+ * `update_repository_member_permissions` and `remove_repository_member` name.
+ * The id is not portable: lookup is scoped through the repository, so a
+ * foreign id is refused 404 server-side, and there is no name-based lookup.
  *
  * == No client-side capability probing
  *

package/dist/src/tools/list-repository-members.js

@@ -7,20 +7,23 @@ import { requireString } from "./args.js";
  *
  * == Memberships only, never `keys_minted`
  *
- * The endpoint answers the same rows the web members page renders — `handle`,
- * `permissions`, `granted_by`, `created_at`, ordered by handle — and
- * deliberately NOTHING else. `keys_minted` is a `keys.manage` disclosure that
- * page gates separately; this read answers memberships to a `members.manage`
- * holder and no more. A tool that promised counts here would be promising
- * something the endpoint refuses to say.
+ * The endpoint answers five fields per row — `id`, `handle`, `permissions`,
+ * `granted_by`, `created_at`, ordered by handle — and deliberately NOTHING
+ * else. Four of the five are the rows the web members page renders
+ * (`handle`, `permissions`, `granted_by`, `created_at`, under the same
+ * names); `id` is served to the API caller alone — that page has no id
+ * column, the id appears there only inside edit and revoke links.
+ * `keys_minted` is a `keys.manage` disclosure
+ * that page gates separately; this read answers memberships to a
+ * `members.manage` holder and no more. A tool that promised counts here would
+ * be promising something the endpoint refuses to say.
  *
- * == No membership id, by design
+ * == The membership `id` is served
  *
- * The body carries no membership id: ids are not portable between
- * repositories, and serving one would invite treating it as portable. PATCH
- * and DELETE still name rows by that id — see
- * `update_repository_member_permissions` and `remove_repository_member` for
- * where the id comes from today.
+ * Each row's `id` is the MEMBERSHIP id — the very identifier
+ * `update_repository_member_permissions` and `remove_repository_member` name.
+ * The id is not portable: lookup is scoped through the repository, so a
+ * foreign id is refused 404 server-side, and there is no name-based lookup.
  *
  * == No client-side capability probing
  *
@@ -32,8 +35,9 @@ import { requireString } from "./args.js";
 const listRepositoryMembers = {
     name: "list_repository_members",
     title: "List repository members",
-    description: "Lists who has access to a SpecGuard repository: one row per member with their `handle`, " +
-        "`permissions`, `granted_by` (who last set them) and `created_at`, ordered by handle. " +
+    description: "Lists who has access to a SpecGuard repository: one row per member with their `id` (the " +
+        "MEMBERSHIP id `update_repository_member_permissions` and `remove_repository_member` name), " +
+        "`handle`, `permissions`, `granted_by` (who last set them) and `created_at`, ordered by handle. " +
         "The list answers MEMBERSHIPS only and never reports how many CI keys a member has minted " +
         "(`keys_minted`) — that is a separate `keys.manage` disclosure this endpoint deliberately " +
         "withholds, and the API-keys tools are the surface for it. " +
@@ -64,8 +68,9 @@ const listRepositoryMembers = {
         const api = requireUserApiConfig(context.config);
         const members = await getJsonObject(api, `/api/v1/repositories/${encodeURIComponent(repositoryId)}/members`, {}, context.fetch);
         // Passed through unreshaped, the standing rule (`types.ts`: "A thin client
-        // that reshapes its upstream is not thin") — the endpoint serves the same
-        // four fields the web members page renders, under the same names.
+        // that reshapes its upstream is not thin") — five fields per row, four of
+        // them the same columns the web members page renders; `id` is served to
+        // the API caller alone, that page has no id column.
         return {
             text: JSON.stringify(members, null, 2),
             structured: members,

package/dist/src/tools/list-repository-members.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-repository-members.js","sourceRoot":"","sources":["../../../src/tools/list-repository-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,qBAAqB,GAAmB;IAC5C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,0FAA0F;QAC1F,uFAAuF;QACvF,2FAA2F;QAC3F,2FAA2F;QAC3F,4DAA4D;QAC5D,wFAAwF;QACxF,4FAA4F;QAC5F,4DAA4D;QAC5D,yFAAyF;QACzF,UAAU;QACV,uFAAuF;QACvF,yFAAyF;IAC3F,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,6EAA6E;oBAC7E,qEAAqE;aACxE;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAClE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,0EAA0E;QAC1E,kEAAkE;QAClE,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"list-repository-members.js","sourceRoot":"","sources":["../../../src/tools/list-repository-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,qBAAqB,GAAmB;IAC5C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,0FAA0F;QAC1F,6FAA6F;QAC7F,iGAAiG;QACjG,2FAA2F;QAC3F,2FAA2F;QAC3F,4DAA4D;QAC5D,wFAAwF;QACxF,4FAA4F;QAC5F,4DAA4D;QAC5D,yFAAyF;QACzF,UAAU;QACV,uFAAuF;QACvF,yFAAyF;IAC3F,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,6EAA6E;oBAC7E,qEAAqE;aACxE;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAClE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,oDAAoD;QACpD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/src/tools/remove-repository-member.js

@@ -41,9 +41,13 @@ const removeRepositoryMember = {
         "request to the member routes answers 404 — a former member is a non-member, so this tool " +
         "cannot read the repository's members afterwards. The repository owner's membership cannot " +
         "be removed at all (an owner holds everything by construction). " +
-        "KNOWN LIMITATION: no API endpoint serves the membership id — the member list and the " +
-        "add-member response both omit it by design — so the id must be obtained from the " +
-        "platform (today via the repository's web members page); there is no name-based lookup. " +
+        "The membership id comes straight off the API: every member response carries it as `id` — " +
+        "the rows `list_repository_members` serves, the `add_repository_member` 201 body, and " +
+        "`update_repository_member_permissions`'s response — so a member you listed or added has " +
+        "already handed you the id. The server serves that `id` as a JSON number (a bigint column) " +
+        "while `member_id` is a string argument refused by name (\"`member_id` must be a string.\") " +
+        "before any request is made — so pass a numeric-looking id such as `7` as a string, not as " +
+        "a number. " +
         "Authorization is the `members.manage` capability — a member without it is refused 403 in " +
         "SpecGuard's own words. A 204 means the membership is revoked. " +
         "Takes `repository_id` — the numeric id `list_repositories` reports, not the `org/repo` " +
@@ -61,8 +65,11 @@ const removeRepositoryMember = {
             member_id: {
                 type: "string",
                 description: "The id of the MEMBERSHIP row to revoke — not a user id, and not the handle. " +
-                    "Scoped to `repository_id`: a foreign membership id is refused 404. No API endpoint " +
-                    "serves this id today; obtain it from the platform's web members page.",
+                    "Scoped to `repository_id`: a foreign membership id is refused 404. Take it from " +
+                    "the `id` field of a member row served by `list_repository_members`, " +
+                    "`add_repository_member` or `update_repository_member_permissions` — the server " +
+                    "serves that id as a JSON number, so pass it on as a string, not as a number " +
+                    "(\"7\", not 7).",
             },
         },
         required: ["repository_id", "member_id"],

package/dist/src/tools/remove-repository-member.js.map

@@ -1 +1 @@
-{"version":3,"file":"remove-repository-member.js","sourceRoot":"","sources":["../../../src/tools/remove-repository-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,sBAAsB,GAAmB;IAC7C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,sFAAsF;QACtF,kFAAkF;QAClF,uFAAuF;QACvF,mCAAmC;QACnC,yFAAyF;QACzF,uFAAuF;QACvF,uDAAuD;QACvD,yFAAyF;QACzF,2FAA2F;QAC3F,4FAA4F;QAC5F,iEAAiE;QACjE,uFAAuF;QACvF,mFAAmF;QACnF,yFAAyF;QACzF,2FAA2F;QAC3F,gEAAgE;QAChE,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qEAAqE;aACxE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,8EAA8E;oBAC9E,qFAAqF;oBACrF,uEAAuE;aAC1E;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;QACxC,4EAA4E;QAC5E,uEAAuE;QACvE,gEAAgE;QAChE,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAClG,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO;YACL,IAAI,EACF,IAAI,KAAK,EAAE;gBACT,CAAC,CAAC,cAAc,QAAQ,uDAAuD;oBAC7E,gEAAgE;oBAChE,kDAAkD;gBACpD,CAAC,CAAC,IAAI;YACV,UAAU,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;SAChF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"remove-repository-member.js","sourceRoot":"","sources":["../../../src/tools/remove-repository-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,sBAAsB,GAAmB;IAC7C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,sFAAsF;QACtF,kFAAkF;QAClF,uFAAuF;QACvF,mCAAmC;QACnC,yFAAyF;QACzF,uFAAuF;QACvF,uDAAuD;QACvD,yFAAyF;QACzF,2FAA2F;QAC3F,4FAA4F;QAC5F,iEAAiE;QACjE,2FAA2F;QAC3F,uFAAuF;QACvF,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,4FAA4F;QAC5F,YAAY;QACZ,2FAA2F;QAC3F,gEAAgE;QAChE,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qEAAqE;aACxE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,8EAA8E;oBAC9E,kFAAkF;oBAClF,sEAAsE;oBACtE,iFAAiF;oBACjF,8EAA8E;oBAC9E,iBAAiB;aACpB;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;QACxC,4EAA4E;QAC5E,uEAAuE;QACvE,gEAAgE;QAChE,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAClG,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO;YACL,IAAI,EACF,IAAI,KAAK,EAAE;gBACT,CAAC,CAAC,cAAc,QAAQ,uDAAuD;oBAC7E,gEAAgE;oBAChE,kDAAkD;gBACpD,CAAC,CAAC,IAAI;YACV,UAAU,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;SAChF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/src/tools/update-repository-member-permissions.d.ts

@@ -18,13 +18,14 @@ import type { ToolDefinition } from "./types.js";
  * write. The bridge adds no client-side check of that scoping: the server is
  * the gate.
  *
- * == Known limitation: no endpoint serves the id
+ * == Where the id comes from
  *
- * `#serialize` deliberately omits the membership id from both the list and the
- * 201 body, so an agent that adds a member has no machine-readable way to
- * learn the id for this call. Today the id is obtained from the platform's web
- * members page. That gap is a platform-side follow-up, not something this
- * bridge can work around — there is no name-based lookup.
+ * `#serialize` serves the membership id on every member response — the list
+ * (`list_repository_members`), the 201 body (`add_repository_member`) and
+ * this tool's own 200 body — so an agent that listed or added a member
+ * already holds the id this call names. There is no name-based lookup: the
+ * id comes off those responses, and lookup is scoped through the repository
+ * (a foreign id is refused 404).
  */
 declare const updateRepositoryMemberPermissions: ToolDefinition;
 export default updateRepositoryMemberPermissions;

package/dist/src/tools/update-repository-member-permissions.js

@@ -19,13 +19,14 @@ import { requireString, requireStringArray } from "./args.js";
  * write. The bridge adds no client-side check of that scoping: the server is
  * the gate.
  *
- * == Known limitation: no endpoint serves the id
+ * == Where the id comes from
  *
- * `#serialize` deliberately omits the membership id from both the list and the
- * 201 body, so an agent that adds a member has no machine-readable way to
- * learn the id for this call. Today the id is obtained from the platform's web
- * members page. That gap is a platform-side follow-up, not something this
- * bridge can work around — there is no name-based lookup.
+ * `#serialize` serves the membership id on every member response — the list
+ * (`list_repository_members`), the 201 body (`add_repository_member`) and
+ * this tool's own 200 body — so an agent that listed or added a member
+ * already holds the id this call names. There is no name-based lookup: the
+ * id comes off those responses, and lookup is scoped through the repository
+ * (a foreign id is refused 404).
  */
 const updateRepositoryMemberPermissions = {
     name: "update_repository_member_permissions",
@@ -38,9 +39,12 @@ const updateRepositoryMemberPermissions = {
         "today, so name every permission the member should end with. Values are strings from " +
         "SpecGuard's own set (`view`, `keys.manage`, `members.manage`, `repo.delete`); an unknown " +
         "value is refused in SpecGuard's own words. " +
-        "KNOWN LIMITATION: no API endpoint serves the membership id — the member list and the " +
-        "add-member response both omit it by design — so the id must be obtained from the " +
-        "platform (today via the repository's web members page); there is no name-based lookup. " +
+        "The membership id comes straight off the API: every member response carries it as `id` — " +
+        "the rows `list_repository_members` serves, the `add_repository_member` 201 body, and this " +
+        "tool's own response — so a member you listed or added has already handed you the id. The " +
+        "server serves that `id` as a JSON number (a bigint column) while `member_id` is a string " +
+        "argument refused by name (\"`member_id` must be a string.\") before any request is made — " +
+        "so pass a numeric-looking id such as `7` as a string, not as a number. " +
         "Authorization is the `members.manage` capability — a member without it is refused 403 in " +
         "SpecGuard's own words. " +
         "Takes `repository_id` — the numeric id `list_repositories` reports, not the `org/repo` " +
@@ -58,8 +62,10 @@ const updateRepositoryMemberPermissions = {
             member_id: {
                 type: "string",
                 description: "The id of the MEMBERSHIP row to edit — not a user id, and not the handle. Scoped " +
-                    "to `repository_id`: a foreign membership id is refused 404. No API endpoint serves " +
-                    "this id today; obtain it from the platform's web members page.",
+                    "to `repository_id`: a foreign membership id is refused 404. Take it from the `id` " +
+                    "field of a member row served by `list_repository_members`, `add_repository_member` " +
+                    "or this tool's own response — the server serves that id as a JSON number, so pass " +
+                    "it on as a string, not as a number (\"7\", not 7).",
             },
             permissions: {
                 type: "array",

package/dist/src/tools/update-repository-member-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-repository-member-permissions.js","sourceRoot":"","sources":["../../../src/tools/update-repository-member-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG9D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,iCAAiC,GAAmB;IACxD,IAAI,EAAE,sCAAsC;IAC5C,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EACT,yFAAyF;QACzF,0FAA0F;QAC1F,8EAA8E;QAC9E,0BAA0B;QAC1B,wFAAwF;QACxF,sFAAsF;QACtF,2FAA2F;QAC3F,6CAA6C;QAC7C,uFAAuF;QACvF,mFAAmF;QACnF,yFAAyF;QACzF,2FAA2F;QAC3F,yBAAyB;QACzB,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qEAAqE;aACxE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,mFAAmF;oBACnF,qFAAqF;oBACrF,gEAAgE;aACnE;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,kFAAkF;oBAClF,mFAAmF;oBACnF,0CAA0C;aAC7C;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,aAAa,CAAC;QACvD,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,sBAAsB;QACtB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,WAAW;QACX,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAClG,EAAE,WAAW,EAAE,EACf,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,4EAA4E;QAC5E,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,iCAAiC,CAAC"}
+{"version":3,"file":"update-repository-member-permissions.js","sourceRoot":"","sources":["../../../src/tools/update-repository-member-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG9D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,iCAAiC,GAAmB;IACxD,IAAI,EAAE,sCAAsC;IAC5C,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EACT,yFAAyF;QACzF,0FAA0F;QAC1F,8EAA8E;QAC9E,0BAA0B;QAC1B,wFAAwF;QACxF,sFAAsF;QACtF,2FAA2F;QAC3F,6CAA6C;QAC7C,2FAA2F;QAC3F,4FAA4F;QAC5F,2FAA2F;QAC3F,2FAA2F;QAC3F,4FAA4F;QAC5F,yEAAyE;QACzE,2FAA2F;QAC3F,yBAAyB;QACzB,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qEAAqE;aACxE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,mFAAmF;oBACnF,oFAAoF;oBACpF,qFAAqF;oBACrF,oFAAoF;oBACpF,oDAAoD;aACvD;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,kFAAkF;oBAClF,mFAAmF;oBACnF,0CAA0C;aAC7C;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,aAAa,CAAC;QACvD,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,sBAAsB;QACtB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,WAAW;QACX,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAClG,EAAE,WAAW,EAAE,EACf,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,4EAA4E;QAC5E,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,iCAAiC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specguard-mcp",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "MCP server exposing SpecGuard suite intelligence to AI coding agents",
   "license": "ISC",
   "type": "module",
@@ -28,7 +28,7 @@
   },
   "devDependencies": {
     "@types/node": "^20.19.0",
-    "specguard-ts": "github:yatfa-ai/specguard-ts",
+    "@yatfa/specguard": "^0.1.1",
     "typescript": "^5.6.0"
   },
   "repository": {