@critical-path/svelte 0.18.18 → 0.18.20

package/CHANGELOG.md

@@ -0,0 +1,913 @@
+# @critical-path/svelte
+
+## 0.18.20
+
+### Patch Changes
+
+- da8c69b: Packages now include `CHANGELOG.md`, so agents and developers can read breaking changes in `node_modules`. READMEs link the new upgrade guide (`UPGRADING.md`, also at /getting-started/upgrading/ on the docs site), which coding agents in consumer apps can follow to migrate on their own.
+- Updated dependencies [da8c69b]
+  - @critical-path/core@0.51.1
+  - @critical-path/client@0.25.1
+  - @critical-path/mcp@0.18.1
+
+## 0.18.19
+
+### Patch Changes
+
+- Updated dependencies [a7e9f4a]
+  - @critical-path/core@0.51.0
+  - @critical-path/client@0.25.0
+  - @critical-path/mcp@0.18.0
+
+## 0.18.18
+
+### Patch Changes
+
+- Updated dependencies [7896d0d]
+  - @critical-path/core@0.50.0
+  - @critical-path/client@0.24.5
+  - @critical-path/mcp@0.17.2
+
+## 0.18.17
+
+### Patch Changes
+
+- Updated dependencies [fc9740b]
+  - @critical-path/mcp@0.17.1
+
+## 0.18.16
+
+### Patch Changes
+
+- Updated dependencies [bbc4305]
+  - @critical-path/core@0.49.0
+  - @critical-path/mcp@0.17.0
+  - @critical-path/client@0.24.4
+
+## 0.18.15
+
+### Patch Changes
+
+- Updated dependencies [cb71e39]
+  - @critical-path/core@0.48.1
+  - @critical-path/client@0.24.3
+  - @critical-path/mcp@0.16.3
+
+## 0.18.14
+
+### Patch Changes
+
+- Updated dependencies [f151568]
+  - @critical-path/core@0.48.0
+  - @critical-path/client@0.24.2
+  - @critical-path/mcp@0.16.2
+
+## 0.18.13
+
+### Patch Changes
+
+- Updated dependencies [fde5883]
+  - @critical-path/core@0.47.0
+  - @critical-path/client@0.24.1
+  - @critical-path/mcp@0.16.1
+
+## 0.18.12
+
+### Patch Changes
+
+- Updated dependencies [d82d168]
+  - @critical-path/core@0.46.0
+  - @critical-path/client@0.24.0
+  - @critical-path/mcp@0.16.0
+
+## 0.18.11
+
+### Patch Changes
+
+- Updated dependencies [3c08dd9]
+  - @critical-path/core@0.45.0
+  - @critical-path/client@0.23.0
+  - @critical-path/mcp@0.15.0
+
+## 0.18.10
+
+### Patch Changes
+
+- Updated dependencies [b3ef9c6]
+  - @critical-path/core@0.44.0
+  - @critical-path/client@0.22.3
+  - @critical-path/mcp@0.14.2
+
+## 0.18.9
+
+### Patch Changes
+
+- Updated dependencies [867cdae]
+  - @critical-path/core@0.43.1
+  - @critical-path/client@0.22.2
+  - @critical-path/mcp@0.14.1
+
+## 0.18.8
+
+### Patch Changes
+
+- Updated dependencies [efa342f]
+  - @critical-path/core@0.43.0
+  - @critical-path/mcp@0.14.0
+  - @critical-path/client@0.22.1
+
+## 0.18.7
+
+### Patch Changes
+
+- Updated dependencies [f548659]
+  - @critical-path/core@0.42.0
+  - @critical-path/client@0.22.0
+  - @critical-path/mcp@0.13.0
+
+## 0.18.6
+
+### Patch Changes
+
+- Updated dependencies [65044e3]
+  - @critical-path/core@0.41.0
+  - @critical-path/client@0.21.1
+  - @critical-path/mcp@0.12.1
+
+## 0.18.5
+
+### Patch Changes
+
+- Updated dependencies [cfd3215]
+  - @critical-path/core@0.40.0
+  - @critical-path/client@0.21.0
+  - @critical-path/mcp@0.12.0
+
+## 0.18.4
+
+### Patch Changes
+
+- Updated dependencies [c7ad4d4]
+  - @critical-path/core@0.39.0
+  - @critical-path/client@0.20.9
+  - @critical-path/mcp@0.11.11
+
+## 0.18.3
+
+### Patch Changes
+
+- Updated dependencies [8e52679]
+  - @critical-path/core@0.38.0
+  - @critical-path/client@0.20.8
+  - @critical-path/mcp@0.11.10
+
+## 0.18.2
+
+### Patch Changes
+
+- Updated dependencies [d4477b1]
+  - @critical-path/core@0.37.0
+  - @critical-path/client@0.20.7
+  - @critical-path/mcp@0.11.9
+
+## 0.18.1
+
+### Patch Changes
+
+- 85d9bb5: Publish only what consumers need.
+  
+  - Packages no longer ship compiled tests or TypeScript sources (`files: ["dist", "!dist/**/*.test.*"]`). `@critical-path/core` goes from 330 files to 146.
+  - `exports` maps list `types` first, as TypeScript's resolution expects.
+- Updated dependencies [85d9bb5]
+  - @critical-path/core@0.36.1
+  - @critical-path/client@0.20.6
+  - @critical-path/mcp@0.11.8
+
+## 0.18.0
+
+### Minor Changes
+
+- dbe7073: Cancel stale requests in UI data hooks.
+  
+  - **@critical-path/react:** data hooks abort their in-flight request when inputs change or the component unmounts, and ignore any response that arrives afterwards. Previously, switching from project A to project B could show A's tasks if A's request finished last. The package now ships with a `'use client'` directive, for Next.js App Router.
+  - **@critical-path/svelte:** state classes abort the previous request when a fetch method is called again, and gain `destroy()` to cancel in-flight requests (call it from `onDestroy`). Duck-typed clients without `with()` keep working; their requests just aren't cancelled.
+
+### Patch Changes
+
+- Updated dependencies [810d8d1]
+  - @critical-path/core@0.36.0
+  - @critical-path/client@0.20.5
+  - @critical-path/mcp@0.11.7
+
+## 0.17.11
+
+### Patch Changes
+
+- Updated dependencies [b13f7c4]
+  - @critical-path/core@0.35.0
+  - @critical-path/client@0.20.4
+  - @critical-path/mcp@0.11.6
+
+## 0.17.10
+
+### Patch Changes
+
+- Updated dependencies [1cc0d4c]
+  - @critical-path/core@0.34.0
+  - @critical-path/client@0.20.3
+  - @critical-path/mcp@0.11.5
+
+## 0.17.9
+
+### Patch Changes
+
+- Updated dependencies [aa94129]
+  - @critical-path/core@0.33.0
+  - @critical-path/client@0.20.2
+  - @critical-path/mcp@0.11.4
+
+## 0.17.8
+
+### Patch Changes
+
+- Updated dependencies [a3fe03d]
+  - @critical-path/core@0.32.0
+  - @critical-path/client@0.20.1
+  - @critical-path/mcp@0.11.3
+
+## 0.17.7
+
+### Patch Changes
+
+- Updated dependencies [40e5958]
+  - @critical-path/core@0.31.0
+  - @critical-path/client@0.20.0
+  - @critical-path/mcp@0.11.2
+
+## 0.17.6
+
+### Patch Changes
+
+- Updated dependencies [b453472]
+  - @critical-path/client@0.19.0
+  - @critical-path/mcp@0.11.1
+
+## 0.17.5
+
+### Patch Changes
+
+- cdb300a: Task filtering and pagination.
+  
+  **@critical-path/core**
+  - New `engine.queryTasks(query)` and `engine.queryActivities(query)` return `Page<T>` (`{ items, nextCursor }`).
+    - Tasks are ordered oldest first, activities newest first, using keyset cursors on `createdAt` then `id`.
+    - Task filters: `status[]`, `priority[]`, `assigneeId` (also matches `assignees`), `iterationId`, `deliverableId`, `containerId`, `parentId` (`null` means top-level), `projectIds`.
+    - Results are limited to projects the actor can read.
+  - **BREAKING (storage adapters):** `queryTasks` and `queryActivities` are required. `SQLiteStore` filters and pages in SQL and adds indexes for tasks, activities, comments and dependencies. Helpers (`paginate`, `matchesTaskQuery`, cursors, `DEFAULT_PAGE_SIZE` / `MAX_PAGE_SIZE`) are exported for custom adapters.
+  
+  **@critical-path/server**
+  - **BREAKING:** `GET /tasks` and `GET /activities` are paginated (default 100, max 500) and return `nextCursor`. `GET /tasks` accepts the filters above as query parameters. Unknown parameters return `400`.
+  
+  **@critical-path/client**
+  - `getTasks` and `getActivities` follow pagination and still return everything. New `queryTasks` and `queryActivities` return single pages.
+  
+  **@critical-path/mcp**
+  - **BREAKING:** `list_tasks` returns `{ tasks, nextCursor }` and accepts `iterationId`, `limit` and `cursor`. It now filters in the store instead of loading every task.
+- Updated dependencies [cdb300a]
+  - @critical-path/core@0.30.0
+  - @critical-path/client@0.18.0
+  - @critical-path/mcp@0.11.0
+
+## 0.17.4
+
+### Patch Changes
+
+- Updated dependencies [a019d37]
+  - @critical-path/core@0.29.0
+  - @critical-path/client@0.17.0
+  - @critical-path/mcp@0.10.4
+
+## 0.17.3
+
+### Patch Changes
+
+- Updated dependencies [4fbbc40]
+  - @critical-path/core@0.28.0
+  - @critical-path/mcp@0.10.3
+  - @critical-path/client@0.16.1
+
+## 0.17.2
+
+### Patch Changes
+
+- Updated dependencies [1a516bd]
+  - @critical-path/core@0.27.0
+  - @critical-path/client@0.16.0
+  - @critical-path/mcp@0.10.2
+
+## 0.17.1
+
+### Patch Changes
+
+- Updated dependencies [719e844]
+  - @critical-path/core@0.26.0
+  - @critical-path/client@0.15.1
+  - @critical-path/mcp@0.10.1
+
+## 0.17.0
+
+### Minor Changes
+
+- fd79762: **BREAKING:** strict request bodies, no identity in payloads, and CORS off by default.
+  
+  **@critical-path/core**
+  - Request schemas are strict: unknown keys, server-assigned fields and identity fields are rejected instead of stripped.
+  - Identity is never read from payloads. `updateTask` no longer reads `actorId`/`actorName`/`actorType`/`actor` from the update object; pass them as the third `options` argument or use `withActor`. `addComment`, `addCommentReaction`, `removeCommentReaction` and `createAttachment` take the actor from `withActor`, falling back to an optional `authorId`/`userId`/`uploaderId`, then `'system'`.
+  - Schemas export request body types (`CreateTaskBody`, `UpdateTaskBody`, ...).
+  
+  **@critical-path/server**
+  - Bodies containing unknown, server-assigned or identity fields return `400`.
+  - Every request runs as the `getContext` user, or `ANONYMOUS_ACTOR` (`anonymous`). Authors of comments, reactions, attachments and time entries are no longer accepted from bodies.
+  - `DELETE /comments/:id/reactions` takes `?emoji=` only.
+  - CORS is off by default (`cors: false`). Pass `cors: { origins: [...] }` to allow cross-origin browsers.
+  
+  **@critical-path/client**
+  - Method parameters use the server's body types, so identity fields no longer type-check. `addCommentReaction`/`removeCommentReaction` take `{ emoji }`; `addTodo`/`toggleTodo` drop the actor options argument.
+  - New `updateProject`, `deleteProject` and `addDependency`. `uploadAttachmentFile` base64-encodes binary data (previously it sent unusable JSON for `Uint8Array`/`ArrayBuffer`).
+  - CLI: `--author`, `--actor-id`, `--actor-name`, `--agent-name` and `CRITICAL_PATH_AUTHOR_ID`/`ACTOR_ID`/`AGENT_NAME` are removed; identity comes from the `--key` token via the server's `getContext`.
+  
+  **@critical-path/mcp**
+  - Tool arguments are strict: undeclared arguments return an `isError` result.
+  - `add_comment` no longer takes `authorId`. With an `engine`, writes are attributed to the new `actor` server option (default `DEFAULT_MCP_ACTOR`).
+  
+  **@critical-path/react / @critical-path/svelte**
+  - `addReaction`/`removeReaction` take `(commentId, emoji)`; comment and attachment inputs no longer accept `authorId`/`uploaderId`. Task, comment and deliverable update parameters use the schema body types.
+
+### Patch Changes
+
+- Updated dependencies [fd79762]
+  - @critical-path/core@0.25.0
+  - @critical-path/client@0.15.0
+  - @critical-path/mcp@0.10.0
+
+## 0.16.3
+
+### Patch Changes
+
+- b54e22c: Validate request bodies with shared zod schemas and publish an OpenAPI document.
+  
+  **@critical-path/core**
+  - New `@critical-path/core/schemas` subpath with create/update schemas for every resource and `parsePayload(schema, data)`. Kept off the package root so browser bundles do not include zod. `zod` is now a dependency of core.
+  - `ValidationError` carries an optional `issues: { path, message }[]`.
+  
+  **@critical-path/server**
+  - All request bodies are validated. Invalid bodies return `400` with `issues`. Server-assigned fields (`id`, `createdAt`, `updatedAt`, task `key`, owning `projectId` on updates) and unknown keys are stripped, so a `PATCH` can no longer move a task to another project.
+  - Comments, reactions and attachments require an author unless `getContext` resolves the caller. Attachment `mimeType` and `sizeBytes` default to `application/octet-stream` and `0` for linked files.
+  - New `GET /openapi.json` and `buildOpenApiDocument()` (OpenAPI 3.1, request bodies generated from the validation schemas).
+  
+  **@critical-path/mcp**
+  - Tool `inputSchema`s are generated from their zod schemas via the new `defineTool`, removing the hand-written JSON copies.
+  
+  **@critical-path/svelte**
+  - Rebuilt with the bundled `@critical-path/mcp` changes.
+- Updated dependencies [b54e22c]
+  - @critical-path/core@0.24.0
+  - @critical-path/mcp@0.9.0
+  - @critical-path/client@0.14.9
+
+## 0.16.2
+
+### Patch Changes
+
+- Updated dependencies [6dd5529]
+  - @critical-path/core@0.23.0
+  - @critical-path/mcp@0.8.0
+  - @critical-path/client@0.14.8
+
+## 0.16.1
+
+### Patch Changes
+
+- b243a37: Fix correctness and safety issues found in a code audit.
+  
+  **@critical-path/core**
+  - `SQLiteStore` now loads `node:sqlite` via `process.getBuiltinModule`, fixing `require is not defined` when constructed from a filename in plain Node ESM.
+  - Removed the unused `better-sqlite3` runtime dependency.
+  - `engine.addDependency` now detects indirect cycles (e.g. A → B → C → D → A), not just cycles between direct neighbours.
+  - Fixed `generateKeyBetween` returning out-of-range, duplicate keys after repeated inserts after the same item. It now throws a `RangeError` when `a >= b`.
+  - Added `engine.deleteProject(id)`, which deletes a project's tasks through `deleteTask` and publishes a new `project.deleted` event and webhook.
+  - Added exported `ValidationError` and `NotFoundError` classes. `logTime` now rejects non-numeric hours.
+  
+  **@critical-path/server**
+  - `DELETE /projects/:id`, `POST /tasks/:id/dependencies` and `POST /time-entries` now go through the engine, so cycle checks, hour validation, roll-ups, events and webhooks apply.
+  - Added `PATCH /projects/:id`.
+  - `DELETE` on a resource that does not exist now returns `404` instead of `200 { success: false }`.
+  - Malformed JSON returns `400`, validation errors `400`, `NotFoundError` `404`, and dependency cycles `409`. Unexpected errors return a generic `500` message outside development.
+  - `OPTIONS` preflight requests return `204` with CORS headers.
+  - New router/adapter options: `onError(error, request)` to report unexpected errors or return a custom response, and `exposeErrors` to include real messages in 500 responses (defaults to on only when `NODE_ENV === 'development'`).
+  - `createNextHandler` returns a callable handler that also exposes per-method properties, so `export { handler as GET }` works as documented.
+  
+  **@critical-path/mcp**
+  - Tools excluded via the `tools` option can no longer be called by name.
+  - Tool arguments are validated with each tool's zod schema; undeclared fields are stripped.
+  - Tool listings include `title` and MCP `readOnlyHint` / `destructiveHint` annotations.
+  
+  **@critical-path/svelte**
+  - Rebuilt with the bundled `@critical-path/mcp` WebMCP argument validation.
+  
+  **@critical-path/client**
+  - Delete methods resolve to `false` when the server returns `404`, keeping their boolean contract with the new server behaviour.
+- Updated dependencies [b243a37]
+  - @critical-path/core@0.22.0
+  - @critical-path/mcp@0.7.0
+  - @critical-path/client@0.14.7
+
+## 0.16.0
+
+### Minor Changes
+
+- f3301bf: - Added comprehensive task lifecycle and semantic status predicates (`isDraftTask`, `isArchivedTask`, `isTrashedTask`, `isTrashedOrArchivedTask`, `isWorkflowTask`, `getTaskSemanticStatus`, `isTaskCompleted`, `isTaskInProgress`, `isTaskNotStarted`, `isTaskCanceled`, `isTaskActive`, `isTaskUnassigned`).
+  - Hardened mention extraction with markdown code suppression (`stripMarkdownCode`) to prevent code blocks, inline code, HTML elements, and URLs from triggering false positive mentions while preserving rich-text mention nodes.
+  - Added Base-62 fractional indexing utilities (`generateKeyBetween`, `generateNKeysBetween`) for zero-cost lexical task/item reordering without array shifting or bulk database rewrites.
+  - Added `completedAt` lifecycle timestamp tracking alongside `actualEndDate`, automatic timestamp assignment upon entering `completed` or `canceled`, and timestamp + progress reset upon reopening to `not_started` or `in_progress`.
+  - Added `isTempTaskId` utility and hardened optimistic temporary task handling in `@critical-path/svelte` (`TaskState`) and `@critical-path/react` (`useTasks`) with in-flight creation resolution and ID mapping to prevent 404 errors during rapid optimistic updates and deletions.
+
+### Patch Changes
+
+- Updated dependencies [f3301bf]
+  - @critical-path/core@0.21.0
+  - @critical-path/client@0.14.6
+  - @critical-path/mcp@0.6.9
+
+## 0.15.9
+
+### Patch Changes
+
+- Updated dependencies [8acf018]
+  - @critical-path/client@0.14.5
+  - @critical-path/mcp@0.6.8
+
+## 0.15.8
+
+### Patch Changes
+
+- Updated dependencies [b8a68dd]
+  - @critical-path/core@0.20.2
+  - @critical-path/client@0.14.4
+  - @critical-path/mcp@0.6.7
+
+## 0.15.7
+
+### Patch Changes
+
+- Updated dependencies [500b353]
+  - @critical-path/core@0.20.1
+  - @critical-path/client@0.14.3
+  - @critical-path/mcp@0.6.6
+
+## 0.15.6
+
+### Patch Changes
+
+- Updated dependencies [c83235b]
+  - @critical-path/core@0.20.0
+  - @critical-path/client@0.14.2
+  - @critical-path/mcp@0.6.5
+
+## 0.15.5
+
+### Patch Changes
+
+- Updated dependencies [f816145]
+  - @critical-path/core@0.19.1
+  - @critical-path/client@0.14.1
+  - @critical-path/mcp@0.6.4
+
+## 0.15.4
+
+### Patch Changes
+
+- Updated dependencies [f539a11]
+  - @critical-path/client@0.14.0
+  - @critical-path/mcp@0.6.3
+
+## 0.15.3
+
+### Patch Changes
+
+- Updated dependencies [1c85472]
+  - @critical-path/client@0.13.1
+  - @critical-path/mcp@0.6.2
+
+## 0.15.2
+
+### Patch Changes
+
+- Updated dependencies [b86b6fc]
+  - @critical-path/client@0.13.0
+  - @critical-path/mcp@0.6.1
+
+## 0.15.1
+
+### Patch Changes
+
+- Updated dependencies [31a6dde]
+- Updated dependencies [31a6dde]
+  - @critical-path/core@0.19.0
+  - @critical-path/mcp@0.6.0
+  - @critical-path/client@0.12.1
+
+## 0.15.0
+
+### Minor Changes
+
+- adf44f6: Add headless workload and capacity distribution engine for streamgraphs, stacked area charts, and team capacity planning. Features include contiguous calendar bucketing (`day`, `week`, `month`), multi-dimension grouping (`assignee`, `team`, `taskType`, `priority`, `status`), effort metric distribution (`scheduled`, `logged`, `remaining`, `blended`), tabular zero-filled series matrix for D3 stack layouts, and capacity/utilization thresholds.
+
+### Patch Changes
+
+- Updated dependencies [adf44f6]
+  - @critical-path/core@0.18.0
+  - @critical-path/client@0.12.0
+  - @critical-path/mcp@0.5.0
+
+## 0.14.0
+
+### Minor Changes
+
+- 9c31e8d: Introduce comprehensive Task Metrics, Inferred Actuals, Progress Inference, Earned Value Management (EVM), and Time-Series Progress History Curve Profiling.
+  - **Inferred Actuals**: Automatic start/completion auto-stamping on workflow transitions with fallback inference from activity logs, plus automatic completion timestamp clearing on task re-open.
+  - **Reality Delta**: Multi-dimensional variance analysis comparing planned estimates to logged hours (`effortVarianceHours`, `durationVarianceHours`, `accuracyRatio`, `isOverdue`, `isOverEstimate`).
+  - **Progress Inference**: Deterministic priority waterfall resolving completion progress across explicit values, checklist/todo completion ratios, logged effort, and elapsed schedule time.
+  - **Earned Value Management (EVM)**: Task-level PV, EV, AC, CV, SV, CPI, and SPI calculations.
+  - **Time-Series History & Curve Shapes**: Historical timeline reconstruction from activity logs with piecewise interpolation curve classification (`linear`, `s_curve`, `early_surge`, `late_rush`, `stalled`).
+  - **Full-Stack Integration**: REST endpoints (`/tasks/:id/metrics`, `/tasks/:id/progress-history`), Client SDK methods, React `useTaskMetrics` hook, Svelte 5 `TaskMetricsState`, and MCP tools (`get_task_metrics`, `get_task_progress_history`).
+
+### Patch Changes
+
+- Updated dependencies [9c31e8d]
+  - @critical-path/core@0.17.0
+  - @critical-path/client@0.11.0
+  - @critical-path/mcp@0.4.0
+
+## 0.13.1
+
+### Patch Changes
+
+- Updated dependencies [b4b2c98]
+  - @critical-path/mcp@0.3.1
+
+## 0.13.0
+
+### Minor Changes
+
+- e2a7eef: Introduce Ladder of Abstraction and Critical Path Method (CPM) timeline synthesis to the framework data model:
+  - **Core Domain**: Multi-scale timeline synthesis model across Macro phase rollups, Standard CPM Gantt schedule (early/late bounds, float/slack calculation, bottleneck identification), and Concrete grounding (deliverables, file attachments, daily effort distribution, and reality deltas). Added `calculateCriticalPath`, `getTimelineLadder`, and `getTaskLadder` to `CriticalPathEngine`.
+  - **Server Router**: HTTP endpoints `GET /projects/:id/critical-path`, `GET /projects/:id/ladder`, and `GET /tasks/:id/ladder`.
+  - **Client SDK**: `CriticalPathClient` methods `calculateCriticalPath`, `getTimelineLadder`, and `getTaskLadder`.
+  - **MCP**: New AI tools `calculate_critical_path`, `get_timeline_ladder`, and `get_task_ladder`.
+  - **React**: Custom hooks `useTimelineLadder`, `useCriticalPath`, and `useTaskLadder`.
+  - **Svelte 5**: Svelte 5 Runes state classes `TimelineLadderState` and `CriticalPathState`.
+
+### Patch Changes
+
+- Updated dependencies [e2a7eef]
+  - @critical-path/core@0.16.0
+  - @critical-path/client@0.10.0
+  - @critical-path/mcp@0.3.0
+
+## 0.12.0
+
+### Minor Changes
+
+- 105f3d3: Synchronize feature parity between `@critical-path/react` and `@critical-path/svelte`:
+  - `@critical-path/react`: Added `updateTask` with optimistic updates and rollback to `useTasks`, and introduced `useTaskActivity` hook for unified threaded discussions and attachments.
+  - `@critical-path/svelte`: Added `KanbanState` (`createKanbanState`), `TaskTransitionsState` (`createTaskTransitionsState`), and `DeliverableSummaryState` (`createDeliverableSummaryState`) using native Svelte 5 runes.
+
+## 0.11.0
+
+### Minor Changes
+
+- ed51060: Add Model Context Protocol (MCP) server and client-side WebMCP support:
+  - New `@critical-path/mcp` package providing standard MCP server (`createCriticalPathMcpServer`, stdio transport, resources, prompts) and CLI (`npx @critical-path/mcp`).
+  - Client-side WebMCP browser integration (`registerWebMcpTools`) adhering to W3C WebML CG specification with ambient project scoping.
+  - First-class React hook `useWebMCP` in `@critical-path/react`.
+  - First-class Svelte 5 runes state `WebMcpState` and `createWebMcpState` in `@critical-path/svelte`.
+
+### Patch Changes
+
+- Updated dependencies [ed51060]
+  - @critical-path/mcp@0.2.0
+
+## 0.10.2
+
+### Patch Changes
+
+- Updated dependencies [dbd2072]
+  - @critical-path/core@0.15.2
+  - @critical-path/client@0.9.2
+
+## 0.10.1
+
+### Patch Changes
+
+- Updated dependencies [f53afab]
+  - @critical-path/core@0.15.1
+  - @critical-path/client@0.9.1
+
+## 0.10.0
+
+### Minor Changes
+
+- 21eb85c: Implement Universal Semantic Statuses & System-Derived Implied Statuses (3-Tier Status Architecture)
+  
+  - **Tier 1 (Universal Semantic Statuses)**: Defined canonical status enum `SemanticStatus = 'not_started' | 'in_progress' | 'completed' | 'canceled'` providing universal semantic meaning across any industry domain.
+  - **Tier 2 (Workflow-Defined Statuses)**: Updated `StatusDefinition` to map domain-specific statuses to a semantic `category`. Updated built-in workflows (Software, Creative, VFX, Simple) to classify statuses by category.
+  - **Tier 3 (System-Derived Implied Statuses)**: Added `deriveTaskLifecycleState` and `engine.getTaskLifecycleState(taskId)` returning dynamic indicators:
+    - Dependency: `isReady`, `isBlocked`, `blockingTaskIds`
+    - Schedule: `isOverdue`, `isUpcoming`, `isUnplanned`
+    - Ownership: `isUnassigned`, `isStalled`
+    - Estimate/Pace: `isOverEstimate`, `isPaceWarning`
+    - Convenience flags: `isDone`, `isActive`, `isCancelled`
+  - **Domain Entities & Engine**: Added automatic timestamp progression (`actualStartDate`, `actualEndDate`), progress completion, and event emission driven by semantic status categories.
+  - **React UI Hooks**: Updated `useKanban` to support dynamic custom workflow columns without dropping tasks, plus added `groupBy: 'semantic' | 'workflow'` option.
+  - **Client SDK**: Added `client.getTaskLifecycleState(taskId)`.
+
+### Patch Changes
+
+- Updated dependencies [21eb85c]
+  - @critical-path/core@0.15.0
+  - @critical-path/client@0.9.0
+
+## 0.9.5
+
+### Patch Changes
+
+- Updated dependencies [3dc2798]
+  - @critical-path/core@0.14.0
+  - @critical-path/client@0.8.4
+
+## 0.9.4
+
+### Patch Changes
+
+- Updated dependencies [573a4fa]
+  - @critical-path/core@0.13.3
+  - @critical-path/client@0.8.3
+
+## 0.9.3
+
+### Patch Changes
+
+- Updated dependencies [03d269c]
+  - @critical-path/core@0.13.2
+  - @critical-path/client@0.8.2
+
+## 0.9.2
+
+### Patch Changes
+
+- Updated dependencies [a7d17c0]
+  - @critical-path/core@0.13.1
+  - @critical-path/client@0.8.1
+
+## 0.9.1
+
+### Patch Changes
+
+- Updated dependencies [a4a464b]
+  - @critical-path/core@0.13.0
+  - @critical-path/client@0.8.0
+
+## 0.9.0
+
+### Minor Changes
+
+- 5a5930f: Add first-class Deliverable entity, Creative Workflow presets, and reactive UI bindings:
+  - `@critical-path/core`: Added `Deliverable` entity, `DeliverableSummary` rollup computation, `DEFAULT_CREATIVE_WORKFLOW` preset, `deliverableId` on tasks, store implementations (InMemory, SQLite, Firebase), domain events, and webhook integration.
+  - `@critical-path/server`: Added RESTful API endpoints for `/deliverables` and `/deliverables/:id/summary`.
+  - `@critical-path/client`: Added deliverable management and summary methods to `CriticalPathClient`.
+  - `@critical-path/react`: Added `useDeliverables` and `useDeliverableSummary` React hooks.
+  - `@critical-path/svelte`: Added `DeliverableState` and `createDeliverableState` Svelte 5 Runes state management.
+
+### Patch Changes
+
+- Updated dependencies [5a5930f]
+  - @critical-path/core@0.12.0
+  - @critical-path/client@0.7.0
+
+## 0.8.0
+
+### Minor Changes
+
+- 55549e9: Support @mentions in comments with extraction and segmentation utilities
+  
+  - Add `mentions?: string[]` to `Comment` interface
+  - Add `extractMentions` and `parseMentionSegments` utilities for mention parsing and UI rendering
+  - Auto-extract and populate mentions during `addComment` and `updateComment` in the engine
+  - Update SQLite comments schema with `mentions` column and migration
+  - Preserve and pass through mentions in server routes, client SDK, and Svelte bindings
+
+### Patch Changes
+
+- Updated dependencies [55549e9]
+  - @critical-path/core@0.11.0
+  - @critical-path/client@0.6.0
+
+## 0.7.0
+
+### Minor Changes
+
+- e9003d3: Add emoji reactions support for comment conversations with domain events, deduplication, REST endpoints, client SDK, and React/Svelte state integrations.
+
+### Patch Changes
+
+- Updated dependencies [e9003d3]
+  - @critical-path/core@0.10.0
+  - @critical-path/client@0.5.0
+
+## 0.6.0
+
+### Minor Changes
+
+- e983557: Add first-class optional todo list (checklist) support to Task model and TaskEntity with helper methods (addTodo, toggleTodo, removeTodo) and updateTask helper in @critical-path/svelte.
+
+### Patch Changes
+
+- Updated dependencies [e983557]
+  - @critical-path/core@0.9.0
+  - @critical-path/client@0.4.4
+
+## 0.5.4
+
+### Patch Changes
+
+- 9aa53f7: Optimistically remove comments and attachments upon delete with automatic rollback on network failure
+
+## 0.5.3
+
+### Patch Changes
+
+- 2d5ff04: fix(core): decode base64 strings and data URIs into binary Uint8Array in storage adapters
+- Updated dependencies [2d5ff04]
+  - @critical-path/core@0.8.3
+  - @critical-path/client@0.4.3
+
+## 0.5.2
+
+### Patch Changes
+
+- fix(core): decode base64 strings and data URIs into binary Uint8Array in storage adapters
+- Updated dependencies
+  - @critical-path/core@0.8.2
+  - @critical-path/client@0.4.2
+
+## 0.5.1
+
+### Patch Changes
+
+- 315425c: fix(core): generate Firebase Storage download tokens and construct valid public URLs
+- Updated dependencies [315425c]
+  - @critical-path/core@0.8.1
+  - @critical-path/client@0.4.1
+
+## 0.5.0
+
+### Minor Changes
+
+- 1811922: Add attachment URL validation against large data URIs, sanitize undefined properties in FirebaseStore, provide direct attachment upload routes & SDK methods, and introduce TaskActivityState for combined comment & attachment threads.
+
+### Patch Changes
+
+- Updated dependencies [1811922]
+  - @critical-path/core@0.8.0
+  - @critical-path/client@0.4.0
+
+## 0.4.0
+
+### Minor Changes
+
+- a48a04a: Add threaded conversations, attachment metadata management, and storage adapters (S3 & Firebase Storage):
+  
+  - **`@critical-path/core`**:
+    - Added `Attachment` entity, `CreateAttachmentInput`, `UploadFileInput`, and `FileStorageAdapter` contracts.
+    - Added `InMemoryFileStore`, duck-typed `S3StorageAdapter` (compatible with AWS SDK v3, v2, MinIO, and Cloudflare R2), and `FirebaseStorageAdapter` (compatible with Google Cloud Storage and Firebase Admin SDK).
+    - Extended `Comment` with `authorType` (`user`, `agent`, `system`) and `parentId` for threaded discussions.
+    - Implemented full comment and attachment repository methods across `InMemoryStore`, `SQLiteStore`, and `FirebaseStore`.
+    - Added engine operations for upload, presigning, and deleting attachments with domain events (`comment.*`, `attachment.*`) and webhooks.
+  
+  - **`@critical-path/server`**:
+    - Added RESTful routes for comments (`GET/POST /tasks/:taskId/comments`, `GET/POST /comments`, `GET/PATCH/DELETE /comments/:id`).
+    - Added RESTful routes for attachments (`GET/POST /tasks/:taskId/attachments`, `GET/POST /attachments`, `GET/DELETE /attachments/:id`, `POST /attachments/presign`).
+  
+  - **`@critical-path/client`**:
+    - Added SDK methods `getComments`, `getComment`, `addComment`, `updateComment`, `deleteComment`.
+    - Added SDK methods `getAttachments`, `getAttachment`, `createAttachment`, `deleteAttachment`, and `getPresignedAttachmentUploadUrl`.
+  
+  - **`@critical-path/react`**:
+    - Added `useComments(taskId)` with reactive thread tree derivation (`threads` containing nested `replies`) and comment mutations.
+    - Added `useAttachments(filter)` with attachment creation and deletion.
+  
+  - **`@critical-path/svelte`**:
+    - Added Svelte 5 Rune-based `CommentState` / `createCommentState(client, taskId)` with derived threaded hierarchy.
+    - Added Svelte 5 Rune-based `AttachmentState` / `createAttachmentState(client, filter)`.
+
+### Patch Changes
+
+- Updated dependencies [a48a04a]
+  - @critical-path/core@0.7.0
+  - @critical-path/client@0.3.0
+
+## 0.3.4
+
+### Patch Changes
+
+- Updated dependencies [6e9dece]
+  - @critical-path/core@0.6.0
+  - @critical-path/client@0.2.4
+
+## 0.3.3
+
+### Patch Changes
+
+- Updated dependencies [c24b76c]
+  - @critical-path/core@0.5.2
+  - @critical-path/client@0.2.3
+
+## 0.3.2
+
+### Patch Changes
+
+- Updated dependencies [34067fd]
+  - @critical-path/core@0.5.1
+  - @critical-path/client@0.2.2
+
+## 0.3.1
+
+### Patch Changes
+
+- Updated dependencies [83a5c17]
+  - @critical-path/core@0.5.0
+  - @critical-path/client@0.2.1
+
+## 0.3.0
+
+### Minor Changes
+
+- 35576a6: Introduce Workflow concept to the project management model with status definitions, allowed transition validation, task types, webhook events (workflow.created, workflow.updated, workflow.deleted), server routes, SDK methods, and React/Svelte state hooks.
+
+### Patch Changes
+
+- Updated dependencies [35576a6]
+  - @critical-path/core@0.4.0
+  - @critical-path/client@0.2.0
+
+## 0.2.4
+
+### Patch Changes
+
+- Updated dependencies [4b92228]
+  - @critical-path/core@0.3.0
+  - @critical-path/client@0.1.5
+
+## 0.2.3
+
+### Patch Changes
+
+- 3470b61: add optimistic updates with error rollback to Svelte state classes and React hooks
+
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies [df22aad]
+  - @critical-path/core@0.2.1
+  - @critical-path/client@0.1.4
+
+## 0.2.1
+
+### Patch Changes
+
+- 5160802: Publish Svelte 5 Runes state classes on 0.2.x prerelease line.
+
+## 1.0.0
+
+### Major Changes
+
+- 283e450: Modernize `@critical-path/svelte` for Svelte 5 Runes:
+  - Replaced Svelte 4 legacy stores (`createProjectStore`, `createTaskStore`) with Svelte 5 Runes state classes and factories (`ProjectState`, `createProjectState`, `TaskState`, `createTaskState`).
+  - Updated peer dependency requirement to `svelte: ^5.0.0`.
+  - Components now access reactive state properties directly (e.g. `taskState.data`, `projectState.loading`) without `$` store auto-subscriptions.
+
+## 0.1.3
+
+### Patch Changes
+
+- Updated dependencies [755286a]
+  - @critical-path/core@0.2.0
+  - @critical-path/client@0.1.3
+
+## 0.1.2
+
+### Patch Changes
+
+- Initial open-source release of Svelte reactive store factories (`createProjectStore`, `createTaskStore`).

package/README.md

@@ -2,6 +2,9 @@
 
 > **Svelte 5 Runes Reactive Integrations for Critical Path.**
 
+> **Upgrading?** Upgrade every `@critical-path/*` package together. Coding agents: follow [UPGRADING.md](https://github.com/Pixerate/critical-path/blob/main/UPGRADING.md); breaking changes are marked **BREAKING** in this package's `CHANGELOG.md`.
+
+
 `@critical-path/svelte` provides Svelte 5 Runes reactive state classes and factories (`ProjectState`, `TaskState`, `KanbanState`, `TaskTransitionsState`, `WorkflowState`, `CommentState`, `AttachmentState`, `TaskActivityState`, `DeliverableState`, `DeliverableSummaryState`, `WebMcpState`) for building project management UIs in Svelte 5 and SvelteKit applications.
 
 ---

package/dist/index.js

@@ -4586,7 +4586,7 @@ var xn = $({
 }), wn = $({
 	name: "list_tasks",
 	title: "List Tasks",
-	description: "List tasks (oldest first), optionally filtered by project, status, priority, assignee or iteration. Returns { tasks, nextCursor }; pass nextCursor back as cursor to get the next page.",
+	description: "List tasks (oldest first), optionally filtered by project, status, priority, assignee, iteration, deliverable, container or parent task ('none' for top-level tasks). Returns { tasks, nextCursor }; pass nextCursor back as cursor to get the next page.",
 	zodSchema: W({
 		projectId: z().optional().describe("Filter by project ID"),
 		status: z().optional().describe("Filter by task status key"),
@@ -4599,6 +4599,9 @@ var xn = $({
 		]).optional().describe("Filter by priority"),
 		assigneeId: z().optional().describe("Filter by assignee ID"),
 		iterationId: z().optional().describe("Filter by iteration (sprint) ID"),
+		deliverableId: z().optional().describe("Filter by deliverable ID"),
+		containerId: z().optional().describe("Filter by container (e.g. epic) ID"),
+		parentId: z().optional().describe("Subtasks of this task ID, or 'none' for top-level tasks only"),
 		limit: B().int().min(1).max(500).optional().describe("Page size (default 100)"),
 		cursor: z().optional().describe("nextCursor from a previous call")
 	}),
@@ -4610,6 +4613,9 @@ var xn = $({
 			priority: e.priority ? [e.priority] : void 0,
 			assigneeId: e.assigneeId,
 			iterationId: e.iterationId,
+			deliverableId: e.deliverableId,
+			containerId: e.containerId,
+			...e.parentId ? { parentId: e.parentId === "none" ? null : e.parentId } : {},
 			limit: e.limit,
 			cursor: e.cursor
 		});
@@ -4633,7 +4639,7 @@ var xn = $({
 		projectId: z().optional().describe("Project ID (inferred from active view in browser if omitted)"),
 		title: z().describe("Title of the task"),
 		description: z().optional().describe("Detailed description / markdown"),
-		status: z().optional().describe("Status (defaults to \"todo\" or first workflow status)"),
+		status: z().optional().describe("Status key (defaults to the project workflow's default status)"),
 		priority: K([
 			"urgent",
 			"high",
@@ -4657,7 +4663,7 @@ var xn = $({
 			projectId: r,
 			title: e.title,
 			description: e.description,
-			status: e.status || "todo",
+			...e.status ? { status: e.status } : {},
 			priority: e.priority || "none",
 			assigneeId: e.assigneeId,
 			dueDate: e.dueDate,
@@ -4947,6 +4953,10 @@ function In(e) {
 	let t = e.document ?? (typeof document < "u" ? document : null), n = e.navigator ?? (typeof navigator < "u" ? navigator : null), r = e.window ?? (typeof window < "u" ? window : null), i;
 	t?.modelContext ? i = t.modelContext : n?.modelContext ? i = n.modelContext : t && (i = Fn(t) ?? void 0);
 	let a = e.tools ? Pn.filter((t) => e.tools.includes(t.name)) : Pn, o = [], s = new AbortController();
+	if (e.signal?.aborted) return {
+		unregister: () => {},
+		getRegisteredTools: () => []
+	};
 	e.signal && e.signal.addEventListener("abort", () => s.abort(), { once: !0 });
 	for (let t of a) {
 		let n = {
@@ -4954,7 +4964,10 @@ function In(e) {
 			title: t.title,
 			description: t.description,
 			inputSchema: t.inputSchema,
-			annotations: t.annotations,
+			annotations: {
+				readOnlyHint: t.annotations?.readOnlyHint ?? !1,
+				destructiveHint: t.annotations?.requiresConfirmation ?? !1
+			},
 			execute: async (n) => {
 				let r = e.projectId ? { projectId: e.projectId } : void 0, i = await t.execute(bn(t, n), e.client, r);
 				return e.onToolExecuted?.(t.name, n, i), i;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@critical-path/svelte",
-  "version": "0.18.18",
+  "version": "0.18.20",
   "description": "Svelte 5 Runes state and reactive integrations for Critical Path headless project management framework",
   "author": "Jack James",
   "license": "MIT",
@@ -18,9 +18,9 @@
     }
   },
   "dependencies": {
-    "@critical-path/core": "0.50.0",
-    "@critical-path/client": "0.24.5",
-    "@critical-path/mcp": "0.17.2"
+    "@critical-path/core": "0.51.1",
+    "@critical-path/client": "0.25.1",
+    "@critical-path/mcp": "0.18.1"
   },
   "peerDependencies": {
     "svelte": "^5.0.0"
@@ -38,6 +38,7 @@
   },
   "files": [
     "dist",
+    "CHANGELOG.md",
     "!dist/**/*.test.*"
   ],
   "scripts": {