@critical-path/core 0.36.0 → 0.36.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@critical-path/core",
-  "version": "0.36.0",
+  "version": "0.36.1",
   "description": "Core headless domain engine, plugin architecture, and data stores for Critical Path",
   "author": "Jack James",
   "license": "MIT",
@@ -36,6 +36,10 @@
   "dependencies": {
     "zod": "^3.25.76"
   },
+  "files": [
+    "dist",
+    "!dist/**/*.test.*"
+  ],
   "scripts": {
     "build": "tsc --build",
     "test": "vitest run",

package/CHANGELOG.md

@@ -1,593 +0,0 @@
-# @critical-path/core
-
-## 0.36.0
-
-### Minor Changes
-
-- 810d8d1: Upload and request body limits.
-  
-  - **@critical-path/core:** new `uploads: { maxBytes, allowedMimeTypes }` engine option, with `type/*` wildcards. It applies to direct uploads (decoded size), presigned uploads (content type) and registered attachments (declared size and type). Violations throw `ValidationError` (400).
-  - **@critical-path/server:** new `maxBodyBytes` router option (default 10 MiB). Larger bodies get `413`, checked while streaming rather than only through `Content-Length`. Previously bodies were read without any limit.
-
-## 0.35.0
-
-### Minor Changes
-
-- b13f7c4: `InMemoryStore` returns copies.
-  
-  - **BREAKING:** `InMemoryStore` deep-copies (`structuredClone`) every argument and result, so mutating a returned record, or an input object you keep using, no longer changes stored state. This matches SQLite and Firestore. Call `update*` to change records.
-  - The conformance suite checks that adapters return copies. `InMemoryFirestoreMock` now copies too, like real Firestore.
-
-## 0.34.0
-
-### Minor Changes
-
-- 1cc0d4c: Domain events for every team, container and iteration change, and collision-safe ids.
-  
-  - New events: `team.updated`, `team.deleted`, `container.updated`, `container.deleted`, `iteration.created`, `iteration.updated` and `iteration.deleted`. They are delivered to webhooks like other events; deleted events carry the ids needed to route them to the right tenant. Previously these changes published nothing.
-  - Event ids and the ids generated by `InMemoryStore`, `SQLiteStore` and domain entities now use `crypto.randomUUID()` (e.g. `task_<uuid>`) instead of 7 random characters, which were likely to collide at around a million records.
-
-## 0.33.0
-
-### Minor Changes
-
-- aa94129: Storage adapter conformance suite and parity fixes.
-  
-  - New `@critical-path/core/testing` entry with `runStorageAdapterConformance({ name, createStore, describe, it, expect })`, the suite the built-in adapters run, for verifying custom adapters.
-  - `SQLiteStore` no longer drops fields. Tasks keep `key`, `semanticStatus` and `todos`; projects keep `schedule`, `startDate` and `targetEndDate`; teams keep `weeklyCapacityHours` and `schedule`; attachments keep `artifactType`. Fields without a dedicated column are stored in a JSON `extra` column, which is added to existing databases automatically.
-  - `FirebaseStore` applies every filter passed to `getAttachments` and `getActivities` (previously only the first), returns activities newest first and comments oldest first.
-
-## 0.32.0
-
-### Minor Changes
-
-- a3fe03d: Honour engine configuration options.
-  
-  - **BREAKING:** `store` must be a storage adapter instance (e.g. `new SQLiteStore({ filename })`). Strings such as `'sqlite'` used to fall back to an in-memory store silently; they now throw.
-  - New `users` option: your app's user directory (an array, or a function called with the acting user), merged with `initialData.users`, which was previously ignored. New `engine.getUsers()`. Workload distribution now uses user names, weekly capacity and schedules.
-
-## 0.31.0
-
-### Minor Changes
-
-- 40e5958: Real S3 uploads and signed URLs, and server-chosen storage keys.
-  
-  **@critical-path/core**
-  - **BREAKING:** `S3StorageAdapter` now takes your AWS SDK v3 `client`, `commands` (`PutObjectCommand`, `DeleteObjectCommand`, optional `GetObjectCommand`) and a `presign` function (`getSignedUrl` from `@aws-sdk/s3-request-presigner`). Uploads send real commands and propagate S3 errors; previously failures were swallowed and reported as success. Presigned uploads are actually signed and cover `Content-Type`. New `signedDownloads` for private buckets. The unused `accessKeyId`/`secretAccessKey`/`sessionToken`/`s3Client` options are removed.
-  - **BREAKING:** `FirebaseStorageAdapter` requires a `bucket`; it no longer silently uses an in-memory mock. It throws instead of returning a public URL when the bucket cannot sign uploads.
-  - **BREAKING:** `engine.getPresignedAttachmentUploadUrl({ projectId, filename, contentType?, expiresInSeconds? })` generates the storage key under `projects/<projectId>/`, instead of accepting a caller-chosen `storageKey`.
-  - Attachments created through an actor view must use a `storageKey` under their project's prefix, so callers cannot register (and then delete) other projects' files. Uploads through views are always stored under the project prefix.
-  - New `buildStorageKey` (validates path prefixes, crypto-random component) and `contentDispositionFor`. HTML, SVG and script uploads are stored as downloads.
-  
-  **@critical-path/server**
-  - **BREAKING:** `POST /attachments/presign` takes `{ projectId, filename, contentType?, expiresInSeconds? }`. `POST /attachments/upload` no longer accepts `pathPrefix`.
-  
-  **@critical-path/client**
-  - `getPresignedAttachmentUploadUrl` and `uploadAttachmentFile` use the updated request bodies.
-
-## 0.30.0
-
-### Minor Changes
-
-- cdb300a: Task filtering and pagination.
-  
-  **@critical-path/core**
-  - New `engine.queryTasks(query)` and `engine.queryActivities(query)` return `Page<T>` (`{ items, nextCursor }`).
-    - Tasks are ordered oldest first, activities newest first, using keyset cursors on `createdAt` then `id`.
-    - Task filters: `status[]`, `priority[]`, `assigneeId` (also matches `assignees`), `iterationId`, `deliverableId`, `containerId`, `parentId` (`null` means top-level), `projectIds`.
-    - Results are limited to projects the actor can read.
-  - **BREAKING (storage adapters):** `queryTasks` and `queryActivities` are required. `SQLiteStore` filters and pages in SQL and adds indexes for tasks, activities, comments and dependencies. Helpers (`paginate`, `matchesTaskQuery`, cursors, `DEFAULT_PAGE_SIZE` / `MAX_PAGE_SIZE`) are exported for custom adapters.
-  
-  **@critical-path/server**
-  - **BREAKING:** `GET /tasks` and `GET /activities` are paginated (default 100, max 500) and return `nextCursor`. `GET /tasks` accepts the filters above as query parameters. Unknown parameters return `400`.
-  
-  **@critical-path/client**
-  - `getTasks` and `getActivities` follow pagination and still return everything. New `queryTasks` and `queryActivities` return single pages.
-  
-  **@critical-path/mcp**
-  - **BREAKING:** `list_tasks` returns `{ tasks, nextCursor }` and accepts `iterationId`, `limit` and `cursor`. It now filters in the store instead of loading every task.
-
-## 0.29.0
-
-### Minor Changes
-
-- a019d37: Cascading deletes and dependency removal.
-  
-  **@critical-path/core**
-  - **BREAKING:** `deleteTask` now also deletes subtasks (recursively), dependencies, comments, attachments (including stored files and comment attachments) and time entries. Pass `{ subtasks: 'detach' }` to keep subtasks.
-  - **BREAKING:** `deleteProject` also deletes containers, iterations, deliverables and project attachments. `project.deleted`'s `deletedTaskIds` includes subtasks.
-  - Deleting a container, iteration or deliverable clears the reference on its tasks; nested containers are detached.
-  - New `engine.removeDependency(id)` and `dependency.removed` event.
-  - **BREAKING (storage adapters):** `DependencyRepository` gains `getDependency` and `removeDependency`, and `TimeEntryRepository` gains `deleteTimeEntry`.
-  - `SQLiteStore` no longer returns `null` for unset optional fields.
-  - `FirebaseStore` updates now remove fields cleared with `undefined` (for example, reopening a completed task now clears `completedAt`).
-  
-  **@critical-path/server**
-  - New `DELETE /tasks/:id/dependencies/:dependencyId`. `DELETE /tasks/:id` accepts `?subtasks=detach`.
-  
-  **@critical-path/client**
-  - New `removeDependency(taskId, dependencyId)`. `deleteTask(id, { subtasks })`.
-
-## 0.28.0
-
-### Minor Changes
-
-- 4fbbc40: Complete the plugin system.
-  
-  **@critical-path/core**
-  - `plugin.init(engine)` now runs at startup. `engine.ready` resolves after seeding and every plugin's `init`; init failures reject `ready`.
-  - **BREAKING:** `customFieldTypes` is now `CustomFieldType[]` (`{ type, label?, validate(value, definition) }`), not unused definitions. Projects may use registered types in `customFieldDefinitions`; unknown types are rejected on project create and update. New `validateCustomFieldDefinitions`, and `validateCustomFieldValues` accepts the registered types.
-  - **BREAKING:** before-hook output is now validated (workflow transitions, custom fields) like caller input. Hooks cannot change a task's `projectId` (rejected on create, ignored on update), `id` or `createdAt`.
-  - After-hook errors are logged with the plugin id instead of failing an already-stored write.
-  - **BREAKING:** `beforeTaskDelete` and `afterTaskDelete` receive the task as a second argument.
-  - **BREAKING:** required custom fields are enforced even when `customFields` is omitted.
-  - New plugin `routes` and `middleware` types (`PluginRoute`, `PluginMiddleware`, `PluginRequestContext`).
-  
-  **@critical-path/server**
-  - Serves plugin `routes` (with `:param` patterns) before built-in routes, and runs plugin `middleware` around every routed request after authentication. Handlers receive the caller's `withActor` engine.
-  - Awaits `engine.ready` before handling requests.
-  
-  **@critical-path/mcp**
-  - Awaits `engine.ready` before running tools.
-
-## 0.27.0
-
-### Minor Changes
-
-- 1a516bd: Signed, retried webhooks driven by domain events.
-  
-  **@critical-path/core**
-  - **BREAKING:** webhooks are delivered from the domain event bus instead of ad-hoc calls, so every published event is deliverable, including `task.updated`, `time.logged` and `dependency.added`.
-    - The payload is now `{ id, event, occurredAt, tenantId?, data }`, where `data` is the domain event payload.
-    - A status change delivers both `task.status_changed` and `task.updated` to webhooks subscribed to both.
-  - Deliveries carry `X-CriticalPath-Event`, `X-CriticalPath-Delivery` (stable across retries), `X-CriticalPath-Timestamp` and `X-CriticalPath-Signature` (HMAC-SHA256). New exports: `verifyWebhookSignature`, `signWebhookPayload`, `generateWebhookSecret`.
-  - New `webhookDelivery` engine option:
-    - `timeoutMs` (default 10s), `maxAttempts` (default 5) and exponential `retryBaseDelayMs`.
-    - A pluggable `queue`; the default is in-process.
-    - `allowPrivateUrls` (default `false`).
-    - `onDelivered` and `onDeliveryFailed` callbacks.
-  - `engine.webhooks` exposes `deliver(job)` for custom queues and `idle()` for tests.
-  - `config.webhooks` are now honoured as static webhooks.
-  - New engine methods `getWebhooks`, `getWebhook`, `createWebhook` and `updateWebhook`/`deleteWebhook`. They require `workspace.manage` and are tenant-scoped. Secrets are generated when omitted, returned only on creation, and redacted afterwards (`PublicWebhook.hasSecret`).
-  - **BREAKING:** `WebhookRepository` gains `getWebhook`, `updateWebhook` and `deleteWebhook`; custom storage adapters must implement them. `Webhook` gains `tenantId`, and `WebhookEvent` is now any domain event name or `'*'`. SQLite now persists the webhook `name` and `tenantId`.
-  - New `DOMAIN_EVENT_NAMES`. The `project.deleted` and `workflow.deleted` payloads include `tenantId`; `attachment.deleted` includes `projectId`.
-  
-  **@critical-path/server**
-  - New `GET/POST /webhooks` and `GET/PATCH/DELETE /webhooks/:id` routes. Event names are validated.
-  
-  **@critical-path/client**
-  - New `getWebhooks`, `createWebhook`, `updateWebhook` and `deleteWebhook`.
-
-## 0.26.0
-
-### Minor Changes
-
-- 719e844: Role-based authorization and multi-tenancy.
-  
-  **@critical-path/core**
-  - New `authorize` engine option and `createRolePolicy()`:
-    - Project roles (`viewer`, `contributor`, `project_manager`, `admin`) come from `project.members`.
-    - Workspace superusers come from `actor.roles`.
-    - Authors manage their own comments and attachments.
-    - Checks run on `withActor` views. Unreadable or cross-tenant projects behave as not found, denied actions throw the new `ForbiddenError`, and lists are filtered.
-  - `Actor` gains `tenantId` and `roles`. Projects, workflows and teams gain `tenantId`, stamped from the actor and never accepted from payloads. Reads are scoped to the actor's tenant, including the default-workflow fallback.
-  - **BREAKING:** `Project.members` is now `{ userId, role }[]` (was `string[]`). Project creators become `admin` members.
-  - New `engine.getActivities()` and `engine.getTimeEntries()`, which respect authorization.
-  - **BREAKING:** on views, presigned uploads require `projectId` and are confined to `projects/<projectId>/`. The presign request schema now requires `projectId`.
-  - `SQLiteStore` persists `tenantId` (migrated automatically).
-  
-  **@critical-path/server**
-  - `RequestContext` gains `tenantId` and `roles`, which are passed to the actor. `ForbiddenError` maps to `403`. Activities and time entries are read through the engine.
-  
-  **@critical-path/client / @critical-path/mcp**
-  - Rebuilt for the new presign `projectId` requirement and project member shape.
-
-## 0.25.0
-
-### Minor Changes
-
-- fd79762: **BREAKING:** strict request bodies, no identity in payloads, and CORS off by default.
-  
-  **@critical-path/core**
-  - Request schemas are strict: unknown keys, server-assigned fields and identity fields are rejected instead of stripped.
-  - Identity is never read from payloads. `updateTask` no longer reads `actorId`/`actorName`/`actorType`/`actor` from the update object; pass them as the third `options` argument or use `withActor`. `addComment`, `addCommentReaction`, `removeCommentReaction` and `createAttachment` take the actor from `withActor`, falling back to an optional `authorId`/`userId`/`uploaderId`, then `'system'`.
-  - Schemas export request body types (`CreateTaskBody`, `UpdateTaskBody`, ...).
-  
-  **@critical-path/server**
-  - Bodies containing unknown, server-assigned or identity fields return `400`.
-  - Every request runs as the `getContext` user, or `ANONYMOUS_ACTOR` (`anonymous`). Authors of comments, reactions, attachments and time entries are no longer accepted from bodies.
-  - `DELETE /comments/:id/reactions` takes `?emoji=` only.
-  - CORS is off by default (`cors: false`). Pass `cors: { origins: [...] }` to allow cross-origin browsers.
-  
-  **@critical-path/client**
-  - Method parameters use the server's body types, so identity fields no longer type-check. `addCommentReaction`/`removeCommentReaction` take `{ emoji }`; `addTodo`/`toggleTodo` drop the actor options argument.
-  - New `updateProject`, `deleteProject` and `addDependency`. `uploadAttachmentFile` base64-encodes binary data (previously it sent unusable JSON for `Uint8Array`/`ArrayBuffer`).
-  - CLI: `--author`, `--actor-id`, `--actor-name`, `--agent-name` and `CRITICAL_PATH_AUTHOR_ID`/`ACTOR_ID`/`AGENT_NAME` are removed; identity comes from the `--key` token via the server's `getContext`.
-  
-  **@critical-path/mcp**
-  - Tool arguments are strict: undeclared arguments return an `isError` result.
-  - `add_comment` no longer takes `authorId`. With an `engine`, writes are attributed to the new `actor` server option (default `DEFAULT_MCP_ACTOR`).
-  
-  **@critical-path/react / @critical-path/svelte**
-  - `addReaction`/`removeReaction` take `(commentId, emoji)`; comment and attachment inputs no longer accept `authorId`/`uploaderId`. Task, comment and deliverable update parameters use the schema body types.
-
-## 0.24.0
-
-### Minor Changes
-
-- b54e22c: Validate request bodies with shared zod schemas and publish an OpenAPI document.
-  
-  **@critical-path/core**
-  - New `@critical-path/core/schemas` subpath with create/update schemas for every resource and `parsePayload(schema, data)`. Kept off the package root so browser bundles do not include zod. `zod` is now a dependency of core.
-  - `ValidationError` carries an optional `issues: { path, message }[]`.
-  
-  **@critical-path/server**
-  - All request bodies are validated. Invalid bodies return `400` with `issues`. Server-assigned fields (`id`, `createdAt`, `updatedAt`, task `key`, owning `projectId` on updates) and unknown keys are stripped, so a `PATCH` can no longer move a task to another project.
-  - Comments, reactions and attachments require an author unless `getContext` resolves the caller. Attachment `mimeType` and `sizeBytes` default to `application/octet-stream` and `0` for linked files.
-  - New `GET /openapi.json` and `buildOpenApiDocument()` (OpenAPI 3.1, request bodies generated from the validation schemas).
-  
-  **@critical-path/mcp**
-  - Tool `inputSchema`s are generated from their zod schemas via the new `defineTool`, removing the hand-written JSON copies.
-  
-  **@critical-path/svelte**
-  - Rebuilt with the bundled `@critical-path/mcp` changes.
-
-## 0.23.0
-
-### Minor Changes
-
-- 6dd5529: Add request context, authentication hooks and actor attribution.
-  
-  **@critical-path/core**
-  - New `engine.withActor(actor)` returns a per-request view that attributes every mutation (activity log, comment authors, reactions, time entries, attachment uploaders, task reporters) to the actor and ignores identity fields supplied in payloads. New exported `Actor` type.
-  
-  **@critical-path/server**
-  - New router options, accepted by all adapters as a second argument: `getContext` (resolve the caller per request), `requireAuth` (401 without a user), `basePath` (exact mount path), and `cors` (origin allow-list, credentials, or `false`).
-  - With a resolved user, identity fields in request bodies (`actorId`, `authorId`, `userId`, `uploaderId`) are ignored. Reaction routes no longer require `userId` in the body when a user is resolved.
-  - `createSvelteKitHandler` options take `getContext(event)` so `event.locals` is available; `configOrRouter` is now optional.
-  - New `createUniversalHandler(config, options)` for Workers, Deno, Bun and Hono.
-  - `handleRequest(request, { getContext })` lets custom adapters supply a per-request resolver.
-  
-  **@critical-path/mcp**
-  - CLI `--api` mode reads `CRITICAL_PATH_API_TOKEN` (sent as a Bearer token) and accepts repeatable `--header "Name: value"`, warning when credentials would go over plain http to a remote host.
-
-## 0.22.0
-
-### Minor Changes
-
-- b243a37: Fix correctness and safety issues found in a code audit.
-  
-  **@critical-path/core**
-  - `SQLiteStore` now loads `node:sqlite` via `process.getBuiltinModule`, fixing `require is not defined` when constructed from a filename in plain Node ESM.
-  - Removed the unused `better-sqlite3` runtime dependency.
-  - `engine.addDependency` now detects indirect cycles (e.g. A → B → C → D → A), not just cycles between direct neighbours.
-  - Fixed `generateKeyBetween` returning out-of-range, duplicate keys after repeated inserts after the same item. It now throws a `RangeError` when `a >= b`.
-  - Added `engine.deleteProject(id)`, which deletes a project's tasks through `deleteTask` and publishes a new `project.deleted` event and webhook.
-  - Added exported `ValidationError` and `NotFoundError` classes. `logTime` now rejects non-numeric hours.
-  
-  **@critical-path/server**
-  - `DELETE /projects/:id`, `POST /tasks/:id/dependencies` and `POST /time-entries` now go through the engine, so cycle checks, hour validation, roll-ups, events and webhooks apply.
-  - Added `PATCH /projects/:id`.
-  - `DELETE` on a resource that does not exist now returns `404` instead of `200 { success: false }`.
-  - Malformed JSON returns `400`, validation errors `400`, `NotFoundError` `404`, and dependency cycles `409`. Unexpected errors return a generic `500` message outside development.
-  - `OPTIONS` preflight requests return `204` with CORS headers.
-  - New router/adapter options: `onError(error, request)` to report unexpected errors or return a custom response, and `exposeErrors` to include real messages in 500 responses (defaults to on only when `NODE_ENV === 'development'`).
-  - `createNextHandler` returns a callable handler that also exposes per-method properties, so `export { handler as GET }` works as documented.
-  
-  **@critical-path/mcp**
-  - Tools excluded via the `tools` option can no longer be called by name.
-  - Tool arguments are validated with each tool's zod schema; undeclared fields are stripped.
-  - Tool listings include `title` and MCP `readOnlyHint` / `destructiveHint` annotations.
-  
-  **@critical-path/svelte**
-  - Rebuilt with the bundled `@critical-path/mcp` WebMCP argument validation.
-  
-  **@critical-path/client**
-  - Delete methods resolve to `false` when the server returns `404`, keeping their boolean contract with the new server behaviour.
-
-## 0.21.0
-
-### Minor Changes
-
-- f3301bf: - Added comprehensive task lifecycle and semantic status predicates (`isDraftTask`, `isArchivedTask`, `isTrashedTask`, `isTrashedOrArchivedTask`, `isWorkflowTask`, `getTaskSemanticStatus`, `isTaskCompleted`, `isTaskInProgress`, `isTaskNotStarted`, `isTaskCanceled`, `isTaskActive`, `isTaskUnassigned`).
-  - Hardened mention extraction with markdown code suppression (`stripMarkdownCode`) to prevent code blocks, inline code, HTML elements, and URLs from triggering false positive mentions while preserving rich-text mention nodes.
-  - Added Base-62 fractional indexing utilities (`generateKeyBetween`, `generateNKeysBetween`) for zero-cost lexical task/item reordering without array shifting or bulk database rewrites.
-  - Added `completedAt` lifecycle timestamp tracking alongside `actualEndDate`, automatic timestamp assignment upon entering `completed` or `canceled`, and timestamp + progress reset upon reopening to `not_started` or `in_progress`.
-  - Added `isTempTaskId` utility and hardened optimistic temporary task handling in `@critical-path/svelte` (`TaskState`) and `@critical-path/react` (`useTasks`) with in-flight creation resolution and ID mapping to prevent 404 errors during rapid optimistic updates and deletions.
-
-## 0.20.2
-
-### Patch Changes
-
-- b8a68dd: Track task blocked duration while active in progress:
-  - Add `blockedDurationSeconds` and `blockedSince` to `Task` and `TaskInferredActuals`
-  - Update `TaskEntity` to stamp `blockedSince` when blocked while `in_progress` and accumulate elapsed blocked time into `blockedDurationSeconds` upon unblocking or exiting `in_progress`
-  - Update `CriticalPathEngine.updateTask` and `checkAndUnblockDownstreamTasks` to manage `blockedSince` and `blockedDurationSeconds` lifecycle transitions
-  - Update SQLite storage schema and statements to persist `blockedDurationSeconds` and `blockedSince`
-
-## 0.20.1
-
-### Patch Changes
-
-- 500b353: Standardize task blocker state on `isBlocked` as the single source of truth:
-  - Persist `isBlocked` and `blockedReason` on task creation in `engine.createTask`
-  - Rely strictly on `task.isBlocked` in `engine.updateTask` when detecting blocked transitions
-  - Remove redundant checks and mutations of `customFields.isBlocked` and `status === 'blocked'` during downstream dependency auto-unblocking
-  - Update `deriveTaskLifecycleState` to evaluate `task.isBlocked === true`
-
-## 0.20.0
-
-### Minor Changes
-
-- c83235b: Add task execution timestamps and cumulative in-progress duration tracking:
-  - Introduce `actualDurationSeconds` and `inProgressSince` to `Task` and `TaskEntity`
-  - Automatically timestamp `actualStartDate` (retaining earliest) and begin session timer when transitioning to `in_progress`
-  - Automatically accumulate duration delta into `actualDurationSeconds` when leaving `in_progress` (pausing/completing)
-  - Automatically timestamp `actualEndDate` when entering `completed` or `canceled`, and reset `actualEndDate` to `undefined` upon reopening
-  - Mutually synchronize manual edits between `actualDurationSeconds` and `actualHours`
-  - Export `formatTaskDuration(seconds, options)` with dynamic scoping (`< 120s`, `< 1 day`, `>= 1 day`)
-  - Add `calendarDurationHours` and `actualDurationSeconds` to `TaskInferredActuals`
-
-## 0.19.1
-
-### Patch Changes
-
-- f816145: Preserve real actor identity and metadata in `updateTask`, activity logs, and domain events, preventing status changes and updates from erroneously attributing the task's assignee as the initiating actor.
-
-## 0.19.0
-
-### Minor Changes
-
-- 31a6dde: Promote task blocking state (`isBlocked: boolean` and `blockedReason: string | null`) to first-class fields on `Task`, `CreateTaskInput`, and `UpdateTaskInput`.
-  
-  - **Domain Events**: Introduced `TaskBlockedEvent` (`task.blocked`) and updated `TaskUnblockedEvent` (`task.unblocked`) to support explicit unblocking.
-  - **Lifecycle Derivation**: Updated `deriveTaskStatus` and `deriveTaskLifecycleState` to reflect `task.isBlocked` directly alongside upstream dependency checks.
-  - **Engines & Storage**: Added `isBlocked` and `blockedReason` persistence to `SQLiteStore`, `FirebaseStore`, and `InMemoryStore`.
-  - **MCP Server**: Added `isBlocked` and `blockedReason` parameter options to `create_task` and `update_task` tool schemas.
-- 31a6dde: Add comprehensive Work Schedule, Working Hours, Working Days & Holidays subsystem:
-  - Added `WorkSchedule`, `DaySchedule`, `WorkingHoursRange`, and `Holiday` types supporting custom shifts, weekend configurations, and organization/regional holidays.
-  - Integrated hierarchical calendar resolution: Task Assignee/Team -> Project -> Engine/Default (`DEFAULT_WORK_SCHEDULE`).
-  - Enhanced Critical Path Method (CPM) with calendar working-hours math (`earlyStartDate`, `earlyFinishDate`, `lateStartDate`, `lateFinishDate`, `totalWorkingHours`, `projectEndDate`) skipping weekends and holidays.
-  - Enhanced Workload & Capacity Engine with working-day effort distribution and holiday capacity deductions.
-  - Added working-days schedule variance (`scheduleVarianceWorkingDays`) to Reality Deltas in the Ladder of Abstraction.
-
-## 0.18.0
-
-### Minor Changes
-
-- adf44f6: Add headless workload and capacity distribution engine for streamgraphs, stacked area charts, and team capacity planning. Features include contiguous calendar bucketing (`day`, `week`, `month`), multi-dimension grouping (`assignee`, `team`, `taskType`, `priority`, `status`), effort metric distribution (`scheduled`, `logged`, `remaining`, `blended`), tabular zero-filled series matrix for D3 stack layouts, and capacity/utilization thresholds.
-
-## 0.17.0
-
-### Minor Changes
-
-- 9c31e8d: Introduce comprehensive Task Metrics, Inferred Actuals, Progress Inference, Earned Value Management (EVM), and Time-Series Progress History Curve Profiling.
-  - **Inferred Actuals**: Automatic start/completion auto-stamping on workflow transitions with fallback inference from activity logs, plus automatic completion timestamp clearing on task re-open.
-  - **Reality Delta**: Multi-dimensional variance analysis comparing planned estimates to logged hours (`effortVarianceHours`, `durationVarianceHours`, `accuracyRatio`, `isOverdue`, `isOverEstimate`).
-  - **Progress Inference**: Deterministic priority waterfall resolving completion progress across explicit values, checklist/todo completion ratios, logged effort, and elapsed schedule time.
-  - **Earned Value Management (EVM)**: Task-level PV, EV, AC, CV, SV, CPI, and SPI calculations.
-  - **Time-Series History & Curve Shapes**: Historical timeline reconstruction from activity logs with piecewise interpolation curve classification (`linear`, `s_curve`, `early_surge`, `late_rush`, `stalled`).
-  - **Full-Stack Integration**: REST endpoints (`/tasks/:id/metrics`, `/tasks/:id/progress-history`), Client SDK methods, React `useTaskMetrics` hook, Svelte 5 `TaskMetricsState`, and MCP tools (`get_task_metrics`, `get_task_progress_history`).
-
-## 0.16.0
-
-### Minor Changes
-
-- e2a7eef: Introduce Ladder of Abstraction and Critical Path Method (CPM) timeline synthesis to the framework data model:
-  - **Core Domain**: Multi-scale timeline synthesis model across Macro phase rollups, Standard CPM Gantt schedule (early/late bounds, float/slack calculation, bottleneck identification), and Concrete grounding (deliverables, file attachments, daily effort distribution, and reality deltas). Added `calculateCriticalPath`, `getTimelineLadder`, and `getTaskLadder` to `CriticalPathEngine`.
-  - **Server Router**: HTTP endpoints `GET /projects/:id/critical-path`, `GET /projects/:id/ladder`, and `GET /tasks/:id/ladder`.
-  - **Client SDK**: `CriticalPathClient` methods `calculateCriticalPath`, `getTimelineLadder`, and `getTaskLadder`.
-  - **MCP**: New AI tools `calculate_critical_path`, `get_timeline_ladder`, and `get_task_ladder`.
-  - **React**: Custom hooks `useTimelineLadder`, `useCriticalPath`, and `useTaskLadder`.
-  - **Svelte 5**: Svelte 5 Runes state classes `TimelineLadderState` and `CriticalPathState`.
-
-## 0.15.2
-
-### Patch Changes
-
-- dbd2072: Add comprehensive unit test coverage for task state lifecycle behaviors and upstream/downstream dependency validation.
-
-## 0.15.1
-
-### Patch Changes
-
-- f53afab: Add automated downstream task unblocking on task completion, full bidirectional VFX and Creative workflow transitions, and bidirectional dependency querying in FirebaseStore.
-
-## 0.15.0
-
-### Minor Changes
-
-- 21eb85c: Implement Universal Semantic Statuses & System-Derived Implied Statuses (3-Tier Status Architecture)
-  
-  - **Tier 1 (Universal Semantic Statuses)**: Defined canonical status enum `SemanticStatus = 'not_started' | 'in_progress' | 'completed' | 'canceled'` providing universal semantic meaning across any industry domain.
-  - **Tier 2 (Workflow-Defined Statuses)**: Updated `StatusDefinition` to map domain-specific statuses to a semantic `category`. Updated built-in workflows (Software, Creative, VFX, Simple) to classify statuses by category.
-  - **Tier 3 (System-Derived Implied Statuses)**: Added `deriveTaskLifecycleState` and `engine.getTaskLifecycleState(taskId)` returning dynamic indicators:
-    - Dependency: `isReady`, `isBlocked`, `blockingTaskIds`
-    - Schedule: `isOverdue`, `isUpcoming`, `isUnplanned`
-    - Ownership: `isUnassigned`, `isStalled`
-    - Estimate/Pace: `isOverEstimate`, `isPaceWarning`
-    - Convenience flags: `isDone`, `isActive`, `isCancelled`
-  - **Domain Entities & Engine**: Added automatic timestamp progression (`actualStartDate`, `actualEndDate`), progress completion, and event emission driven by semantic status categories.
-  - **React UI Hooks**: Updated `useKanban` to support dynamic custom workflow columns without dropping tasks, plus added `groupBy: 'semantic' | 'workflow'` option.
-  - **Client SDK**: Added `client.getTaskLifecycleState(taskId)`.
-
-## 0.14.0
-
-### Minor Changes
-
-- 3dc2798: feat(core): add readAttachmentText engine method, download on storage adapters, and artifactType metadata
-
-## 0.13.3
-
-### Patch Changes
-
-- 573a4fa: Fix mention regex to avoid capturing trailing punctuation like periods or commas in unquoted handles
-
-## 0.13.2
-
-### Patch Changes
-
-- 03d269c: Make getAllowedNextStatuses strictly forward and symmetrical with getAllowedPreviousStatuses by constraining to downstream statuses in workflow sequence.
-
-## 0.13.1
-
-### Patch Changes
-
-- a7d17c0: Add backward status transitions to default workflows and align allowed previous statuses with workflow transitions
-
-## 0.13.0
-
-### Minor Changes
-
-- a4a464b: Support multi-assignees and backward workflow status transitions:
-  - Add `TaskAssignee` interface (`id`, `name`, `role`, `type: 'user' | 'agent' | 'team'`, `avatarUrl`) and `assignees?: TaskAssignee[]` to `Task` entity and SQLite storage adapter.
-  - Add `getAllowedPreviousStatuses(workflow, currentStatus)` utility and `CriticalPathEngine.getAllowedPreviousTaskTransitions(taskId)` for calculating valid backward transitions.
-  - Expose `allowedPreviousStatuses` in server endpoint `GET /tasks/:taskId/transitions`.
-  - Add `getAllowedPreviousTaskTransitions(taskId)` to `CriticalPathClient` SDK.
-
-## 0.12.0
-
-### Minor Changes
-
-- 5a5930f: Add first-class Deliverable entity, Creative Workflow presets, and reactive UI bindings:
-  - `@critical-path/core`: Added `Deliverable` entity, `DeliverableSummary` rollup computation, `DEFAULT_CREATIVE_WORKFLOW` preset, `deliverableId` on tasks, store implementations (InMemory, SQLite, Firebase), domain events, and webhook integration.
-  - `@critical-path/server`: Added RESTful API endpoints for `/deliverables` and `/deliverables/:id/summary`.
-  - `@critical-path/client`: Added deliverable management and summary methods to `CriticalPathClient`.
-  - `@critical-path/react`: Added `useDeliverables` and `useDeliverableSummary` React hooks.
-  - `@critical-path/svelte`: Added `DeliverableState` and `createDeliverableState` Svelte 5 Runes state management.
-
-## 0.11.0
-
-### Minor Changes
-
-- 55549e9: Support @mentions in comments with extraction and segmentation utilities
-  
-  - Add `mentions?: string[]` to `Comment` interface
-  - Add `extractMentions` and `parseMentionSegments` utilities for mention parsing and UI rendering
-  - Auto-extract and populate mentions during `addComment` and `updateComment` in the engine
-  - Update SQLite comments schema with `mentions` column and migration
-  - Preserve and pass through mentions in server routes, client SDK, and Svelte bindings
-
-## 0.10.0
-
-### Minor Changes
-
-- e9003d3: Add emoji reactions support for comment conversations with domain events, deduplication, REST endpoints, client SDK, and React/Svelte state integrations.
-
-## 0.9.0
-
-### Minor Changes
-
-- e983557: Add first-class optional todo list (checklist) support to Task model and TaskEntity with helper methods (addTodo, toggleTodo, removeTodo) and updateTask helper in @critical-path/svelte.
-
-## 0.8.3
-
-### Patch Changes
-
-- 2d5ff04: fix(core): decode base64 strings and data URIs into binary Uint8Array in storage adapters
-
-## 0.8.2
-
-### Patch Changes
-
-- fix(core): decode base64 strings and data URIs into binary Uint8Array in storage adapters
-
-## 0.8.1
-
-### Patch Changes
-
-- 315425c: fix(core): generate Firebase Storage download tokens and construct valid public URLs
-
-## 0.8.0
-
-### Minor Changes
-
-- 1811922: Add attachment URL validation against large data URIs, sanitize undefined properties in FirebaseStore, provide direct attachment upload routes & SDK methods, and introduce TaskActivityState for combined comment & attachment threads.
-
-## 0.7.0
-
-### Minor Changes
-
-- a48a04a: Add threaded conversations, attachment metadata management, and storage adapters (S3 & Firebase Storage):
-  
-  - **`@critical-path/core`**:
-    - Added `Attachment` entity, `CreateAttachmentInput`, `UploadFileInput`, and `FileStorageAdapter` contracts.
-    - Added `InMemoryFileStore`, duck-typed `S3StorageAdapter` (compatible with AWS SDK v3, v2, MinIO, and Cloudflare R2), and `FirebaseStorageAdapter` (compatible with Google Cloud Storage and Firebase Admin SDK).
-    - Extended `Comment` with `authorType` (`user`, `agent`, `system`) and `parentId` for threaded discussions.
-    - Implemented full comment and attachment repository methods across `InMemoryStore`, `SQLiteStore`, and `FirebaseStore`.
-    - Added engine operations for upload, presigning, and deleting attachments with domain events (`comment.*`, `attachment.*`) and webhooks.
-  
-  - **`@critical-path/server`**:
-    - Added RESTful routes for comments (`GET/POST /tasks/:taskId/comments`, `GET/POST /comments`, `GET/PATCH/DELETE /comments/:id`).
-    - Added RESTful routes for attachments (`GET/POST /tasks/:taskId/attachments`, `GET/POST /attachments`, `GET/DELETE /attachments/:id`, `POST /attachments/presign`).
-  
-  - **`@critical-path/client`**:
-    - Added SDK methods `getComments`, `getComment`, `addComment`, `updateComment`, `deleteComment`.
-    - Added SDK methods `getAttachments`, `getAttachment`, `createAttachment`, `deleteAttachment`, and `getPresignedAttachmentUploadUrl`.
-  
-  - **`@critical-path/react`**:
-    - Added `useComments(taskId)` with reactive thread tree derivation (`threads` containing nested `replies`) and comment mutations.
-    - Added `useAttachments(filter)` with attachment creation and deletion.
-  
-  - **`@critical-path/svelte`**:
-    - Added Svelte 5 Rune-based `CommentState` / `createCommentState(client, taskId)` with derived threaded hierarchy.
-    - Added Svelte 5 Rune-based `AttachmentState` / `createAttachmentState(client, filter)`.
-
-## 0.6.0
-
-### Minor Changes
-
-- 6e9dece: Introduce Domain-Driven Design (DDD) constructs:
-  - Rich Domain Aggregates (`TaskEntity`, `ProjectEntity`, `BaseEntity`) encapsulating invariants, transitions, and uncommitted events.
-  - Typed `DomainEventBus` and domain event interfaces (`task.created`, `task.status_changed`, `time.logged`, `dependency.added`, etc.).
-  - DAG task dependency graph cycle detection (`detectDependencyCycle`, `CircularDependencyError`).
-  - Custom field value object validation (`validateCustomFieldValues`, `CustomFieldValidationError`).
-  - Interface segregation for discrete repositories (`ProjectRepository`, `TaskRepository`, `WorkflowRepository`, etc.).
-
-## 0.5.2
-
-### Patch Changes
-
-- c24b76c: Set `isDefault: false` on DEFAULT_SOFTWARE_WORKFLOW so only DEFAULT_SIMPLE_WORKFLOW is default
-
-## 0.5.1
-
-### Patch Changes
-
-- 34067fd: Make node:sqlite import browser-safe for web bundlers
-
-## 0.5.0
-
-### Minor Changes
-
-- 83a5c17: Add `DEFAULT_VFX_WORKFLOW` preset and validation suite for Software Development and Visual Effects (VFX) production use cases.
-
-## 0.4.0
-
-### Minor Changes
-
-- 35576a6: Introduce Workflow concept to the project management model with status definitions, allowed transition validation, task types, webhook events (workflow.created, workflow.updated, workflow.deleted), server routes, SDK methods, and React/Svelte state hooks.
-
-## 0.3.0
-
-### Minor Changes
-
-- 4b92228: Add project short key utilities (`generateProjectKey`, `validateProjectKey`, `formatTaskKey`) and automatic key generation fallback in `createProject`.
-
-## 0.2.1
-
-### Patch Changes
-
-- df22aad: Remove implicit InMemoryFirestoreMock fallback and require explicit db parameter in FirebaseStore constructor
-
-## 0.2.0
-
-### Minor Changes
-
-- 755286a: Add native `SQLiteStore` (using `node:sqlite`) and `FirebaseStore` (Firestore) storage adapters with full CRUD support for projects, tasks, sprints, comments, activities, time entries, dependencies, and webhooks.
-
-## 0.1.2
-
-### Patch Changes
-
-- Initial open-source release of the core headless domain engine, plugin lifecycle hooks, and in-memory store.

package/dist/deliverables.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=deliverables.test.d.ts.map

package/dist/deliverables.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deliverables.test.d.ts","sourceRoot":"","sources":["../src/deliverables.test.ts"],"names":[],"mappings":""}