@defrex/autobuild 0.12.0 → 0.13.0

package/docs/remote-ticket-protocol.md

@@ -67,6 +67,16 @@ must match the credential's project; mismatches are 403. Owner admin requests
 require this selector and registration is checked before configuration is read.
 Internal operator credentials remain forbidden on machine ticket routes.
 
+Hosted ticket attachments use the ticket service's existing repository-keyed
+asset routes with the ticket connection's URL and credential, independently
+of the build store. Names, revisions, tombstones and service limits are
+unchanged. Existing service attachments need no migration; old local
+attachments are not moved or used as a fallback. A claim or ticket spec re-pin
+copies exact revisions into immutable chunked repository artifacts in the
+destination build store. Build pins reference explicit snapshot manifests;
+build-scoped asset reads need no ticket credentials. Old pins without snapshot
+references keep their existing ticket-row lookup.
+
 The strict request envelope is:
 
 ```json
@@ -82,16 +92,37 @@ The strict request envelope is:
 
 `teamKey` remains required for older client compatibility. It and the optional
 `claimedState` / `createState` fields are ignored as policy inputs. The service
-loads the project's latest effective configuration from its repository journal
-and artifact bytes for every operation. Missing or invalid configuration returns
-an actionable 409; run the project's dispatcher to publish its configuration.
-There is no deployment-wide lifecycle fallback.
+loads the project's durable independent ticket policy. Project authority publishes
+version 1 policy through `POST /tickets/policy`, using the usual context/input
+envelope. The input contains only `version` and `tickets`: source, teamKey,
+readyState, triageState, claimedState, doneState, createState, proposalState and
+optional readyLabels. URL, secrets, and pipeline configuration are rejected.
+Only project or owner authority can publish. This does not append BuildStore
+history. Registration removal invalidates policy and grants from that registration.
+
+For compatibility, projects without independent policy use their latest uploaded
+dispatcher configuration with the old `Backlog`, `Doing`, `Done` defaults.
+New policy defaults are `triage`, `ready`, `doing`, `done`; create/proposal follow
+triage. States are persistent project data, including empty states and optional
+one-line purposes. Configured role names always exist; removed roles remain as
+custom states and keep their tickets. Explicit settings preserve state spelling.
+State lookup prefers an exact match, then a unique case-insensitive match;
+unknown or ambiguous names are refused. Lists order configured triage, ready,
+doing, done first (deduplicated), then other names alphabetically.
+
+`[tickets] url` selects the ticket service independently of the build store;
+otherwise the selected remote build store is used. A local build store requires
+an explicit ticket URL. Credentials are resolved for that selected service.
+`ab connect --tickets URL` registers and publishes policy before any dispatcher run.
 
-Hosted lifecycle defaults are triage `Backlog`, claimed `Doing`, done `Done`,
-and create/proposal equal to triage. `readyState` is required. The allowed states
-are the distinct union of these configured roles, including custom create and
-proposal states; roles may overlap. Historical states remain readable unchanged.
-`tickets.doneState` controls completion and the dispatcher's merged transition.
+`POST /tickets/grants` issues, renews or revokes short-lived, digest-stored ticket
+grants. Project authority issues runner grants scoped to project and execution;
+runners may issue only read-only phase children bound to themselves. Runner grants
+allow read and create; phase grants allow read only. Policy, claim, moves, comments,
+updates, blocker changes, BuildStore, and credential administration are denied.
+AB_TICKET_URL and AB_TICKET_TOKEN carry this authority separately from AB_STORE and
+AB_TOKEN. Revocation, expiry, parent revocation and registration changes invalidate
+grants. Existing combined-service BuildStore delegation remains supported.
 
 The service never contacts Linear or relays external trackers. If the project's
 source is Linear, file or another non-hosted source, machine HTTP, operator and
@@ -111,6 +142,8 @@ The operation names and `input` values are:
 
 | Operation | Input | Successful response |
 |---|---|---|
+| `states` | `{}` | `{name, tickets, about?}[]`, including empty states |
+| `add-state` | `{name, about?: string}` | `{state: {name,tickets,about?}, created: boolean}` |
 | `list-ready` | `{labels?: string[], state?: string}` | `TicketListing` |
 | `get` | `{id}` | `Ticket \| null` |
 | `claim` | `{id}` | `{claimed: boolean}` |
@@ -132,6 +165,35 @@ Ticket body strings are opaque. Clients, JSON handling, the service, and the
 database backend must not trim or normalize bytes, newlines, Unicode, blank
 lines, or trailing whitespace.
 
+## Readable ticket identity
+
+New hosted tickets use `<teamKey>-<n>`, for example `ENG-1`. The effective
+project configuration supplies the literal prefix; the request's `teamKey`
+does not choose it. Numbers start at 1 in each project, increase atomically
+across concurrent creates, and are never reused after deletion. Projects sharing
+a team key have independent counters. Changing `teamKey` affects only future
+ids and continues the same numbering; existing ids retain their captured prefix.
+
+Every ticket operation, CLI command, MCP tool and blocker input accepts readable
+ids in any letter case. Legacy storage ids (such as `ticket-<uuid>`) remain
+aliases, including references in existing builds, harvest records and assets.
+Current ticket and blocker output uses the canonical readable id. The exception
+is `dependency-states`: each result's `id` echoes the requested id for correlation,
+while its `blockedBy` edges are canonical. Raw historical events and artifacts
+remain unchanged. These rules apply only to hosted tickets, not file or Linear ids.
+
+Upgrade the service with its environment-aware migration command before serving
+requests. The transactional migration preserves storage keys and assigns existing
+tickets numbers in `(created_at, id)` order within each project. It first resolves
+legacy team ownership, then reads each populated project's current independent
+ticket policy. Projects without that policy use their selected effective
+configuration through the configured blob backend. Independent-policy projects
+need no uploaded config or blob access. Missing or invalid fallback config,
+missing `teamKey`, or inaccessible required blobs abort the entire migration
+unchanged with a project diagnostic. Restore that config/blob access and rerun;
+an ownership assignment alone cannot supply a readable prefix. Empty projects
+need no config lookup. Re-running a completed migration does not renumber tickets.
+
 ## Errors and conformance
 
 Errors are JSON `{ "error": string, "kind": "validation" | "not-found" |
@@ -170,3 +232,83 @@ project removal are also checked before parsing or source construction.
 
 Ticket admission and assets use the authenticated project, including for
 delegated harvest grants.
+
+Custom state creation uses `/^[a-z][a-z0-9-]{0,39}$/`; an optional purpose must
+be one nonblank line. A duplicate in any letter case is refused without
+changing purpose. `add-state` requires project or owner machine authority;
+ticket grants and harvest delegations can read states but cannot create them.
+Request context cannot supply lifecycle policy or insert another project's
+states. These operations use the existing wire version and strict envelopes.
+
+## Revision-checked ticket writes
+
+Every ticket read includes an opaque `revision`. Pass it as `expectedRevision`
+(on MCP/operator requests) or `--expected-revision <opaque>` on `ab ticket update`,
+`move`, `block` and `unblock`. A stale write fails without changing anything and
+reports the current revision. Omission preserves unguarded behavior. Blocker
+checks cover the entire batch. Dispatcher moves remain unguarded and change the
+revision. Sources without guarded writes, including Linear, refuse supplied
+revisions rather than ignoring them.
+
+`ab ticket edit <id>` opens `$VISUAL`, falling back to `$EDITOR`, using TOML
+frontmatter and a Markdown body. Only title, body and labels are editable;
+id, blockers, creation key and reference comments are read-only. It saves only
+changed fields with the opening revision. Unchanged or formatting-only edits
+write nothing. On conflict, invalid input or editor failure, the error names an
+absolute file path containing the edited text. Read the current ticket and
+reapply the intended changes before retrying; conflicts are never merged.
+
+File and Linear revisions fingerprint title, body, canonical label/blocker sets
+and state; reverting identical content restores its fingerprint. File checks
+re-read immediately before writing, with the existing no-lock race window.
+Direct file edits and state-directory moves change revisions. File revisions also
+cover structured comments and portable attachments. Legacy file comments change
+the body; structured comments preserve it. Separate hosted comments do not change
+ticket revisions. Hosted revisions
+are monotonic decimal bigint strings, and checks run under the same row lock
+and transaction as all requested changes. Hosted reads return a coherent
+snapshot of fields, blockers and revision.
+
+### Guarded mutation transport
+
+`POST /tickets/mutate-if-revision` accepts the usual authenticated context and
+`input: { id, expectedRevision, mutation }`. Mutation is one of
+`{ kind: "update", patch: { title?, body?, labels? } }`,
+`{ kind: "transition", state }`, or
+`{ kind: "blockers", operation: "block" | "unblock", ids: string[] }`.
+Unknown keys and empty patches are refused. Success returns `{ ok: true }`.
+A revision conflict returns HTTP 409 with `kind: "conflict"`, `error`, `id`,
+`expectedRevision` and `currentRevision`. Delegated credentials retain existing
+permissions: none of the guarded mutation variants grants additional access.
+Ticket responses include `revision` only when the request advertises
+`x-autobuild-ticket-revisions: 1`. The current hosted client sends this header
+on every request and requires revision-bearing responses. Released clients
+through 0.12.x omit the header and retain their strict decoder's original
+response shape on get, list-ready and create. This explicit capability also
+supports new source checkouts that still report version 0.12.0; version alone
+cannot distinguish them from released clients. Unknown capability values do
+not opt in. Clients before 0.11 also omit the existing resolution projections.
+The capability does not change authentication, authorization or the remote
+BuildStore protocol version.
+
+## Requested ids for migration
+
+Create options accept optional `requestedId: string` alongside `state` and
+`idempotencyKey`. Older clients omit it and responses are unchanged. Unsupported
+sources reject supplied ids; Linear is not an import target. File sources keep
+filesystem-safe ids exactly and never overwrite an occupied id.
+
+Hosted sources preserve only literal own-team `<teamKey>-<n>` ids, where `n` is a
+positive canonical decimal within PostgreSQL bigint bounds. For example,
+`AUT-706` in team `AUT` keeps 706; `OTHER-706`, `AUT-01` and `AUT-0` use ordinary
+allocation. Overflow canonical numbers are rejected. A matching creation key is
+adopted before occupancy checks. A kept number belonging to a different ticket
+fails without replacing it. Creation and counter advancement share the existing
+project transaction and counter lock. Later automatic numbers exceed both the
+counter and highest occupied number; importing a lower number never lowers the
+counter. Requested ids require project or owner authority. Ticket grants and
+delegated credentials receive 403 for create options containing `requestedId`,
+before source construction. Their ordinary create grants remain unchanged.
+
+See the [migration procedure](ticket-migration.md) for preflight, state mapping,
+resumption and portable file records.

package/docs/setup.md

@@ -398,13 +398,13 @@ the verifier does not fix it.
 ### Project-scoped hosted tickets
 
 Hosted ticket queues belong to the credential's registered repository, even
-when projects share a team key. The latest uploaded effective `[tickets]`
-configuration owns lifecycle: hosted defaults are Backlog / Doing / Done,
-`readyState` is required, `doneState` customizes completion, and create/proposal
-default to triage. The union of configured roles is allowed; roles may overlap.
-Owner admin requests require an explicit registered `context.repo`; project
-credentials cannot select another project. Missing effective configuration is
-an actionable refusal: run the project's dispatcher to publish it.
+when projects share a team key. Independent project ticket policy owns lifecycle:
+new defaults are triage / ready / doing / done, with create/proposal following
+triage. Explicit names retain their spelling; doneState customizes completion.
+`ab connect --tickets URL` publishes policy before dispatch. Older clients without
+independent policy retain their uploaded dispatcher configuration and legacy defaults.
+Owner admin requests require an explicit registered context.repo; project credentials
+cannot select another project. See [local builds with hosted tickets](#local-builds-with-hosted-tickets).
 
 The service never contacts Linear. Projects with external sources (including
 file and Linear) keep using those sources directly through their dispatcher;
@@ -447,3 +447,29 @@ require the running service's blob backend, access mode, credentials and prefix
 (`AB_BLOB_PREFIX`), not just PostgreSQL access. `deploy:build` inherits this
 environment and migration failure stops Next build. Fresh databases, empty v1
 queues and v2 reruns stay SQL-only and do not initialize blob storage.
+
+## Local builds with hosted tickets
+
+Hosted tickets do not require hosted builds. Set `[tickets] source = "hosted"`
+and `teamKey = "ENG"`, then run `ab connect --tickets https://your-service.example`.
+Approve the project in the browser. This saves a service-scoped credential and
+`[tickets] url` while leaving `[store]` unchanged. Ticket commands work immediately,
+before any dispatcher runs. `ab connect` reports every service and whether it serves
+builds, tickets, or both. Use `ab disconnect --tickets` to revoke ticket access;
+when services differ use `--builds` to select build access. Shared uses share one
+credential, so disconnecting either shared use affects both.
+
+Ticket URL selection is `[tickets] url`, then the selected build service (including
+AB_STORE or a supported --store override). With local builds, `[tickets] url` is
+required. Builds, events, artifacts, and harvest journals remain in the local store.
+The service stores ticket records, project ticket policy, and restricted ticket
+grants. Normal project clients synchronize current `[tickets]` policy before use;
+failed synchronization fails the operation. Harvest grants can read and create;
+phase grants can only read. Neither can change policy or access BuildStore routes.
+
+New hosted policy defaults to `triage`, `ready`, `doing`, `done`, with creation and
+harvest proposals in `triage`. Explicit state names preserve their spelling.
+To retain earlier names configure `triageState = "Backlog"`,
+`claimedState = "Doing"`, `doneState = "Done"`, and the desired `readyState`.
+Existing ticket rows are never renamed. Older combined-service clients continue
+using the uploaded dispatcher configuration until independent policy is published.

package/docs/ticket-migration.md

@@ -0,0 +1,64 @@
+# Moving a project between ticket sources
+
+Export and import use the ordinary file ticket layout. They operate on tickets
+and current attachments through the ticket source; neither command contacts the
+forge. File and hosted sources support import. Linear supports export only.
+
+1. Pause intake and stop other ticket writers for the cutover. Import preflight
+   does not reserve numbers against concurrent writers.
+2. With the old `[tickets]` configuration, run `ab ticket export /path/to/export`.
+   The destination must be absent or empty. Export reads every state, including
+   archived Linear tickets and empty discoverable states, and publishes the
+   directory only after all reads succeed. Back up the target tracker too.
+3. Configure the new `[tickets]` source, or use `ab connect --tickets URL` for a
+   hosted ticket service. Keep the export directory intact.
+4. Run `ab ticket import /path/to/export`. Inspect its printed ticket and state
+   mappings and `/path/to/export/.ab-import-map.json`.
+5. Inspect ticket bodies, labels, blockers, comments and attachments in the new
+   source. Confirm lifecycle configuration and the ready gate, then resume intake.
+
+Both commands also accept
+`--store <ref>` to reach legacy BuildStore attachments. Keep the old store available
+through export when file or Linear tickets have attachments there.
+
+State directory names use lowercase letters, digits and hyphens, start with a
+letter and contain at most forty characters. Export maps `In Progress` to
+`in-progress`, `Backlog` to `backlog`, and `Done` to `done`. It retains each ticket's
+state rather than assigning lifecycle roles. Distinct names that collapse to the
+same directory fail before publication. The hidden `.ab-migration.json` records
+original display names and the state map. Import also accepts ordinary legacy
+file layouts: it reuses exact or unique case-insensitive target states before
+normalizing new names. A seeded `done` satisfies `Done`; absent `In Progress`
+creates `in-progress`. Ambiguous matches and colliding state maps fail preflight.
+
+File targets retain source ids. Hosted targets keep canonical own-team ids:
+`AUT-706` imported into team `AUT` stays `AUT-706`. Other ids receive numbers above
+all existing and preserved incoming numbers. Known clashes with unrelated tickets
+are reported together before any target state, ticket, comment or asset write.
+Content similarity and stale mapping files never establish identity.
+
+Creation keys establish identity. Exports retain existing keys and assign keys to
+legacy tickets. Importing an ordinary file layout first saves a hidden migration
+identity and keys in that input directory. Preserve this file and the input across
+retries. After interruption, rerun the same command: committed creates are adopted
+by key even if their mapping write failed. Adopted bodies and other fields are not
+overwritten. Missing blockers and comments are replayed, and unchanged attachments
+do not create another revision. Comments are deduplicated by exact body, so two
+identical source comment bodies produce one target comment. Original authors and
+timestamps remain in the export; imported comments use the target's metadata.
+
+Portable records use TOML frontmatter between `+++` fences and an unchanged
+Markdown body. Alongside `id`, `title`, `labels`, `blockedBy` and `idempotencyKey`,
+optional `comments` contain `body`, `createdAt` and optional `author`. Optional
+`attachments` contain `kind`, `name`, `layout` (`file` or `tree`) and `entries`:
+`{ type = "dir", path = "empty" }` or
+`{ type = "file", path = "image.png", base64 = "…" }`. Common asset limits and
+path validators apply. Only current attachment contents travel, including binary
+files and empty directories; historical revisions do not. The exported directory
+works directly as a file source, without its migration manifest or original store.
+File source revision history stays in its hidden `.ab-assets` directory.
+
+Legacy records without `comments` retain their Markdown comment append behavior;
+export never interprets Markdown headings as structured history. New file tickets
+use structured comments and preserve their body when a comment is added. There is
+no continuous sync, assignee migration, state history or build-history migration.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defrex/autobuild",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Agent-driven software delivery from groomed ticket to merged PR",
   "repository": {
     "type": "git",
@@ -143,8 +143,8 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.5",
-    "@defrex/autobuild-postgres-store": "0.11.0",
-    "@defrex/autobuild-vercel-sandbox": "0.11.0",
+    "@defrex/autobuild-postgres-store": "0.12.0",
+    "@defrex/autobuild-vercel-sandbox": "0.12.0",
     "@resvg/resvg-js": "2.6.2",
     "@types/bun": "^1.3.14",
     "@types/node": "^24.0.0",

package/packages/core/src/cli/build-control.ts

@@ -464,6 +464,7 @@ export interface ControlBuildOpts {
   via?: Via
   action: BuildControlAction
   /** Injected only for --revise-spec-from-ticket. */
+  prepareTicketAssets?: (ref: TicketRef, store: BuildStore, repo: string) => Promise<PinnedAsset[]>
   readTicketBody?: (ref: TicketRef) => Promise<string>
 }
 
@@ -624,7 +625,15 @@ export async function controlBuild(opts: ControlBuildOpts): Promise<BuildControl
               )
             }
             body = await opts.readTicketBody(record.ticket)
-            assets = await samplePinnedAssets(opts.store, record.repo, record.ticket.id)
+            if (record.ticket.source === 'hosted' && !opts.prepareTicketAssets) {
+              throw new BuildControlError(
+                'ticket-unavailable',
+                'hosted ticket asset preparation is unavailable',
+              )
+            }
+            assets = opts.prepareTicketAssets
+              ? await opts.prepareTicketAssets(record.ticket, opts.store, record.repo)
+              : await samplePinnedAssets(opts.store, record.repo, record.ticket.id)
           }
           const conformance = specConformance(body)
           if (!conformance.conforms) {
@@ -862,6 +871,7 @@ export interface AbBuildControlOpts {
   /** Explicit `--store`; selection remains --store > AB_STORE > repo-local. */
   storeRef?: string
   /** Injected only for --revise-spec-from-ticket. */
+  prepareTicketAssets?: (ref: TicketRef, store: BuildStore, repo: string) => Promise<PinnedAsset[]>
   readTicketBody?: (ref: TicketRef) => Promise<string>
   /** Injectable adapter seam for unit tests. */
   openStore?: StoreOpener
@@ -881,6 +891,7 @@ export async function abBuildControl(opts: AbBuildControlOpts): Promise<BuildCon
       env: opts.env,
       action: opts.action,
       ...(opts.readTicketBody !== undefined ? { readTicketBody: opts.readTicketBody } : {}),
+      ...(opts.prepareTicketAssets ? { prepareTicketAssets: opts.prepareTicketAssets } : {}),
     }),
   )
 }

package/packages/core/src/cli/connect.ts

@@ -1,3 +1,6 @@
+import { parseConfig } from '../config/load'
+import { HostedTicketSource } from '../ports/tickets/remote'
+import { ticketLifecycle } from '../ports/tickets/lifecycle'
 import { createHash, randomBytes, randomUUID } from 'node:crypto'
 import { access, readFile, rename, unlink, writeFile } from 'node:fs/promises'
 import { constants } from 'node:fs'
@@ -14,6 +17,8 @@ import { resolveMainRepo } from './repo-state'
 import { ProjectCredentials } from './project-credentials'
 
 interface ConnectOptions {
+  tickets?: boolean
+  builds?: boolean
   cwd: string
   env: Record<string, string | undefined>
   exec: Exec
@@ -45,8 +50,15 @@ async function project(opts: ConnectOptions) {
   const store = table.store as { url?: unknown } | undefined
   if (store && (typeof store !== 'object' || Array.isArray(store)))
     throw new Error('Invalid [store] configuration')
-  const service = store?.url === undefined ? undefined : normalizeServiceURL(String(store.url))
-  return { checkout, repo, path, text, table, service }
+  const tickets = table.tickets as { source?: string; url?: string } | undefined
+  const buildService = opts.env.AB_STORE?.trim() || store?.url
+  const ticketService = tickets?.source === 'hosted' ? (tickets.url ?? buildService) : undefined
+  const selected = opts.tickets ? ticketService : buildService
+  const service =
+    typeof selected === 'string' && /^https?:/.test(selected)
+      ? normalizeServiceURL(selected)
+      : undefined
+  return { checkout, repo, path, text, table, service, buildService, ticketService }
 }
 async function request(
   opts: ConnectOptions,
@@ -84,45 +96,64 @@ async function atomicConfig(path: string, before: string, after: string) {
   }
 }
 export async function abConnect(raw: string | undefined, opts: ConnectOptions): Promise<void> {
+  if (opts.tickets && opts.builds) throw new Error('Choose --tickets or --builds')
   const p = await project(opts)
+  if (opts.tickets && (p.table.tickets as { source?: string } | undefined)?.source !== 'hosted')
+    throw new Error('ab connect --tickets requires [tickets] source = "hosted"')
   const credentials = new ProjectCredentials(opts.env)
   if (raw === undefined) {
-    if (!p.service) {
-      opts.print(
-        `Project: ${p.repo}\nService: unconfigured\nCredential: missing; run ab connect <url>`,
-      )
+    const connections = new Map<string, string[]>()
+    for (const [use, candidate] of [
+      ['builds', p.buildService],
+      ['tickets', p.ticketService],
+    ] as const) {
+      if (typeof candidate !== 'string' || !/^https?:/.test(candidate)) continue
+      const service = normalizeServiceURL(candidate)
+      connections.set(service, [...(connections.get(service) ?? []), use])
+    }
+    if (connections.size === 0) {
+      opts.print(`Project: ${p.repo}\nService: unconfigured`)
       return
     }
-    const entry = credentials.load(p.service, p.repo)
-    let status = 'missing; run ab connect'
-    if (entry) {
-      try {
-        const response = await request(opts, p.service, 'status', undefined, entry.token)
-        if (response.ok) {
-          const body = (await response.json()) as {
-            repo?: string
-            credentialId?: string
-            accepted?: boolean
+    for (const [service, uses] of connections) {
+      opts.print(`Uses: ${uses.join(', ')}`)
+      if (!service) {
+        opts.print(
+          `Project: ${p.repo}\nService: unconfigured\nCredential: missing; run ab connect <url>`,
+        )
+        return
+      }
+      const entry = credentials.load(service, p.repo)
+      let status = 'missing; run ab connect'
+      if (entry) {
+        try {
+          const response = await request(opts, service, 'status', undefined, entry.token)
+          if (response.ok) {
+            const body = (await response.json()) as {
+              repo?: string
+              credentialId?: string
+              accepted?: boolean
+            }
+            if (body.repo !== p.repo || body.credentialId !== entry.id || body.accepted !== true)
+              throw new Error('Invalid status response')
           }
-          if (body.repo !== p.repo || body.credentialId !== entry.id || body.accepted !== true)
-            throw new Error('Invalid status response')
+          status = response.ok
+            ? 'accepted'
+            : response.status === 401 || response.status === 403
+              ? 'rejected; run ab connect'
+              : 'unreachable'
+        } catch {
+          status = 'unreachable'
         }
-        status = response.ok
-          ? 'accepted'
-          : response.status === 401 || response.status === 403
-            ? 'rejected; run ab connect'
-            : 'unreachable'
-      } catch {
-        status = 'unreachable'
       }
+      opts.print(`Service: ${service}\nProject: ${p.repo}\nCredential: ${status}`)
     }
-    opts.print(`Service: ${p.service}\nProject: ${p.repo}\nCredential: ${status}`)
     return
   }
   const service = normalizeServiceURL(raw)
-  if (p.service && p.service !== service)
+  if (!opts.tickets && p.service && p.service !== service)
     throw new Error(
-      'Configured [store] url differs; update it explicitly before connecting to another service',
+      `Configured [${opts.tickets ? 'tickets' : 'store'}] url differs; update it explicitly before connecting to another service`,
     )
   await access(p.path, constants.W_OK)
   await access(dirname(p.path), constants.W_OK)
@@ -169,6 +200,7 @@ export async function abConnect(raw: string | undefined, opts: ConnectOptions):
   let approved = false
   let configChanged = false
   let saved = false
+  let updatedText = p.text
   try {
     let outcome: ConnectionOutcome | undefined
     while (!opts.signal?.aborted && now() <= Date.parse(started.expiresAt) + interval) {
@@ -199,15 +231,42 @@ export async function abConnect(raw: string | undefined, opts: ConnectOptions):
     approved = true
     if (outcome.repo !== p.repo || outcome.credentialId !== id)
       throw new Error('Approval identity mismatch')
-    if (!p.service) {
-      // Dotted root key also supports an existing empty [store] table after it.
-      const after = `store.url = ${JSON.stringify(service)}\n${p.text}`
-      const parsed = parse(after)
-      if ((parsed.store as { url?: string })?.url !== service)
-        throw new Error('Cannot safely update [store] url; add it manually and retry')
-      await atomicConfig(p.path, p.text, after)
+    if (!p.service || (opts.tickets && (p.table.tickets as { url?: string }).url !== service)) {
+      updatedText = setConnectionURL(p.text, opts.tickets ? 'tickets' : 'store', service)
+      if (opts.tickets) parseConfig(updatedText)
+      else parse(updatedText)
+      await atomicConfig(p.path, p.text, updatedText)
       configChanged = true
     }
+    const configuredTickets = p.table.tickets as { source?: string; url?: string } | undefined
+    if (
+      opts.tickets ||
+      (configuredTickets?.source === 'hosted' &&
+        (!configuredTickets.url || normalizeServiceURL(configuredTickets.url) === service))
+    ) {
+      const tickets = parseConfig(updatedText).tickets
+      const lifecycle = ticketLifecycle(tickets)
+      await new HostedTicketSource({
+        url: service,
+        token,
+        repo: p.repo,
+        teamKey: tickets.teamKey!,
+        ...(opts.fetch ? { fetchFn: (input, init) => opts.fetch!(String(input), init) } : {}),
+      }).synchronizePolicy({
+        version: 1,
+        tickets: {
+          source: 'hosted',
+          teamKey: tickets.teamKey!,
+          readyState: lifecycle.ready,
+          triageState: lifecycle.triage,
+          claimedState: lifecycle.doing,
+          doneState: lifecycle.done,
+          createState: lifecycle.create,
+          proposalState: lifecycle.proposal,
+          ...(tickets.readyLabels !== undefined ? { readyLabels: tickets.readyLabels } : {}),
+        },
+      })
+    }
     credentials.save({ service, repo: p.repo, id, token })
     saved = true
     if (previous) {
@@ -233,21 +292,35 @@ export async function abConnect(raw: string | undefined, opts: ConnectOptions):
       }
       if (configChanged) {
         try {
-          await atomicConfig(p.path, `store.url = ${JSON.stringify(service)}\n${p.text}`, p.text)
+          await atomicConfig(p.path, updatedText, p.text)
         } catch {
-          opts.print('Restore [store] url manually if needed; configuration changed concurrently.')
+          opts.print(
+            `Restore [${opts.tickets ? 'tickets' : 'store'}] url manually if needed; configuration changed concurrently.`,
+          )
         }
       }
     }
     throw new Error(
       approved
-        ? 'Connection could not be saved; previous credential retained. Repair local storage and run ab connect again.'
+        ? `Connection could not be saved; previous credential retained. ${(error as Error).message}. Repair the reported error and run ab connect again.`
         : (error as Error).message,
     )
   }
 }
 export async function abDisconnect(opts: ConnectOptions): Promise<void> {
+  if (opts.tickets && opts.builds) throw new Error('Choose --tickets or --builds')
   const p = await project(opts)
+  if (
+    !opts.tickets &&
+    !opts.builds &&
+    p.ticketService &&
+    p.service &&
+    normalizeServiceURL(String(p.ticketService)) !== p.service
+  )
+    throw new Error(
+      'Multiple services: use ab disconnect --tickets for tickets; set AB_STORE to the build service and select --builds for builds',
+    )
+  if (!p.service && !opts.builds && p.ticketService) return abDisconnect({ ...opts, tickets: true })
   if (!p.service) throw new Error('No configured service')
   const credentials = new ProjectCredentials(opts.env)
   const entry = credentials.load(p.service, p.repo)
@@ -255,7 +328,37 @@ export async function abDisconnect(opts: ConnectOptions): Promise<void> {
     opts.print('No stored credential; project configuration and service data retained.')
     return
   }
+  if (p.ticketService && p.buildService === p.ticketService)
+    opts.print('Builds and tickets share this credential; disconnecting affects both uses.')
   await revoke(opts, p.service, entry.token)
   credentials.remove(p.service, p.repo)
   opts.print('Disconnected; project registration, data, and [store] url retained.')
 }
+
+/** Edit only the selected table; preserve unrelated configuration and comments. */
+export function setConnectionURL(
+  text: string,
+  table: 'tickets' | 'store',
+  service: string,
+): string {
+  const lines = text.split('\n')
+  let inside = false
+  let start = -1
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]!
+    if (/^\s*\[/.test(line)) {
+      if (inside) {
+        lines.splice(i, 0, `url = ${JSON.stringify(service)}`)
+        return lines.join('\n')
+      }
+      inside = new RegExp(`^\\s*\\[${table}\\]\\s*(?:#.*)?$`).test(line)
+      if (inside) start = i
+    } else if (inside && /^\s*url\s*=/.test(line)) {
+      lines[i] = `url = ${JSON.stringify(service)}`
+      return lines.join('\n')
+    }
+  }
+  if (start >= 0) lines.splice(start + 1, 0, `url = ${JSON.stringify(service)}`)
+  else lines.push(`[${table}]`, `url = ${JSON.stringify(service)}`)
+  return lines.join('\n')
+}

package/packages/core/src/cli/context.ts

@@ -273,7 +273,13 @@ export async function buildContext(deps: ContextDeps): Promise<ContextManifest>
   if (inputs.ticket === true) {
     const created = events.find((event) => event.type === 'build.created')
     if (created !== undefined && created.type === 'build.created') {
-      const ticket = created.payload.ticket
+      const original = created.payload.ticket
+      const current =
+        original.source === 'hosted' ? (await store.getBuild(build))?.ticket : undefined
+      const ticket = {
+        ...original,
+        ...(current?.source === original.source ? { id: current.id } : {}),
+      }
       const lines = [
         `# Ticket: ${ticket.title ?? ticket.id}`,
         '',