@maudecode/kanvil 0.2.1 → 0.3.0

package/apps/server/dist/index.mjs

@@ -1,12 +1,14 @@
-import { a as instanceUpdateSchema, c as s3SettingsSchema, d as createDatabase, f as account, g as user, h as session, i as brokerSettingsSchema, n as adminInstanceSchema, o as photoInputSchema, p as apikey, s as photoResultSchema, t as readConfig, u as searchSettingsSchema } from "./config-CbNqtJEj.mjs";
+import { a as instanceUpdateSchema, b as user$1, c as s3SettingsSchema, d as createDatabase, f as account, i as brokerSettingsSchema, m as auth_schema_exports, n as adminInstanceSchema, o as photoInputSchema, p as apikey, s as photoResultSchema, t as readConfig, u as searchSettingsSchema, y as session } from "./config-D3cAABi7.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { A as pushDevices, B as memberSchema, D as profilePhotos, E as notifications, F as workspaces, G as pushDeviceInput, H as notificationPreferencesSchema, I as ApiError, J as matchesOIDCBinding, K as roles, L as errorSchema, M as subscriptions, N as tickets, O as projects, P as workspaceMembers, R as hasAdminRole, S as events, T as notificationPreferences, U as okSchema, V as notificationPreferencesInput, W as operations, _ as attachmentContent, a as fail, b as deliveryCheckpoints, c as requireRow, d as createTicketIndex, f as createBlobStorage, g as createPollingJob, h as createObjectStore, i as createDomain, j as storageBackends, k as pushDeliveries, l as projectRoleSQL, m as imageResponse, n as createInstance, o as json, p as decodeImage, q as scopes, r as assertVersion, s as one, t as createAuth, u as createTicketSearch, v as attachments, w as members, x as eventClock, y as blobObjects, z as isOperation } from "./auth-I1XEr0d4.mjs";
+import { $ as subscriptions, A as createTicketSearch, B as blobObjects, C as DeliveryError, Ct as roles, D as requireInstanceAdmin, Dt as matchesOIDCBinding, E as createWriteLimiter, Et as ticketExportFormat, F as stagedUploadCutoff, G as members, H as eventClock, I as createObjectStore, J as profilePhotos, K as notificationPreferences, L as createPollingJob, M as createBlobStorage, N as decodeImage, O as requireSession, P as imageResponse, Q as storageBackends, R as attachmentContent, S as deliverBatch, St as pushDeviceInput, T as createAccess, Tt as stateLabels, U as events, V as deliveryCheckpoints, X as pushDevices, Y as projects, Z as stagedUploads, _ as recipientColumns, _t as notificationPreferencesSchema, a as deliverySecrets, at as credentialInput, b as receiveRepositoryWebhook, bt as operations, c as ownerBlocker, ct as hasAdminRole, d as createDomain, dt as isOperation, et as tickets, f as fail, ft as isPresetColor, g as reachable, gt as notificationPreferencesInput, h as one, ht as notificationIdsInput, i as createInstance, it as closedStates, j as createTicketIndex, k as readCalendarFeed, l as appendEvents, lt as importLimits, m as notify, mt as memberSchema, n as emailCodesAvailable, nt as workspaces, o as otherActiveAdministrator, ot as defaultWorkflow, p as json, pt as isPublicOperation, q as notifications, r as signInProviders, rt as ApiError, s as ownedWorkspaces, st as errorSchema, t as createAuth, tt as workspaceMembers, u as assertVersion, ut as importProviderDefinitions, v as requireRow, vt as notificationReadInput, w as createHttpSender, wt as scopes, x as defaultSenders, xt as publicOperations, y as processImports, yt as okSchema, z as attachments } from "./auth-JcS53IcO.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
-import { and, asc, count, desc, eq, gt, ilike, inArray, isNull, lte, or, sql } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { and, asc, count, desc, eq, gt, ilike, inArray, isNotNull, isNull, notInArray, or, sql } from "drizzle-orm";
 import { z } from "zod";
 import { fileURLToPath } from "node:url";
-import { createHash, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { Expo } from "expo-server-sdk";
 import { isDeepStrictEqual } from "node:util";
 import { EventEmitter } from "node:events";
 import { connect } from "amqplib";
@@ -18,7 +20,7 @@ import { streamSSE } from "hono/streaming";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { APIError } from "better-auth/api";
 import { requireMcpAuth } from "@better-auth/mcp";
-import { Expo } from "expo-server-sdk";
+import TurndownService from "turndown";
 import { McpServer, createMcpHandler } from "@modelcontextprotocol/server";
 //#region ../../packages/contracts/src/users.ts
 const accountSchema = memberSchema.pick({
@@ -65,22 +67,46 @@ const accountDetailsSchema = accountSchema.extend({
 	sessionCount: z.number().int().nonnegative()
 });
 const localPasswordSchema = z.object({ password: z.string().min(12).max(128) }).strict();
+const adminWorkspaceQuerySchema = accountQuerySchema.pick({
+	q: true,
+	limit: true,
+	offset: true
+});
+const adminWorkspacesSchema = z.object({
+	workspaces: z.array(z.object({
+		id: z.uuid(),
+		name: z.string(),
+		slug: z.string(),
+		ownerId: z.string().nullable().default(null),
+		createdAt: z.iso.datetime(),
+		memberCount: z.number().int().nonnegative(),
+		projectCount: z.number().int().nonnegative(),
+		administrators: z.array(accountSchema.pick({
+			id: true,
+			name: true,
+			email: true,
+			image: true
+		}))
+	})),
+	total: z.number().int().nonnegative()
+});
 //#endregion
 //#region src/account-administration.ts
 const person = {
-	id: user.id,
-	name: user.name,
-	email: user.email,
-	image: user.image,
-	role: user.role,
-	banned: sql`coalesce(${user.banned}, false)`,
-	createdAt: user.createdAt
+	id: user$1.id,
+	name: user$1.name,
+	email: user$1.email,
+	image: user$1.image,
+	role: user$1.role,
+	banned: sql`coalesce(${user$1.banned}, false)`,
+	createdAt: user$1.createdAt
 };
 const mutationBody = z.object({
 	userId: z.string().optional(),
 	role: z.union([z.string(), z.array(z.string())]).optional(),
 	data: z.record(z.string(), z.unknown()).optional()
 }).passthrough();
+const pattern = (q) => `%${q.replace(/[\\%_]/g, "\\$&")}%`;
 function authPath(request) {
 	try {
 		return decodeURIComponent(new URL(request.url).pathname).replace(/\/+/g, "/").replace(/\/$/, "");
@@ -99,7 +125,7 @@ function createAccountAdministration(database, auth, config) {
 			fail(503, "session_revocation_failed", "The password changed, but existing sessions could not be revoked. Revoke this user’s sessions before continuing.");
 		}
 	}
-	async function mutate(request, run, administratorOnly = true) {
+	async function mutate(request, run, administratorOnly = true, subjectId) {
 		const login = await auth.api.getSession({ headers: request.headers });
 		if (!login) fail(401, "unauthorized", "Sign in to continue");
 		if (administratorOnly && !hasAdminRole(login.user.role) || login.user.banned) fail(403, "forbidden", "Instance administrator access is required");
@@ -108,6 +134,7 @@ function createAccountAdministration(database, auth, config) {
 		try {
 			await lock.query("SELECT pg_advisory_lock(7361083)");
 			locked = true;
+			await lock.query("SELECT pg_advisory_lock(7361080)");
 			const path = authPath(request);
 			if (path === "/api/auth/unlink-account") {
 				if (!one((await lock.query("SELECT email_password_enabled AS enabled FROM instance_settings WHERE id=1")).rows).enabled) {
@@ -116,25 +143,29 @@ function createAccountAdministration(database, auth, config) {
 					if (!(await lock.query(`SELECT account_id AS "accountId", id_token AS "idToken" FROM account WHERE user_id=$1 AND provider_id='oidc' AND id<>$2`, [login.user.id, accountId])).rows.some((binding) => matchesOIDCBinding(binding, issuer, config.OIDC_CLIENT_ID))) fail(409, "oidc_binding_required", "Enable password sign-in before unlinking your last account for the configured OIDC provider");
 				}
 			}
-			let passwordUserId;
-			if (path.endsWith("/admin/set-user-password")) passwordUserId = mutationBody.parse(await request.clone().json()).userId;
-			if ([
-				"set-role",
-				"update-user",
-				"ban-user",
-				"remove-user"
-			].some((name) => path.endsWith(`/admin/${name}`))) {
-				const body = mutationBody.parse(await request.clone().json());
-				if (body.userId) {
-					const current = one((await lock.query(`SELECT id, role, coalesce(banned,false) AS banned FROM "user" WHERE id = $1`, [body.userId])).rows);
+			if (path.endsWith("/admin/remove-user")) fail(403, "forbidden", "Delete accounts with delete_account so their history stays intact");
+			const body = path.startsWith("/api/auth/admin/") ? mutationBody.parse(await request.clone().json()) : void 0;
+			const userId = subjectId ?? body?.userId;
+			const passwordUserId = path.endsWith("/admin/set-user-password") ? userId : void 0;
+			if (administratorOnly && userId) {
+				const current = one((await lock.query(`SELECT id, role, coalesce(banned,false) AS banned FROM "user" WHERE id = $1 AND deleted_at IS NULL`, [userId])).rows);
+				if (body && [
+					"set-role",
+					"update-user",
+					"ban-user"
+				].some((name) => path.endsWith(`/admin/${name}`))) {
 					const role = body.role ?? body.data?.role ?? current.role;
 					const candidate = z.union([z.string(), z.array(z.string())]).nullable().safeParse(role);
 					const nextRole = candidate.success ? Array.isArray(candidate.data) ? candidate.data.join(",") : candidate.data : current.role;
 					if (body.data && Object.hasOwn(body.data, "banned")) z.boolean().parse(body.data.banned);
 					const banned = path.endsWith("/ban-user") || body.data?.banned === true || body.data?.banned === void 0 && current.banned;
-					if (hasAdminRole(current.role) && !current.banned && (!hasAdminRole(nextRole) || banned || path.endsWith("/remove-user"))) {
-						if (!(await lock.query(`SELECT id FROM "user" WHERE id <> $1 AND NOT coalesce(banned,false) AND 'admin' = ANY(string_to_array(role, ',')) LIMIT 1`, [current.id])).rowCount) fail(409, "last_administrator", "Keep at least one active instance administrator");
+					const guard = drizzle(lock, { schema: auth_schema_exports });
+					if (banned && !current.banned) {
+						const owned = await ownedWorkspaces(guard, current.id);
+						const [blocker] = ownerBlocker(owned);
+						if (blocker) fail(409, blocker.code, blocker.message, { workspaces: owned });
 					}
+					if (hasAdminRole(current.role) && !current.banned && (!hasAdminRole(nextRole) || banned) && !await otherActiveAdministrator(guard, current.id)) fail(409, "last_administrator", "Keep at least one active instance administrator");
 				}
 			}
 			const response = await run();
@@ -142,7 +173,7 @@ function createAccountAdministration(database, auth, config) {
 			return response;
 		} finally {
 			try {
-				if (locked) await lock.query("SELECT pg_advisory_unlock(7361083)");
+				if (locked) await lock.query("SELECT pg_advisory_unlock_all()");
 			} finally {
 				lock.release();
 			}
@@ -157,7 +188,8 @@ function createAccountAdministration(database, auth, config) {
 				"ban-user",
 				"unban-user",
 				"remove-user",
-				"set-user-password"
+				"set-user-password",
+				"impersonate-user"
 			].some((name) => path === `/api/auth/admin/${name}`);
 			const unlink = path === "/api/auth/unlink-account";
 			return request.method === "POST" && (guarded || unlink) ? mutate(request, () => auth.handler(request), !unlink) : auth.handler(request);
@@ -183,6 +215,16 @@ function createAccountAdministration(database, auth, config) {
 					content: { "application/json": { schema: accountDetailsSchema } }
 				} }
 			});
+			app.openAPIRegistry.registerPath({
+				method: "get",
+				path: "/api/v1/admin/workspaces",
+				security: [{ sessionCookie: [] }],
+				request: { query: adminWorkspaceQuerySchema },
+				responses: { 200: {
+					description: "Every workspace with member and project counts and its administrators",
+					content: { "application/json": { schema: adminWorkspacesSchema } }
+				} }
+			});
 			app.openAPIRegistry.registerPath({
 				method: "post",
 				path: "/api/v1/admin/users/{id}/password",
@@ -200,17 +242,17 @@ function createAccountAdministration(database, auth, config) {
 				} }
 			});
 			app.get("/api/v1/admin/users", async (c) => {
-				const input = accountQuerySchema.parse(c.req.query()), needle = `%${input.q.replace(/[\\%_]/g, "\\$&")}%`;
-				const administrator = sql`'admin' = ANY(string_to_array(${user.role}, ','))`;
-				const filter = and(input.q ? or(ilike(user.name, needle), ilike(user.email, needle)) : void 0, input.role === "admin" ? administrator : input.role === "user" ? sql`NOT coalesce(${administrator},false)` : void 0, input.status === "all" ? void 0 : input.status === "disabled" ? eq(user.banned, true) : sql`NOT coalesce(${user.banned},false)`);
-				const [users, total] = await Promise.all([database.db.select(person).from(user).where(filter).orderBy(asc(user.name), asc(user.id)).limit(input.limit).offset(input.offset), database.db.select({ value: count() }).from(user).where(filter)]);
+				const input = accountQuerySchema.parse(c.req.query()), needle = pattern(input.q);
+				const administrator = sql`'admin' = ANY(string_to_array(${user$1.role}, ','))`;
+				const filter = and(isNull(user$1.deletedAt), input.q ? or(ilike(user$1.name, needle), ilike(user$1.email, needle)) : void 0, input.role === "admin" ? administrator : input.role === "user" ? sql`NOT coalesce(${administrator},false)` : void 0, input.status === "all" ? void 0 : input.status === "disabled" ? eq(user$1.banned, true) : sql`NOT coalesce(${user$1.banned},false)`);
+				const [users, total] = await Promise.all([database.db.select(person).from(user$1).where(filter).orderBy(asc(user$1.name), asc(user$1.id)).limit(input.limit).offset(input.offset), database.db.select({ value: count() }).from(user$1).where(filter)]);
 				return Response.json(json({
 					users,
 					total: total[0]?.value ?? 0
 				}));
 			});
 			app.get("/api/v1/admin/users/:id", async (c) => {
-				const id = c.req.param("id"), row = one(await database.db.select(person).from(user).where(eq(user.id, id)));
+				const id = c.req.param("id"), row = one(await database.db.select(person).from(user$1).where(and(eq(user$1.id, id), isNull(user$1.deletedAt))));
 				const [spaces, direct, providers, sessions] = await Promise.all([
 					database.db.select({
 						id: workspaces.id,
@@ -233,6 +275,38 @@ function createAccountAdministration(database, auth, config) {
 					sessionCount: sessions[0]?.value ?? 0
 				}));
 			});
+			app.get("/api/v1/admin/workspaces", async (c) => {
+				const input = adminWorkspaceQuerySchema.parse(c.req.query()), needle = pattern(input.q);
+				const filter = and(isNull(workspaces.deletedAt), input.q ? or(ilike(workspaces.name, needle), ilike(workspaces.slug, needle)) : void 0);
+				const [rows, total] = await Promise.all([database.db.select({
+					id: workspaces.id,
+					name: workspaces.name,
+					slug: workspaces.slug,
+					ownerId: workspaces.ownerId,
+					createdAt: workspaces.createdAt,
+					memberCount: sql`(SELECT count(*)::int FROM workspace_members m WHERE m.workspace_id = workspaces.id)`,
+					projectCount: sql`(SELECT count(*)::int FROM projects p WHERE p.workspace_id = workspaces.id AND p.deleted_at IS NULL)`
+				}).from(workspaces).where(filter).orderBy(asc(workspaces.name), asc(workspaces.id)).limit(input.limit).offset(input.offset), database.db.select({ value: count() }).from(workspaces).where(filter)]);
+				const administrators = rows.length ? await database.db.select({
+					workspaceId: workspaceMembers.workspaceId,
+					id: user$1.id,
+					name: user$1.name,
+					email: user$1.email,
+					image: user$1.image
+				}).from(workspaceMembers).innerJoin(user$1, eq(user$1.id, workspaceMembers.userId)).where(and(eq(workspaceMembers.role, "admin"), inArray(workspaceMembers.workspaceId, rows.map((row) => row.id)))).orderBy(asc(user$1.name), asc(user$1.id)) : [];
+				return Response.json(json({
+					workspaces: rows.map((row) => ({
+						...row,
+						administrators: administrators.filter((admin) => admin.workspaceId === row.id).map(({ id, name, email, image }) => ({
+							id,
+							name,
+							email,
+							image
+						}))
+					})),
+					total: total[0]?.value ?? 0
+				}));
+			});
 			app.post("/api/v1/admin/users/:id/password", async (c) => mutate(c.req.raw, async () => {
 				const input = localPasswordSchema.parse(await c.req.json()), userId = c.req.param("id");
 				await auth.api.setUserPassword({
@@ -244,94 +318,13 @@ function createAccountAdministration(database, auth, config) {
 				});
 				await revokeAfterPasswordChange(c.req.raw.headers, userId);
 				return Response.json({ ok: true });
-			}));
-		}
-	};
-}
-//#endregion
-//#region src/access.ts
-const credentialPermissions = z.object({ kanvil: z.array(z.enum(scopes)) });
-const credentialMetadata = z.object({ projectIds: z.array(z.uuid()).max(1e3) });
-function createWriteLimiter(max, windowMs = 6e4) {
-	const recent = /* @__PURE__ */ new Map();
-	return { consume(key, now = Date.now()) {
-		const hits = (recent.get(key) ?? []).filter((at) => at > now - windowMs);
-		if (hits.length >= max) {
-			const retryAfterSeconds = Math.max(1, Math.ceil(((hits[0] ?? now) + windowMs - now) / 1e3));
-			fail(429, "rate_limited", "Too many changes in a short time; wait and retry", { retryAfterSeconds });
-		}
-		hits.push(now);
-		recent.set(key, hits);
-		if (recent.size > 1e4) {
-			for (const [id, stamps] of recent) if (!stamps.some((at) => at > now - windowMs)) recent.delete(id);
+			}, true, c.req.param("id")));
 		}
-	} };
-}
-function requireSession(actor) {
-	if (actor.machine) fail(403, "session_required", "Use a signed-in account for this action");
-	return actor;
-}
-function requireInstanceAdmin(actor) {
-	requireSession(actor);
-	if (!actor.admin) fail(403, "forbidden", "Instance administrator access is required");
-	return actor;
-}
-function storedJson(value) {
-	if (typeof value !== "string") return value;
-	try {
-		return JSON.parse(value);
-	} catch {
-		return null;
-	}
-}
-function createAccess(auth, domain, config, database) {
-	async function credentialActor(key) {
-		const permissions = credentialPermissions.safeParse(storedJson(key.permissions));
-		const metadata = credentialMetadata.safeParse(storedJson(key.metadata));
-		if (!permissions.success || !metadata.success) fail(403, "invalid_credential_scope", "This credential has no valid project permissions");
-		return domain.actor(key.referenceId, {
-			ownerId: key.id,
-			scopes: permissions.data.kanvil,
-			projectIds: metadata.data.projectIds
-		});
-	}
-	async function authenticate(request) {
-		const token = request.headers.get("authorization")?.replace(/^Bearer\s+/i, "");
-		if (token) {
-			if (!token.startsWith("kv_")) fail(401, "unauthorized", "Use a Kanvil API credential");
-			const result = await auth.api.verifyApiKey({ body: { key: token } });
-			if (!result.valid || !result.key) fail(401, "unauthorized", "The API credential is invalid or expired");
-			return credentialActor(result.key);
-		}
-		const session = await auth.api.getSession({ headers: request.headers });
-		if (!session) fail(401, "unauthorized", "Sign in to continue");
-		return domain.actor(session.user.id);
-	}
-	async function revalidate(request, identity) {
-		if (!identity.machine) return authenticate(request);
-		const key = (await database.db.select().from(apikey).where(eq(apikey.id, identity.ownerId)))[0];
-		if (!key?.enabled || key.referenceId !== identity.id || key.expiresAt && key.expiresAt <= /* @__PURE__ */ new Date()) fail(401, "unauthorized", "The API credential is invalid or expired");
-		return credentialActor(key);
-	}
-	function checkOrigin(request) {
-		if ([
-			"GET",
-			"HEAD",
-			"OPTIONS"
-		].includes(request.method)) return;
-		const origin = request.headers.get("origin");
-		if (origin && !config.trustedOrigins.includes(origin)) fail(403, "invalid_origin", "This origin is not allowed");
-		if (request.headers.get("sec-fetch-site") === "cross-site" && !origin) fail(403, "invalid_origin", "Cross-site writes are not allowed");
-	}
-	return {
-		authenticate,
-		revalidate,
-		checkOrigin
 	};
 }
 //#endregion
 //#region src/version.ts
-const applicationVersion = "0.2.1";
+const applicationVersion = "0.3.0";
 //#endregion
 //#region src/realtime.ts
 async function createRealtime(config) {
@@ -871,10 +864,10 @@ function registerInstanceRoutes(app, database, instance, blobs, search, delivery
 				target: profilePhotos.userId,
 				set: { objectId: id }
 			});
-			await tx.update(user).set({
+			await tx.update(user$1).set({
 				image,
 				updatedAt: /* @__PURE__ */ new Date()
-			}).where(eq(user.id, actor.id));
+			}).where(eq(user$1.id, actor.id));
 		});
 		blobs.sync().catch(() => {});
 		return Response.json({ image });
@@ -883,10 +876,10 @@ function registerInstanceRoutes(app, database, instance, blobs, search, delivery
 		const actor = requireSession(c.get("actor"));
 		await database.db.transaction(async (tx) => {
 			await tx.delete(profilePhotos).where(eq(profilePhotos.userId, actor.id));
-			await tx.update(user).set({
+			await tx.update(user$1).set({
 				image: null,
 				updatedAt: /* @__PURE__ */ new Date()
-			}).where(eq(user.id, actor.id));
+			}).where(eq(user$1.id, actor.id));
 		});
 		return Response.json({ image: null });
 	});
@@ -898,117 +891,2175 @@ function registerInstanceRoutes(app, database, instance, blobs, search, delivery
 	});
 }
 //#endregion
-//#region src/push.ts
-const delay = (attempt) => Math.min(6e4 * 2 ** attempt, 36e5);
-async function deliverPushBatch(database, config, transport) {
-	const lock = await database.pool.connect();
-	let ownsLock = false;
-	try {
-		if (!(await lock.query("SELECT pg_try_advisory_lock(7361082) AS acquired")).rows[0]?.acquired) return;
-		ownsLock = true;
-		const jobs = await database.db.select({ id: pushDeliveries.id }).from(pushDeliveries).where(and(isNull(pushDeliveries.finishedAt), lte(pushDeliveries.availableAt, /* @__PURE__ */ new Date()))).orderBy(asc(pushDeliveries.availableAt)).limit(100);
-		for (const pending of jobs) {
-			const row = (await database.db.select({
-				job: pushDeliveries,
-				device: pushDevices,
-				notification: notifications,
-				event: events,
-				preference: notificationPreferences,
-				account: user,
-				session,
-				projectRole: projectRoleSQL(user.id, notifications.projectId),
-				subscription: subscriptions,
-				ticketId: tickets.id
-			}).from(pushDeliveries).innerJoin(pushDevices, eq(pushDevices.id, pushDeliveries.deviceId)).innerJoin(notifications, eq(notifications.id, pushDeliveries.notificationId)).innerJoin(events, eq(events.id, notifications.eventId)).leftJoin(tickets, eq(tickets.id, events.ticketId)).innerJoin(user, eq(user.id, pushDevices.userId)).innerJoin(session, eq(session.id, pushDevices.sessionId)).leftJoin(notificationPreferences, eq(notificationPreferences.userId, user.id)).leftJoin(subscriptions, and(eq(subscriptions.ticketId, events.ticketId), eq(subscriptions.userId, user.id))).where(and(eq(pushDeliveries.id, pending.id), isNull(pushDeliveries.finishedAt))))[0];
-			if (!row) continue;
-			const { job, device, event } = row;
-			const finish = async (error) => database.db.update(pushDeliveries).set({
-				finishedAt: /* @__PURE__ */ new Date(),
-				error
-			}).where(eq(pushDeliveries.id, job.id));
-			if (device.userId !== row.notification.userId || row.account.banned || row.session.expiresAt <= /* @__PURE__ */ new Date() || !row.preference?.push || !row.subscription && row.ticketId !== null || !row.projectRole && !hasAdminRole(row.account.role)) {
-				await finish("access_revoked");
+//#region src/adapters/github.ts
+const sameSecret = (received, expected) => timingSafeEqual(createHash("sha256").update(received).digest(), createHash("sha256").update(expected).digest());
+const hmacHex = (secret, body) => createHmac("sha256", secret).update(body).digest("hex");
+const repository = z.object({
+	full_name: z.string(),
+	html_url: z.url({ protocol: /^https?$/ })
+});
+const reference = z.object({
+	ref: z.string().min(1),
+	ref_type: z.string(),
+	repository
+});
+const item$2 = {
+	number: z.number().int().positive(),
+	html_url: z.url({ protocol: /^https?$/ }),
+	title: z.string(),
+	state: z.enum(["open", "closed"]),
+	updated_at: z.iso.datetime({ offset: true })
+};
+const pullRequest = z.object({
+	action: z.string(),
+	pull_request: z.object({
+		...item$2,
+		draft: z.boolean().default(false),
+		merged: z.boolean().nullish(),
+		merged_at: z.string().nullish(),
+		head: z.object({ ref: z.string() })
+	}),
+	changes: z.object({ title: z.object({ from: z.string() }).optional() }).optional(),
+	repository
+});
+const issueFields$1 = z.object({
+	...item$2,
+	body: z.string().nullish(),
+	labels: z.array(z.object({ name: z.string() })).nullish(),
+	pull_request: z.unknown().optional()
+});
+const issue$1 = z.object({
+	action: z.string(),
+	issue: issueFields$1,
+	repository
+});
+const issueComment = z.object({
+	action: z.string(),
+	issue: issueFields$1,
+	comment: z.object({
+		id: z.union([z.number(), z.string()]),
+		body: z.string().nullish(),
+		user: z.object({ login: z.string() }).nullish(),
+		created_at: z.iso.datetime({ offset: true }).nullish()
+	}),
+	is_pull: z.boolean().optional(),
+	repository
+});
+const githubIssue = (found) => ({
+	number: found.number,
+	url: found.html_url,
+	title: found.title,
+	description: found.body ?? "",
+	open: found.state === "open",
+	labels: (found.labels ?? []).map((label) => label.name),
+	updatedAt: new Date(found.updated_at)
+});
+const issueActions = [
+	"opened",
+	"edited",
+	"closed",
+	"reopened",
+	"labeled",
+	"unlabeled",
+	"label_updated",
+	"label_cleared"
+];
+function githubIssueEvent(event, payload) {
+	if (event !== "issues") return null;
+	const parsed = issue$1.parse(payload);
+	return parsed.issue.pull_request || !issueActions.includes(parsed.action) ? null : githubIssue(parsed.issue);
+}
+function githubComment(event, payload) {
+	if (event !== "issue_comment") return null;
+	const parsed = issueComment.parse(payload);
+	if (parsed.action !== "created" || parsed.issue.pull_request || parsed.is_pull) return null;
+	return {
+		id: String(parsed.comment.id),
+		issue: parsed.issue.number,
+		body: parsed.comment.body ?? "",
+		author: parsed.comment.user?.login ?? "",
+		createdAt: parsed.comment.created_at ? new Date(parsed.comment.created_at) : null
+	};
+}
+const readGitHubIssue = (body) => githubIssue(issueFields$1.parse(JSON.parse(body)));
+const githubIssueBody = (changes) => JSON.stringify({
+	...changes.title !== void 0 && { title: changes.title },
+	...changes.description !== void 0 && { body: changes.description },
+	...changes.open !== void 0 && { state: changes.open ? "open" : "closed" }
+});
+const pullRequestTriggers = {
+	opened: (draft) => draft ? "pull_request_draft" : "pull_request_opened",
+	reopened: (draft) => draft ? "pull_request_draft" : "pull_request_opened",
+	ready_for_review: () => "pull_request_opened",
+	converted_to_draft: () => "pull_request_draft"
+};
+const workInProgress = (title) => /^\s*(?:wip:|\[wip\])/i.test(title);
+const githubNamed = (payload) => z.object({ repository: repository.optional() }).parse(payload).repository?.full_name ?? null;
+function githubChange(event, payload, { branchPath = "tree", titleDrafts = false } = {}) {
+	if (event === "create" || event === "delete") {
+		const parsed = reference.parse(payload);
+		if (parsed.ref_type !== "branch") return null;
+		const name = parsed.ref.replace(/^refs\/heads\//, "");
+		const path = name.split("/").map(encodeURIComponent).join("/");
+		return {
+			kind: "branch",
+			url: `${parsed.repository.html_url}/${branchPath}/${path}`,
+			title: name,
+			number: null,
+			state: event === "create" ? "active" : "deleted",
+			trigger: event === "create" ? "branch_created" : null,
+			references: [name],
+			occurredAt: null,
+			creates: event === "create"
+		};
+	}
+	if (event === "pull_request") {
+		const { action, pull_request: pr, changes } = pullRequest.parse(payload);
+		const merged = !!(pr.merged ?? pr.merged_at), draft = pr.draft || titleDrafts && workInProgress(pr.title);
+		if (action !== "closed" && action !== "edited" && !pullRequestTriggers[action]) return null;
+		const retitled = titleDrafts && action === "edited" && changes?.title && workInProgress(changes.title.from) !== draft;
+		return {
+			kind: "pull_request",
+			url: pr.html_url,
+			title: pr.title,
+			number: pr.number,
+			state: merged ? "merged" : pr.state === "closed" ? "closed" : draft ? "draft" : "open",
+			trigger: action === "closed" ? merged ? "pull_request_merged" : "pull_request_closed" : retitled ? draft ? "pull_request_draft" : "pull_request_opened" : pullRequestTriggers[action]?.(draft) ?? null,
+			references: [pr.head.ref, pr.title],
+			occurredAt: new Date(pr.updated_at),
+			creates: true
+		};
+	}
+	if (event === "issues") {
+		const { action, issue: found } = issue$1.parse(payload);
+		if (!issueActions.includes(action)) return null;
+		return {
+			kind: "issue",
+			url: found.html_url,
+			title: found.title,
+			number: found.number,
+			state: found.state,
+			trigger: null,
+			references: [found.title],
+			occurredAt: new Date(found.updated_at),
+			creates: true
+		};
+	}
+	return null;
+}
+const headers$2 = (token) => ({
+	Accept: "application/vnd.github+json",
+	Authorization: `Bearer ${token}`,
+	"X-GitHub-Api-Version": "2022-11-28"
+});
+function createGitHubDriver(apiUrl) {
+	const api = (path) => new URL(path, apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`).href;
+	return {
+		signed: (secret, received, body) => sameSecret(received.get("x-hub-signature-256") ?? "", `sha256=${hmacHex(secret, body)}`),
+		read(received, body) {
+			const id = received.get("x-github-delivery"), event = received.get("x-github-event");
+			if (!id || !event) throw new Error("Missing GitHub delivery headers");
+			const payload = JSON.parse(body);
+			return {
+				id,
+				event,
+				repository: githubNamed(payload),
+				change: githubChange(event, payload),
+				issue: githubIssueEvent(event, payload),
+				comment: githubComment(event, payload)
+			};
+		},
+		access: ({ repository: name }, token) => ({
+			method: "GET",
+			url: api(`repos/${name}`),
+			headers: headers$2(token),
+			body: ""
+		}),
+		comment: ({ repository: name }, token, { number }, text) => ({
+			url: api(`repos/${name}/issues/${number}/comments`),
+			headers: headers$2(token),
+			body: JSON.stringify({ body: text }),
+			read: true
+		}),
+		createIssue: ({ repository: name }, token, content) => ({
+			url: api(`repos/${name}/issues`),
+			headers: headers$2(token),
+			body: githubIssueBody(content),
+			read: true
+		}),
+		updateIssue: ({ repository: name }, token, number, changes) => ({
+			method: "PATCH",
+			url: api(`repos/${name}/issues/${number}`),
+			headers: headers$2(token),
+			body: githubIssueBody(changes),
+			read: true
+		}),
+		issue: readGitHubIssue
+	};
+}
+//#endregion
+//#region src/adapters/gitea.ts
+const instanceApi = ({ baseUrl }, path) => {
+	if (!baseUrl) throw new DeliveryError("invalid_endpoint", false);
+	return `${baseUrl}/${path}`;
+};
+const headers$1 = (token) => ({
+	Accept: "application/json",
+	Authorization: `token ${token}`
+});
+function createGiteaDriver() {
+	return {
+		signed: (secret, received, body) => sameSecret(received.get("x-gitea-signature") ?? "", hmacHex(secret, body)),
+		read(received, body) {
+			const id = received.get("x-gitea-delivery"), sent = received.get("x-gitea-event");
+			if (!id || !sent) throw new Error("Missing Gitea delivery headers");
+			const event = sent === "issue_label" ? "issues" : sent;
+			const payload = JSON.parse(body);
+			return {
+				id,
+				event,
+				repository: githubNamed(payload),
+				change: githubChange(event, payload, {
+					branchPath: "src/branch",
+					titleDrafts: true
+				}),
+				issue: githubIssueEvent(event, payload),
+				comment: githubComment(event, payload)
+			};
+		},
+		access: (target, token) => ({
+			method: "GET",
+			url: instanceApi(target, `api/v1/repos/${target.repository}`),
+			headers: headers$1(token),
+			body: ""
+		}),
+		comment: (target, token, { number }, text) => ({
+			url: instanceApi(target, `api/v1/repos/${target.repository}/issues/${number}/comments`),
+			headers: headers$1(token),
+			body: JSON.stringify({ body: text }),
+			read: true
+		}),
+		createIssue: (target, token, content) => ({
+			url: instanceApi(target, `api/v1/repos/${target.repository}/issues`),
+			headers: headers$1(token),
+			body: githubIssueBody(content),
+			read: true
+		}),
+		updateIssue: (target, token, number, changes) => ({
+			method: "PATCH",
+			url: instanceApi(target, `api/v1/repos/${target.repository}/issues/${number}`),
+			headers: headers$1(token),
+			body: githubIssueBody(changes),
+			read: true
+		}),
+		issue: readGitHubIssue
+	};
+}
+//#endregion
+//#region src/adapters/gitlab.ts
+const project$1 = z.object({
+	path_with_namespace: z.string(),
+	web_url: z.url({ protocol: /^https?$/ })
+});
+const push = z.object({
+	ref: z.string(),
+	before: z.string(),
+	after: z.string(),
+	project: project$1
+});
+const item$1 = {
+	iid: z.number().int().positive(),
+	url: z.url({ protocol: /^https?$/ }),
+	title: z.string(),
+	state: z.string(),
+	action: z.string().default("update"),
+	updated_at: z.string()
+};
+const mergeRequest = z.object({
+	object_attributes: z.object({
+		...item$1,
+		draft: z.boolean().optional(),
+		work_in_progress: z.boolean().optional(),
+		source_branch: z.string()
+	}),
+	changes: z.object({ draft: z.object({ current: z.boolean() }).optional() }).optional(),
+	project: project$1
+});
+const issue = z.object({
+	object_attributes: z.object({
+		...item$1,
+		description: z.string().nullish()
+	}),
+	labels: z.array(z.object({ title: z.string() })).nullish(),
+	project: project$1
+});
+const note = z.object({
+	object_attributes: z.object({
+		id: z.union([z.number(), z.string()]),
+		note: z.string(),
+		noteable_type: z.string(),
+		created_at: z.string().nullish(),
+		system: z.boolean().nullish()
+	}),
+	issue: z.object({ iid: z.number().int().positive() }).optional(),
+	user: z.object({ username: z.string() }).nullish(),
+	project: project$1
+});
+const apiIssue = z.object({
+	iid: z.number().int().positive(),
+	web_url: z.url({ protocol: /^https?$/ }),
+	title: z.string(),
+	description: z.string().nullish(),
+	state: z.string(),
+	labels: z.array(z.string()).nullish(),
+	updated_at: z.string()
+});
+const absent = /^0+$/;
+function hostTime(value) {
+	const time = new Date(value.replace(/^(\d{4}-\d\d-\d\d) (\d\d:\d\d:\d\d) UTC$/, "$1T$2Z"));
+	return Number.isNaN(time.getTime()) ? null : time;
+}
+const mergeRequestTriggers = {
+	open: (draft) => draft ? "pull_request_draft" : "pull_request_opened",
+	reopen: (draft) => draft ? "pull_request_draft" : "pull_request_opened",
+	merge: () => "pull_request_merged",
+	close: () => "pull_request_closed"
+};
+function issueOf(payload) {
+	if (z.object({ object_kind: z.string() }).parse(payload).object_kind !== "issue") return null;
+	const { object_attributes: found, labels } = issue.parse(payload);
+	if (![
+		"open",
+		"update",
+		"close",
+		"reopen"
+	].includes(found.action)) return null;
+	return {
+		number: found.iid,
+		url: found.url,
+		title: found.title,
+		description: found.description ?? "",
+		open: found.state === "opened",
+		labels: (labels ?? []).map((label) => label.title),
+		updatedAt: hostTime(found.updated_at)
+	};
+}
+function commentOf(payload) {
+	if (z.object({ object_kind: z.string() }).parse(payload).object_kind !== "note") return null;
+	const parsed = note.parse(payload), found = parsed.object_attributes;
+	if (found.noteable_type !== "Issue" || found.system || !parsed.issue) return null;
+	return {
+		id: String(found.id),
+		issue: parsed.issue.iid,
+		body: found.note,
+		author: parsed.user?.username ?? "",
+		createdAt: found.created_at ? hostTime(found.created_at) : null
+	};
+}
+function change(payload) {
+	const kind = z.object({ object_kind: z.string() }).parse(payload).object_kind;
+	if (kind === "push") {
+		const parsed = push.parse(payload);
+		const created = absent.test(parsed.before), deleted = absent.test(parsed.after);
+		if (!parsed.ref.startsWith("refs/heads/") || created === deleted) return null;
+		const name = parsed.ref.slice(11);
+		return {
+			kind: "branch",
+			url: `${parsed.project.web_url}/-/tree/${name.split("/").map(encodeURIComponent).join("/")}`,
+			title: name,
+			number: null,
+			state: created ? "active" : "deleted",
+			trigger: created ? "branch_created" : null,
+			references: [name],
+			occurredAt: null,
+			creates: created
+		};
+	}
+	if (kind === "merge_request") {
+		const { object_attributes: mr, changes } = mergeRequest.parse(payload);
+		const draft = mr.draft ?? mr.work_in_progress ?? false;
+		if (mr.action !== "update" && !mergeRequestTriggers[mr.action]) return null;
+		return {
+			kind: "pull_request",
+			url: mr.url,
+			title: mr.title,
+			number: mr.iid,
+			state: mr.state === "merged" || mr.state === "closed" ? mr.state : draft ? "draft" : "open",
+			trigger: mr.action === "update" ? changes?.draft ? changes.draft.current ? "pull_request_draft" : "pull_request_opened" : null : mergeRequestTriggers[mr.action]?.(draft) ?? null,
+			references: [mr.source_branch, mr.title],
+			occurredAt: hostTime(mr.updated_at),
+			creates: true
+		};
+	}
+	if (kind === "issue") {
+		const { object_attributes: found } = issue.parse(payload);
+		if (![
+			"open",
+			"update",
+			"close",
+			"reopen"
+		].includes(found.action)) return null;
+		return {
+			kind: "issue",
+			url: found.url,
+			title: found.title,
+			number: found.iid,
+			state: found.state === "opened" ? "open" : found.state,
+			trigger: null,
+			references: [found.title],
+			occurredAt: hostTime(found.updated_at),
+			creates: true
+		};
+	}
+	return null;
+}
+const headers = (token) => ({
+	Accept: "application/json",
+	"PRIVATE-TOKEN": token
+});
+const projectApi = (target, path = "") => instanceApi(target, `api/v4/projects/${encodeURIComponent(target.repository)}${path}`);
+function createGitLabDriver() {
+	return {
+		signed: (secret, received) => sameSecret(received.get("x-gitlab-token") ?? "", secret),
+		read(received, body) {
+			const id = received.get("idempotency-key") ?? received.get("x-gitlab-event-uuid"), event = received.get("x-gitlab-event");
+			if (!id || !event) throw new Error("Missing GitLab delivery headers");
+			const payload = JSON.parse(body);
+			return {
+				id,
+				event,
+				repository: z.object({ project: project$1.partial().optional() }).parse(payload).project?.path_with_namespace ?? null,
+				change: change(payload),
+				issue: issueOf(payload),
+				comment: commentOf(payload)
+			};
+		},
+		access: (target, token) => ({
+			method: "GET",
+			url: projectApi(target),
+			headers: headers(token),
+			body: ""
+		}),
+		comment: (target, token, { kind, number }, text) => ({
+			url: projectApi(target, `/${kind === "pull_request" ? "merge_requests" : "issues"}/${number}/notes`),
+			headers: headers(token),
+			body: JSON.stringify({ body: text }),
+			read: true
+		}),
+		createIssue: (target, token, content) => ({
+			url: projectApi(target, "/issues"),
+			headers: headers(token),
+			body: JSON.stringify({
+				title: content.title,
+				description: content.description
+			}),
+			read: true
+		}),
+		updateIssue: (target, token, number, changes) => ({
+			method: "PUT",
+			url: projectApi(target, `/issues/${number}`),
+			headers: headers(token),
+			body: JSON.stringify({
+				...changes.title !== void 0 && { title: changes.title },
+				...changes.description !== void 0 && { description: changes.description },
+				...changes.open !== void 0 && { state_event: changes.open ? "reopen" : "close" }
+			}),
+			read: true
+		}),
+		issue(body) {
+			const found = apiIssue.parse(JSON.parse(body));
+			return {
+				number: found.iid,
+				url: found.web_url,
+				title: found.title,
+				description: found.description ?? "",
+				open: found.state === "opened",
+				labels: found.labels ?? [],
+				updatedAt: hostTime(found.updated_at)
+			};
+		}
+	};
+}
+//#endregion
+//#region src/adapters/source-bundle.ts
+const byStatus = (status) => status >= 200 && status < 300 ? "ok" : status === 401 || status === 403 ? "rejected" : status === 404 ? "not_found" : status === 429 ? "limited" : status >= 500 ? "failing" : "invalid";
+const attempts = 4;
+const limitWindows = {
+	trello: 1e4,
+	plane: 6e4,
+	kaneo: 6e4
+};
+function delay(provider, response, attempt, outcome) {
+	const header = response?.headers?.["retry-after"], value = Array.isArray(header) ? header[0] : header;
+	const seconds = value === void 0 ? NaN : /^\d+$/.test(value) ? Number(value) : (Date.parse(value) - Date.now()) / 1e3;
+	if (Number.isFinite(seconds)) return Math.min(Math.max(seconds, 0), 30) * 1e3;
+	const window = outcome === "limited" ? limitWindows[provider] : void 0;
+	return window ? window / 3 : 2 ** (attempt - 1) * 1e3;
+}
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const unreadable = (provider) => new ApiError(502, "source_unavailable", `${importProviderDefinitions[provider].label} sent a response Kanvil cannot read`);
+function readable(provider, schema, data) {
+	const parsed = schema.safeParse(data);
+	if (!parsed.success) throw unreadable(provider);
+	return parsed.data;
+}
+async function readSource(http, provider, request, judge = byStatus, { retry = true } = {}) {
+	const { label, project } = importProviderDefinitions[provider];
+	for (let attempt = 1;; attempt++) {
+		let response;
+		try {
+			response = await http({
+				...request,
+				read: true
+			});
+		} catch (error) {
+			if (!(error instanceof DeliveryError)) throw error;
+			if (retry && error.code === "network_error" && attempt < attempts) {
+				await wait(delay(provider, void 0, attempt));
 				continue;
 			}
-			if (row.notification.createdAt.getTime() < Date.now() - 864e5) {
-				await finish("expired");
-				continue;
+			throw new ApiError(502, "source_unavailable", `${label} could not be reached (${error.code})`);
+		}
+		let data;
+		try {
+			data = JSON.parse(response.body ?? "");
+		} catch {
+			data = void 0;
+		}
+		const outcome = judge(response.status, data);
+		if (outcome === "ok") {
+			if (data === void 0) throw unreadable(provider);
+			return data;
+		}
+		if (retry && (outcome === "limited" || outcome === "failing") && attempt < attempts) {
+			await wait(delay(provider, response, attempt, outcome));
+			continue;
+		}
+		if (outcome === "rejected") throw new ApiError(422, "source_rejected", `${label} refused these credentials, or they cannot read this ${project.toLowerCase()}`);
+		if (outcome === "not_found") throw new ApiError(404, "not_found", `${label} has no such ${project.toLowerCase()}`);
+		if (outcome === "limited") throw new ApiError(429, "source_rate_limited", `${label} is limiting requests; try again later`);
+		throw new ApiError(502, "source_unavailable", `${label} answered with an error (${response.status})`);
+	}
+}
+const category = (name, fallback) => defaultWorkflow.find((state) => state.name.toLowerCase() === name.trim().toLowerCase())?.category ?? fallback;
+const dueAt = (date) => date && /^\d{4}-\d{2}-\d{2}$/.test(date) ? `${date}T23:59:59.999Z` : null;
+const dueTime = (value) => value ? dueAt(value) ?? isoTime(value) : null;
+const startTime = (value) => !value ? null : /^\d{4}-\d{2}-\d{2}$/.test(value) ? `${value}T00:00:00.000Z` : isoTime(value);
+const isoTime = (value) => new Date(value.replace(/([+-]\d{2})(\d{2})$/, "$1:$2")).toISOString();
+const kindOf = (names) => names.some((name) => name.trim().toLowerCase() === "bug") ? "bug" : "feature";
+function toneOf(color) {
+	if (!color) return "gray";
+	if (/^#[0-9a-f]{6}$/i.test(color)) return color.toLowerCase();
+	return color.toLowerCase().split(/[^a-z]+/).find(isPresetColor) ?? "gray";
+}
+function withChecklists(description, checklists) {
+	const lists = checklists.filter((list) => list.items.length).map((list) => `### ${list.name.trim() || "Checklist"}\n\n${list.items.map((item) => `- [${item.done ? "x" : " "}] ${item.name.trim()}`).join("\n")}`);
+	return [description.trim(), ...lists].filter(Boolean).join("\n\n");
+}
+const formerMember = (ref) => ({
+	ref,
+	name: "Former member",
+	email: ""
+});
+function bundleBuilder(provider) {
+	const { label, project } = importProviderDefinitions[provider];
+	const people = /* @__PURE__ */ new Map(), labels = /* @__PURE__ */ new Map(), notes = /* @__PURE__ */ new Map();
+	const tickets = [], relations = [], comments = [];
+	const within = (size, limit, what) => {
+		if (size >= limit) throw new ApiError(400, "validation_error", `This ${project.toLowerCase()} has more ${what} than an import holds (${limit})`);
+	};
+	const note = (content, reason, count = 1) => {
+		const entry = notes.get(content) ?? {
+			content,
+			count: count === null ? null : 0,
+			reason
+		};
+		if (entry.count !== null && count !== null) entry.count += count;
+		notes.set(content, entry);
+	};
+	const clip = (value, max) => {
+		if (value.length <= max) return value;
+		note("shortened text", "Titles, descriptions, comments, or label names longer than Kanvil holds were cut at its limit.");
+		return value.slice(0, max);
+	};
+	const person = (who) => {
+		if (!who) return null;
+		if (!people.has(who.ref)) {
+			within(people.size, importLimits.members, "people");
+			people.set(who.ref, who);
+		}
+		return who.ref;
+	};
+	return {
+		note,
+		clip,
+		person,
+		assignee(who) {
+			if (who.length > 1) note("additional assignees", "A ticket has one assignee; items with several keep the first.", who.length - 1);
+			return person(who[0]);
+		},
+		labels(items) {
+			const names = [];
+			for (const item of items) {
+				const name = clip(item.name.trim(), 40);
+				if (!name || names.includes(name)) continue;
+				if (!labels.has(name)) {
+					within(labels.size, importLimits.labels, "labels");
+					labels.set(name, {
+						name,
+						color: toneOf(item.color)
+					});
+				}
+				names.push(name);
 			}
-			try {
-				let result;
-				if (job.receiptId) result = (await transport.getPushNotificationReceiptsAsync([job.receiptId]))[job.receiptId];
-				else result = (await transport.sendPushNotificationsAsync([{
-					to: device.token,
-					title: "Kanvil",
-					body: "A subscribed ticket has an update.",
-					sound: "default",
-					channelId: "tickets",
-					ttl: 3600,
-					data: {
-						server: config.KANVIL_URL,
-						projectId: event.projectId,
-						ticketId: event.ticketId,
-						notificationId: row.notification.id
+			if (names.length > 30) note("labels past 30", "A ticket holds 30 labels; issues with more keep their first 30.");
+			return names.slice(0, 30);
+		},
+		ticket(ticket) {
+			within(tickets.length, importLimits.tickets, "issues");
+			tickets.push(ticket);
+		},
+		relation(relation) {
+			within(relations.length, importLimits.relations, "relationships");
+			relations.push(relation);
+		},
+		comment(comment) {
+			within(comments.length, importLimits.comments, "comments");
+			comments.push(comment);
+		},
+		build(source, workflow) {
+			if (!workflow.length) workflow.push({
+				ref: "kanvil:todo",
+				name: stateLabels.todo,
+				category: "todo",
+				color: "default"
+			});
+			const taken = /* @__PURE__ */ new Set();
+			for (const state of workflow) {
+				const base = state.name || "Untitled";
+				let name = base;
+				for (let n = 2; taken.has(name.toLowerCase()); n++) name = `${base.slice(0, 40 - ` ${n}`.length)} ${n}`;
+				taken.add(name.toLowerCase());
+				state.name = name;
+			}
+			return {
+				format: ticketExportFormat,
+				version: 1,
+				exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				project: {
+					ref: source.ref,
+					key: source.key.slice(0, 20),
+					name: clip(source.name.trim(), 120) || label,
+					description: clip(source.description, 5e3)
+				},
+				completeness: { omitted: [...notes.values()] },
+				members: [...people.values()],
+				workflow,
+				customFields: [],
+				labels: [...labels.values()],
+				tickets,
+				relations,
+				comments,
+				evidence: [],
+				resources: []
+			};
+		}
+	};
+}
+const sourceTicket = (ticket) => ({
+	acceptanceCriteria: "",
+	difficulty: null,
+	scopes: [],
+	automationReady: false,
+	holdReason: null,
+	startAt: null,
+	customFields: {},
+	...ticket
+});
+//#endregion
+//#region src/adapters/jira.ts
+const jiraProject = z.object({
+	id: z.string(),
+	key: z.string(),
+	name: z.string(),
+	description: z.string().nullish()
+});
+const jiraPerson = z.object({
+	accountId: z.string().optional(),
+	key: z.string().optional(),
+	name: z.string().optional(),
+	displayName: z.string().default(""),
+	emailAddress: z.string().default("")
+}).nullish();
+const jiraComment = z.object({
+	id: z.string(),
+	body: z.string().nullish(),
+	author: jiraPerson,
+	created: z.string()
+});
+const commentPage = z.object({
+	comments: z.array(jiraComment),
+	total: z.number(),
+	startAt: z.number().default(0)
+});
+const jiraIssue = z.object({
+	id: z.string(),
+	key: z.string(),
+	fields: z.object({
+		summary: z.string().default(""),
+		description: z.string().nullish(),
+		priority: z.object({ name: z.string() }).nullish(),
+		labels: z.array(z.string()).default([]),
+		assignee: jiraPerson,
+		reporter: jiraPerson,
+		parent: z.object({ id: z.string() }).nullish(),
+		issuelinks: z.array(z.object({
+			type: z.object({ name: z.string() }),
+			outwardIssue: z.object({ id: z.string() }).optional()
+		})).default([]),
+		status: z.object({ id: z.string() }),
+		issuetype: z.object({ name: z.string() }).nullish(),
+		duedate: z.string().nullish(),
+		created: z.string(),
+		timeoriginalestimate: z.number().nullish(),
+		fixVersions: z.array(z.unknown()).default([]),
+		attachment: z.array(z.unknown()).default([]),
+		comment: commentPage.optional()
+	})
+});
+const statuses = z.array(z.object({ statuses: z.array(z.object({
+	id: z.string(),
+	name: z.string(),
+	statusCategory: z.object({ key: z.string() }).optional()
+})) }));
+const jiraCategory = {
+	new: "todo",
+	indeterminate: "in_progress",
+	done: "done"
+};
+const jiraPriority = {
+	highest: "urgent",
+	blocker: "urgent",
+	critical: "urgent",
+	high: "high",
+	major: "high",
+	medium: "medium",
+	low: "low",
+	minor: "low",
+	lowest: "low",
+	trivial: "low"
+};
+const jiraRelation = {
+	blocks: "blocks",
+	duplicate: "duplicate",
+	cloners: "clones",
+	"problem/incident": "causes"
+};
+const pageSize$2 = 50;
+const issueFields = [
+	"summary",
+	"description",
+	"priority",
+	"labels",
+	"assignee",
+	"reporter",
+	"parent",
+	"issuelinks",
+	"status",
+	"issuetype",
+	"duedate",
+	"created",
+	"timeoriginalestimate",
+	"fixVersions",
+	"attachment"
+];
+function createJiraReader(http) {
+	const get = async (source, schema, path, query = {}) => {
+		const url = new URL(`${source.baseUrl}/rest/api/2/${path}`);
+		for (const [name, value] of Object.entries(query)) url.searchParams.set(name, String(value));
+		return readable("jira", schema, await readSource(http, "jira", {
+			method: "GET",
+			url: url.toString(),
+			headers: {
+				Accept: "application/json",
+				Authorization: source.edition === "cloud" ? `Basic ${Buffer.from(`${source.email}:${source.token}`).toString("base64")}` : `Bearer ${source.token}`
+			},
+			body: ""
+		}));
+	};
+	async function* issuePages(source, project, fields) {
+		const common = {
+			jql: `project = ${JSON.stringify(project)} ORDER BY created ASC`,
+			fields: fields.join(","),
+			maxResults: pageSize$2
+		};
+		if (source.edition === "cloud") for (let token;;) {
+			const page = await get(source, z.object({
+				issues: z.array(jiraIssue),
+				nextPageToken: z.string().nullish(),
+				isLast: z.boolean().optional()
+			}), "search/jql", {
+				...common,
+				...token ? { nextPageToken: token } : {}
+			});
+			yield page.issues;
+			if (page.isLast === true || !page.nextPageToken) return;
+			token = page.nextPageToken;
+		}
+		for (let startAt = 0;;) {
+			const page = await get(source, z.object({
+				issues: z.array(jiraIssue),
+				total: z.number()
+			}), "search", {
+				...common,
+				startAt
+			});
+			yield page.issues;
+			startAt += page.issues.length;
+			if (!page.issues.length || startAt >= page.total) return;
+		}
+	}
+	return {
+		async projects(source) {
+			let found = [];
+			if (source.edition === "data_center") found = await get(source, z.array(jiraProject), "project");
+			else for (let startAt = 0;;) {
+				const page = await get(source, z.object({
+					values: z.array(jiraProject),
+					isLast: z.boolean().default(true)
+				}), "project/search", {
+					startAt,
+					maxResults: pageSize$2
+				});
+				found.push(...page.values);
+				startAt += page.values.length;
+				if (page.isLast || !page.values.length) break;
+			}
+			return found.map((item) => ({
+				ref: item.id,
+				key: item.key,
+				name: item.name,
+				group: ""
+			}));
+		},
+		async bundle(source, projectRef, includeComments) {
+			const project = await get(source, jiraProject, `project/${encodeURIComponent(projectRef)}`);
+			const out = bundleBuilder("jira");
+			const workflow = /* @__PURE__ */ new Map();
+			for (const type of await get(source, statuses, `project/${project.id}/statuses`)) for (const status of type.statuses) workflow.set(status.id, {
+				ref: status.id,
+				name: out.clip(status.name.trim(), 40),
+				category: category(status.name, jiraCategory[status.statusCategory?.key ?? ""] ?? "todo"),
+				color: "default"
+			});
+			const person = (who) => {
+				const ref = who && (who.accountId ?? who.key ?? who.name);
+				return out.person(who && ref ? {
+					ref,
+					name: who.displayName || ref,
+					email: who.emailAddress
+				} : null);
+			};
+			const fields = includeComments ? [...issueFields, "comment"] : issueFields;
+			for await (const page of issuePages(source, project.key, fields)) for (const { id, key, fields: issue } of page) {
+				const labels = out.labels(issue.labels.map((name) => ({ name })));
+				out.ticket(sourceTicket({
+					ref: id,
+					key,
+					title: out.clip(issue.summary.trim(), 500) || key,
+					description: out.clip(issue.description ?? "", 1e5),
+					priority: jiraPriority[issue.priority?.name.toLowerCase() ?? ""] ?? "none",
+					kind: kindOf([issue.issuetype?.name ?? "", ...labels]),
+					labels,
+					stateRef: issue.status.id,
+					assigneeRef: person(issue.assignee),
+					parentRef: issue.parent?.id ?? null,
+					createdByRef: person(issue.reporter),
+					createdAt: isoTime(issue.created),
+					dueAt: dueAt(issue.duedate),
+					archived: false
+				}));
+				for (const link of issue.issuelinks) if (link.outwardIssue) out.relation({
+					sourceRef: id,
+					targetRef: link.outwardIssue.id,
+					type: jiraRelation[link.type.name.toLowerCase()] ?? "related"
+				});
+				if (issue.timeoriginalestimate != null) out.note("estimates", "Kanvil has no estimates; difficulty is left unset.");
+				if (issue.fixVersions.length) out.note("fix versions", "Kanvil has no releases or milestones; the issues import without them.");
+				if (issue.attachment.length) out.note("attachments", "Files stay in Jira; text that links to them keeps its addresses.", issue.attachment.length);
+				if (!issue.comment) continue;
+				const notes = [...issue.comment.comments];
+				while (notes.length < issue.comment.total) {
+					const more = await get(source, commentPage, `issue/${id}/comment`, {
+						startAt: notes.length,
+						maxResults: 100
+					});
+					if (!more.comments.length) break;
+					notes.push(...more.comments);
+				}
+				for (const note of notes) if (note.body?.trim()) out.comment({
+					ref: note.id,
+					ticketRef: id,
+					authorRef: person(note.author),
+					body: out.clip(note.body, 5e4),
+					createdAt: isoTime(note.created)
+				});
+			}
+			if (!includeComments) out.note("comments", "Left out when the import was set up.", null);
+			out.note("sprints and story points", "Jira keeps them in custom fields an import does not read.", null);
+			out.note("Jira formatting", "Descriptions and comments keep Jira's wiki markup as plain text.", null);
+			if (source.edition === "data_center") out.note("epic links", "Data Center keeps epic links in a custom field an import does not read; sub-tasks keep their parent.", null);
+			return out.build({
+				ref: project.id,
+				key: project.key,
+				name: project.name,
+				description: project.description ?? ""
+			}, [...workflow.values()]);
+		}
+	};
+}
+//#endregion
+//#region src/adapters/kaneo.ts
+const task = z.object({
+	id: z.string(),
+	number: z.number(),
+	title: z.string(),
+	description: z.string().nullish(),
+	descriptionDeferred: z.boolean().optional(),
+	status: z.string(),
+	priority: z.string().nullish(),
+	startDate: z.string().nullish(),
+	dueDate: z.string().nullish(),
+	createdAt: z.string(),
+	userId: z.string().nullish(),
+	assigneeName: z.string().nullish(),
+	labels: z.array(z.object({
+		name: z.string(),
+		color: z.string().nullish()
+	})).default([]),
+	externalLinks: z.array(z.unknown()).default([])
+});
+const column = z.object({
+	id: z.string(),
+	name: z.string(),
+	isFinal: z.boolean().default(false),
+	position: z.number().default(0),
+	tasks: z.array(task).default([])
+});
+const board$2 = z.object({
+	data: z.object({
+		id: z.string(),
+		name: z.string(),
+		slug: z.string(),
+		description: z.string().nullish(),
+		descriptionDeferred: z.boolean().optional(),
+		workspaceId: z.string(),
+		columns: z.array(column).default([]),
+		archivedTasks: z.array(task).default([]),
+		plannedTasks: z.array(task).default([])
+	}),
+	pagination: z.object({
+		totalPages: z.number(),
+		relatedTotalPages: z.number().default(1)
+	})
+});
+const relation = z.object({
+	id: z.string(),
+	sourceTaskId: z.string(),
+	targetTaskId: z.string(),
+	relationType: z.string()
+});
+const comment$2 = z.object({
+	id: z.string(),
+	userId: z.string().nullish(),
+	content: z.string().nullish(),
+	createdAt: z.string(),
+	user: z.object({ name: z.string().nullish() }).nullish()
+});
+const priorities$1 = [
+	"urgent",
+	"high",
+	"medium",
+	"low"
+];
+const priorityOf$1 = (value) => priorities$1.find((priority) => priority === value) ?? "none";
+const plannedRef = "kaneo:planned";
+const pageSize$1 = 100;
+function createKaneoReader(http) {
+	const get = async (source, schema, path, query = {}) => {
+		const base = source.baseUrl.endsWith("/api") ? source.baseUrl : `${source.baseUrl}/api`;
+		const url = new URL(`${base}/${path}`);
+		for (const [name, value] of Object.entries(query)) url.searchParams.set(name, String(value));
+		return readable("kaneo", schema, await readSource(http, "kaneo", {
+			method: "GET",
+			url: url.toString(),
+			headers: {
+				Accept: "application/json",
+				Authorization: `Bearer ${source.token}`
+			},
+			body: ""
+		}));
+	};
+	return {
+		async projects(source) {
+			const workspaces = await get(source, z.array(z.object({
+				id: z.string(),
+				name: z.string()
+			})), "workspace");
+			const found = [];
+			for (const workspace of workspaces) for (const project of await get(source, z.array(z.object({
+				id: z.string(),
+				name: z.string(),
+				slug: z.string()
+			})), "project", {
+				workspaceId: workspace.id,
+				includeArchived: "true"
+			})) found.push({
+				ref: project.id,
+				key: project.slug.toUpperCase(),
+				name: project.name,
+				group: workspace.name
+			});
+			return found;
+		},
+		async bundle(source, projectId, includeComments) {
+			const out = bundleBuilder("kaneo");
+			const tasks = /* @__PURE__ */ new Map(), columns = /* @__PURE__ */ new Map();
+			let project;
+			for (let page = 1, pages = 1; page <= pages; page++) for (let related = 1, relatedPages = 1; related <= relatedPages; related++) {
+				const found = await get(source, board$2, `task/tasks/${encodeURIComponent(projectId)}`, {
+					page,
+					limit: pageSize$1,
+					relatedPage: related,
+					sortBy: "number",
+					sortOrder: "asc"
+				});
+				project ??= found.data;
+				pages = found.pagination.totalPages;
+				relatedPages = found.pagination.relatedTotalPages;
+				for (const item of found.data.columns) if (!columns.has(item.id)) columns.set(item.id, item);
+				for (const item of [
+					...found.data.columns.flatMap((list) => list.tasks),
+					...found.data.archivedTasks,
+					...found.data.plannedTasks
+				]) {
+					const known = tasks.get(item.id);
+					if (!known) tasks.set(item.id, item);
+					else {
+						const names = new Set(known.labels.map((label) => label.name));
+						known.labels.push(...item.labels.filter((label) => !names.has(label.name)));
+						known.externalLinks.push(...item.externalLinks);
 					}
-				}]))[0];
-				if (result?.status === "ok") {
-					if (!job.receiptId && "id" in result) await database.db.update(pushDeliveries).set({
-						receiptId: result.id,
-						availableAt: new Date(Date.now() + 9e5),
-						attempts: 0,
-						error: null
-					}).where(eq(pushDeliveries.id, job.id));
-					else await finish(null);
-				} else if (result?.status === "error" && result.details?.error !== "MessageRateExceeded") {
-					if (result.details?.error === "DeviceNotRegistered") await database.db.delete(pushDevices).where(eq(pushDevices.id, device.id));
-					else await finish(result.details?.error ?? "delivery_rejected");
-				} else await retry(result ? "rate_limited" : "receipt_pending");
-			} catch {
-				await retry("transport_error");
+				}
 			}
-			async function retry(error) {
-				await database.db.update(pushDeliveries).set({
-					attempts: job.attempts + 1,
-					error,
-					availableAt: new Date(Date.now() + (job.receiptId ? 9e5 : delay(job.attempts))),
-					finishedAt: job.attempts >= 4 && error !== "receipt_pending" ? /* @__PURE__ */ new Date() : null
-				}).where(eq(pushDeliveries.id, job.id));
+			if (!project) throw new ApiError(404, "not_found", "Kaneo has no such project");
+			const lists = [...columns.values()].toSorted((a, b) => a.position - b.position);
+			const workflow = lists.map((list) => ({
+				ref: list.id,
+				name: out.clip(list.name.trim(), 40) || list.id,
+				category: category(list.name, list.isFinal ? "done" : "todo"),
+				color: "default"
+			}));
+			if ([...tasks.values()].some((item) => item.status === "planned")) workflow.unshift({
+				ref: plannedRef,
+				name: "Planned",
+				category: "backlog",
+				color: "default"
+			});
+			const archivedRef = lists.findLast((list) => list.isFinal)?.id ?? lists.at(-1)?.id ?? plannedRef;
+			const people = new Map((await get(source, z.array(z.object({
+				id: z.string(),
+				name: z.string().nullish(),
+				email: z.string().nullish()
+			})), `workspace/${encodeURIComponent(project.workspaceId)}/members`)).map((member) => [member.id, {
+				ref: member.id,
+				name: member.name || member.id,
+				email: member.email ?? ""
+			}]));
+			const person = (id, name) => id ? people.get(id) ?? {
+				...formerMember(id),
+				...name ? { name } : {}
+			} : null;
+			const linked = /* @__PURE__ */ new Set(), parents = /* @__PURE__ */ new Map(), pending = [];
+			for (const item of tasks.values()) {
+				const key = `${project.slug.toUpperCase()}-${item.number}`;
+				const description = item.descriptionDeferred ? (await get(source, z.object({ description: z.string().nullish() }), `task/${encodeURIComponent(item.id)}`)).description ?? "" : item.description ?? "";
+				const labels = out.labels(item.labels);
+				pending.push(sourceTicket({
+					ref: item.id,
+					key,
+					title: out.clip(item.title.trim(), 500) || key,
+					description: out.clip(description, 1e5),
+					priority: priorityOf$1(item.priority),
+					kind: kindOf(labels),
+					labels,
+					stateRef: item.status === "planned" ? plannedRef : item.status === "archived" || !columns.has(item.status) ? archivedRef : item.status,
+					assigneeRef: out.person(person(item.userId, item.assigneeName)),
+					parentRef: null,
+					createdByRef: null,
+					createdAt: isoTime(item.createdAt),
+					startAt: startTime(item.startDate),
+					dueAt: dueTime(item.dueDate),
+					archived: item.status === "archived"
+				}));
+				if (item.externalLinks.length) out.note("external links", "Links to pull requests and issues stay in Kaneo.", item.externalLinks.length);
+				for (const link of await get(source, z.array(relation), `task-relation/${encodeURIComponent(item.id)}`)) {
+					if (linked.has(link.id)) continue;
+					linked.add(link.id);
+					if (link.relationType === "subtask") {
+						if (parents.has(link.targetTaskId)) out.note("other parents", "A ticket has one parent; subtasks keep the first.");
+						else parents.set(link.targetTaskId, link.sourceTaskId);
+					} else out.relation({
+						sourceRef: link.sourceTaskId,
+						targetRef: link.targetTaskId,
+						type: link.relationType === "blocks" ? "blocks" : "related"
+					});
+				}
+				if (includeComments) {
+					for (const note of await get(source, z.array(comment$2), `comment/${encodeURIComponent(item.id)}`)) if (note.content?.trim()) out.comment({
+						ref: note.id,
+						ticketRef: item.id,
+						authorRef: out.person(person(note.userId, note.user?.name)),
+						body: out.clip(note.content, 5e4),
+						createdAt: isoTime(note.createdAt)
+					});
+				}
 			}
+			for (const ticket of pending) out.ticket({
+				...ticket,
+				parentRef: parents.get(ticket.ref) ?? null
+			});
+			if (!includeComments) out.note("comments", "Left out when the import was set up.", null);
+			try {
+				const fields = await get(source, z.array(z.unknown()), `custom-field/project/${encodeURIComponent(project.id)}`);
+				if (fields.length) out.note("custom fields", "Custom fields and their values stay in Kaneo.", fields.length);
+			} catch (error) {
+				if (!(error instanceof ApiError && error.code === "not_found")) throw error;
+			}
+			out.note("time entries", "Kanvil has no time tracking; logged time stays in Kaneo.", null);
+			return out.build({
+				ref: project.id,
+				key: project.slug.toUpperCase(),
+				name: project.name,
+				description: project.descriptionDeferred ? (await get(source, z.object({ description: z.string().nullish() }), `project/${encodeURIComponent(project.id)}`)).description ?? "" : project.description ?? ""
+			}, workflow);
 		}
-	} finally {
+	};
+}
+//#endregion
+//#region src/adapters/linear.ts
+const pageInfo = z.object({
+	hasNextPage: z.boolean(),
+	endCursor: z.string().nullable()
+});
+const linearPerson = z.object({
+	id: z.string(),
+	name: z.string(),
+	email: z.string().nullish()
+}).transform(({ id, name, email }) => ({
+	ref: id,
+	name,
+	email: email ?? ""
+}));
+const ref = z.object({ id: z.string() }).nullable();
+const teams = z.object({ teams: z.object({
+	nodes: z.array(z.object({
+		id: z.string(),
+		key: z.string(),
+		name: z.string()
+	})),
+	pageInfo
+}) });
+const team = z.object({ team: z.object({
+	id: z.string(),
+	key: z.string(),
+	name: z.string(),
+	description: z.string().nullable(),
+	states: z.object({ nodes: z.array(z.object({
+		id: z.string(),
+		name: z.string(),
+		type: z.string(),
+		color: z.string()
+	})) })
+}) });
+const issues = z.object({ team: z.object({ issues: z.object({
+	nodes: z.array(z.object({
+		id: z.string(),
+		identifier: z.string(),
+		title: z.string(),
+		description: z.string().nullable(),
+		priority: z.number(),
+		estimate: z.number().nullable(),
+		dueDate: z.string().nullable(),
+		createdAt: z.string(),
+		archivedAt: z.string().nullable(),
+		state: z.object({ id: z.string() }),
+		parent: ref,
+		cycle: ref,
+		projectMilestone: ref,
+		project: ref,
+		assignee: linearPerson.nullable(),
+		creator: linearPerson.nullable(),
+		labels: z.object({
+			nodes: z.array(z.object({
+				name: z.string(),
+				color: z.string()
+			})),
+			pageInfo: pageInfo.pick({ hasNextPage: true })
+		}),
+		relations: z.object({
+			nodes: z.array(z.object({
+				type: z.string(),
+				relatedIssue: z.object({ id: z.string() })
+			})),
+			pageInfo: pageInfo.pick({ hasNextPage: true })
+		})
+	})),
+	pageInfo
+}) }) });
+const comments = z.object({ comments: z.object({
+	nodes: z.array(z.object({
+		id: z.string(),
+		body: z.string(),
+		createdAt: z.string(),
+		user: linearPerson.nullable(),
+		issue: ref
+	})),
+	pageInfo
+}) });
+const teamsQuery = `query Teams($after: String) {
+  teams(first: 100, after: $after) { nodes { id key name } pageInfo { hasNextPage endCursor } }
+}`;
+const teamQuery = `query Team($team: String!) {
+  team(id: $team) { id key name description states(first: 100) { nodes { id name type color } } }
+}`;
+const issuesQuery = `query Issues($team: String!, $after: String) {
+  team(id: $team) {
+    issues(first: 50, after: $after, includeArchived: true, orderBy: createdAt) {
+      nodes {
+        id identifier title description priority estimate dueDate createdAt archivedAt
+        state { id } parent { id } cycle { id } projectMilestone { id } project { id }
+        assignee { id name email } creator { id name email }
+        labels(first: 50) { nodes { name color } pageInfo { hasNextPage } }
+        relations(first: 50) { nodes { type relatedIssue { id } } pageInfo { hasNextPage } }
+      }
+      pageInfo { hasNextPage endCursor }
+    }
+  }
+}`;
+const commentsQuery = `query Comments($team: ID!, $after: String) {
+  comments(first: 100, after: $after, includeArchived: true, filter: { issue: { team: { id: { eq: $team } } } }) {
+    nodes { id body createdAt user { id name email } issue { id } }
+    pageInfo { hasNextPage endCursor }
+  }
+}`;
+const graphErrors = z.object({ errors: z.array(z.object({
+	message: z.string().default(""),
+	extensions: z.object({ code: z.string().optional() }).optional()
+})).optional() }).catch({});
+function judge$1(status, data) {
+	const errors = graphErrors.parse(data).errors ?? [];
+	const codes = errors.map((error) => error.extensions?.code);
+	if (codes.includes("RATELIMITED")) return "limited";
+	if (codes.includes("AUTHENTICATION_ERROR") || codes.includes("FORBIDDEN")) return "rejected";
+	if (errors.some((error) => /not found/i.test(error.message))) return "not_found";
+	if (errors.length) return status >= 200 && status < 300 ? "invalid" : byStatus(status);
+	return byStatus(status);
+}
+const linearCategory = {
+	triage: "backlog",
+	backlog: "backlog",
+	unstarted: "todo",
+	started: "in_progress",
+	completed: "done",
+	canceled: "cancelled"
+};
+const linearPriority = [
+	"none",
+	"urgent",
+	"high",
+	"medium",
+	"low"
+];
+const linearRelation = {
+	blocks: "blocks",
+	duplicate: "duplicate",
+	related: "related",
+	similar: "related"
+};
+const pages$1 = async (read) => {
+	const all = [];
+	for (let after = null;;) {
+		const page = await read(after);
+		all.push(...page.nodes);
+		if (!page.pageInfo.hasNextPage || !page.pageInfo.endCursor) return all;
+		after = page.pageInfo.endCursor;
+	}
+};
+function createLinearReader(http, url) {
+	const query = async (token, schema, text, variables) => {
+		const data = await readSource(http, "linear", {
+			method: "POST",
+			url,
+			headers: { Authorization: token },
+			body: JSON.stringify({
+				query: text,
+				variables
+			})
+		}, judge$1);
+		return readable("linear", schema, readable("linear", z.object({ data: z.unknown() }), data).data);
+	};
+	return {
+		async projects(token) {
+			return (await pages$1(async (after) => (await query(token, teams, teamsQuery, { after })).teams)).map((item) => ({
+				ref: item.id,
+				key: item.key,
+				name: item.name,
+				group: ""
+			}));
+		},
+		async bundle(token, teamId, includeComments) {
+			const source = (await query(token, team, teamQuery, { team: teamId })).team;
+			const out = bundleBuilder("linear");
+			const workflow = source.states.nodes.map((state) => ({
+				ref: state.id,
+				name: out.clip(state.name.trim(), 40),
+				category: category(state.name, linearCategory[state.type] ?? "todo"),
+				color: toneOf(state.color)
+			}));
+			const read = await pages$1(async (after) => (await query(token, issues, issuesQuery, {
+				team: source.id,
+				after
+			})).team.issues);
+			for (const issue of read) {
+				const labels = out.labels(issue.labels.nodes);
+				out.ticket(sourceTicket({
+					ref: issue.id,
+					key: issue.identifier,
+					title: out.clip(issue.title.trim(), 500) || issue.identifier,
+					description: out.clip(issue.description ?? "", 1e5),
+					priority: linearPriority[issue.priority] ?? "none",
+					kind: kindOf(labels),
+					labels,
+					stateRef: issue.state.id,
+					assigneeRef: out.person(issue.assignee),
+					parentRef: issue.parent?.id ?? null,
+					createdByRef: out.person(issue.creator),
+					createdAt: isoTime(issue.createdAt),
+					dueAt: dueAt(issue.dueDate),
+					archived: issue.archivedAt !== null
+				}));
+				for (const relation of issue.relations.nodes) out.relation({
+					sourceRef: issue.id,
+					targetRef: relation.relatedIssue.id,
+					type: linearRelation[relation.type] ?? "related"
+				});
+				if (issue.labels.pageInfo.hasNextPage || issue.relations.pageInfo.hasNextPage) out.note("labels or relationships past 50", "Kanvil reads the first 50 labels and relationships of each Linear issue.");
+				if (issue.cycle) out.note("cycles", "Kanvil has no cycles; issues keep their state and dates.");
+				if (issue.estimate !== null) out.note("estimates", "Kanvil has no estimates; difficulty is left unset.");
+				if (issue.projectMilestone) out.note("milestones", "Kanvil has no milestones; the issues import without them.");
+				if (issue.project) out.note("Linear projects", "Project membership is not carried over; issues import into one project.");
+			}
+			if (includeComments) {
+				const notes = await pages$1(async (after) => (await query(token, comments, commentsQuery, {
+					team: source.id,
+					after
+				})).comments);
+				for (const note of notes) if (note.issue && note.body.trim()) out.comment({
+					ref: note.id,
+					ticketRef: note.issue.id,
+					authorRef: out.person(note.user),
+					body: out.clip(note.body, 5e4),
+					createdAt: isoTime(note.createdAt)
+				});
+			} else out.note("comments", "Left out when the import was set up.", null);
+			out.note("attachments", "Files and linked resources stay in Linear.", null);
+			return out.build({
+				ref: source.id,
+				key: source.key,
+				name: source.name,
+				description: source.description ?? ""
+			}, workflow);
+		}
+	};
+}
+//#endregion
+//#region src/adapters/plane.ts
+const perPage = 100;
+const listOf = (item) => z.union([z.array(item).transform((results) => ({
+	results,
+	next_cursor: null,
+	more: false
+})), z.object({
+	results: z.array(item),
+	next_cursor: z.string().nullish(),
+	next_page_results: z.boolean().default(false)
+}).transform(({ results, next_cursor, next_page_results }) => ({
+	results,
+	next_cursor,
+	more: next_page_results
+}))]);
+const project = z.object({
+	id: z.string(),
+	identifier: z.string(),
+	name: z.string(),
+	description: z.string().nullish()
+});
+const state = z.object({
+	id: z.string(),
+	name: z.string(),
+	color: z.string().nullish(),
+	group: z.string()
+});
+const label$1 = z.object({
+	id: z.string(),
+	name: z.string(),
+	color: z.string().nullish()
+});
+const member$1 = z.object({
+	id: z.string(),
+	display_name: z.string().nullish(),
+	first_name: z.string().nullish(),
+	last_name: z.string().nullish(),
+	email: z.string().nullish()
+});
+const named = z.union([z.string(), z.object({ id: z.string() }).transform(({ id }) => id)]);
+const item = z.object({
+	id: z.string(),
+	sequence_id: z.number(),
+	name: z.string(),
+	description_html: z.string().nullish(),
+	priority: z.string().nullish(),
+	state: named.nullish(),
+	parent: named.nullish(),
+	assignees: z.array(named).default([]),
+	labels: z.array(named).default([]),
+	start_date: z.string().nullish(),
+	target_date: z.string().nullish(),
+	created_at: z.string(),
+	created_by: named.nullish(),
+	estimate_point: named.nullish(),
+	cycle_id: z.string().nullish(),
+	attachment_count: z.number().default(0),
+	link_count: z.number().default(0)
+});
+const comment$1 = z.object({
+	id: z.string(),
+	comment_html: z.string().nullish(),
+	actor: named.nullish(),
+	created_by: named.nullish(),
+	created_at: z.string()
+});
+const linked = z.array(z.object({ issue_id: z.string() })).default([]);
+const relations$1 = z.object({
+	blocking: linked,
+	duplicate: linked,
+	relates_to: linked,
+	start_before: linked,
+	start_after: linked,
+	finish_before: linked,
+	finish_after: linked
+});
+const planeCategory = {
+	triage: "backlog",
+	backlog: "backlog",
+	unstarted: "todo",
+	started: "in_progress",
+	completed: "done",
+	cancelled: "cancelled"
+};
+const priorities = [
+	"urgent",
+	"high",
+	"medium",
+	"low"
+];
+const priorityOf = (value) => priorities.find((priority) => priority === value) ?? "none";
+const markdown = new TurndownService({
+	headingStyle: "atx",
+	codeBlockStyle: "fenced",
+	bulletListMarker: "-"
+});
+const text = (html) => html ? markdown.turndown(html).trim() : "";
+const notFound = (error) => error instanceof ApiError && error.code === "not_found";
+function createPlaneReader(http) {
+	const get = async (source, schema, path, query = {}) => {
+		const url = new URL(`${source.baseUrl}/api/v1/workspaces/${encodeURIComponent(source.workspace)}/${path}`);
+		for (const [name, value] of Object.entries(query)) url.searchParams.set(name, String(value));
+		return readable("plane", schema, await readSource(http, "plane", {
+			method: "GET",
+			url: url.toString(),
+			headers: {
+				Accept: "application/json",
+				"X-API-Key": source.token
+			},
+			body: ""
+		}));
+	};
+	const all = async (source, schema, path) => {
+		const found = [];
+		for (let cursor = null;;) {
+			const page = await get(source, listOf(schema), path, {
+				per_page: perPage,
+				...cursor ? { cursor } : {}
+			});
+			found.push(...page.results);
+			if (!page.more || !page.next_cursor || page.next_cursor === cursor) return found;
+			cursor = page.next_cursor;
+		}
+	};
+	return {
+		async projects(source) {
+			return (await all(source, project, "projects/")).map((found) => ({
+				ref: found.id,
+				key: found.identifier,
+				name: found.name,
+				group: ""
+			}));
+		},
+		async bundle(source, projectId, includeComments) {
+			const found = await get(source, project, `projects/${encodeURIComponent(projectId)}/`);
+			const path = `projects/${encodeURIComponent(found.id)}`;
+			const out = bundleBuilder("plane");
+			const workflow = (await all(source, state, `${path}/states/`)).map((entry) => ({
+				ref: entry.id,
+				name: out.clip(entry.name.trim(), 40),
+				category: category(entry.name, planeCategory[entry.group] ?? "todo"),
+				color: toneOf(entry.color)
+			}));
+			const labels = new Map((await all(source, label$1, `${path}/labels/`)).map((entry) => [entry.id, entry]));
+			const people = new Map((await all(source, member$1, `${path}/members/`)).map((entry) => [entry.id, {
+				ref: entry.id,
+				name: entry.display_name || [entry.first_name, entry.last_name].filter(Boolean).join(" ") || entry.id,
+				email: entry.email ?? ""
+			}]));
+			const person = (id) => id ? people.get(id) ?? formerMember(id) : null;
+			let items, kind = "work-items";
+			try {
+				items = await all(source, item, `${path}/work-items/`);
+			} catch (error) {
+				if (!notFound(error)) throw error;
+				kind = "issues";
+				items = await all(source, item, `${path}/issues/`);
+			}
+			const key = (sequence) => `${found.identifier}-${sequence}`;
+			const related = /* @__PURE__ */ new Set();
+			let readsRelations = kind === "work-items";
+			for (const work of items) {
+				const names = out.labels(work.labels.flatMap((id) => {
+					const tag = labels.get(id);
+					return tag ? [{
+						name: tag.name,
+						color: tag.color
+					}] : [];
+				}));
+				out.ticket(sourceTicket({
+					ref: work.id,
+					key: key(work.sequence_id),
+					title: out.clip(work.name.trim(), 500) || key(work.sequence_id),
+					description: out.clip(text(work.description_html), 1e5),
+					priority: priorityOf(work.priority),
+					kind: kindOf(names),
+					labels: names,
+					stateRef: work.state ?? workflow[0]?.ref ?? "",
+					assigneeRef: out.assignee(work.assignees.flatMap((id) => person(id) ?? [])),
+					parentRef: work.parent ?? null,
+					createdByRef: out.person(person(work.created_by)),
+					createdAt: isoTime(work.created_at),
+					startAt: startTime(work.start_date),
+					dueAt: dueTime(work.target_date),
+					archived: false
+				}));
+				if (work.estimate_point) out.note("estimates", "Kanvil has no estimates; difficulty is left unset.");
+				if (work.cycle_id) out.note("cycles", "Kanvil has no cycles; work items keep their state and dates.");
+				if (work.attachment_count) out.note("attachments", "Files stay in Plane.", work.attachment_count);
+				if (work.link_count) out.note("links", "Work item links stay in Plane.", work.link_count);
+				if (readsRelations) try {
+					const links = await get(source, relations$1, `${path}/work-items/${encodeURIComponent(work.id)}/relations/`);
+					const add = (type, target, mutual) => {
+						const pair = mutual ? [work.id, target].toSorted().join(":") : `${work.id}:${target}`;
+						if (related.has(`${type}:${pair}`)) return;
+						related.add(`${type}:${pair}`);
+						out.relation({
+							sourceRef: work.id,
+							targetRef: target,
+							type
+						});
+					};
+					for (const other of links.blocking) add("blocks", other.issue_id, false);
+					for (const other of links.duplicate) add("duplicate", other.issue_id, true);
+					for (const other of links.relates_to) add("related", other.issue_id, true);
+					const dated = links.start_before.length + links.start_after.length + links.finish_before.length + links.finish_after.length;
+					if (dated) out.note("date dependencies", "Kanvil has no start or finish dependencies; the work items keep their dates.", dated);
+				} catch (error) {
+					if (!notFound(error)) throw error;
+					readsRelations = false;
+				}
+				if (includeComments) for (const note of (await all(source, comment$1, `${path}/${kind}/${encodeURIComponent(work.id)}/comments/`)).toSorted((a, b) => a.created_at.localeCompare(b.created_at))) {
+					const body = text(note.comment_html);
+					if (body) out.comment({
+						ref: note.id,
+						ticketRef: work.id,
+						authorRef: out.person(person(note.actor ?? note.created_by)),
+						body: out.clip(body, 5e4),
+						createdAt: isoTime(note.created_at)
+					});
+				}
+			}
+			if (!readsRelations) out.note("relations", "This Plane version does not list relations through its API.", null);
+			if (!includeComments) out.note("comments", "Left out when the import was set up.", null);
+			out.note("archived, draft, and intake work items", "Plane's API does not list them; restore or publish them in Plane first.", null);
+			try {
+				const modules = await get(source, z.object({ total_count: z.number().default(0) }).catch({ total_count: 0 }), `${path}/modules/`, { per_page: 1 });
+				if (modules.total_count) out.note("modules", "Kanvil has no modules; the work items import without them.", modules.total_count);
+			} catch (error) {
+				if (!notFound(error)) throw error;
+			}
+			return out.build({
+				ref: found.id,
+				key: found.identifier,
+				name: found.name,
+				description: found.description ?? ""
+			}, workflow);
+		}
+	};
+}
+//#endregion
+//#region src/adapters/planka.ts
+const user = z.object({
+	id: z.string(),
+	name: z.string().nullish(),
+	username: z.string().nullish(),
+	email: z.string().nullish()
+});
+const card$1 = z.object({
+	id: z.string(),
+	name: z.string(),
+	description: z.string().nullish(),
+	dueDate: z.string().nullish(),
+	listId: z.string(),
+	prevListId: z.string().nullish(),
+	creatorUserId: z.string().nullish(),
+	createdAt: z.string(),
+	listChangedAt: z.string().nullish(),
+	stopwatch: z.unknown().nullish(),
+	commentsTotal: z.number().optional()
+});
+const included = z.object({
+	users: z.array(user).default([]),
+	cards: z.array(card$1).default([]),
+	cardLabels: z.array(z.object({
+		cardId: z.string(),
+		labelId: z.string()
+	})).default([]),
+	cardMemberships: z.array(z.object({
+		cardId: z.string(),
+		userId: z.string()
+	})).default([]),
+	taskLists: z.array(z.object({
+		id: z.string(),
+		cardId: z.string(),
+		name: z.string().nullish(),
+		position: z.number().nullish()
+	})).optional(),
+	tasks: z.array(z.object({
+		cardId: z.string().nullish(),
+		taskListId: z.string().nullish(),
+		name: z.string(),
+		isCompleted: z.boolean().default(false),
+		position: z.number().nullish()
+	})).default([]),
+	attachments: z.array(z.object({ cardId: z.string() })).default([]),
+	customFieldValues: z.array(z.object({ cardId: z.string() })).default([])
+});
+const board$1 = z.object({
+	item: z.object({
+		id: z.string(),
+		name: z.string()
+	}),
+	included: included.extend({
+		lists: z.array(z.object({
+			id: z.string(),
+			name: z.string().nullish(),
+			type: z.string().nullish(),
+			position: z.number().nullish()
+		})).default([]),
+		labels: z.array(z.object({
+			id: z.string(),
+			name: z.string().nullish(),
+			color: z.string().nullish()
+		})).default([])
+	})
+});
+const cardPage = z.object({
+	items: z.array(card$1),
+	included: included.omit({ cards: true })
+});
+const notes = z.object({
+	items: z.array(z.object({
+		id: z.string(),
+		type: z.string().optional(),
+		text: z.string().optional(),
+		data: z.object({ text: z.string().optional() }).nullish(),
+		userId: z.string().nullish(),
+		createdAt: z.string()
+	})),
+	included: z.object({ users: z.array(user).default([]) }).default({ users: [] })
+});
+const pageSize = 50;
+const byPosition$1 = (a, b) => (a.position ?? Number.MAX_SAFE_INTEGER) - (b.position ?? Number.MAX_SAFE_INTEGER);
+async function pages(read, stalled) {
+	const found = [], seen = /* @__PURE__ */ new Set();
+	for (let last;;) {
+		const page = await read(last);
+		const fresh = page.items.filter((item) => !seen.has(item.id));
+		if (!fresh.length && page.items.length) {
+			stalled();
+			return found;
+		}
+		for (const item of fresh) seen.add(item.id);
+		found.push({
+			...page,
+			items: fresh
+		});
+		if (page.items.length < pageSize) return found;
+		last = page.items.at(-1);
+	}
+}
+function grouped(items) {
+	const map = /* @__PURE__ */ new Map();
+	for (const entry of items) map.set(entry.cardId, [...map.get(entry.cardId) ?? [], entry]);
+	return map;
+}
+function createPlankaReader(http) {
+	const read = async (source, headers, schema, path, query = {}) => {
+		const url = new URL(`${source.baseUrl}/api/${path}`);
+		for (const [name, value] of Object.entries(query)) url.searchParams.set(name, value);
+		return readable("planka", schema, await readSource(http, "planka", {
+			method: "GET",
+			url: url.toString(),
+			headers: {
+				Accept: "application/json",
+				...headers
+			},
+			body: ""
+		}));
+	};
+	const session = async (source, use) => {
+		if (source.signIn === "api_key") return use({ "X-Api-Key": source.token });
+		const { item: token } = readable("planka", z.object({ item: z.string() }), await readSource(http, "planka", {
+			method: "POST",
+			url: `${source.baseUrl}/api/access-tokens`,
+			headers: { Accept: "application/json" },
+			body: JSON.stringify({
+				emailOrUsername: source.username,
+				password: source.password
+			})
+		}, byStatus, { retry: false }));
+		const headers = { Authorization: `Bearer ${token}` };
 		try {
-			if (ownsLock) await lock.query("SELECT pg_advisory_unlock(7361082)");
+			return await use(headers);
 		} finally {
-			lock.release();
+			await http({
+				method: "DELETE",
+				url: `${source.baseUrl}/api/access-tokens/me`,
+				headers,
+				body: ""
+			}).catch(() => void 0);
 		}
+	};
+	return {
+		projects: (source) => session(source, async (headers) => {
+			const found = await read(source, headers, z.object({
+				items: z.array(z.object({
+					id: z.string(),
+					name: z.string()
+				})),
+				included: z.object({ boards: z.array(z.object({
+					id: z.string(),
+					projectId: z.string(),
+					name: z.string(),
+					position: z.number().nullish()
+				})).default([]) })
+			}), "projects");
+			return found.items.flatMap((project) => found.included.boards.filter((item) => item.projectId === project.id).toSorted(byPosition$1).map((item) => ({
+				ref: item.id,
+				key: "",
+				name: item.name,
+				group: project.name
+			})));
+		}),
+		bundle: (source, boardId, includeComments) => session(source, async (headers) => {
+			const { item, included: contents } = await read(source, headers, board$1, `boards/${encodeURIComponent(boardId)}`);
+			const modern = contents.taskLists !== void 0;
+			const out = bundleBuilder("planka");
+			const lists = [...contents.lists].toSorted(byPosition$1);
+			const states = lists.filter((list) => !list.type || ["active", "closed"].includes(list.type));
+			const workflow = states.map((list) => ({
+				ref: list.id,
+				name: out.clip((list.name ?? "").trim(), 40) || "Untitled list",
+				category: category(list.name ?? "", list.type === "closed" ? "done" : "todo"),
+				color: "default"
+			}));
+			const merged = {
+				...contents,
+				cards: [...contents.cards],
+				archived: /* @__PURE__ */ new Set()
+			};
+			for (const archive of lists.filter((list) => list.type === "archive")) for (const page of await pages((last) => read(source, headers, cardPage, `lists/${encodeURIComponent(archive.id)}/cards`, last?.listChangedAt ? {
+				"before[listChangedAt]": last.listChangedAt,
+				"before[id]": last.id
+			} : {}), () => out.note("archived cards past the first page", "PLANKA answered the same page again; the archived cards it did not return are left out.", null))) {
+				for (const found of page.items) merged.archived.add(found.id);
+				merged.cards.push(...page.items);
+				merged.users.push(...page.included.users);
+				merged.cardLabels.push(...page.included.cardLabels);
+				merged.cardMemberships.push(...page.included.cardMemberships);
+				merged.taskLists?.push(...page.included.taskLists ?? []);
+				merged.tasks.push(...page.included.tasks);
+				merged.attachments.push(...page.included.attachments);
+				merged.customFieldValues.push(...page.included.customFieldValues);
+			}
+			if (lists.some((list) => list.type === "trash")) out.note("deleted cards", "Cards in PLANKA's trash are left out.", null);
+			const people = /* @__PURE__ */ new Map();
+			const know = (users) => {
+				for (const found of users) people.set(found.id, {
+					ref: found.id,
+					name: found.name || found.username || found.id,
+					email: found.email ?? ""
+				});
+			};
+			know(merged.users);
+			const threads = /* @__PURE__ */ new Map();
+			if (includeComments) for (const found of merged.cards) {
+				if (found.commentsTotal === 0) continue;
+				const thread = await pages((last) => read(source, headers, notes, `cards/${encodeURIComponent(found.id)}/${modern ? "comments" : "actions"}`, last ? { beforeId: last.id } : {}), () => out.note("comments past the first page", "PLANKA answered the same page again; older comments are left out.", null));
+				for (const page of thread) know(page.included.users);
+				threads.set(found.id, thread.flatMap((page) => page.items));
+			}
+			const person = (id) => id ? people.get(id) ?? formerMember(id) : null;
+			const labels = new Map(contents.labels.map((label) => [label.id, label]));
+			const cardLabels = grouped(merged.cardLabels), memberships = grouped(merged.cardMemberships), attachments = grouped(merged.attachments), values = grouped(merged.customFieldValues), taskLists = grouped(merged.taskLists ?? []);
+			const known = new Set(states.map((list) => list.id));
+			const fallback = states.find((list) => list.type === "closed")?.id ?? states.at(-1)?.id ?? "";
+			for (const found of merged.cards) {
+				const names = out.labels((cardLabels.get(found.id) ?? []).flatMap(({ labelId }) => {
+					const label = labels.get(labelId);
+					return label ? [{
+						name: label.name?.trim() || label.color || "label",
+						color: label.color
+					}] : [];
+				}));
+				const checklists = modern ? (taskLists.get(found.id) ?? []).toSorted(byPosition$1).map((list) => ({
+					name: list.name ?? "Tasks",
+					items: merged.tasks.filter((task) => task.taskListId === list.id)
+				})) : [{
+					name: "Tasks",
+					items: merged.tasks.filter((task) => task.cardId === found.id)
+				}];
+				const archived = merged.archived.has(found.id);
+				const stateRef = known.has(found.listId) ? found.listId : found.prevListId && known.has(found.prevListId) ? found.prevListId : fallback;
+				out.ticket(sourceTicket({
+					ref: found.id,
+					key: out.clip(found.name.trim(), 40),
+					title: out.clip(found.name.trim(), 500) || "Untitled card",
+					description: out.clip(withChecklists(found.description ?? "", checklists.map((list) => ({
+						name: list.name,
+						items: list.items.toSorted(byPosition$1).map((task) => ({
+							name: task.name,
+							done: task.isCompleted
+						}))
+					}))), 1e5),
+					priority: "none",
+					kind: kindOf(names),
+					labels: names,
+					stateRef,
+					assigneeRef: out.assignee((memberships.get(found.id) ?? []).flatMap(({ userId }) => person(userId) ?? [])),
+					parentRef: null,
+					createdByRef: out.person(person(found.creatorUserId)),
+					createdAt: isoTime(found.createdAt),
+					dueAt: found.dueDate ? isoTime(found.dueDate) : null,
+					archived
+				}));
+				const files = attachments.get(found.id)?.length ?? 0;
+				if (files) out.note("attachments", "Files and links stay in PLANKA.", files);
+				const filled = values.get(found.id)?.length ?? 0;
+				if (filled) out.note("custom fields", "Custom field values stay in PLANKA.", filled);
+				if (found.stopwatch) out.note("stopwatches", "Kanvil has no time tracking; recorded time stays in PLANKA.");
+				for (const note of (threads.get(found.id) ?? []).toReversed()) {
+					const body = (note.text ?? note.data?.text ?? "").trim();
+					if (note.type && note.type !== "commentCard" || !body) continue;
+					out.comment({
+						ref: note.id,
+						ticketRef: found.id,
+						authorRef: out.person(person(note.userId)),
+						body: out.clip(body, 5e4),
+						createdAt: isoTime(note.createdAt)
+					});
+				}
+			}
+			if (!includeComments) out.note("comments", "Left out when the import was set up.", null);
+			return out.build({
+				ref: item.id,
+				key: "",
+				name: item.name,
+				description: ""
+			}, workflow);
+		})
+	};
+}
+//#endregion
+//#region src/adapters/trello.ts
+const board = z.object({
+	id: z.string(),
+	name: z.string(),
+	desc: z.string().default("")
+});
+const list = z.object({
+	id: z.string(),
+	name: z.string(),
+	closed: z.boolean().default(false)
+});
+const label = z.object({
+	name: z.string().nullish(),
+	color: z.string().nullish()
+});
+const card = z.object({
+	id: z.string(),
+	idShort: z.number().optional(),
+	name: z.string(),
+	desc: z.string().default(""),
+	due: z.string().nullish(),
+	start: z.string().nullish(),
+	dueComplete: z.boolean().default(false),
+	idList: z.string(),
+	idMembers: z.array(z.string()).default([]),
+	labels: z.array(label).default([]),
+	closed: z.boolean().default(false),
+	badges: z.object({ attachments: z.number().default(0) }).optional()
+});
+const checklist = z.object({
+	id: z.string(),
+	idCard: z.string(),
+	name: z.string(),
+	pos: z.number().default(0),
+	checkItems: z.array(z.object({
+		name: z.string(),
+		state: z.string(),
+		pos: z.number().default(0)
+	})).default([])
+});
+const member = z.object({
+	id: z.string(),
+	fullName: z.string().nullish(),
+	username: z.string().default("")
+});
+const comment = z.object({
+	id: z.string(),
+	date: z.string(),
+	data: z.object({
+		text: z.string().default(""),
+		card: z.object({ id: z.string() }).optional()
+	}),
+	memberCreator: member.nullish()
+});
+const pageLimit = 1e3;
+const byPosition = (a, b) => a.pos - b.pos;
+const createdAt = (id) => (/* @__PURE__ */ new Date(parseInt(id.slice(0, 8), 16) * 1e3)).toISOString();
+const personOf = (who) => ({
+	ref: who.id,
+	name: who.fullName || who.username || who.id,
+	email: ""
+});
+const judge = (status, data) => status === 400 && data === void 0 ? "rejected" : byStatus(status);
+const all = async (read) => {
+	const found = /* @__PURE__ */ new Map();
+	for (let before = null;;) {
+		const page = await read(before);
+		const fresh = page.filter((item) => !found.has(item.id));
+		for (const item of fresh) found.set(item.id, item);
+		if (page.length < pageLimit || !fresh.length) return [...found.values()];
+		before = fresh.map((item) => item.id).reduce((a, b) => a < b ? a : b);
 	}
+};
+const paged = (before) => ({
+	limit: pageLimit,
+	...before ? { before } : {}
+});
+function createTrelloReader(http, url) {
+	const get = async (source, schema, path, query = {}) => {
+		const target = new URL(`${url}/1/${path}`);
+		for (const [name, value] of Object.entries(query)) target.searchParams.set(name, String(value));
+		return readable("trello", schema, await readSource(http, "trello", {
+			method: "GET",
+			url: target.toString(),
+			headers: {
+				Accept: "application/json",
+				Authorization: `OAuth oauth_consumer_key="${source.apiKey}", oauth_token="${source.token}"`
+			},
+			body: ""
+		}, judge));
+	};
+	return {
+		async projects(source) {
+			return (await get(source, z.array(board.pick({
+				id: true,
+				name: true
+			})), "members/me/boards", {
+				filter: "all",
+				fields: "name"
+			})).map((item) => ({
+				ref: item.id,
+				key: "",
+				name: item.name,
+				group: ""
+			}));
+		},
+		async bundle(source, boardId, includeComments) {
+			const found = await get(source, board, `boards/${encodeURIComponent(boardId)}`, { fields: "name,desc" });
+			const path = `boards/${encodeURIComponent(found.id)}`;
+			const out = bundleBuilder("trello");
+			const lists = await get(source, z.array(list), `${path}/lists`, {
+				filter: "all",
+				fields: "name,closed"
+			});
+			const members = new Map((await get(source, z.array(member), `${path}/members`, { fields: "fullName,username" })).map((item) => [item.id, personOf(item)]));
+			const cards = await all((before) => get(source, z.array(card), `${path}/cards/all`, {
+				fields: "idShort,name,desc,due,start,dueComplete,idList,idMembers,labels,closed,badges",
+				...paged(before)
+			}));
+			const checklists = /* @__PURE__ */ new Map();
+			for (const item of await all((before) => get(source, z.array(checklist), `${path}/checklists`, {
+				fields: "idCard,name,pos",
+				checkItems: "all",
+				checkItem_fields: "name,state,pos",
+				...paged(before)
+			}))) checklists.set(item.idCard, [...checklists.get(item.idCard) ?? [], item]);
+			const used = new Set(cards.map((item) => item.idList));
+			const closedLists = new Set(lists.filter((item) => item.closed).map((item) => item.id));
+			const workflow = lists.filter((item) => !item.closed || used.has(item.id)).map((item) => ({
+				ref: item.id,
+				name: out.clip(item.name.trim(), 40),
+				category: category(item.name, "todo"),
+				color: "default"
+			}));
+			for (const item of cards) {
+				const labels = out.labels(item.labels.map((tag) => ({
+					name: tag.name?.trim() || tag.color || "label",
+					color: tag.color
+				})));
+				const own = (checklists.get(item.id) ?? []).toSorted(byPosition);
+				out.ticket(sourceTicket({
+					ref: item.id,
+					key: item.idShort === void 0 ? "" : `#${item.idShort}`,
+					title: out.clip(item.name.trim(), 500) || "Untitled card",
+					description: out.clip(withChecklists(item.desc, own.map((checks) => ({
+						name: checks.name,
+						items: checks.checkItems.toSorted(byPosition).map((check) => ({
+							name: check.name,
+							done: check.state === "complete"
+						}))
+					}))), 1e5),
+					priority: "none",
+					kind: kindOf(labels),
+					labels,
+					stateRef: item.idList,
+					assigneeRef: out.assignee(item.idMembers.map((id) => members.get(id) ?? formerMember(id))),
+					parentRef: null,
+					createdByRef: null,
+					createdAt: createdAt(item.id),
+					startAt: item.start ? isoTime(item.start) : null,
+					dueAt: item.due ? isoTime(item.due) : null,
+					archived: item.closed || closedLists.has(item.idList)
+				}));
+				if (item.dueComplete) out.note("completed due dates", "Kanvil has no due-date checkmark; the cards keep their due date and list.");
+				if (item.badges?.attachments) out.note("attachments", "Files and links stay in Trello.", item.badges.attachments);
+			}
+			if (includeComments) {
+				const notes = await all((before) => get(source, z.array(comment), `${path}/actions`, {
+					filter: "commentCard",
+					fields: "data,date",
+					memberCreator_fields: "fullName,username",
+					...paged(before)
+				}));
+				for (const note of notes.toSorted((a, b) => a.date.localeCompare(b.date))) if (note.data.card && note.data.text.trim()) out.comment({
+					ref: note.id,
+					ticketRef: note.data.card.id,
+					authorRef: out.person(note.memberCreator ? personOf(note.memberCreator) : null),
+					body: out.clip(note.data.text, 5e4),
+					createdAt: isoTime(note.date)
+				});
+			} else out.note("comments", "Left out when the import was set up.", null);
+			const fields = await get(source, z.array(z.unknown()), `${path}/customFields`);
+			if (fields.length) out.note("custom fields", "Power-Up custom fields stay in Trello.", fields.length);
+			return out.build({
+				ref: found.id,
+				key: "",
+				name: found.name,
+				description: found.desc
+			}, workflow);
+		}
+	};
 }
-function createPushDelivery(database, config) {
-	let running;
-	const transport = new Expo(config.EXPO_ACCESS_TOKEN ? { accessToken: config.EXPO_ACCESS_TOKEN } : {});
-	const tick = () => {
-		if (!running) running = deliverPushBatch(database, config, transport).catch(() => {
-			console.error("Push delivery failed; queued notifications will be retried.");
-		}).finally(() => {
-			running = void 0;
-		});
+//#endregion
+//#region src/adapters/import-sources.ts
+function createImportSources(http, urls) {
+	const linear = createLinearReader(http, urls.linear), jira = createJiraReader(http), trello = createTrelloReader(http, urls.trello), plane = createPlaneReader(http), planka = createPlankaReader(http), kaneo = createKaneoReader(http);
+	const reader = (source) => {
+		switch (source.provider) {
+			case "linear": return {
+				projects: () => linear.projects(source.token),
+				bundle: (project, comments) => linear.bundle(source.token, project, comments)
+			};
+			case "jira": return {
+				projects: () => jira.projects(source),
+				bundle: (project, comments) => jira.bundle(source, project, comments)
+			};
+			case "trello": return {
+				projects: () => trello.projects(source),
+				bundle: (project, comments) => trello.bundle(source, project, comments)
+			};
+			case "plane": return {
+				projects: () => plane.projects(source),
+				bundle: (project, comments) => plane.bundle(source, project, comments)
+			};
+			case "planka": return {
+				projects: () => planka.projects(source),
+				bundle: (project, comments) => planka.bundle(source, project, comments)
+			};
+			default: return {
+				projects: () => kaneo.projects(source),
+				bundle: (project, comments) => kaneo.bundle(source, project, comments)
+			};
+		}
+	};
+	return {
+		projects: (source) => reader(source).projects(),
+		bundle: (source, project, { includeComments }) => reader(source).bundle(project, includeComments)
 	};
-	const timer = config.KANVIL_PUSH_ENABLED ? setInterval(tick, 3e4) : void 0;
-	timer?.unref();
-	return { async close() {
-		clearInterval(timer);
-		await running;
-	} };
 }
 //#endregion
 //#region src/runtime-adapters.ts
 const defaultAdapters = {
 	auth: createAuth,
 	realtime: createEventDelivery,
-	push: createPushDelivery,
+	senders: defaultSenders,
 	objectStore: createObjectStore,
 	ticketIndex: createTicketIndex,
-	jobs: createPollingJob
+	jobs: createPollingJob,
+	repositories: (config) => ({
+		github: createGitHubDriver(config.KANVIL_GITHUB_API_URL),
+		gitea: createGiteaDriver(),
+		gitlab: createGitLabDriver()
+	}),
+	importSources: (config) => createImportSources(createHttpSender({
+		allowPrivate: config.KANVIL_DELIVERY_ALLOW_PRIVATE,
+		timeout: 3e4,
+		responseLimit: 16777216
+	}), {
+		linear: config.KANVIL_LINEAR_API_URL,
+		trello: config.KANVIL_TRELLO_API_URL
+	})
 };
 //#endregion
 //#region src/mcp.ts
@@ -1075,6 +3126,66 @@ function createMcp(auth, domain, access, config, limitWrite) {
 	};
 }
 //#endregion
+//#region src/reminders.ts
+const overdueWindow = 6048e5;
+const source = {
+	kind: "system",
+	id: "due-reminders"
+};
+async function sendDueReminders(database, now = /* @__PURE__ */ new Date()) {
+	return database.db.transaction(async (tx) => {
+		await tx.execute(sql`SELECT pg_advisory_xact_lock(7361080)`);
+		const kind = sql`case when ${tickets.dueAt} <= ${now} then 'overdue' else 'due_soon' end`;
+		const lead = sql`(coalesce(${notificationPreferences.reminderAmount}, 1) || ' ' || coalesce(${notificationPreferences.reminderUnit}, 'days'))::interval`;
+		const due = await tx.select({
+			kind,
+			ticketId: tickets.id,
+			projectId: tickets.projectId,
+			key: tickets.key,
+			title: tickets.title,
+			dueAt: tickets.dueAt,
+			...recipientColumns
+		}).from(tickets).innerJoin(subscriptions, eq(subscriptions.ticketId, tickets.id)).innerJoin(user$1, eq(user$1.id, subscriptions.userId)).leftJoin(notificationPreferences, eq(notificationPreferences.userId, user$1.id)).where(and(isNotNull(tickets.dueAt), eq(tickets.archived, false), sql`not exists (select 1 from projects p where p.id = ${tickets.projectId} and p.archived_at is not null)`, notInArray(tickets.status, [...closedStates]), gt(tickets.dueAt, /* @__PURE__ */ new Date(now.getTime() - overdueWindow)), sql`${tickets.dueAt} - ${lead} <= ${now}`, sql`coalesce((${notificationPreferences.categories} ->> ${kind})::boolean, true)`, reachable(tickets.projectId), sql`not exists (
+            select 1 from ${notifications} join ${events} on ${events.id} = ${notifications.eventId}
+            where ${notifications.userId} = ${user$1.id} and ${events.ticketId} = ${tickets.id}
+              and ${events.type} = 'ticket.' || ${kind}
+              and (${events.data} ->> 'dueAt')::timestamptz = ${tickets.dueAt})`));
+		const groups = /* @__PURE__ */ new Map();
+		for (const row of due) {
+			const group = groups.get(`${row.ticketId}:${row.kind}`) ?? {
+				row,
+				recipients: []
+			};
+			group.recipients.push(row);
+			groups.set(`${row.ticketId}:${row.kind}`, group);
+		}
+		const pending = [];
+		for (const { row, recipients } of groups.values()) {
+			const dueAt = row.dueAt?.toISOString();
+			const [event] = await appendEvents(tx, [{
+				projectId: row.projectId,
+				ticketId: row.ticketId,
+				actorId: null,
+				type: `ticket.${row.kind}`,
+				data: {
+					dueAt,
+					key: row.key,
+					title: row.title,
+					source
+				}
+			}]);
+			const reminderKey = `${row.kind}:${row.ticketId}:${dueAt}`;
+			if (event) pending.push(...recipients.map((recipient) => ({
+				event,
+				recipient,
+				reminderKey
+			})));
+		}
+		await notify(tx, pending);
+		return pending.length;
+	});
+}
+//#endregion
 //#region src/app.ts
 const setupInput = z$1.object({
 	token: z$1.string().max(200),
@@ -1082,12 +3193,15 @@ const setupInput = z$1.object({
 	name: z$1.string().trim().min(1).max(120),
 	password: z$1.string().min(12).max(128)
 }).strict();
-const keyInput = z$1.object({
-	name: z$1.string().trim().min(1).max(100),
-	projectIds: z$1.array(z$1.uuid()).min(1).max(1e3),
-	scopes: z$1.array(z$1.enum(scopes)).min(1),
-	expiresIn: z$1.number().int().min(3600).max(31536e3).default(7776e3)
-}).strict();
+const toPreferences = (row) => notificationPreferencesSchema.parse(row ? {
+	inApp: row.inApp,
+	push: row.push,
+	categories: row.categories,
+	reminderLead: {
+		amount: row.reminderAmount,
+		unit: row.reminderUnit
+	}
+} : {});
 const digest = (value) => createHash("sha256").update(value).digest();
 async function createApplication(database, config, overrides = {}) {
 	const adapters = {
@@ -1098,15 +3212,24 @@ async function createApplication(database, config, overrides = {}) {
 	const instance = createInstance(integrationDatabase, config);
 	await instance.read();
 	const blobs = createBlobStorage(integrationDatabase, instance, adapters.objectStore, adapters.jobs), search = createTicketSearch(integrationDatabase, instance, adapters.ticketIndex, adapters.jobs);
+	const secrets = deliverySecrets(config), senders = adapters.senders(config), repositories = adapters.repositories(config);
 	const auth = adapters.auth(database, config), domain = createDomain(database, {
 		blobs,
-		search
+		search,
+		secrets,
+		publicUrl: config.KANVIL_URL,
+		mail: senders.mail,
+		sources: adapters.importSources(config)
 	}), access = createAccess(auth, domain, config, database), realtime = await adapters.realtime(config, instance, integrationDatabase);
 	const unsubscribeJobs = realtime.subscribe(() => {
 		blobs.sync().catch(() => {});
 		search.sync().catch(() => {});
 	});
-	const push = adapters.push(database, config);
+	const outbox = adapters.jobs("outbox", 5e3, () => deliverBatch(database, config, senders, secrets, repositories));
+	const reminders = adapters.jobs("due-reminders", 6e4, () => sendDueReminders(database));
+	const imports = adapters.jobs("imports", 2e3, async () => {
+		if (await processImports(domain)) imports.trigger().catch(() => {});
+	});
 	const accounts = createAccountAdministration(integrationDatabase, auth, config);
 	const app = new OpenAPIHono({ defaultHook: (result) => {
 		if (!result.success) return Response.json({ error: {
@@ -1170,20 +3293,23 @@ async function createApplication(database, config, overrides = {}) {
 		return Response.json({ status: "ok" });
 	});
 	const setupRequired = async () => (await database.pool.query("SELECT count(*)::int AS count FROM \"user\"")).rows[0]?.count === 0;
-	app.get("/api/v1/info", async () => Response.json({
-		...await instance.read().then((row) => ({
-			name: row.name,
-			description: row.description
-		})),
-		version: applicationVersion,
-		authentication: await instance.authentication(),
-		setupRequired: await setupRequired(),
-		push: config.KANVIL_PUSH_ENABLED,
-		oidc: config.OIDC_DISCOVERY_URL ? {
-			id: "oidc",
-			name: config.OIDC_NAME
-		} : null
-	}));
+	app.get("/api/v1/info", async () => {
+		const authentication = await instance.authentication(), providers = signInProviders(config);
+		return Response.json({
+			...await instance.read().then((row) => ({
+				name: row.name,
+				description: row.description
+			})),
+			version: applicationVersion,
+			authentication,
+			setupRequired: await setupRequired(),
+			push: config.KANVIL_PUSH_ENABLED,
+			email: !!config.SMTP_URL,
+			emailCodes: emailCodesAvailable(config, authentication),
+			oidc: providers.find((provider) => provider.id === "oidc") ?? null,
+			providers
+		});
+	});
 	app.post("/api/v1/setup", async (c) => {
 		access.checkOrigin(c.req.raw);
 		const input = setupInput.parse(await c.req.json());
@@ -1203,6 +3329,7 @@ async function createApplication(database, config, overrides = {}) {
 				userId: created.user.id,
 				role: "admin"
 			});
+			await tx.update(workspaces).set({ ownerId: created.user.id }).where(and(eq(workspaces.id, workspace.id), isNull(workspaces.ownerId)));
 		});
 		return Response.json({ ok: true }, { status: 201 });
 	});
@@ -1214,6 +3341,43 @@ async function createApplication(database, config, overrides = {}) {
 	const writes = createWriteLimiter(config.KANVIL_SESSION_WRITE_LIMIT);
 	const mcpHandler = createMcp(auth, domain, access, config, (key) => writes.consume(key));
 	app.all("/mcp", (c) => mcpHandler(c.req.raw));
+	app.openAPIRegistry.registerPath({
+		method: "get",
+		path: "/api/calendar/{token}.ics",
+		request: { params: z$1.object({ token: z$1.string() }) },
+		responses: {
+			200: {
+				description: "iCalendar feed",
+				content: { "text/calendar": { schema: z$1.string() } }
+			},
+			404: { description: "Feed unavailable" }
+		}
+	});
+	app.get("/api/calendar/:file", async (c) => {
+		const token = /^(.+)\.ics$/.exec(c.req.param("file"))?.[1], body = token ? await readCalendarFeed(database.db, token, config.KANVIL_URL) : null;
+		if (body === null) fail(404, "not_found", "This calendar feed does not exist or was revoked");
+		return new Response(body, { headers: {
+			"Content-Type": "text/calendar; charset=utf-8",
+			"Content-Disposition": "inline; filename=\"kanvil.ics\"",
+			"Cache-Control": "no-store",
+			"Referrer-Policy": "no-referrer"
+		} });
+	});
+	app.openAPIRegistry.registerPath({
+		method: "post",
+		path: "/api/repository-hooks/{connectionId}",
+		request: { params: z$1.object({ connectionId: z$1.uuid() }) },
+		responses: {
+			200: { description: "Already handled; nothing applied again" },
+			202: { description: "Handled; the body names the outcome per linked ticket" },
+			401: { description: "Signature does not match" },
+			404: { description: "Connection unavailable" }
+		}
+	});
+	app.post("/api/repository-hooks/:connectionId", async (c) => {
+		const result = await receiveRepositoryWebhook(domain, repositories, secrets, c.req.param("connectionId"), c.req.raw.headers, await c.req.text());
+		return c.json(result, result.outcome === "duplicate" ? 200 : 202);
+	});
 	app.use("/api/v1/*", async (c, next) => {
 		access.checkOrigin(c.req.raw);
 		const actor = await access.authenticate(c.req.raw);
@@ -1231,29 +3395,39 @@ async function createApplication(database, config, overrides = {}) {
 	});
 	registerInstanceRoutes(app, database, instance, blobs, search, realtime, auth);
 	accounts.register(app);
-	app.openAPIRegistry.registerPath({
-		method: "get",
-		path: "/api/v1/projects/{projectId}/icon",
-		security: [{ sessionCookie: [] }],
-		request: { params: z$1.object({ projectId: z$1.string() }) },
-		responses: {
-			200: {
-				description: "Private project icon",
-				content: {
-					"image/png": { schema: z$1.string() },
-					"image/jpeg": { schema: z$1.string() },
-					"image/webp": { schema: z$1.string() }
-				}
-			},
-			404: { description: "Project icon unavailable" }
-		}
-	});
-	app.get("/api/v1/projects/:projectId/icon", async (c) => {
-		const project = await domain.execute("get_project", { projectId: c.req.param("projectId") }, c.get("actor"));
-		const row = one(await database.db.select({ objectId: projects.iconObjectId }).from(projects).where(eq(projects.id, project.id)));
-		if (!row.objectId) fail(404, "not_found", "This project has no uploaded icon");
-		return imageResponse(await blobs.get(row.objectId));
-	});
+	for (const [image, column, description] of [[
+		"icon",
+		projects.iconObjectId,
+		"Private project icon"
+	], [
+		"background",
+		projects.backgroundObjectId,
+		"Private project background"
+	]]) {
+		app.openAPIRegistry.registerPath({
+			method: "get",
+			path: `/api/v1/projects/{projectId}/${image}`,
+			security: [{ sessionCookie: [] }],
+			request: { params: z$1.object({ projectId: z$1.string() }) },
+			responses: {
+				200: {
+					description,
+					content: {
+						"image/png": { schema: z$1.string() },
+						"image/jpeg": { schema: z$1.string() },
+						"image/webp": { schema: z$1.string() }
+					}
+				},
+				404: { description: `Project ${image} unavailable` }
+			}
+		});
+		app.get(`/api/v1/projects/:projectId/${image}`, async (c) => {
+			const project = await domain.execute("get_project", { projectId: c.req.param("projectId") }, c.get("actor"));
+			const row = one(await database.db.select({ objectId: column }).from(projects).where(eq(projects.id, project.id)));
+			if (!row.objectId) fail(404, "not_found", `This project has no uploaded ${image}`);
+			return imageResponse(await blobs.get(row.objectId));
+		});
+	}
 	app.get("/api/v1/credentials", async (c) => {
 		const identity = c.get("actor");
 		if (identity.machine) fail(403, "forbidden", "Use a signed-in account to manage credentials");
@@ -1272,7 +3446,7 @@ async function createApplication(database, config, overrides = {}) {
 	app.post("/api/v1/credentials", async (c) => {
 		const identity = c.get("actor");
 		if (identity.machine) fail(403, "forbidden", "Use a signed-in account to manage credentials");
-		const input = keyInput.parse(await c.req.json()), allowed = await domain.accessibleProjects(identity);
+		const input = credentialInput.parse(await c.req.json()), allowed = await domain.accessibleProjects(identity);
 		if (input.projectIds.some((id) => !allowed.some((row) => row.id === id))) fail(403, "forbidden", "Choose projects you can access");
 		const key = await auth.api.createApiKey({ body: {
 			userId: identity.id,
@@ -1309,14 +3483,23 @@ async function createApplication(database, config, overrides = {}) {
 		return Response.json({ cursor: row.value.toString() });
 	});
 	app.get("/api/v1/projects/:projectId/attachments/:id/content", async (c) => {
-		const id = z$1.uuid().parse(c.req.param("id"));
-		const row = one(await database.db.select().from(attachments).where(eq(attachments.id, id)));
-		const authorized = await domain.execute("list_attachments", {
-			projectId: c.req.param("projectId"),
-			ticketId: row.ticketId
-		}, c.get("actor"));
-		requireRow(authorized.find((item) => item.id === id));
-		const bytes = row.objectId ? (await blobs.get(row.objectId)).data : one(await database.db.select({ data: attachmentContent.data }).from(attachmentContent).where(eq(attachmentContent.id, id))).data;
+		const id = z$1.uuid().parse(c.req.param("id")), projectId = c.req.param("projectId"), actor = c.get("actor");
+		const attached = (await database.db.select().from(attachments).where(eq(attachments.id, id)))[0];
+		let row, objectId;
+		if (attached) {
+			const authorized = await domain.execute("list_attachments", {
+				projectId: attached.projectId,
+				ticketId: attached.ticketId
+			}, actor);
+			requireRow(authorized.find((item) => item.id === id));
+			row = attached;
+			objectId = attached.objectId;
+		} else {
+			const visible = await domain.execute("get_project", { projectId }, actor);
+			row = one(await database.db.select().from(stagedUploads).where(and(eq(stagedUploads.id, id), eq(stagedUploads.projectId, visible.id), eq(stagedUploads.actorId, actor.id), gt(stagedUploads.createdAt, stagedUploadCutoff()))));
+			objectId = id;
+		}
+		const bytes = objectId ? (await blobs.get(objectId)).data : one(await database.db.select({ data: attachmentContent.data }).from(attachmentContent).where(eq(attachmentContent.id, id))).data;
 		if (bytes.length !== row.size) fail(500, "attachment_corrupt", "Attachment integrity check failed");
 		return new Response(bytes, { headers: {
 			"Content-Type": row.contentType,
@@ -1328,25 +3511,30 @@ async function createApplication(database, config, overrides = {}) {
 	});
 	app.get("/api/v1/notifications/preferences", async (c) => {
 		const row = (await database.db.select().from(notificationPreferences).where(eq(notificationPreferences.userId, c.get("actor").id)))[0];
-		return Response.json(notificationPreferencesSchema.parse(row ? {
-			inApp: row.inApp,
-			push: row.push
-		} : {}));
+		return Response.json(toPreferences(row));
 	});
 	app.put("/api/v1/notifications/preferences", async (c) => {
 		const identity = requireSession(c.get("actor"));
-		const input = notificationPreferencesInput.parse(await c.req.json());
+		const { categories, reminderLead, ...channels } = notificationPreferencesInput.parse(await c.req.json());
+		const values = {
+			...channels,
+			...reminderLead && {
+				reminderAmount: reminderLead.amount,
+				reminderUnit: reminderLead.unit
+			}
+		};
 		const row = one(await database.db.insert(notificationPreferences).values({
 			userId: identity.id,
-			...input
+			...values,
+			categories: categories ?? {}
 		}).onConflictDoUpdate({
 			target: notificationPreferences.userId,
-			set: input
-		}).returning({
-			inApp: notificationPreferences.inApp,
-			push: notificationPreferences.push
-		}));
-		return Response.json(notificationPreferencesSchema.parse(row));
+			set: {
+				...values,
+				...categories && { categories: sql`${notificationPreferences.categories} || ${JSON.stringify(categories)}::jsonb` }
+			}
+		}).returning());
+		return Response.json(toPreferences(row));
 	});
 	app.post("/api/v1/notifications/device", async (c) => {
 		const identity = requireSession(c.get("actor"));
@@ -1378,13 +3566,19 @@ async function createApplication(database, config, overrides = {}) {
 		return Response.json(json(await database.db.select({
 			id: notifications.id,
 			readAt: notifications.readAt,
+			category: notifications.category,
+			createdAt: notifications.createdAt,
 			event: events
-		}).from(notifications).innerJoin(events, eq(events.id, notifications.eventId)).where(and(eq(notifications.userId, identity.id), eq(notifications.inbox, true), inArray(notifications.projectId, allowed.map((row) => row.id)))).orderBy(desc(notifications.createdAt)).limit(100)));
+		}).from(notifications).innerJoin(events, eq(events.id, notifications.eventId)).where(and(eq(notifications.userId, identity.id), eq(notifications.inbox, true), isNull(notifications.dismissedAt), inArray(notifications.projectId, allowed.map((row) => row.id)))).orderBy(desc(notifications.createdAt)).limit(100)));
 	});
 	app.post("/api/v1/notifications/read", async (c) => {
-		requireSession(c.get("actor"));
-		const input = z$1.object({ ids: z$1.array(z$1.uuid()).min(1).max(100) }).parse(await c.req.json());
-		await database.db.update(notifications).set({ readAt: /* @__PURE__ */ new Date() }).where(and(eq(notifications.userId, c.get("actor").id), inArray(notifications.id, input.ids)));
+		const identity = requireSession(c.get("actor")), input = notificationReadInput.parse(await c.req.json());
+		await database.db.update(notifications).set({ readAt: input.read ? sql`coalesce(${notifications.readAt}, now())` : null }).where(and(eq(notifications.userId, identity.id), inArray(notifications.id, input.ids)));
+		return Response.json({ ok: true });
+	});
+	app.post("/api/v1/notifications/dismiss", async (c) => {
+		const identity = requireSession(c.get("actor")), input = notificationIdsInput.parse(await c.req.json());
+		await database.db.update(notifications).set({ dismissedAt: /* @__PURE__ */ new Date() }).where(and(eq(notifications.userId, identity.id), inArray(notifications.id, input.ids), isNull(notifications.dismissedAt)));
 		return Response.json({ ok: true });
 	});
 	app.get("/api/v1/events", async (c) => {
@@ -1461,18 +3655,18 @@ async function createApplication(database, config, overrides = {}) {
 			await done;
 		});
 	});
-	for (const name of Object.keys(operations).filter(isOperation)) {
-		const spec = operations[name], params = {}, rest = {};
+	const register = (name, spec, base, secured, run) => {
+		const params = {}, rest = {};
 		const keys = [...spec.path.matchAll(/\{(\w+)\}/g)].map((match) => match[1]);
 		for (const [key, value] of Object.entries(spec.input.shape)) if (keys.includes(key)) params[key] = value;
 		else rest[key] = value;
 		const method = spec.method === "GET" ? "get" : spec.method === "POST" ? "post" : spec.method === "PATCH" ? "patch" : "delete";
 		const route = createRoute({
 			method,
-			path: `/api/v1${spec.path}`,
+			path: `${base}${spec.path}`,
 			operationId: name,
 			description: spec.description,
-			security: [{ bearerAuth: [] }],
+			security: secured ? [{ bearerAuth: [] }] : [],
 			request: {
 				params: z$1.object(params),
 				...method === "get" ? { query: z$1.object(rest).strict() } : { body: {
@@ -1489,21 +3683,31 @@ async function createApplication(database, config, overrides = {}) {
 					description: "Invalid input",
 					content: { "application/json": { schema: errorSchema } }
 				},
-				401: { description: "Authentication required" },
-				403: { description: "Insufficient permissions" },
+				...secured ? {
+					401: { description: "Authentication required" },
+					403: { description: "Insufficient permissions" }
+				} : {},
 				404: { description: "Not found" },
-				409: { description: "Version, ownership, or dependency conflict" },
-				429: { description: "Too many writes from this session; see Retry-After" }
+				...secured ? {
+					409: { description: "Version, ownership, or dependency conflict" },
+					429: { description: "Too many writes from this session; see Retry-After" }
+				} : {}
 			}
 		});
 		app.openapi(route, async (c) => {
-			const values = spec.method === "GET" ? c.req.query() : z$1.record(z$1.string(), z$1.unknown()).parse(await c.req.json());
-			return Response.json(await domain.execute(name, {
-				...values,
+			return run({
+				...spec.method === "GET" ? Object.fromEntries(Object.entries(c.req.queries()).map(([key, list]) => [key, list.length === 1 ? list[0] : list])) : z$1.record(z$1.string(), z$1.unknown()).parse(await c.req.json()),
 				...c.req.param()
-			}, c.get("actor")));
+			}, () => c.get("actor"));
 		});
-	}
+	};
+	for (const name of Object.keys(operations).filter(isOperation)) register(name, operations[name], "/api/v1", true, async (values, actor) => Response.json(await domain.execute(name, values, actor())));
+	app.use("/api/public/*", async (c, next) => {
+		await next();
+		c.header("Cache-Control", "no-store");
+		c.header("Referrer-Policy", "no-referrer");
+	});
+	for (const name of Object.keys(publicOperations).filter(isPublicOperation)) register(name, publicOperations[name], "/api/public", false, async (values) => Response.json(await domain.readPublic(name, values)));
 	app.openAPIRegistry.registerComponent("securitySchemes", "bearerAuth", {
 		type: "http",
 		scheme: "bearer",
@@ -1552,12 +3756,14 @@ async function createApplication(database, config, overrides = {}) {
 		search,
 		realtime,
 		close: async () => {
+			await imports.close();
 			unsubscribeJobs();
 			await realtime.close();
 			await search.close();
 			await blobs.close();
 			await integrationDatabase.pool.end();
-			await push.close();
+			await outbox.close();
+			await reminders.close();
 		}
 	};
 }