@maudecode/kanvil 0.2.1 → 0.4.0

package/apps/server/dist/auth-I1XEr0d4.mjs

@@ -1,2931 +0,0 @@
-import { a as instanceUpdateSchema, c as s3SettingsSchema, f as account, g as user, h as session, i as brokerSettingsSchema, l as searchAuthentication, m as auth_schema_exports, r as authenticationPolicySchema, u as searchSettingsSchema } from "./config-CbNqtJEj.mjs";
-import { and, asc, count, desc, eq, getTableColumns, gt, ilike, inArray, isNotNull, isNull, lt, ne, notInArray, or, sql } from "drizzle-orm";
-import { alias, bigint, boolean, customType, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unique, uuid } from "drizzle-orm/pg-core";
-import { z } from "zod";
-import { decodeJwt } from "jose";
-import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "node:crypto";
-import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { icons } from "@iconify-json/lucide";
-import { APIError, createAuthMiddleware } from "better-auth/api";
-import { betterAuth } from "better-auth";
-import { admin, genericOAuth, jwt } from "better-auth/plugins";
-import { drizzleAdapter } from "@better-auth/drizzle-adapter";
-import { apiKey } from "@better-auth/api-key";
-import { expo } from "@better-auth/expo";
-import { mcp } from "@better-auth/mcp";
-import { cimd } from "@better-auth/cimd";
-import { fetchClientMetadataResource } from "@better-auth/cimd/node";
-//#region src/adapters/oidc.ts
-const identitySchema = z.object({
-	sub: z.string().min(1),
-	email: z.email(),
-	email_verified: z.literal(true),
-	name: z.string().nullish(),
-	picture: z.string().nullish()
-});
-const discoverySchema = z.object({
-	issuer: z.string(),
-	userinfo_endpoint: z.url({ protocol: /^https?$/ })
-});
-function createOIDCUserInfo(config) {
-	return async (tokens) => {
-		if (!tokens.idToken) return null;
-		const claims = decodeJwt(tokens.idToken);
-		let profile = identitySchema.safeParse(claims);
-		if (!profile.success) {
-			if (!config.OIDC_DISCOVERY_URL || !tokens.accessToken) return null;
-			const discovery = await fetch(config.OIDC_DISCOVERY_URL, { signal: AbortSignal.timeout(1e4) });
-			if (!discovery.ok) return null;
-			const metadata = discoverySchema.parse(await discovery.json());
-			if (metadata.issuer !== claims.iss) return null;
-			const response = await fetch(metadata.userinfo_endpoint, {
-				headers: { Authorization: `Bearer ${tokens.accessToken}` },
-				signal: AbortSignal.timeout(1e4)
-			});
-			if (!response.ok) return null;
-			profile = identitySchema.safeParse(await response.json());
-		}
-		if (!profile.success || profile.data.sub !== claims.sub) return null;
-		return {
-			...profile.data,
-			id: profile.data.sub,
-			emailVerified: true,
-			name: profile.data.name ?? "",
-			image: profile.data.picture ?? void 0
-		};
-	};
-}
-function matchesOIDCBinding(binding, issuer, clientId) {
-	if (!binding.idToken || !issuer || !clientId) return false;
-	try {
-		const claims = decodeJwt(binding.idToken);
-		const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
-		return claims.iss === issuer && claims.sub === binding.accountId && audience.includes(clientId);
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region ../../packages/contracts/src/index.ts
-const states = [
-	"backlog",
-	"todo",
-	"in_progress",
-	"in_review",
-	"done",
-	"cancelled"
-];
-const closedStates = ["done", "cancelled"];
-const priorities = [
-	"urgent",
-	"high",
-	"medium",
-	"low",
-	"none"
-];
-const kinds = [
-	"feature",
-	"bug",
-	"chore",
-	"research",
-	"documentation"
-];
-const difficulties = [
-	"low",
-	"med",
-	"high"
-];
-const roles = [
-	"reader",
-	"writer",
-	"admin"
-];
-const projectIconColors = [
-	"default",
-	"red",
-	"orange",
-	"amber",
-	"yellow",
-	"lime",
-	"green",
-	"emerald",
-	"teal",
-	"cyan",
-	"sky",
-	"blue",
-	"indigo",
-	"violet",
-	"purple",
-	"fuchsia",
-	"pink",
-	"rose",
-	"gray"
-];
-const hexColor = z.string().regex(/^#[0-9a-f]{6}$/i).overwrite((value) => value.toLowerCase());
-const labelColor = z.union([z.enum(projectIconColors), hexColor]);
-const isHexColor = (value) => hexColor.safeParse(value).success;
-const hasAdminRole = (role) => role?.split(",").includes("admin") ?? false;
-const scopes = [
-	"read",
-	"write",
-	"claim",
-	"admin"
-];
-const attachmentLimit = 1e7;
-const id = z.string().min(1).max(80);
-const timestamp$1 = z.iso.datetime();
-const dueDate = z.iso.datetime().refine((value) => new Date(value).getUTCFullYear() >= 1, "Due date must be in year 1 or later");
-const version = z.number().int().positive();
-const text$1 = z.string().trim().min(1);
-const tags = z.array(text$1.max(40)).max(30).overwrite((values) => [...new Set(values)]);
-const projectLabelSchema = z.object({
-	id: z.uuid(),
-	projectId: z.uuid(),
-	name: text$1.max(40),
-	color: labelColor,
-	version
-});
-const pagination = {
-	limit: z.coerce.number().int().min(1).max(100).default(50),
-	offset: z.coerce.number().int().min(0).default(0)
-};
-const mutation = { requestId: z.uuid().optional() };
-const projectInput = z.object({ projectId: id });
-const ticketInput = projectInput.extend({ ticketId: id });
-const ticketFilter = z.object({
-	q: z.string().trim().max(200).optional(),
-	status: z.enum(states).optional(),
-	priority: z.enum(priorities).optional(),
-	kind: z.enum(kinds).optional(),
-	difficulty: z.enum(difficulties).optional(),
-	label: z.string().max(40).optional(),
-	assigneeId: z.union([id, z.literal("none")]).optional(),
-	parentId: id.optional(),
-	archived: z.enum([
-		"include",
-		"only",
-		"exclude"
-	]).default("exclude"),
-	due: z.enum([
-		"overdue",
-		"today",
-		"week",
-		"scheduled",
-		"none"
-	]).optional(),
-	sort: z.enum([
-		"priority",
-		"updated",
-		"created",
-		"title",
-		"labels",
-		"due",
-		"number",
-		"status",
-		"difficulty",
-		"kind",
-		"assignee"
-	]).default("priority"),
-	order: z.enum(["asc", "desc"]).optional()
-}).strict();
-const defaultOrder = {
-	priority: "asc",
-	updated: "desc",
-	created: "desc",
-	title: "asc",
-	labels: "asc",
-	due: "asc",
-	number: "asc",
-	status: "asc",
-	difficulty: "asc",
-	kind: "asc",
-	assignee: "asc"
-};
-const ticketFields = z.object({
-	title: text$1.max(500).overwrite((value) => value.replace(/\s+/gu, " ")),
-	description: z.string().max(1e5),
-	acceptanceCriteria: z.string().max(5e4),
-	status: z.enum(states),
-	priority: z.enum(priorities),
-	kind: z.enum(kinds),
-	difficulty: z.enum(difficulties).nullable(),
-	labels: tags,
-	scopes: tags,
-	assigneeId: z.string().nullable(),
-	parentId: z.uuid().nullable(),
-	automationReady: z.boolean(),
-	holdReason: z.string().trim().max(2e3).nullable(),
-	dueAt: dueDate.nullable(),
-	archived: z.boolean()
-}).strict();
-const ticketChanges = ticketFields.partial().refine((value) => Object.keys(value).length > 0, "Provide at least one change");
-const workspaceSchema = z.object({
-	id: z.uuid(),
-	slug: text$1.max(80),
-	name: text$1.max(120),
-	description: z.string(),
-	version,
-	createdAt: timestamp$1,
-	updatedAt: timestamp$1,
-	role: z.enum(roles).nullable()
-});
-const memberSchema = z.object({
-	userId: z.string(),
-	name: z.string(),
-	email: z.string(),
-	role: z.enum(roles),
-	image: z.string().nullable().optional(),
-	source: z.enum(["project", "workspace"]).optional(),
-	inheritedRole: z.enum(roles).nullable().optional()
-});
-const projectSchema = z.object({
-	iconName: z.string().nullable().default(null),
-	iconColor: z.enum(projectIconColors).default("default"),
-	image: z.string().nullable().default(null),
-	workspaceId: z.uuid(),
-	visibility: z.enum(["workspace", "private"]),
-	id: z.uuid(),
-	key: z.string(),
-	name: z.string(),
-	description: z.string(),
-	version,
-	createdAt: timestamp$1,
-	updatedAt: timestamp$1
-});
-const ticketSchema = ticketFields.extend({
-	claimRequired: z.boolean(),
-	id: z.uuid(),
-	projectId: z.uuid(),
-	key: z.string(),
-	number: z.number().int().positive(),
-	version,
-	createdBy: z.string(),
-	createdAt: timestamp$1,
-	updatedAt: timestamp$1
-});
-const snapshotSchema = z.object({
-	project: projectSchema,
-	tickets: z.array(ticketSchema),
-	cursor: z.string().regex(/^\d+$/)
-});
-z.object({ cursor: z.string().regex(/^\d+$/) });
-const readinessSchema = z.object({
-	ready: z.boolean(),
-	reasons: z.array(z.object({
-		code: z.string(),
-		message: z.string(),
-		ticketId: z.uuid().optional()
-	}))
-});
-const claimSchema = z.object({
-	id: z.uuid(),
-	projectId: z.uuid(),
-	ticketId: z.uuid(),
-	actorId: z.string(),
-	workerId: z.string(),
-	expiresAt: timestamp$1,
-	createdAt: timestamp$1
-});
-const relationSchema = z.object({
-	id: z.uuid(),
-	projectId: z.uuid(),
-	sourceId: z.uuid(),
-	targetId: z.uuid(),
-	type: z.enum([
-		"blocks",
-		"related",
-		"duplicate",
-		"causes",
-		"clones",
-		"implements",
-		"reviews"
-	]),
-	sourceKey: z.string().optional(),
-	sourceTitle: z.string().optional(),
-	targetKey: z.string().optional(),
-	targetTitle: z.string().optional()
-});
-const relationDirections = z.enum(["outgoing", "incoming"]);
-const relationLabels = {
-	blocks: ["Blocks", "Is blocked by"],
-	related: ["Related to", "Related to"],
-	duplicate: ["Duplicates", "Is duplicated by"],
-	causes: ["Causes", "Is caused by"],
-	clones: ["Clones", "Is cloned by"],
-	implements: ["Implements", "Is implemented by"],
-	reviews: ["Reviews", "Is reviewed by"]
-};
-relationSchema.shape.type.options.flatMap((type) => (type === "related" ? ["outgoing"] : relationDirections.options).map((direction) => ({
-	value: `${type}:${direction}`,
-	label: relationLabels[type][direction === "outgoing" ? 0 : 1],
-	type,
-	direction
-})));
-const commentSchema = z.object({
-	id: z.uuid(),
-	projectId: z.uuid(),
-	ticketId: z.uuid(),
-	actorId: z.string(),
-	body: z.string(),
-	version,
-	createdAt: timestamp$1,
-	updatedAt: timestamp$1
-});
-const attachmentSchema = z.object({
-	id: z.uuid(),
-	projectId: z.uuid(),
-	ticketId: z.uuid(),
-	actorId: z.string(),
-	name: z.string(),
-	contentType: z.string(),
-	size: z.number().int().nonnegative(),
-	createdAt: timestamp$1
-});
-const evidenceFields = z.object({
-	kind: z.enum([
-		"pull_request",
-		"test",
-		"review",
-		"deployment",
-		"device",
-		"other"
-	]),
-	title: text$1.max(200),
-	url: z.url().regex(/^https?:\/\//i, "Use an HTTP or HTTPS URL"),
-	commit: z.string().regex(/^[a-f0-9]{40,64}$/i).nullable().default(null),
-	outcome: z.enum([
-		"reported",
-		"pending",
-		"passed",
-		"failed"
-	]).default("reported"),
-	note: z.string().max(2e4).default("")
-});
-const evidenceSchema = evidenceFields.extend({
-	id: z.uuid(),
-	projectId: z.uuid(),
-	ticketId: z.uuid(),
-	actorId: z.string(),
-	createdAt: timestamp$1
-});
-const eventSchema = z.object({
-	id: z.string().regex(/^\d+$/),
-	projectId: z.uuid(),
-	ticketId: z.uuid().nullable(),
-	actorId: z.string(),
-	type: z.string(),
-	data: z.record(z.string(), z.unknown()),
-	createdAt: timestamp$1
-});
-z.object({
-	authentication: authenticationPolicySchema.default(() => authenticationPolicySchema.parse({})),
-	name: z.string(),
-	description: z.string().default(""),
-	version: z.string(),
-	setupRequired: z.boolean(),
-	oidc: z.object({
-		id: z.string(),
-		name: z.string()
-	}).nullable(),
-	push: z.boolean().default(false)
-});
-z.array(z.object({
-	id: z.uuid(),
-	readAt: timestamp$1.nullable(),
-	event: eventSchema
-}));
-const notificationPreferencesSchema = z.object({
-	inApp: z.boolean().default(true),
-	push: z.boolean().default(false)
-});
-const notificationPreferencesInput = z.object({
-	inApp: z.boolean(),
-	push: z.boolean().optional()
-}).strict();
-const pushDeviceInput = z.object({ token: z.string().min(1).max(250) }).strict();
-z.array(z.object({
-	id: z.string(),
-	name: z.string().nullable(),
-	start: z.string().nullable(),
-	enabled: z.boolean(),
-	expiresAt: timestamp$1.nullable(),
-	createdAt: timestamp$1,
-	permissions: z.string().nullable(),
-	metadata: z.string().nullable()
-}));
-z.object({
-	id: z.string(),
-	key: z.string(),
-	name: z.string().nullable(),
-	expiresAt: timestamp$1.nullable()
-});
-const okSchema = z.object({ ok: z.literal(true) });
-const page = (item) => z.object({
-	items: z.array(item),
-	total: z.number().int().nonnegative()
-});
-const op = (input, output, method, path, scope, description) => ({
-	input,
-	output,
-	method,
-	path,
-	scope,
-	description
-});
-const operations = {
-	list_workspaces: op(z.object({}), z.array(workspaceSchema), "GET", "/workspaces", "read", "List accessible workspaces and the current membership role."),
-	create_workspace: op(z.object({
-		...mutation,
-		name: text$1.max(120),
-		slug: z.string().trim().regex(/^[a-z0-9][a-z0-9-]{1,79}$/),
-		description: z.string().max(5e3).default("")
-	}).strict(), workspaceSchema, "POST", "/workspaces", "write", "Create a workspace and become its administrator."),
-	update_workspace: op(z.object({
-		...mutation,
-		workspaceId: z.uuid(),
-		expectedVersion: version,
-		name: text$1.max(120),
-		description: z.string().max(5e3)
-	}).strict(), workspaceSchema, "PATCH", "/workspaces/{workspaceId}", "admin", "Update workspace details with version checks."),
-	list_workspace_members: op(z.object({ workspaceId: z.uuid() }), z.array(memberSchema), "GET", "/workspaces/{workspaceId}/members", "read", "List members of a workspace you belong to."),
-	set_workspace_member: op(z.object({
-		...mutation,
-		workspaceId: z.uuid(),
-		email: z.email(),
-		role: z.enum(roles).nullable()
-	}).strict(), okSchema, "POST", "/workspaces/{workspaceId}/members", "admin", "Manage workspace access; removal also revokes direct project access in this workspace."),
-	list_projects: op(z.object({ workspaceId: z.uuid().optional() }), z.array(projectSchema.extend({
-		openTickets: z.number().int().nonnegative(),
-		overdueTickets: z.number().int().nonnegative()
-	})), "GET", "/projects", "read", "List projects accessible to the current identity, each with its open and overdue ticket counts."),
-	create_project: op(z.object({
-		...mutation,
-		workspaceId: z.uuid().optional(),
-		visibility: z.enum(["workspace", "private"]).default("private"),
-		key: z.string().trim().regex(/^[A-Z][A-Z0-9]{1,9}$/),
-		name: text$1.max(120),
-		description: z.string().max(5e3).default("")
-	}).strict(), projectSchema, "POST", "/projects", "write", "Create a project with a permanent ticket prefix."),
-	get_project: op(projectInput, projectSchema, "GET", "/projects/{projectId}", "read", "Read project details, workspace identity, and appearance."),
-	set_project_icon: op(projectInput.extend({
-		...mutation,
-		expectedVersion: version,
-		icon: z.union([
-			z.object({
-				kind: z.literal("library"),
-				name: z.string().regex(/^[a-z0-9-]{1,80}$/),
-				color: z.enum(projectIconColors).default("default")
-			}).strict(),
-			z.object({
-				kind: z.literal("image"),
-				contentType: z.enum([
-					"image/png",
-					"image/jpeg",
-					"image/webp"
-				]),
-				data: z.string().max(7e5)
-			}).strict(),
-			z.null()
-		])
-	}).strict(), projectSchema, "POST", "/projects/{projectId}/icon", "admin", "Choose an installed library icon, upload an image, or reset the project icon."),
-	update_project: op(projectInput.extend({
-		...mutation,
-		expectedVersion: version,
-		visibility: z.enum(["workspace", "private"]).optional(),
-		name: text$1.max(120),
-		description: z.string().max(5e3)
-	}).strict(), projectSchema, "PATCH", "/projects/{projectId}", "admin", "Update project details without changing its prefix."),
-	list_members: op(projectInput, z.array(memberSchema), "GET", "/projects/{projectId}/members", "read", "List project members."),
-	set_member: op(projectInput.extend({
-		...mutation,
-		email: z.email(),
-		role: z.enum(roles).nullable()
-	}).strict(), okSchema, "POST", "/projects/{projectId}/members", "admin", "Add or update an existing user's membership, or remove it with a null role."),
-	list_tickets: op(projectInput.extend({
-		...ticketFilter.shape,
-		...pagination
-	}), page(ticketSchema), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination."),
-	list_ticket_labels: op(projectInput.extend({ archived: ticketFilter.shape.archived }), z.array(z.object({
-		name: z.string(),
-		count: z.number().int().nonnegative()
-	})), "GET", "/projects/{projectId}/labels", "read", "List distinct ticket labels and usage counts across the authorized project, independent of ticket pagination."),
-	list_project_labels: op(projectInput, z.array(projectLabelSchema.extend({ count: z.number().int().nonnegative() })), "GET", "/projects/{projectId}/labels/catalog", "read", "List project label definitions, colors, and ticket counts, including unused labels and archived tickets."),
-	create_project_label: op(projectInput.extend({
-		...mutation,
-		name: text$1.max(40),
-		color: labelColor.default("gray")
-	}).strict(), projectLabelSchema, "POST", "/projects/{projectId}/labels", "admin", "Create a reusable project label. Label names are unique within the project."),
-	update_project_label: op(projectInput.extend({
-		...mutation,
-		labelId: z.uuid(),
-		expectedVersion: version,
-		name: text$1.max(40),
-		color: labelColor
-	}).strict(), projectLabelSchema, "PATCH", "/projects/{projectId}/labels/{labelId}", "admin", "Rename or recolor a project label. Renames update tickets and saved-view filters atomically."),
-	delete_project_label: op(projectInput.extend({
-		...mutation,
-		labelId: z.uuid(),
-		expectedVersion: version
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/labels/{labelId}", "admin", "Delete a project label and remove it from tickets and saved-view filters atomically."),
-	list_label_colors: op(z.object({}), z.array(z.object({
-		value: hexColor,
-		createdAt: timestamp$1
-	})), "GET", "/label-colors", "read", "List the site-wide custom label colors, newest first. A custom color joins the list when a label is saved with it."),
-	remove_label_color: op(z.object({
-		...mutation,
-		value: hexColor
-	}).strict(), okSchema, "POST", "/label-colors/remove", "write", "Remove a custom color from the site-wide palette; instance administrators and the person who added it may do so. Labels already using it keep their color."),
-	get_ticket: op(ticketInput, z.object({
-		ticket: ticketSchema,
-		readiness: readinessSchema,
-		claim: claimSchema.nullable(),
-		subscribed: z.boolean(),
-		canReleaseClaim: z.boolean()
-	}), "GET", "/projects/{projectId}/tickets/{ticketId}", "read", "Read a ticket by ID or key, with readiness and ownership."),
-	create_ticket: op(projectInput.extend({
-		...mutation,
-		title: ticketFields.shape.title,
-		description: z.string().max(1e5).default(""),
-		acceptanceCriteria: z.string().max(5e4).default(""),
-		status: z.enum(states).default("todo"),
-		priority: z.enum(priorities).default("medium"),
-		kind: z.enum(kinds).default("feature"),
-		difficulty: z.enum(difficulties).nullable().default(null),
-		dueAt: dueDate.nullable().default(null),
-		labels: tags.default([]),
-		scopes: tags.default([]),
-		assigneeId: z.string().nullable().default(null),
-		parentId: z.uuid().nullable().default(null),
-		automationReady: z.boolean().default(false),
-		holdReason: z.string().trim().max(2e3).nullable().default(null),
-		archived: z.boolean().default(false)
-	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets", "write", "Create a ticket. Reuse requestId when retrying this write."),
-	update_ticket: op(ticketInput.extend({
-		...mutation,
-		expectedVersion: version,
-		changes: ticketChanges,
-		claimId: z.uuid().optional()
-	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}", "write", "Update a ticket with optimistic concurrency. Worker completion requires its active claim."),
-	bulk_update_tickets: op(projectInput.extend({
-		...mutation,
-		tickets: z.array(z.object({
-			ticketId: id,
-			expectedVersion: version
-		})).min(1).max(100).refine((values) => new Set(values.map((v) => v.ticketId)).size === values.length, "Tickets must be unique"),
-		changes: ticketChanges
-	}).strict(), z.array(ticketSchema), "POST", "/projects/{projectId}/tickets/bulk", "write", "Apply an atomic bulk edit using each ticket's current version."),
-	delete_ticket: op(ticketInput.extend({
-		...mutation,
-		expectedVersion: version
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/tickets/{ticketId}", "admin", "Delete a ticket and publish a deletion event."),
-	search_tickets: op(z.object({
-		q: z.string().trim().min(1).max(200),
-		workspaceId: z.uuid().optional(),
-		limit: z.coerce.number().int().min(1).max(50).default(20)
-	}).strict(), z.object({ items: z.array(z.object({
-		ticket: ticketSchema,
-		project: z.object({
-			id: z.uuid(),
-			key: z.string(),
-			name: z.string()
-		})
-	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace."),
-	list_eligible_tickets: op(projectInput.extend(pagination), page(z.object({
-		ticket: ticketSchema,
-		readiness: readinessSchema
-	})), "GET", "/projects/{projectId}/eligibility", "read", "Inspect eligibility and explicit blocking reasons for open tickets."),
-	list_relations: op(ticketInput, z.array(relationSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/relations", "read", "List incoming and outgoing ticket relationships."),
-	add_relation: op(ticketInput.extend({
-		...mutation,
-		targetId: z.uuid(),
-		type: relationSchema.shape.type,
-		direction: relationDirections.optional()
-	}).strict(), relationSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/relations", "write", "Relate tickets while rejecting dependency cycles."),
-	remove_relation: op(projectInput.extend({
-		...mutation,
-		relationId: z.uuid()
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/relations/{relationId}", "write", "Remove a ticket relationship."),
-	list_comments: op(ticketInput.extend(pagination), page(commentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/comments", "read", "Read ticket discussion."),
-	add_comment: op(ticketInput.extend({
-		...mutation,
-		body: text$1.max(5e4)
-	}).strict(), commentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/comments", "write", "Add a comment with authenticated attribution."),
-	update_comment: op(projectInput.extend({
-		...mutation,
-		commentId: z.uuid(),
-		expectedVersion: version,
-		body: text$1.max(5e4)
-	}).strict(), commentSchema, "PATCH", "/projects/{projectId}/comments/{commentId}", "write", "Edit your own comment or moderate as a project administrator."),
-	delete_comment: op(projectInput.extend({
-		...mutation,
-		commentId: z.uuid(),
-		expectedVersion: version
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/comments/{commentId}", "write", "Delete your own comment or moderate as a project administrator."),
-	list_activity: op(ticketInput.extend(pagination), page(eventSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/activity", "read", "Read durable ticket activity."),
-	upload_attachment: op(ticketInput.extend({
-		...mutation,
-		name: text$1.max(255).refine((value) => {
-			for (const character of value) if (character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) return false;
-			return true;
-		}, "Use a filename without control characters"),
-		contentType: z.string().max(120).regex(/^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/i).default("application/octet-stream"),
-		data: z.string().max(Math.ceil(attachmentLimit / 3) * 4)
-	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path."),
-	list_attachments: op(ticketInput, z.array(attachmentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/attachments", "read", "List authorized attachment metadata."),
-	delete_attachment: op(projectInput.extend({
-		...mutation,
-		attachmentId: z.uuid()
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/attachments/{attachmentId}", "write", "Remove an attachment."),
-	list_evidence: op(ticketInput, z.array(evidenceSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/evidence", "read", "Read attributed evidence. Outcomes are reports from the submitting identity."),
-	add_evidence: op(ticketInput.extend({
-		...mutation,
-		...evidenceFields.shape,
-		claimId: z.uuid().optional()
-	}).strict(), evidenceSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/evidence", "write", "Attach evidence with its commit and provenance."),
-	claim_ticket: op(ticketInput.extend({
-		...mutation,
-		workerId: text$1.max(200),
-		expectedVersion: version,
-		leaseSeconds: z.number().int().min(30).max(3600).default(300)
-	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim", "claim", "Atomically claim ready work. Expired claims require explicit recovery."),
-	renew_claim: op(ticketInput.extend({
-		...mutation,
-		claimId: z.uuid(),
-		leaseSeconds: z.number().int().min(30).max(3600).default(300)
-	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/renew", "claim", "Renew the caller's unexpired claim."),
-	release_claim: op(ticketInput.extend({
-		...mutation,
-		claimId: z.uuid()
-	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/release", "claim", "Release the caller's claim."),
-	recover_claim: op(ticketInput.extend({
-		...mutation,
-		claimId: z.uuid(),
-		reason: text$1.min(10).max(2e3),
-		confirmedStopped: z.literal(true)
-	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/recover", "admin", "Recover an expired claim only after confirming the worker stopped."),
-	set_subscription: op(ticketInput.extend({
-		...mutation,
-		enabled: z.boolean()
-	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/subscription", "read", "Subscribe to ticket updates or unsubscribe."),
-	list_views: op(projectInput, z.array(z.object({
-		id: z.uuid(),
-		name: z.string(),
-		filters: ticketFilter
-	})), "GET", "/projects/{projectId}/views", "read", "List your saved project views."),
-	save_view: op(projectInput.extend({
-		...mutation,
-		name: text$1.max(80),
-		filters: ticketFilter
-	}).strict(), z.object({ id: z.uuid() }), "POST", "/projects/{projectId}/views", "read", "Save a personal filtered view."),
-	delete_view: op(projectInput.extend({
-		...mutation,
-		viewId: z.uuid()
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/views/{viewId}", "read", "Delete your own saved view.")
-};
-function isOperation(name) {
-	return Object.hasOwn(operations, name);
-}
-const errorSchema = z.object({ error: z.object({
-	code: z.string(),
-	message: z.string(),
-	details: z.unknown().optional()
-}) });
-z.object({
-	status: z.number().int().min(400).max(599),
-	code: z.string(),
-	message: z.string()
-});
-var ApiError = class extends Error {
-	status;
-	code;
-	details;
-	constructor(status, code, message, details) {
-		super(message);
-		this.name = "ApiError";
-		this.status = status;
-		this.code = code;
-		this.details = details;
-	}
-};
-function parseOutput(name, value) {
-	return operations[name].output.parse(value);
-}
-//#endregion
-//#region src/schema.ts
-const time = (name) => timestamp(name, { withTimezone: true }).notNull().defaultNow();
-const actor = () => text("actor_id").notNull().references(() => user.id);
-const workspaces = pgTable("workspaces", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	slug: text("slug").notNull().unique(),
-	name: text("name").notNull(),
-	description: text("description").notNull().default(""),
-	version: integer("version").notNull().default(1),
-	createdAt: time("created_at"),
-	updatedAt: time("updated_at")
-});
-const workspaceMembers = pgTable("workspace_members", {
-	workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
-	role: text("role").notNull()
-}, (table) => [primaryKey({ columns: [table.workspaceId, table.userId] }), index("workspace_member_user").on(table.userId)]);
-const projects = pgTable("projects", {
-	iconName: text("icon_name"),
-	iconColor: text("icon_color").notNull().default("default"),
-	image: text("image"),
-	iconObjectId: uuid("icon_object_id").references(() => blobObjects.id),
-	workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id),
-	visibility: text("visibility").notNull().default("private"),
-	id: uuid("id").primaryKey().defaultRandom(),
-	key: text("key").notNull().unique(),
-	name: text("name").notNull(),
-	description: text("description").notNull().default(""),
-	nextNumber: integer("next_number").notNull().default(1),
-	version: integer("version").notNull().default(1),
-	createdAt: time("created_at"),
-	updatedAt: time("updated_at")
-}, (table) => [index("project_workspace").on(table.workspaceId)]);
-const members = pgTable("project_members", {
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
-	role: text("role").notNull()
-}, (table) => [primaryKey({ columns: [table.projectId, table.userId] }), index("member_user").on(table.userId)]);
-const projectLabels = pgTable("project_labels", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	name: text("name").notNull(),
-	color: text("color").notNull().default("gray"),
-	version: integer("version").notNull().default(1)
-}, (table) => [unique("project_label_name").on(table.projectId, table.name)]);
-const labelColors = pgTable("label_colors", {
-	value: text("value").primaryKey(),
-	createdBy: text("created_by").references(() => user.id, { onDelete: "set null" }),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-});
-const tickets = pgTable("tickets", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	key: text("key").notNull().unique(),
-	number: integer("number").notNull(),
-	title: text("title").notNull(),
-	description: text("description").notNull().default(""),
-	acceptanceCriteria: text("acceptance_criteria").notNull().default(""),
-	status: text("status").notNull().default("todo"),
-	priority: text("priority").notNull().default("medium"),
-	kind: text("kind").notNull().default("feature"),
-	difficulty: text("difficulty"),
-	labels: text("labels").array().notNull().default([]),
-	scopes: text("scopes").array().notNull().default([]),
-	assigneeId: text("assignee_id").references(() => user.id, { onDelete: "set null" }),
-	parentId: uuid("parent_id"),
-	automationReady: boolean("automation_ready").notNull().default(false),
-	claimRequired: boolean("claim_required").notNull().default(false),
-	holdReason: text("hold_reason"),
-	dueAt: timestamp("due_at", { withTimezone: true }),
-	archived: boolean("archived").notNull().default(false),
-	createdBy: text("created_by").notNull().references(() => user.id),
-	version: integer("version").notNull().default(1),
-	createdAt: time("created_at"),
-	updatedAt: time("updated_at")
-}, (table) => [
-	unique("ticket_project_number").on(table.projectId, table.number),
-	index("ticket_project_status").on(table.projectId, table.status),
-	index("ticket_parent").on(table.parentId)
-]);
-const relations$1 = pgTable("ticket_relations", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	sourceId: uuid("source_id").notNull().references(() => tickets.id, { onDelete: "cascade" }),
-	targetId: uuid("target_id").notNull().references(() => tickets.id, { onDelete: "cascade" }),
-	type: text("type").notNull()
-}, (table) => [unique("ticket_relation_edge").on(table.sourceId, table.targetId, table.type), index("relation_target").on(table.targetId)]);
-const comments = pgTable("comments", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	ticketId: uuid("ticket_id").notNull().references(() => tickets.id, { onDelete: "cascade" }),
-	actorId: actor(),
-	body: text("body").notNull(),
-	version: integer("version").notNull().default(1),
-	createdAt: time("created_at"),
-	updatedAt: time("updated_at")
-}, (table) => [index("comment_ticket").on(table.ticketId)]);
-const claims = pgTable("claims", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	ticketId: uuid("ticket_id").notNull().unique().references(() => tickets.id, { onDelete: "cascade" }),
-	actorId: actor(),
-	ownerId: text("owner_id").notNull(),
-	workerId: text("worker_id").notNull(),
-	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
-	createdAt: time("created_at")
-});
-const events = pgTable("events", {
-	id: bigint("id", { mode: "bigint" }).primaryKey(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	ticketId: uuid("ticket_id"),
-	actorId: actor(),
-	type: text("type").notNull(),
-	data: jsonb("data").$type().notNull(),
-	createdAt: time("created_at")
-}, (table) => [index("event_project_cursor").on(table.projectId, table.id), index("event_ticket").on(table.ticketId, table.id)]);
-const eventClock = pgTable("event_clock", {
-	id: integer("id").primaryKey(),
-	value: bigint("value", { mode: "bigint" }).notNull().default(sql`0`),
-	floor: bigint("floor", { mode: "bigint" }).notNull().default(sql`0`)
-});
-const receipts = pgTable("mutation_receipts", {
-	actorId: actor(),
-	requestId: uuid("request_id").notNull(),
-	operation: text("operation").notNull(),
-	hash: text("hash").notNull(),
-	result: jsonb("result").notNull(),
-	createdAt: time("created_at")
-}, (table) => [primaryKey({ columns: [table.actorId, table.requestId] })]);
-const storageBackends = pgTable("storage_backends", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	identity: text("identity").notNull().unique(),
-	config: text("config").notNull(),
-	createdAt: time("created_at")
-});
-const binary = customType({ dataType: () => "bytea" });
-const blobObjects = pgTable("blob_objects", {
-	id: uuid("id").primaryKey(),
-	backendId: uuid("backend_id").references(() => storageBackends.id),
-	objectKey: text("object_key"),
-	data: binary("data"),
-	contentType: text("content_type").notNull(),
-	size: integer("size").notNull(),
-	sha256: text("sha256").notNull(),
-	createdAt: time("created_at")
-}, (table) => [index("blob_objects_created").on(table.createdAt)]);
-const profilePhotos = pgTable("profile_photos", {
-	userId: text("user_id").primaryKey().references(() => user.id, { onDelete: "cascade" }),
-	objectId: uuid("object_id").notNull().references(() => blobObjects.id)
-});
-const instanceSettings = pgTable("instance_settings", {
-	id: integer("id").primaryKey().default(1),
-	identity: uuid("identity").notNull().defaultRandom(),
-	version: integer("version").notNull().default(1),
-	name: text("name").notNull().default("Kanvil"),
-	description: text("description").notNull().default("Ticketing for people and agents"),
-	storageBackendId: uuid("storage_backend_id").references(() => storageBackends.id),
-	searchConfig: text("search_config"),
-	brokerConfig: text("broker_config"),
-	emailPasswordEnabled: boolean("email_password_enabled").notNull().default(true),
-	ssoAutoProvision: boolean("sso_auto_provision").notNull().default(false)
-});
-const deliveryCheckpoints = pgTable("delivery_checkpoints", {
-	destination: text("destination").primaryKey(),
-	cursor: bigint("cursor", { mode: "bigint" }).notNull().default(sql`0`)
-});
-const searchState = pgTable("search_state", {
-	id: integer("id").primaryKey().default(1),
-	configHash: text("config_hash").notNull().default(""),
-	cursor: bigint("cursor", { mode: "bigint" }).notNull().default(sql`0`),
-	error: text("error")
-});
-const attachments = pgTable("attachments", {
-	objectId: uuid("object_id").references(() => blobObjects.id),
-	id: uuid("id").primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	ticketId: uuid("ticket_id").notNull().references(() => tickets.id, { onDelete: "cascade" }),
-	actorId: actor(),
-	name: text("name").notNull(),
-	contentType: text("content_type").notNull(),
-	size: integer("size").notNull(),
-	createdAt: time("created_at")
-});
-const bytea = customType({ dataType: () => "bytea" });
-const attachmentContent = pgTable("attachment_content", {
-	id: uuid("id").primaryKey().references(() => attachments.id, { onDelete: "cascade" }),
-	data: bytea("data").notNull()
-});
-const evidence = pgTable("evidence", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	ticketId: uuid("ticket_id").notNull().references(() => tickets.id, { onDelete: "cascade" }),
-	actorId: actor(),
-	title: text("title").notNull(),
-	kind: text("kind").notNull(),
-	url: text("url").notNull(),
-	commit: text("commit"),
-	outcome: text("outcome").notNull(),
-	note: text("note").notNull(),
-	createdAt: time("created_at")
-});
-const subscriptions = pgTable("subscriptions", {
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	ticketId: uuid("ticket_id").notNull().references(() => tickets.id, { onDelete: "cascade" }),
-	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" })
-}, (table) => [primaryKey({ columns: [table.ticketId, table.userId] })]);
-const notificationPreferences = pgTable("notification_preferences", {
-	userId: text("user_id").primaryKey().references(() => user.id, { onDelete: "cascade" }),
-	inApp: boolean("in_app").notNull().default(true),
-	push: boolean("push").notNull().default(false)
-});
-const notifications = pgTable("notifications", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	eventId: bigint("event_id", { mode: "bigint" }).notNull(),
-	readAt: timestamp("read_at", { withTimezone: true }),
-	inbox: boolean("inbox").notNull().default(true),
-	createdAt: time("created_at")
-});
-const pushDevices = pgTable("push_devices", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
-	sessionId: text("session_id").notNull().references(() => session.id, { onDelete: "cascade" }),
-	token: text("token").notNull().unique(),
-	createdAt: time("created_at")
-});
-const pushDeliveries = pgTable("push_deliveries", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	notificationId: uuid("notification_id").notNull().references(() => notifications.id, { onDelete: "cascade" }),
-	deviceId: uuid("device_id").notNull().references(() => pushDevices.id, { onDelete: "cascade" }),
-	attempts: integer("attempts").notNull().default(0),
-	availableAt: time("available_at"),
-	receiptId: text("receipt_id"),
-	finishedAt: timestamp("finished_at", { withTimezone: true }),
-	error: text("error")
-}, (table) => [index("push_pending_idx").on(table.finishedAt, table.availableAt), unique().on(table.notificationId, table.deviceId)]);
-const views = pgTable("saved_views", {
-	id: uuid("id").primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
-	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
-	name: text("name").notNull(),
-	filters: jsonb("filters").notNull()
-});
-//#endregion
-//#region src/adapters/polling-jobs.ts
-const createPollingJob = (name, intervalMs, run) => {
-	let pending, closed = false, again = false;
-	function trigger() {
-		if (closed) return Promise.reject(/* @__PURE__ */ new Error("The background job is closed"));
-		again = true;
-		return pending ??= (async () => {
-			let result;
-			do {
-				again = false;
-				result = await run();
-				if (closed) break;
-			} while (again);
-			return result;
-		})().finally(() => {
-			pending = void 0;
-		});
-	}
-	const timer = setInterval(() => {
-		trigger().catch(() => console.error("Background job failed", { job: name }));
-	}, intervalMs);
-	timer.unref();
-	return {
-		trigger,
-		async close() {
-			closed = true;
-			clearInterval(timer);
-			await pending?.catch(() => {});
-		}
-	};
-};
-//#endregion
-//#region src/adapters/s3.ts
-function createS3ObjectStore(configuration) {
-	const settings = s3SettingsSchema.parse(configuration);
-	const client = new S3Client({
-		region: settings.region,
-		...settings.endpoint ? { endpoint: settings.endpoint } : {},
-		forcePathStyle: settings.forcePathStyle,
-		maxAttempts: 2,
-		...settings.accessKeyId && settings.secretAccessKey ? { credentials: {
-			accessKeyId: settings.accessKeyId,
-			secretAccessKey: settings.secretAccessKey
-		} } : {}
-	});
-	return {
-		keyFor: (id) => `${settings.prefix ? settings.prefix.replace(/\/?$/, "/") : ""}${id}`,
-		async put(key, bytes, contentType) {
-			await client.send(new PutObjectCommand({
-				Bucket: settings.bucket,
-				Key: key,
-				Body: bytes,
-				ContentType: contentType,
-				ContentMD5: createHash("md5").update(bytes).digest("base64")
-			}), { abortSignal: AbortSignal.timeout(15e3) });
-		},
-		async get(key, maxBytes) {
-			const response = await client.send(new GetObjectCommand({
-				Bucket: settings.bucket,
-				Key: key
-			}), { abortSignal: AbortSignal.timeout(15e3) });
-			if (!response.Body) throw new Error("Object content missing");
-			const reader = response.Body.transformToWebStream().getReader(), chunks = [];
-			let size = 0;
-			const timeout = setTimeout(() => {
-				reader.cancel().catch(() => {});
-			}, 15e3);
-			try {
-				for (;;) {
-					const part = await reader.read();
-					if (part.done) break;
-					size += part.value.byteLength;
-					if (size > maxBytes) throw new Error("Object size exceeds metadata");
-					chunks.push(part.value);
-				}
-				return Buffer.concat(chunks);
-			} finally {
-				clearTimeout(timeout);
-				await reader.cancel().catch(() => {});
-			}
-		},
-		async remove(key) {
-			await client.send(new DeleteObjectCommand({
-				Bucket: settings.bucket,
-				Key: key
-			}), { abortSignal: AbortSignal.timeout(15e3) });
-		},
-		close() {
-			client.destroy();
-		}
-	};
-}
-//#endregion
-//#region src/adapters/object-stores.ts
-const providers$1 = { s3: createS3ObjectStore };
-const createObjectStore = (configuration) => {
-	const create = providers$1[configuration.provider];
-	if (!create) throw new Error("Unsupported object storage provider");
-	return create(configuration.config);
-};
-//#endregion
-//#region src/blob-storage.ts
-const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function decodeBlobData(value, limit) {
-	const bytes = Buffer.from(value, "base64");
-	if (bytes.length > limit || bytes.toString("base64") !== value) fail(400, "invalid_attachment", `Provide valid base64 data of at most ${limit} bytes`);
-	return bytes;
-}
-async function writeLocalBlob(db, id, bytes, contentType) {
-	await db.insert(blobObjects).values({
-		id,
-		data: bytes,
-		contentType,
-		size: bytes.length,
-		sha256: digest(bytes)
-	});
-}
-function createBlobStorage(database, instance, factory = createObjectStore, schedule = createPollingJob) {
-	async function transfer(configuration, run) {
-		const store = factory(configuration);
-		try {
-			return await run(store);
-		} catch {
-			return fail(503, "storage_unavailable", "Object storage is unavailable. Check the instance storage settings.");
-		} finally {
-			store.close();
-		}
-	}
-	async function put(db, id, bytes, contentType) {
-		const active = await instance.storage();
-		if (!active) {
-			await writeLocalBlob(db, id, bytes, contentType);
-			return;
-		}
-		const backend = await instance.backend(active.id), store = factory(backend.spec);
-		try {
-			await db.insert(blobObjects).values({
-				id,
-				data: bytes,
-				backendId: backend.id,
-				objectKey: store.keyFor(id),
-				contentType,
-				size: bytes.length,
-				sha256: digest(bytes)
-			});
-		} finally {
-			store.close();
-		}
-	}
-	let transferError = null;
-	async function flushBatch() {
-		try {
-			await database.db.transaction(async (tx) => {
-				const rows = await tx.select().from(blobObjects).where(and(isNotNull(blobObjects.data), isNotNull(blobObjects.backendId), sql`(EXISTS (SELECT 1 FROM attachments a WHERE a.object_id=${blobObjects.id}) OR EXISTS (SELECT 1 FROM profile_photos p WHERE p.object_id=${blobObjects.id}))`)).orderBy(blobObjects.createdAt).limit(10).for("update", {
-					of: blobObjects,
-					skipLocked: true
-				});
-				for (const row of rows) {
-					const backend = await instance.backend(requireRow(row.backendId ?? void 0)), key = requireRow(row.objectKey ?? void 0), bytes = requireRow(row.data ?? void 0);
-					await transfer(backend.spec, async (store) => {
-						await store.put(key, bytes, row.contentType);
-						const verified = await store.get(key, row.size);
-						if (digest(verified) !== row.sha256) throw new Error("Storage readback failed");
-					});
-					await tx.update(blobObjects).set({ data: null }).where(eq(blobObjects.id, row.id));
-				}
-			});
-			transferError = null;
-		} catch (error) {
-			transferError = "File transfer is unavailable. Pending files remain readable from the local database.";
-			throw error;
-		}
-	}
-	async function get(id) {
-		const row = one(await database.db.select().from(blobObjects).where(eq(blobObjects.id, id)));
-		let data = row.data;
-		if (!data) {
-			if (!row.backendId || !row.objectKey) fail(500, "blob_corrupt", "The stored file has no content location");
-			const backend = await instance.backend(row.backendId), key = row.objectKey;
-			data = Buffer.from(await transfer(backend.spec, (store) => store.get(key, row.size)));
-		}
-		if (data.length !== row.size || digest(data) !== row.sha256) fail(500, "blob_corrupt", "The stored file failed its integrity check");
-		return {
-			...row,
-			data
-		};
-	}
-	async function test(configuration) {
-		return transfer(configuration, async (store) => {
-			const key = store.keyFor(`connection-test-${crypto.randomUUID()}`), bytes = Buffer.from("Kanvil object storage test");
-			try {
-				await store.put(key, bytes, "text/plain");
-				if (Buffer.from(await store.get(key, bytes.length)).compare(bytes)) throw new Error("Readback failed");
-			} finally {
-				await store.remove(key);
-			}
-		});
-	}
-	async function collectBatch() {
-		return database.db.transaction(async (tx) => {
-			const rows = await tx.select({ object: blobObjects }).from(blobObjects).leftJoin(attachments, eq(attachments.objectId, blobObjects.id)).leftJoin(profilePhotos, eq(profilePhotos.objectId, blobObjects.id)).leftJoin(projects, eq(projects.iconObjectId, blobObjects.id)).where(and(isNull(attachments.id), isNull(profilePhotos.userId), isNull(projects.id), lt(blobObjects.createdAt, /* @__PURE__ */ new Date(Date.now() - 864e5)))).limit(20).for("update", {
-				of: blobObjects,
-				skipLocked: true
-			});
-			for (const { object } of rows) {
-				if (object.backendId && object.objectKey) {
-					const backend = await instance.backend(object.backendId), key = object.objectKey;
-					await transfer(backend.spec, (store) => store.remove(key));
-				}
-				await tx.delete(blobObjects).where(eq(blobObjects.id, object.id));
-			}
-			return rows.length;
-		});
-	}
-	const job = schedule("blob-cleanup", 6e4, collectBatch);
-	const uploads = schedule("blob-transfer", 1e3, flushBatch);
-	return {
-		put,
-		get,
-		test,
-		collect: job.trigger,
-		sync: uploads.trigger,
-		async status() {
-			const [row] = await database.db.select({ pending: count() }).from(blobObjects).where(and(isNotNull(blobObjects.data), isNotNull(blobObjects.backendId)));
-			const pending = row?.pending ?? 0;
-			return {
-				pending,
-				status: transferError ? "unavailable" : pending ? "transferring" : "ready",
-				error: transferError
-			};
-		},
-		async close() {
-			await uploads.close();
-			await job.close();
-		}
-	};
-}
-function decodeImage(input) {
-	const bytes = decodeBlobData(input.data, 512e3);
-	if (!(input.contentType === "image/png" ? bytes.subarray(0, 8).equals(Buffer.from([
-		137,
-		80,
-		78,
-		71,
-		13,
-		10,
-		26,
-		10
-	])) : input.contentType === "image/jpeg" ? bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255 : input.contentType === "image/webp" && bytes.subarray(0, 4).toString() === "RIFF" && bytes.subarray(8, 12).toString() === "WEBP")) fail(400, "invalid_image", "Choose a PNG, JPEG, or WebP image");
-	return bytes;
-}
-function imageResponse(blob) {
-	return new Response(new Uint8Array(blob.data), { headers: {
-		"Content-Type": blob.contentType,
-		"Cache-Control": "private, max-age=300",
-		ETag: `"${blob.sha256}"`
-	} });
-}
-//#endregion
-//#region src/adapters/elasticsearch.ts
-function fail$1(_status, _code, message) {
-	throw new Error(message);
-}
-function headers(settings) {
-	return {
-		"Content-Type": "application/json",
-		...searchAuthentication(settings) === "apiKey" && settings.apiKey ? { Authorization: `ApiKey ${settings.apiKey}` } : searchAuthentication(settings) === "basic" && settings.username && settings.password ? { Authorization: `Basic ${Buffer.from(`${settings.username}:${settings.password}`).toString("base64")}` } : {}
-	};
-}
-async function call(settings, path, init = {}) {
-	const requestHeaders = new Headers(headers(settings));
-	new Headers(init.headers).forEach((value, name) => requestHeaders.set(name, value));
-	return fetch(`${settings.url.replace(/\/$/, "")}/${path}`, {
-		...init,
-		headers: requestHeaders,
-		signal: AbortSignal.timeout(15e3)
-	});
-}
-async function accepted(response) {
-	if (!response.ok) fail$1(503, "search_unavailable", "Elasticsearch is unavailable. Check its address, index, and credentials.");
-	return response;
-}
-async function ensure(settings, identity) {
-	const mapping = await call(settings, `${settings.index}/_mapping`);
-	if (mapping.status === 404) {
-		await accepted(await call(settings, settings.index, {
-			method: "PUT",
-			body: JSON.stringify({ mappings: {
-				_meta: { kanvilInstanceId: identity },
-				properties: {
-					instanceId: { type: "keyword" },
-					projectId: { type: "keyword" },
-					key: { type: "text" },
-					title: { type: "text" },
-					description: { type: "text" },
-					acceptanceCriteria: { type: "text" },
-					labels: { type: "keyword" },
-					scopes: { type: "keyword" }
-				}
-			} })
-		}));
-		return;
-	}
-	if (z.record(z.string(), z.object({ mappings: z.object({ _meta: z.object({ kanvilInstanceId: z.string() }).optional() }) })).parse(await (await accepted(mapping)).json())[settings.index]?.mappings["_meta"]?.kanvilInstanceId !== identity) fail$1(409, "index_not_owned", "Choose a dedicated, unused Kanvil index name.");
-}
-async function bulk(settings, identity, rows, deleted = []) {
-	const lines = rows.flatMap((row) => [JSON.stringify({ index: { _id: row.id } }), JSON.stringify({
-		id: row.id,
-		instanceId: identity,
-		projectId: row.projectId,
-		key: row.key,
-		title: row.title,
-		description: row.description,
-		acceptanceCriteria: row.acceptanceCriteria,
-		labels: row.labels,
-		scopes: row.scopes
-	})]);
-	for (const id of deleted) lines.push(JSON.stringify({ delete: { _id: id } }));
-	if (!lines.length) return;
-	const response = await accepted(await call(settings, `${settings.index}/_bulk?refresh=wait_for`, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-ndjson" },
-		body: lines.join("\n") + "\n"
-	}));
-	if (z.object({ errors: z.boolean() }).parse(await response.json()).errors) fail$1(503, "search_unavailable", "Elasticsearch rejected an indexing operation");
-}
-async function testSearchConnection(settings, identity) {
-	const id = crypto.randomUUID(), token = crypto.randomUUID();
-	try {
-		await accepted(await call(settings, `${settings.index}/_doc/${id}?refresh=wait_for`, {
-			method: "PUT",
-			body: JSON.stringify({
-				instanceId: identity,
-				projectId: crypto.randomUUID(),
-				title: token
-			})
-		}));
-		if (z.object({ _source: z.object({ title: z.string() }) }).parse(await (await accepted(await call(settings, `${settings.index}/_doc/${id}`))).json())["_source"].title !== token) throw new Error("Search readback failed");
-	} finally {
-		await accepted(await call(settings, `${settings.index}/_doc/${id}`, { method: "DELETE" }));
-	}
-}
-function createElasticsearchIndex(configuration) {
-	const settings = searchSettingsSchema.parse(configuration);
-	return {
-		initialize: (identity) => ensure(settings, identity),
-		async reset(identity) {
-			await accepted(await call(settings, `${settings.index}/_delete_by_query?refresh=true`, {
-				method: "POST",
-				body: JSON.stringify({ query: { term: { instanceId: identity } } })
-			}));
-		},
-		write: (identity, rows, deleted) => bulk(settings, identity, rows, deleted),
-		probe: (identity) => testSearchConnection(settings, identity),
-		async find(identity, projectIds, query) {
-			let scrollId;
-			try {
-				const found = [];
-				let response = await accepted(await call(settings, `${settings.index}/_search?scroll=1m`, {
-					method: "POST",
-					body: JSON.stringify({
-						size: 1e3,
-						_source: false,
-						sort: ["_doc"],
-						query: { bool: {
-							filter: [{ terms: { projectId: [...projectIds] } }, { term: { instanceId: identity } }],
-							must: [{ multi_match: {
-								query,
-								fields: [
-									"title^3",
-									"key^3",
-									"description",
-									"acceptanceCriteria",
-									"labels",
-									"scopes"
-								],
-								operator: "and",
-								fuzziness: "AUTO"
-							} }]
-						} }
-					})
-				}));
-				for (;;) {
-					const result = z.object({
-						_scroll_id: z.string().optional(),
-						hits: z.object({ hits: z.array(z.object({ _id: z.uuid() })) })
-					}).parse(await response.json());
-					scrollId = result["_scroll_id"] ?? scrollId;
-					found.push(...result.hits.hits.map((hit) => hit["_id"]));
-					if (found.length > 1e4) throw new Error("External search unavailable");
-					if (!result.hits.hits.length || !scrollId) break;
-					response = await accepted(await call(settings, "_search/scroll", {
-						method: "POST",
-						body: JSON.stringify({
-							scroll: "1m",
-							scroll_id: scrollId
-						})
-					}));
-				}
-				return found;
-			} catch {
-				throw new Error("External search unavailable");
-			} finally {
-				if (scrollId) await call(settings, "_search/scroll", {
-					method: "DELETE",
-					body: JSON.stringify({ scroll_id: [scrollId] })
-				}).catch(() => {});
-			}
-		}
-	};
-}
-//#endregion
-//#region src/adapters/ticket-indexes.ts
-const providers = { elasticsearch: createElasticsearchIndex };
-const createTicketIndex = (configuration) => {
-	const create = providers[configuration.provider];
-	if (!create) throw new Error("Unsupported ticket search provider");
-	return create(configuration.config);
-};
-//#endregion
-//#region src/search.ts
-function postgresSearch(query) {
-	const value = `%${query.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_")}%`;
-	return or(ilike(tickets.title, value), ilike(tickets.description, value), ilike(tickets.key, value), ilike(tickets.acceptanceCriteria, value), sql`array_to_string(${tickets.labels}, ' ') ILIKE ${value}`, sql`array_to_string(${tickets.scopes}, ' ') ILIKE ${value}`);
-}
-function createTicketSearch(database, instance, factory = createTicketIndex, schedule = createPollingJob) {
-	const fingerprint = (settings) => createHmac("sha256", instance.config.BETTER_AUTH_SECRET).update(JSON.stringify(settings)).digest("hex");
-	async function work() {
-		const settings = await instance.search();
-		if (!settings) return;
-		const index = factory({
-			provider: "elasticsearch",
-			config: settings
-		});
-		try {
-			await database.db.transaction(async (tx) => {
-				if (!(await tx.execute(sql`SELECT pg_try_advisory_xact_lock(7361084) AS acquired`)).rows[0]?.acquired) return;
-				const root = await instance.read(tx), hash = fingerprint(settings), clock = one(await tx.select().from(eventClock).where(eq(eventClock.id, 1)));
-				await tx.insert(searchState).values({ id: 1 }).onConflictDoNothing();
-				const state = one(await tx.select().from(searchState).where(eq(searchState.id, 1)));
-				if (state.configHash === hash && state.cursor === clock.value && !state.error) return;
-				await index.initialize(root.identity);
-				let cursor = clock.value;
-				if (state.configHash !== hash || state.cursor < clock.floor || state.cursor > clock.value) {
-					await index.reset(root.identity);
-					const all = await tx.select().from(tickets);
-					for (let offset = 0; offset < all.length; offset += 500) await index.write(root.identity, all.slice(offset, offset + 500));
-				} else {
-					const pending = await tx.select().from(events).where(sql`${events.id}>${state.cursor}`).orderBy(events.id).limit(500);
-					const ids = [...new Set(pending.flatMap((event) => event.ticketId ? [event.ticketId] : []))];
-					const rows = ids.length ? await tx.select().from(tickets).where(inArray(tickets.id, ids)) : [];
-					await index.write(root.identity, rows, ids.filter((id) => !rows.some((row) => row.id === id)));
-					cursor = pending.at(-1)?.id ?? clock.value;
-				}
-				await tx.update(searchState).set({
-					configHash: hash,
-					cursor,
-					error: null
-				}).where(eq(searchState.id, 1));
-			}, { isolationLevel: "repeatable read" });
-		} catch {
-			await database.db.insert(searchState).values({
-				id: 1,
-				error: "External search is unavailable. PostgreSQL search remains active."
-			}).onConflictDoUpdate({
-				target: searchState.id,
-				set: { error: "External search is unavailable. PostgreSQL search remains active." }
-			});
-		}
-	}
-	async function where(_db, projectIds, query) {
-		const fallback = () => postgresSearch(query), settings = await instance.search();
-		if (!settings) return fallback();
-		const state = (await database.db.select().from(searchState).where(eq(searchState.id, 1)))[0], clock = (await database.db.select().from(eventClock).where(eq(eventClock.id, 1)))[0];
-		if (!state || !clock || state.error || state.configHash !== fingerprint(settings) || state.cursor !== clock.value) return fallback();
-		const root = await instance.read();
-		try {
-			const ids = await factory({
-				provider: "elasticsearch",
-				config: settings
-			}).find(root.identity, projectIds, query);
-			return ids.length ? inArray(tickets.id, ids) : sql`false`;
-		} catch {
-			return fallback();
-		}
-	}
-	async function test(settings) {
-		try {
-			const index = factory({
-				provider: "elasticsearch",
-				config: settings
-			});
-			const root = await instance.read();
-			await index.initialize(root.identity);
-			await index.probe(root.identity);
-		} catch {
-			fail(503, "search_unavailable", "External search is unavailable. Check the address, index permissions, and credentials.");
-		}
-	}
-	async function rebuild() {
-		await database.db.insert(searchState).values({
-			id: 1,
-			configHash: ""
-		}).onConflictDoUpdate({
-			target: searchState.id,
-			set: {
-				configHash: "",
-				error: null
-			}
-		});
-		sync().catch(() => {});
-	}
-	const job = schedule("ticket-index", 1e3, work);
-	const sync = job.trigger;
-	return {
-		where,
-		sync,
-		test,
-		rebuild,
-		async status() {
-			const settings = await instance.search(), state = (await database.db.select().from(searchState).where(eq(searchState.id, 1)))[0], clock = (await database.db.select().from(eventClock).where(eq(eventClock.id, 1)))[0];
-			return {
-				status: !settings ? "builtin" : state?.error ? "unavailable" : state?.configHash === fingerprint(settings) && state?.cursor === clock?.value ? "ready" : "indexing",
-				cursor: state?.cursor.toString() ?? "0",
-				error: state?.error ?? null
-			};
-		},
-		close: job.close
-	};
-}
-//#endregion
-//#region src/project-access.ts
-function projectRoleSQL(userId, projectId) {
-	return sql`(SELECT CASE WHEN wm.role = 'admin' THEN 'admin'
-    WHEN pm.role IS NOT NULL THEN pm.role
-    WHEN p.visibility = 'workspace' THEN wm.role ELSE NULL END
-    FROM projects p
-    LEFT JOIN project_members pm ON pm.project_id = p.id AND pm.user_id = ${userId}
-    LEFT JOIN workspace_members wm ON wm.workspace_id = p.workspace_id AND wm.user_id = ${userId}
-    WHERE p.id = ${projectId})`;
-}
-async function projectRole(db, actor, row) {
-	if (actor.admin) return "admin";
-	const result = (await db.select({ role: projectRoleSQL(actor.id, row.id) }).from(projects).where(eq(projects.id, row.id)))[0];
-	return z.enum(roles).safeParse(result?.role).data;
-}
-async function accessibleProjectRows(db, actor, workspaceId) {
-	return db.select().from(projects).where(and(workspaceId ? eq(projects.workspaceId, workspaceId) : void 0, actor.admin ? void 0 : isNotNull(projectRoleSQL(actor.id, projects.id)), actor.projectIds ? actor.projectIds.length ? inArray(projects.id, [...actor.projectIds]) : sql`false` : void 0)).orderBy(projects.name);
-}
-//#endregion
-//#region src/workspace-operations.ts
-async function requireWorkspace(ctx, workspaceId, admin = false) {
-	if (ctx.actor.projectIds) fail(403, "workspace_scope_required", "Use an account with workspace access for this action");
-	const row = one(await ctx.db.select().from(workspaces).where(eq(workspaces.id, workspaceId)));
-	const membership = (await ctx.db.select().from(workspaceMembers).where(and(eq(workspaceMembers.workspaceId, workspaceId), eq(workspaceMembers.userId, ctx.actor.id))))[0];
-	if (!ctx.actor.admin && (!membership || admin && membership.role !== "admin")) fail(admin ? 403 : 404, "workspace_access_required", admin ? "Workspace administrator access is required" : "Workspace was not found");
-	return workspaceSchema.parse({
-		...row,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString(),
-		role: ctx.actor.admin ? "admin" : membership.role
-	});
-}
-async function publishWorkspace(ctx, workspaceId, type, data) {
-	await publishMany(ctx, (await ctx.db.select({ id: projects.id }).from(projects).where(eq(projects.workspaceId, workspaceId))).map((row) => ({
-		type,
-		ticketId: null,
-		projectId: row.id,
-		data: {
-			workspaceId,
-			...data
-		}
-	})));
-}
-const workspaceHandlers = {
-	async list_workspaces(ctx) {
-		const allowed = await accessibleProjectRows(ctx.db, ctx.actor);
-		const memberships = await ctx.db.select().from(workspaceMembers).where(eq(workspaceMembers.userId, ctx.actor.id));
-		const ids = [.../* @__PURE__ */ new Set([...allowed.map((row) => row.workspaceId), ...!ctx.actor.projectIds ? memberships.map((row) => row.workspaceId) : []])];
-		return (await ctx.db.select().from(workspaces).where(ctx.actor.admin && !ctx.actor.projectIds ? void 0 : ids.length ? inArray(workspaces.id, ids) : sql`false`).orderBy(workspaces.name)).map((row) => ({
-			...row,
-			role: ctx.actor.projectIds ? null : ctx.actor.admin ? "admin" : memberships.find((m) => m.workspaceId === row.id)?.role ?? null
-		}));
-	},
-	async create_workspace(ctx, input) {
-		if (ctx.actor.projectIds) fail(403, "workspace_scope_required", "Project-bound credentials cannot create workspaces");
-		if ((await ctx.db.select().from(workspaces).where(eq(workspaces.slug, input.slug))).length) fail(409, "duplicate_workspace", "This workspace URL key is already in use");
-		const row = one(await ctx.db.insert(workspaces).values({
-			name: input.name,
-			slug: input.slug,
-			description: input.description
-		}).returning());
-		await ctx.db.insert(workspaceMembers).values({
-			workspaceId: row.id,
-			userId: ctx.actor.id,
-			role: "admin"
-		});
-		return {
-			...row,
-			role: "admin"
-		};
-	},
-	async update_workspace(ctx, input) {
-		const current = workspace(ctx);
-		assertVersion(current, input.expectedVersion, "workspace", "saving");
-		const row = one(await ctx.db.update(workspaces).set({
-			name: input.name,
-			description: input.description,
-			version: current.version + 1,
-			updatedAt: /* @__PURE__ */ new Date()
-		}).where(eq(workspaces.id, current.id)).returning());
-		await publishWorkspace(ctx, row.id, "workspace.updated", { version: row.version });
-		return {
-			...row,
-			role: current.role
-		};
-	},
-	async list_workspace_members(ctx, input) {
-		workspace(ctx);
-		return ctx.db.select({
-			userId: user.id,
-			name: user.name,
-			email: user.email,
-			image: user.image,
-			role: workspaceMembers.role
-		}).from(workspaceMembers).innerJoin(user, eq(user.id, workspaceMembers.userId)).where(eq(workspaceMembers.workspaceId, input.workspaceId)).orderBy(user.name);
-	},
-	async set_workspace_member(ctx, input) {
-		workspace(ctx);
-		const person = await accountByEmail(ctx.db, input.email);
-		if ((await ctx.db.select().from(workspaceMembers).where(and(eq(workspaceMembers.workspaceId, input.workspaceId), eq(workspaceMembers.userId, person.id))))[0]?.role === "admin" && input.role !== "admin") {
-			if ((await ctx.db.select().from(workspaceMembers).where(and(eq(workspaceMembers.workspaceId, input.workspaceId), eq(workspaceMembers.role, "admin")))).length <= 1) fail(409, "last_administrator", "Keep at least one workspace administrator");
-		}
-		if (input.role) await ctx.db.insert(workspaceMembers).values({
-			workspaceId: input.workspaceId,
-			userId: person.id,
-			role: input.role
-		}).onConflictDoUpdate({
-			target: [workspaceMembers.workspaceId, workspaceMembers.userId],
-			set: { role: input.role }
-		});
-		else {
-			await ctx.db.delete(workspaceMembers).where(and(eq(workspaceMembers.workspaceId, input.workspaceId), eq(workspaceMembers.userId, person.id)));
-			await ctx.db.delete(members).where(and(eq(members.userId, person.id), inArray(members.projectId, ctx.db.select({ id: projects.id }).from(projects).where(eq(projects.workspaceId, input.workspaceId)))));
-		}
-		await publishWorkspace(ctx, input.workspaceId, "membership.updated", {
-			userId: person.id,
-			role: input.role
-		});
-		return { ok: true };
-	}
-};
-//#endregion
-//#region src/ticket-operations.ts
-const openTicket = notInArray(tickets.status, [...closedStates]);
-const overdueTicket = sql`${tickets.dueAt} < now()`;
-const rank = (column, values) => sql`array_position(ARRAY[${sql.join(values.map((value) => sql`${value}`), sql`, `)}]::text[], ${column}::text)`;
-const labelOrder = (column) => [asc(sql`lower(${column}) COLLATE "C"`), asc(sql`${column} COLLATE "C"`)];
-const dueColumn = (dueAt) => dueAt === void 0 ? {} : { dueAt: dueAt ? new Date(dueAt) : null };
-async function readinessMany(ctx, selected) {
-	const ids = selected.map((ticket) => ticket.id);
-	const result = /* @__PURE__ */ new Map();
-	if (!ids.length) return result;
-	const blockers = await ctx.db.select({
-		targetId: relations$1.targetId,
-		ticket: tickets
-	}).from(relations$1).innerJoin(tickets, eq(tickets.id, relations$1.sourceId)).where(and(inArray(relations$1.targetId, ids), eq(relations$1.type, "blocks")));
-	const children = await ctx.db.select().from(tickets).where(inArray(tickets.parentId, ids));
-	const ownership = await ctx.db.select().from(claims).where(inArray(claims.ticketId, ids));
-	const duplicates = await ctx.db.select({ sourceId: relations$1.sourceId }).from(relations$1).where(and(inArray(relations$1.sourceId, ids), eq(relations$1.type, "duplicate")));
-	for (const ticket of selected) {
-		const reasons = [];
-		if (ticket.status !== "todo" || ticket.archived) reasons.push({
-			code: "not_open",
-			message: "Ticket must be in To do and unarchived"
-		});
-		if (!ticket.automationReady) reasons.push({
-			code: "not_enabled",
-			message: "Agent work has not been enabled"
-		});
-		if (ticket.holdReason) reasons.push({
-			code: "hold",
-			message: ticket.holdReason
-		});
-		if (!ticket.description.trim()) reasons.push({
-			code: "missing_description",
-			message: "Add a description"
-		});
-		if (!ticket.acceptanceCriteria.trim()) reasons.push({
-			code: "missing_acceptance_criteria",
-			message: "Add acceptance criteria"
-		});
-		if (!ticket.difficulty) reasons.push({
-			code: "missing_difficulty",
-			message: "Choose a difficulty"
-		});
-		const dependencies = [...blockers.filter((row) => row.targetId === ticket.id).map((row) => row.ticket), ...children.filter((row) => row.parentId === ticket.id)];
-		const seen = /* @__PURE__ */ new Set();
-		for (const dependency of dependencies) if (!complete(dependency.status) && !seen.has(dependency.id)) {
-			seen.add(dependency.id);
-			reasons.push({
-				code: "dependency",
-				message: `${dependency.key} is unfinished`,
-				ticketId: dependency.id
-			});
-		}
-		if (duplicates.some((row) => row.sourceId === ticket.id)) reasons.push({
-			code: "duplicate",
-			message: "This ticket is marked as a duplicate"
-		});
-		const claim = ownership.find((row) => row.ticketId === ticket.id);
-		if (claim) {
-			const expired = claim.expiresAt <= /* @__PURE__ */ new Date();
-			reasons.push({
-				code: expired ? "claim_recovery_required" : "claimed",
-				message: expired ? "Confirm the previous worker stopped before recovering ownership" : `Claimed by ${claim.workerId}`
-			});
-		}
-		result.set(ticket.id, {
-			ready: reasons.length === 0,
-			reasons
-		});
-	}
-	return result;
-}
-async function readiness(ctx, ticket) {
-	return requireRow((await readinessMany(ctx, [ticket])).get(ticket.id));
-}
-async function validateReferences(ctx, ticketId, changes) {
-	if (changes.labels?.length) await ctx.db.insert(projectLabels).values(changes.labels.map((name) => ({
-		projectId: project(ctx).id,
-		name
-	}))).onConflictDoNothing();
-	if (changes.assigneeId && !(await ctx.db.select().from(members).where(and(eq(members.projectId, project(ctx).id), eq(members.userId, changes.assigneeId))).limit(1)).length) fail(400, "invalid_assignee", "Assign a project member");
-	if (changes.parentId) {
-		await getTicket(ctx, changes.parentId);
-		await assertNoCycle(ctx, ticketId, changes.parentId);
-	}
-}
-async function assertNoCycle(ctx, sourceId, targetId) {
-	if (sourceId === targetId) fail(409, "dependency_cycle", "A ticket cannot depend on itself");
-	const all = await ctx.db.select({
-		id: tickets.id,
-		parentId: tickets.parentId
-	}).from(tickets).where(eq(tickets.projectId, project(ctx).id));
-	const links = await ctx.db.select().from(relations$1).where(and(eq(relations$1.projectId, project(ctx).id), eq(relations$1.type, "blocks")));
-	const edges = /* @__PURE__ */ new Map();
-	const add = (from, to) => edges.set(from, [...edges.get(from) ?? [], to]);
-	for (const row of all) if (row.parentId) add(row.id, row.parentId);
-	for (const row of links) add(row.sourceId, row.targetId);
-	const pending = [targetId], visited = /* @__PURE__ */ new Set();
-	while (pending.length) {
-		const node = pending.pop();
-		if (!node || visited.has(node)) continue;
-		if (node === sourceId) fail(409, "dependency_cycle", "This relationship would create a dependency cycle");
-		visited.add(node);
-		pending.push(...edges.get(node) ?? []);
-	}
-}
-async function updateTicketRow(ctx, input) {
-	const current = await getTicket(ctx, input.ticketId);
-	assertVersion(current, input.expectedVersion, "ticket");
-	await assertWorkerClaim(ctx, current, input.claimId);
-	await validateReferences(ctx, current.id, input.changes);
-	const { dueAt, ...changes } = input.changes;
-	const row = one(await ctx.db.update(tickets).set({
-		...changes,
-		...dueColumn(dueAt),
-		version: current.version + 1,
-		updatedAt: /* @__PURE__ */ new Date()
-	}).where(eq(tickets.id, current.id)).returning());
-	await subscribe(ctx, row.projectId, row.id, [row.assigneeId]);
-	return {
-		row,
-		event: {
-			type: "ticket.updated",
-			ticketId: row.id,
-			data: {
-				version: row.version,
-				changedFields: Object.keys(input.changes)
-			}
-		}
-	};
-}
-async function updateTicket(ctx, input) {
-	const { row, event } = await updateTicketRow(ctx, input);
-	await publish(ctx, event.type, event.ticketId, event.data);
-	return row;
-}
-function labelUsage(ctx, archived) {
-	const labels = ctx.db.select({ name: sql`unnest(${tickets.labels})`.as("name") }).from(tickets).where(and(eq(tickets.projectId, project(ctx).id), archived === "include" ? void 0 : eq(tickets.archived, archived === "only"))).as("ticket_labels");
-	return ctx.db.select({
-		name: labels.name,
-		count: count().as("count")
-	}).from(labels).groupBy(labels.name);
-}
-const dueWithin = (interval) => and(sql`${tickets.dueAt} >= now()`, sql`${tickets.dueAt} < now() + ${interval}::interval`);
-function dueWhere(due) {
-	switch (due) {
-		case "overdue": return and(overdueTicket, openTicket);
-		case "today": return and(dueWithin("1 day"), openTicket);
-		case "week": return and(dueWithin("7 days"), openTicket);
-		case "scheduled": return isNotNull(tickets.dueAt);
-		case "none": return isNull(tickets.dueAt);
-		default: return;
-	}
-}
-async function pageOf(ctx, where, order, input) {
-	const rows = await ctx.db.select({
-		...getTableColumns(tickets),
-		total: sql`count(*) over()`.mapWith(Number)
-	}).from(tickets).where(where).orderBy(...order).limit(input.limit).offset(input.offset);
-	const total = rows[0]?.total ?? (input.offset ? one(await ctx.db.select({ count: count() }).from(tickets).where(where)).count : 0);
-	return {
-		items: rows.map(({ total: _total, ...row }) => row),
-		total
-	};
-}
-const ticketHandlers = {
-	async list_ticket_labels(ctx, input) {
-		const labels = labelUsage(ctx, input.archived).as("usage");
-		return ctx.db.select().from(labels).orderBy(...labelOrder(labels.name));
-	},
-	async list_tickets(ctx, input) {
-		const parent = input.parentId ? await getTicket(ctx, input.parentId) : void 0;
-		const search = input.q ? await ctx.search.where(ctx.db, [project(ctx).id], input.q) : void 0;
-		const where = and(eq(tickets.projectId, project(ctx).id), parent ? eq(tickets.parentId, parent.id) : void 0, input.status ? eq(tickets.status, input.status) : void 0, input.priority ? eq(tickets.priority, input.priority) : void 0, input.kind ? eq(tickets.kind, input.kind) : void 0, input.difficulty ? eq(tickets.difficulty, input.difficulty) : void 0, input.assigneeId === "none" ? isNull(tickets.assigneeId) : input.assigneeId ? eq(tickets.assigneeId, input.assigneeId) : void 0, input.label ? sql`${input.label} = ANY(${tickets.labels})` : void 0, input.archived === "include" ? void 0 : eq(tickets.archived, input.archived === "only"), dueWhere(input.due), search);
-		const direction = input.order ?? defaultOrder[input.sort];
-		const by = (column, flip = false) => direction === "asc" !== flip ? sql`${column} ASC NULLS LAST` : sql`${column} DESC NULLS LAST`;
-		return pageOf(ctx, where, [{
-			priority: by(rank(tickets.priority, priorities)),
-			updated: by(tickets.updatedAt),
-			created: by(tickets.createdAt),
-			title: by(sql`lower(${tickets.title})`),
-			labels: by(sql`(SELECT min(lower(label) COLLATE "C") FROM unnest(${tickets.labels}) AS label)`),
-			due: by(tickets.dueAt),
-			number: by(tickets.number),
-			status: by(rank(tickets.status, states)),
-			difficulty: by(rank(tickets.difficulty, difficulties)),
-			kind: by(tickets.kind),
-			assignee: by(sql`(SELECT lower(name) FROM "user" WHERE id = ${tickets.assigneeId})`)
-		}[input.sort], asc(tickets.number)], input);
-	},
-	async get_ticket(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		const claim = (await ctx.db.select().from(claims).where(eq(claims.ticketId, ticket.id)))[0] ?? null;
-		return {
-			ticket,
-			canReleaseClaim: claim ? ownsLiveClaim(ctx, claim) : false,
-			subscribed: (await ctx.db.select({ id: subscriptions.ticketId }).from(subscriptions).where(and(eq(subscriptions.ticketId, ticket.id), eq(subscriptions.userId, ctx.actor.id)))).length > 0,
-			readiness: await readiness(ctx, ticket),
-			claim
-		};
-	},
-	async create_ticket(ctx, input) {
-		const id = crypto.randomUUID();
-		await validateReferences(ctx, id, input);
-		const counter = one(await ctx.db.update(projects).set({ nextNumber: sql`${projects.nextNumber} + 1` }).where(eq(projects.id, project(ctx).id)).returning());
-		const { projectId: _projectId, requestId: _requestId, dueAt, ...fields } = input;
-		const row = one(await ctx.db.insert(tickets).values({
-			...fields,
-			...dueColumn(dueAt),
-			id,
-			projectId: counter.id,
-			number: counter.nextNumber - 1,
-			key: `${counter.key}-${counter.nextNumber - 1}`,
-			createdBy: ctx.actor.id
-		}).returning());
-		await subscribe(ctx, row.projectId, row.id, [ctx.actor.id, row.assigneeId]);
-		await publish(ctx, "ticket.created", row.id, {
-			key: row.key,
-			version: row.version
-		});
-		return row;
-	},
-	update_ticket: updateTicket,
-	async bulk_update_tickets(ctx, input) {
-		const result = [], pending = [];
-		for (const item of input.tickets) {
-			const { row, event } = await updateTicketRow(ctx, {
-				projectId: input.projectId,
-				ticketId: item.ticketId,
-				expectedVersion: item.expectedVersion,
-				changes: input.changes
-			});
-			result.push(row);
-			pending.push(event);
-		}
-		await publishMany(ctx, pending);
-		return result;
-	},
-	async delete_ticket(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		assertVersion(ticket, input.expectedVersion, "ticket", "deleting");
-		if ((await ctx.db.select().from(claims).where(eq(claims.ticketId, ticket.id))).length) fail(409, "claim_conflict", "Release ownership before deleting this ticket");
-		await publishMany(ctx, [...(await ctx.db.update(tickets).set({
-			parentId: null,
-			version: sql`${tickets.version} + 1`,
-			updatedAt: /* @__PURE__ */ new Date()
-		}).where(eq(tickets.parentId, ticket.id)).returning()).map((child) => ({
-			type: "ticket.updated",
-			ticketId: child.id,
-			data: {
-				version: child.version,
-				changedFields: ["parentId"]
-			}
-		})), {
-			type: "ticket.deleted",
-			ticketId: ticket.id,
-			data: {
-				key: ticket.key,
-				version: ticket.version
-			}
-		}]);
-		await ctx.db.delete(tickets).where(eq(tickets.id, ticket.id));
-		return { ok: true };
-	},
-	async list_eligible_tickets(ctx, input) {
-		const page = await pageOf(ctx, and(eq(tickets.projectId, project(ctx).id), openTicket, eq(tickets.archived, false)), [asc(tickets.number)], input);
-		const eligibility = await readinessMany(ctx, page.items);
-		return {
-			items: page.items.map((ticket) => ({
-				ticket,
-				readiness: requireRow(eligibility.get(ticket.id))
-			})),
-			total: page.total
-		};
-	},
-	async search_tickets(ctx, input) {
-		const allowed = await accessibleProjectRows(ctx.db, ctx.actor, input.workspaceId);
-		if (!allowed.length) return { items: [] };
-		const ids = allowed.map((row) => row.id);
-		return { items: (await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, ids), eq(tickets.archived, false), or(eq(tickets.key, input.q.toUpperCase()), await ctx.search.where(ctx.db, ids, input.q)))).orderBy(sql`CASE WHEN ${tickets.key} = ${input.q.toUpperCase()} THEN 0 ELSE 1 END`, desc(tickets.updatedAt)).limit(input.limit)).flatMap((ticket) => {
-			const owner = allowed.find((row) => row.id === ticket.projectId);
-			return owner ? [{
-				ticket,
-				project: {
-					id: owner.id,
-					key: owner.key,
-					name: owner.name
-				}
-			}] : [];
-		}) };
-	},
-	async claim_ticket(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		assertVersion(ticket, input.expectedVersion, "ticket", "claiming");
-		const eligible = await readiness(ctx, ticket);
-		if (!eligible.ready) fail(409, "not_ready", "The ticket is not ready to claim", eligible);
-		const claim = one(await ctx.db.insert(claims).values({
-			projectId: project(ctx).id,
-			ticketId: ticket.id,
-			actorId: ctx.actor.id,
-			ownerId: ctx.actor.ownerId,
-			workerId: input.workerId,
-			expiresAt: new Date(Date.now() + input.leaseSeconds * 1e3)
-		}).returning());
-		const row = one(await ctx.db.update(tickets).set({
-			status: "in_progress",
-			claimRequired: true,
-			version: ticket.version + 1,
-			updatedAt: /* @__PURE__ */ new Date()
-		}).where(eq(tickets.id, ticket.id)).returning());
-		await publish(ctx, "ticket.claimed", ticket.id, {
-			claimId: claim.id,
-			workerId: claim.workerId,
-			version: row.version
-		});
-		return claim;
-	},
-	async renew_claim(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		const current = one(await ctx.db.select().from(claims).where(and(eq(claims.id, input.claimId), eq(claims.ticketId, ticket.id))));
-		if (!ownsLiveClaim(ctx, current)) fail(409, "claim_conflict", "Only the current worker can renew an unexpired claim");
-		const claim = one(await ctx.db.update(claims).set({ expiresAt: new Date(Date.now() + input.leaseSeconds * 1e3) }).where(eq(claims.id, current.id)).returning());
-		await publish(ctx, "claim.renewed", ticket.id, {
-			claimId: claim.id,
-			expiresAt: claim.expiresAt.toISOString()
-		});
-		return claim;
-	},
-	async release_claim(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		const current = one(await ctx.db.select().from(claims).where(and(eq(claims.id, input.claimId), eq(claims.ticketId, ticket.id))));
-		if (!ownsLiveClaim(ctx, current)) fail(409, "claim_conflict", "Only the owning worker can release an unexpired claim. Expired claims require administrator recovery.");
-		await ctx.db.delete(claims).where(eq(claims.id, current.id));
-		await publish(ctx, "claim.released", ticket.id, { claimId: current.id });
-		return { ok: true };
-	},
-	async recover_claim(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		const current = one(await ctx.db.select().from(claims).where(and(eq(claims.id, input.claimId), eq(claims.ticketId, ticket.id))));
-		if (current.expiresAt > /* @__PURE__ */ new Date()) fail(409, "claim_not_expired", "The current claim has not expired");
-		await ctx.db.delete(claims).where(eq(claims.id, current.id));
-		await publish(ctx, "claim.recovered", ticket.id, {
-			claimId: current.id,
-			reason: input.reason,
-			confirmedStopped: true
-		});
-		return { ok: true };
-	}
-};
-//#endregion
-//#region src/project-operations.ts
-async function getLabel(ctx, labelId, expectedVersion) {
-	const label = one(await ctx.db.select().from(projectLabels).where(and(eq(projectLabels.projectId, project(ctx).id), eq(projectLabels.id, labelId))));
-	assertVersion(label, expectedVersion, "label", "saving");
-	return label;
-}
-async function rememberLabelColor(ctx, color) {
-	if (isHexColor(color)) await ctx.db.insert(labelColors).values({
-		value: color,
-		createdBy: ctx.actor.id
-	}).onConflictDoNothing();
-}
-async function availableLabelName(ctx, name, exceptId) {
-	if ((await ctx.db.select({ id: projectLabels.id }).from(projectLabels).where(and(eq(projectLabels.projectId, project(ctx).id), eq(projectLabels.name, name), exceptId ? ne(projectLabels.id, exceptId) : void 0))).length) fail(409, "duplicate_label", "A label with this name already exists in this project.");
-}
-async function changeLabelUsage(ctx, name, replacement) {
-	const affected = await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), sql`${name} = ANY(${tickets.labels})`));
-	const pending = [];
-	for (const ticket of affected) pending.push((await updateTicketRow(ctx, {
-		projectId: project(ctx).id,
-		ticketId: ticket.id,
-		expectedVersion: ticket.version,
-		changes: { labels: replacement ? ticket.labels.map((tag) => tag === name ? replacement : tag) : ticket.labels.filter((tag) => tag !== name) }
-	})).event);
-	await publishMany(ctx, pending);
-	await ctx.db.update(views).set({ filters: replacement ? sql`jsonb_set(${views.filters}, '{label}', to_jsonb(${replacement}::text))` : sql`${views.filters} - 'label'` }).where(and(eq(views.projectId, project(ctx).id), sql`${views.filters}->>'label' = ${name}`));
-}
-const projectHandlers = {
-	async list_project_labels(ctx) {
-		const usage = labelUsage(ctx, "include").as("usage");
-		return ctx.db.select({
-			...getTableColumns(projectLabels),
-			count: sql`coalesce(${usage.count}, 0)`.mapWith(Number)
-		}).from(projectLabels).leftJoin(usage, eq(projectLabels.name, sql`"usage"."name"`)).where(eq(projectLabels.projectId, project(ctx).id)).orderBy(...labelOrder(projectLabels.name));
-	},
-	async create_project_label(ctx, input) {
-		await availableLabelName(ctx, input.name);
-		await rememberLabelColor(ctx, input.color);
-		const label = one(await ctx.db.insert(projectLabels).values({
-			projectId: project(ctx).id,
-			name: input.name,
-			color: input.color
-		}).returning());
-		await publish(ctx, "label.created", null, {
-			labelId: label.id,
-			name: label.name,
-			color: label.color,
-			version: label.version
-		});
-		return label;
-	},
-	async update_project_label(ctx, input) {
-		const current = await getLabel(ctx, input.labelId, input.expectedVersion);
-		await availableLabelName(ctx, input.name, current.id);
-		if (input.color !== current.color) await rememberLabelColor(ctx, input.color);
-		const label = one(await ctx.db.update(projectLabels).set({
-			name: input.name,
-			color: input.color,
-			version: current.version + 1
-		}).where(eq(projectLabels.id, current.id)).returning());
-		if (current.name !== label.name) await changeLabelUsage(ctx, current.name, label.name);
-		await publish(ctx, "label.updated", null, {
-			labelId: label.id,
-			name: label.name,
-			previousName: current.name,
-			color: label.color,
-			version: label.version
-		});
-		return label;
-	},
-	async delete_project_label(ctx, input) {
-		const label = await getLabel(ctx, input.labelId, input.expectedVersion);
-		await changeLabelUsage(ctx, label.name);
-		await ctx.db.delete(projectLabels).where(eq(projectLabels.id, label.id));
-		await publish(ctx, "label.deleted", null, {
-			labelId: label.id,
-			name: label.name
-		});
-		return { ok: true };
-	},
-	async list_label_colors(ctx) {
-		return ctx.db.select({
-			value: labelColors.value,
-			createdAt: labelColors.createdAt
-		}).from(labelColors).orderBy(desc(labelColors.createdAt), asc(labelColors.value));
-	},
-	async remove_label_color(ctx, input) {
-		const current = (await ctx.db.select().from(labelColors).where(eq(labelColors.value, input.value)))[0];
-		if (!current) return { ok: true };
-		if (!ctx.actor.admin && current.createdBy !== ctx.actor.id) fail(403, "forbidden", "Only an instance administrator or the person who added this color can remove it");
-		await ctx.db.delete(labelColors).where(eq(labelColors.value, input.value));
-		await publishMany(ctx, (await ctx.db.select({ id: projects.id }).from(projects).where(ctx.actor.admin ? void 0 : inArray(projectRoleSQL(ctx.actor.id, projects.id), ["writer", "admin"]))).map((row) => ({
-			type: "label.color_removed",
-			ticketId: null,
-			projectId: row.id,
-			data: { value: input.value }
-		})));
-		return { ok: true };
-	},
-	async get_project(ctx) {
-		return project(ctx);
-	},
-	async set_project_icon(ctx, input) {
-		const current = project(ctx);
-		assertVersion(current, input.expectedVersion, "project icon", "saving");
-		const icon = input.icon;
-		if (icon?.kind === "library" && !icons.icons[icon.name]) fail(400, "invalid_icon", "Choose an icon from the installed library");
-		let objectId = null;
-		if (icon?.kind === "image") {
-			objectId = crypto.randomUUID();
-			await ctx.blobs.put(ctx.db, objectId, decodeImage(icon), icon.contentType);
-		}
-		const row = one(await ctx.db.update(projects).set({
-			iconName: icon?.kind === "library" ? icon.name : null,
-			iconColor: icon?.kind === "library" ? icon.color : "default",
-			image: objectId ? `/api/v1/projects/${current.id}/icon?v=${objectId}` : null,
-			iconObjectId: objectId,
-			version: current.version + 1,
-			updatedAt: /* @__PURE__ */ new Date()
-		}).where(eq(projects.id, current.id)).returning());
-		await publish(ctx, "project.updated", null, { version: row.version });
-		return row;
-	},
-	async list_projects(ctx, input) {
-		const rows = await accessibleProjectRows(ctx.db, ctx.actor, input.workspaceId);
-		if (!rows.length) return [];
-		const counts = await ctx.db.select({
-			projectId: tickets.projectId,
-			open: count(),
-			overdue: count(sql`CASE WHEN ${overdueTicket} THEN 1 END`)
-		}).from(tickets).where(and(inArray(tickets.projectId, rows.map((row) => row.id)), eq(tickets.archived, false), openTicket)).groupBy(tickets.projectId);
-		return rows.map((row) => {
-			const stats = counts.find((entry) => entry.projectId === row.id);
-			return {
-				...toProject(row),
-				openTickets: stats?.open ?? 0,
-				overdueTickets: stats?.overdue ?? 0
-			};
-		});
-	},
-	async create_project(ctx, input) {
-		if (ctx.actor.projectIds) fail(403, "insufficient_scope", "Project-bound credentials cannot create projects");
-		let workspaceId = input.workspaceId;
-		if (workspaceId) {
-			if (workspace(ctx).role === "reader") fail(403, "forbidden", "Project creation requires workspace write access");
-		} else {
-			workspaceId = (ctx.actor.admin ? await ctx.db.select({ workspaceId: workspaces.id }).from(workspaces).orderBy(workspaces.createdAt).limit(1) : await ctx.db.select({ workspaceId: workspaceMembers.workspaceId }).from(workspaceMembers).where(and(eq(workspaceMembers.userId, ctx.actor.id), inArray(workspaceMembers.role, ["writer", "admin"]))).orderBy(workspaceMembers.workspaceId).limit(1))[0]?.workspaceId;
-			if (!workspaceId) {
-				workspaceId = one(await ctx.db.insert(workspaces).values({
-					name: "Personal workspace",
-					slug: `personal-${crypto.randomUUID()}`
-				}).returning()).id;
-				await ctx.db.insert(workspaceMembers).values({
-					workspaceId,
-					userId: ctx.actor.id,
-					role: "admin"
-				});
-			}
-		}
-		if ((await ctx.db.select({ id: projects.id }).from(projects).where(eq(projects.key, input.key))).length) fail(409, "duplicate_prefix", "This project prefix is already in use");
-		const row = one(await ctx.db.insert(projects).values({
-			workspaceId,
-			visibility: input.visibility,
-			key: input.key,
-			name: input.name,
-			description: input.description
-		}).returning());
-		await ctx.db.insert(members).values({
-			projectId: row.id,
-			userId: ctx.actor.id,
-			role: "admin"
-		});
-		await publish({
-			...ctx,
-			project: toProject(row)
-		}, "project.created", null, { projectId: row.id });
-		return row;
-	},
-	async update_project(ctx, input) {
-		const current = project(ctx);
-		assertVersion(current, input.expectedVersion, "project");
-		const row = one(await ctx.db.update(projects).set({
-			name: input.name,
-			...input.visibility ? { visibility: input.visibility } : {},
-			description: input.description,
-			version: current.version + 1,
-			updatedAt: /* @__PURE__ */ new Date()
-		}).where(eq(projects.id, current.id)).returning());
-		await publish(ctx, "project.updated", null, { version: row.version });
-		return row;
-	},
-	async list_members(ctx) {
-		const current = project(ctx);
-		const inherited = await ctx.db.select({
-			userId: user.id,
-			role: workspaceMembers.role,
-			name: user.name,
-			email: user.email,
-			image: user.image
-		}).from(workspaceMembers).innerJoin(user, eq(user.id, workspaceMembers.userId)).where(and(eq(workspaceMembers.workspaceId, current.workspaceId), current.visibility === "workspace" ? void 0 : eq(workspaceMembers.role, "admin")));
-		const direct = await ctx.db.select({
-			userId: user.id,
-			role: members.role,
-			name: user.name,
-			email: user.email,
-			image: user.image
-		}).from(members).innerJoin(user, eq(user.id, members.userId)).where(eq(members.projectId, current.id));
-		const people = new Map(inherited.map((person) => [person.userId, {
-			...person,
-			source: "workspace"
-		}]));
-		for (const person of direct) if (people.get(person.userId)?.role !== "admin") people.set(person.userId, {
-			...person,
-			source: "project"
-		});
-		const inheritedRoles = new Map(inherited.map((person) => [person.userId, person.role]));
-		return [...people.values()].map((person) => ({
-			...person,
-			inheritedRole: inheritedRoles.get(person.userId) ?? null
-		})).toSorted((a, b) => a.name.localeCompare(b.name));
-	},
-	async set_member(ctx, input) {
-		const member = await accountByEmail(ctx.db, input.email);
-		const projectId = project(ctx).id;
-		if ((await ctx.db.select().from(members).where(and(eq(members.projectId, projectId), eq(members.userId, member.id))))[0]?.role === "admin" && input.role !== "admin") {
-			if (!(await ctx.db.select({ id: user.id }).from(user).leftJoin(workspaceMembers, and(eq(workspaceMembers.workspaceId, project(ctx).workspaceId), eq(workspaceMembers.userId, user.id))).where(and(eq(projectRoleSQL(user.id, projectId), "admin"), sql`NOT coalesce(${user.banned},false)`, or(ne(user.id, member.id), eq(workspaceMembers.role, "admin")))).limit(1)).length) fail(409, "last_administrator", "Keep at least one project or workspace administrator");
-		}
-		if (input.role) await ctx.db.insert(members).values({
-			projectId,
-			userId: member.id,
-			role: input.role
-		}).onConflictDoUpdate({
-			target: [members.projectId, members.userId],
-			set: { role: input.role }
-		});
-		else await ctx.db.delete(members).where(and(eq(members.projectId, projectId), eq(members.userId, member.id)));
-		await publish(ctx, "membership.updated", null, {
-			userId: member.id,
-			role: input.role
-		});
-		return { ok: true };
-	},
-	async list_views(ctx) {
-		return ctx.db.select().from(views).where(and(eq(views.projectId, project(ctx).id), eq(views.userId, ctx.actor.id))).orderBy(views.name);
-	},
-	async save_view(ctx, input) {
-		return one(await ctx.db.insert(views).values({
-			projectId: project(ctx).id,
-			userId: ctx.actor.id,
-			name: input.name,
-			filters: input.filters
-		}).returning({ id: views.id }));
-	},
-	async delete_view(ctx, input) {
-		one(await ctx.db.delete(views).where(and(eq(views.projectId, project(ctx).id), eq(views.userId, ctx.actor.id), eq(views.id, input.viewId))).returning());
-		return { ok: true };
-	}
-};
-//#endregion
-//#region src/collaboration-operations.ts
-const sourceTicket = alias(tickets, "source_ticket");
-const targetTicket = alias(tickets, "target_ticket");
-async function editableComment(ctx, commentId, expectedVersion) {
-	const row = one(await ctx.db.select().from(comments).where(and(eq(comments.projectId, project(ctx).id), eq(comments.id, commentId))));
-	if (row.actorId !== ctx.actor.id && ctx.role !== "admin") fail(403, "forbidden", "Only the author or a project administrator can edit this comment");
-	assertVersion(row, expectedVersion, "comment");
-	return row;
-}
-async function publishRelation(ctx, type, relation) {
-	await publishMany(ctx, [relation.sourceId, relation.targetId].map((ticketId) => ({
-		type,
-		ticketId,
-		data: { relation }
-	})));
-}
-const collaborationHandlers = {
-	async list_relations(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		return ctx.db.select({
-			...getTableColumns(relations$1),
-			sourceKey: sourceTicket.key,
-			sourceTitle: sourceTicket.title,
-			targetKey: targetTicket.key,
-			targetTitle: targetTicket.title
-		}).from(relations$1).innerJoin(sourceTicket, eq(sourceTicket.id, relations$1.sourceId)).innerJoin(targetTicket, eq(targetTicket.id, relations$1.targetId)).where(and(eq(relations$1.projectId, project(ctx).id), or(eq(relations$1.sourceId, ticket.id), eq(relations$1.targetId, ticket.id))));
-	},
-	async add_relation(ctx, input) {
-		const current = await getTicket(ctx, input.ticketId), other = await getTicket(ctx, input.targetId);
-		const [source, target] = input.direction === "incoming" ? [other, current] : [current, other];
-		if (source.id === target.id) fail(409, "invalid_relation", "Choose a different ticket");
-		if (input.type === "blocks") await assertNoCycle(ctx, source.id, target.id);
-		const [sourceId, targetId] = input.type === "related" ? [source.id, target.id].toSorted() : [source.id, target.id];
-		const row = one(await ctx.db.insert(relations$1).values({
-			projectId: project(ctx).id,
-			sourceId: requireRow(sourceId),
-			targetId: requireRow(targetId),
-			type: input.type
-		}).onConflictDoUpdate({
-			target: [
-				relations$1.sourceId,
-				relations$1.targetId,
-				relations$1.type
-			],
-			set: { type: input.type }
-		}).returning());
-		await publishRelation(ctx, "relation.added", row);
-		return row;
-	},
-	async remove_relation(ctx, input) {
-		await publishRelation(ctx, "relation.removed", one(await ctx.db.delete(relations$1).where(and(eq(relations$1.projectId, project(ctx).id), eq(relations$1.id, input.relationId))).returning()));
-		return { ok: true };
-	},
-	async list_comments(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId), where = eq(comments.ticketId, ticket.id);
-		return {
-			items: await ctx.db.select().from(comments).where(where).orderBy(asc(comments.createdAt), asc(comments.id)).limit(input.limit).offset(input.offset),
-			total: one(await ctx.db.select({ count: count() }).from(comments).where(where)).count
-		};
-	},
-	async add_comment(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		const row = one(await ctx.db.insert(comments).values({
-			projectId: project(ctx).id,
-			ticketId: ticket.id,
-			actorId: ctx.actor.id,
-			body: input.body
-		}).returning());
-		await subscribe(ctx, row.projectId, row.ticketId, [ctx.actor.id]);
-		await publish(ctx, "comment.created", ticket.id, { commentId: row.id });
-		return row;
-	},
-	async update_comment(ctx, input) {
-		const current = await editableComment(ctx, input.commentId, input.expectedVersion);
-		const row = one(await ctx.db.update(comments).set({
-			body: input.body,
-			version: current.version + 1,
-			updatedAt: /* @__PURE__ */ new Date()
-		}).where(eq(comments.id, current.id)).returning());
-		await publish(ctx, "comment.updated", row.ticketId, {
-			commentId: row.id,
-			version: row.version
-		});
-		return row;
-	},
-	async delete_comment(ctx, input) {
-		const current = await editableComment(ctx, input.commentId, input.expectedVersion);
-		await ctx.db.delete(comments).where(eq(comments.id, current.id));
-		await publish(ctx, "comment.deleted", current.ticketId, { commentId: current.id });
-		return { ok: true };
-	},
-	async list_activity(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId), where = and(eq(events.projectId, project(ctx).id), eq(events.ticketId, ticket.id));
-		return {
-			items: await ctx.db.select().from(events).where(where).orderBy(desc(events.id)).limit(input.limit).offset(input.offset),
-			total: one(await ctx.db.select({ count: count() }).from(events).where(where)).count
-		};
-	},
-	async upload_attachment(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		const bytes = decodeBlobData(input.data, attachmentLimit);
-		const id = crypto.randomUUID();
-		await ctx.blobs.put(ctx.db, id, bytes, input.contentType);
-		const row = one(await ctx.db.insert(attachments).values({
-			id,
-			objectId: id,
-			projectId: project(ctx).id,
-			ticketId: ticket.id,
-			actorId: ctx.actor.id,
-			name: input.name,
-			contentType: input.contentType,
-			size: bytes.length
-		}).returning());
-		await publish(ctx, "attachment.created", ticket.id, {
-			attachmentId: row.id,
-			size: row.size
-		});
-		return row;
-	},
-	async list_attachments(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		return ctx.db.select().from(attachments).where(eq(attachments.ticketId, ticket.id)).orderBy(asc(attachments.createdAt));
-	},
-	async delete_attachment(ctx, input) {
-		const row = one(await ctx.db.delete(attachments).where(and(eq(attachments.projectId, project(ctx).id), eq(attachments.id, input.attachmentId))).returning());
-		await publish(ctx, "attachment.deleted", row.ticketId, { attachmentId: row.id });
-		return { ok: true };
-	},
-	async list_evidence(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		return ctx.db.select().from(evidence).where(eq(evidence.ticketId, ticket.id)).orderBy(asc(evidence.createdAt));
-	},
-	async add_evidence(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		await assertWorkerClaim(ctx, ticket, input.claimId);
-		const row = one(await ctx.db.insert(evidence).values({
-			projectId: project(ctx).id,
-			ticketId: ticket.id,
-			actorId: ctx.actor.id,
-			title: input.title,
-			kind: input.kind,
-			url: input.url,
-			commit: input.commit,
-			outcome: input.outcome,
-			note: input.note
-		}).returning());
-		await publish(ctx, "evidence.added", ticket.id, {
-			evidenceId: row.id,
-			kind: row.kind,
-			outcome: row.outcome,
-			commit: row.commit
-		});
-		return row;
-	},
-	async set_subscription(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		if (input.enabled) await subscribe(ctx, project(ctx).id, ticket.id, [ctx.actor.id]);
-		else {
-			await ctx.db.delete(subscriptions).where(and(eq(subscriptions.ticketId, ticket.id), eq(subscriptions.userId, ctx.actor.id)));
-			await ctx.db.update(pushDeliveries).set({
-				finishedAt: /* @__PURE__ */ new Date(),
-				error: "unsubscribed"
-			}).where(and(isNull(pushDeliveries.finishedAt), inArray(pushDeliveries.notificationId, ctx.db.select({ id: notifications.id }).from(notifications).innerJoin(events, eq(events.id, notifications.eventId)).where(and(eq(notifications.userId, ctx.actor.id), eq(events.ticketId, ticket.id))))));
-		}
-		return { ok: true };
-	}
-};
-//#endregion
-//#region src/domain.ts
-function fail(status, code, message, details) {
-	throw new ApiError(status, code, message, details);
-}
-function requireRow(row) {
-	if (!row) fail(404, "not_found", "The requested record was not found");
-	return row;
-}
-const one = (rows) => requireRow(rows[0]);
-function assertVersion(current, expected, subject, action = "editing") {
-	if (current.version !== expected) fail(409, "version_conflict", `The ${subject} changed; reload before ${action}`, { currentVersion: current.version });
-}
-function toProject(row) {
-	return projectSchema.parse({
-		...row,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	});
-}
-async function accountByEmail(db, email) {
-	const found = (await db.select().from(user).where(eq(user.email, email.toLowerCase())).limit(1))[0];
-	if (!found) fail(404, "account_not_found", "No account uses this email. Ask an instance administrator to create one.");
-	return found;
-}
-function workspace(ctx) {
-	return requireRow(ctx.workspace ?? void 0);
-}
-function project(ctx) {
-	return requireRow(ctx.project ?? void 0);
-}
-function json(value) {
-	return JSON.parse(JSON.stringify(value, (_, item) => typeof item === "bigint" ? item.toString() : item));
-}
-const complete = (status) => closedStates.some((closed) => closed === status);
-const hasScope = (actor, scope) => actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.length > 0;
-async function context(db, actor, scope, projectId, workspaceId) {
-	if (!hasScope(actor, scope)) fail(403, "insufficient_scope", `This credential requires ${scope} permission`);
-	const ctx = {
-		db,
-		actor,
-		project: null,
-		workspace: null,
-		role: "reader",
-		blobs: { put: writeLocalBlob },
-		search: { where: async (_db, _ids, query) => postgresSearch(query) }
-	};
-	if (workspaceId) {
-		ctx.workspace = await requireWorkspace(ctx, workspaceId, scope === "admin");
-		if ((scope === "write" || scope === "claim") && ctx.workspace.role === "reader") fail(403, "forbidden", "Workspace write access is required");
-	}
-	if (!projectId) return ctx;
-	const row = one(await db.select().from(projects).where(or(eq(projects.key, projectId.toUpperCase()), sql`${projects.id}::text = ${projectId}`)).limit(1));
-	if (actor.projectIds && !actor.projectIds.includes(row.id)) fail(404, "not_found", "Project was not found");
-	const role = await projectRole(db, actor, row);
-	if (!role) fail(404, "not_found", "Project was not found");
-	if (role !== "reader" && role !== "writer" && role !== "admin") fail(403, "forbidden", "Project access is unavailable");
-	if (scope === "admin" && role !== "admin") fail(403, "forbidden", "Project administration permission is required");
-	if ((scope === "write" || scope === "claim") && role === "reader") fail(403, "forbidden", "Project write permission is required");
-	return {
-		...ctx,
-		project: toProject(row),
-		role
-	};
-}
-async function getTicket(ctx, identifier) {
-	return one(await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), or(eq(tickets.key, identifier.toUpperCase()), sql`${tickets.id}::text = ${identifier}`))).limit(1));
-}
-const insertBatch = 1e3;
-async function insertAll(rows, insert) {
-	const out = [];
-	for (let at = 0; at < rows.length; at += insertBatch) out.push(...await insert(rows.slice(at, at + insertBatch)));
-	return out;
-}
-async function subscribe(ctx, projectId, ticketId, userIds) {
-	const ids = [...new Set(userIds.filter((id) => !!id))];
-	if (ids.length) await ctx.db.insert(subscriptions).values(ids.map((userId) => ({
-		projectId,
-		ticketId,
-		userId
-	}))).onConflictDoNothing();
-}
-async function publishMany(ctx, pending) {
-	if (!pending.length) return [];
-	const ticketIds = [...new Set(pending.flatMap((item) => item.ticketId ? [item.ticketId] : []))];
-	const titles = new Map(ticketIds.length ? (await ctx.db.select({
-		id: tickets.id,
-		key: tickets.key,
-		title: tickets.title
-	}).from(tickets).where(inArray(tickets.id, ticketIds))).map((row) => [row.id, {
-		key: row.key,
-		title: row.title
-	}]) : []);
-	const clock = one(await ctx.db.update(eventClock).set({ value: sql`${eventClock.value} + ${pending.length}` }).where(eq(eventClock.id, 1)).returning());
-	const first = clock.value - BigInt(pending.length) + 1n;
-	const source = {
-		kind: ctx.actor.machine ? "credential" : "session",
-		id: ctx.actor.ownerId
-	};
-	const rows = await insertAll(pending.map((item, index) => ({
-		id: first + BigInt(index),
-		projectId: item.projectId ?? project(ctx).id,
-		ticketId: item.ticketId,
-		actorId: ctx.actor.id,
-		type: item.type,
-		data: {
-			...item.data,
-			...item.ticketId ? titles.get(item.ticketId) : {},
-			source
-		}
-	})), (batch) => ctx.db.insert(events).values(batch).returning());
-	if (ticketIds.length) {
-		const followers = await ctx.db.select({
-			ticketId: subscriptions.ticketId,
-			userId: subscriptions.userId,
-			inApp: notificationPreferences.inApp,
-			push: notificationPreferences.push
-		}).from(subscriptions).innerJoin(user, eq(user.id, subscriptions.userId)).leftJoin(notificationPreferences, eq(notificationPreferences.userId, subscriptions.userId)).where(and(inArray(subscriptions.ticketId, ticketIds), or(isNotNull(projectRoleSQL(user.id, subscriptions.projectId)), sql`'admin' = any(string_to_array(${user.role}, ','))`), sql`not coalesce(${user.banned}, false)`, ctx.actor.machine ? void 0 : ne(subscriptions.userId, ctx.actor.id), or(sql`coalesce(${notificationPreferences.inApp}, true)`, eq(notificationPreferences.push, true))));
-		const entries = rows.flatMap((event) => followers.filter((follower) => follower.ticketId === event.ticketId).map((follower) => ({
-			event,
-			follower
-		})));
-		if (entries.length) {
-			const created = await insertAll(entries.map(({ event, follower }) => ({
-				userId: follower.userId,
-				projectId: event.projectId,
-				eventId: event.id,
-				inbox: follower.inApp ?? true
-			})), (batch) => ctx.db.insert(notifications).values(batch).returning());
-			const pushing = new Set(entries.filter(({ follower }) => follower.push).map(({ event, follower }) => `${event.id}:${follower.userId}`));
-			if (pushing.size) {
-				const devices = await ctx.db.select({
-					id: pushDevices.id,
-					userId: pushDevices.userId
-				}).from(pushDevices).where(inArray(pushDevices.userId, [...new Set(entries.filter((e) => e.follower.push).map((e) => e.follower.userId))]));
-				await insertAll(created.flatMap((notification) => pushing.has(`${notification.eventId}:${notification.userId}`) ? devices.filter((device) => device.userId === notification.userId).map((device) => ({
-					notificationId: notification.id,
-					deviceId: device.id
-				})) : []), (batch) => ctx.db.insert(pushDeliveries).values(batch).returning());
-			}
-		}
-	}
-	await ctx.db.execute(sql`SELECT pg_notify('kanvil_events', ${clock.value.toString()})`);
-	return rows;
-}
-async function publish(ctx, type, ticketId, data) {
-	return one(await publishMany(ctx, [{
-		type,
-		ticketId,
-		data
-	}]));
-}
-function ownsLiveClaim(ctx, claim) {
-	return claim.ownerId === ctx.actor.ownerId && claim.expiresAt > /* @__PURE__ */ new Date() && hasScope(ctx.actor, "claim") && ctx.role !== "reader";
-}
-async function assertWorkerClaim(ctx, ticket, claimId) {
-	if (!ctx.actor.machine) return;
-	const claim = (await ctx.db.select().from(claims).where(eq(claims.ticketId, ticket.id)).limit(1))[0];
-	if (claim && (claim.id !== claimId || !ownsLiveClaim(ctx, claim))) fail(409, "claim_conflict", "An active matching claim is required for this worker write");
-	if (!claim && (claimId || ticket.claimRequired)) fail(409, "claim_conflict", "This ticket requires current ownership for worker writes");
-}
-function createDomain(database, services = {}) {
-	const handlers = {
-		...workspaceHandlers,
-		...projectHandlers,
-		...ticketHandlers,
-		...collaborationHandlers
-	};
-	const workspaceIsFilter = /* @__PURE__ */ new Set(["list_projects", "search_tickets"]);
-	async function execute(name, value, actor) {
-		const spec = operations[name];
-		const input = spec.input.parse(value);
-		const projectId = "projectId" in input ? input.projectId : void 0;
-		const workspaceId = "workspaceId" in input && !workspaceIsFilter.has(name) ? input.workspaceId : void 0;
-		if (actor.projectIds && spec.method !== "GET" && !projectId) fail(403, "insufficient_scope", "Project-bound credentials can only change their configured projects");
-		const invoke = async (ctx) => {
-			if (services.blobs) ctx.blobs = services.blobs;
-			if (services.search) ctx.search = services.search;
-			const handler = handlers[name];
-			return parseOutput(name, json(await handler(ctx, input)));
-		};
-		if (spec.method === "GET") return invoke(await context(database.db, actor, spec.scope, projectId, workspaceId));
-		return database.db.transaction(async (tx) => {
-			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361080)`);
-			const ctx = await context(tx, actor, spec.scope, projectId, workspaceId);
-			const requestId = "requestId" in input ? input.requestId : void 0;
-			const hash = createHash("sha256").update(JSON.stringify({
-				name,
-				input
-			})).digest("hex");
-			if (requestId) {
-				const receipt = (await tx.select().from(receipts).where(and(eq(receipts.actorId, actor.id), eq(receipts.requestId, requestId))).limit(1))[0];
-				if (receipt) {
-					if (receipt.hash !== hash || receipt.operation !== name) fail(409, "idempotency_conflict", "This requestId was already used for another write");
-					const prior = parseOutput(name, receipt.result);
-					if (name === "create_project") await context(tx, actor, "read", projectSchema.parse(prior).id);
-					if (name === "create_workspace") await requireWorkspace(ctx, workspaceSchema.parse(prior).id);
-					return prior;
-				}
-			}
-			const result = await invoke(ctx);
-			if (requestId) await tx.insert(receipts).values({
-				actorId: actor.id,
-				requestId,
-				hash,
-				operation: name,
-				result
-			});
-			return result;
-		});
-	}
-	async function resolveActor(id, credential) {
-		const row = one(await database.db.select().from(user).where(eq(user.id, id)).limit(1));
-		if (row.banned) fail(403, "account_disabled", "This account is disabled");
-		return {
-			id,
-			admin: hasAdminRole(row.role),
-			machine: !!credential,
-			ownerId: credential?.ownerId ?? id,
-			scopes: credential?.scopes ?? scopes,
-			...credential?.projectIds ? { projectIds: credential.projectIds } : {}
-		};
-	}
-	async function accessibleProjects(identity) {
-		return accessibleProjectRows(database.db, identity);
-	}
-	async function readEvents(identity, cursor, projectId) {
-		if (!hasScope(identity, "read")) fail(403, "insufficient_scope", "Read permission is required");
-		const ids = (await accessibleProjects(identity)).filter((row) => !projectId || row.id === projectId || row.key === projectId.toUpperCase()).map((row) => row.id);
-		if (projectId && !ids.length) fail(404, "not_found", "Project was not found");
-		const clock = one(await database.db.select().from(eventClock).where(eq(eventClock.id, 1)));
-		if (cursor < clock.floor || cursor > clock.value) fail(410, "snapshot_required", "Fetch a fresh snapshot before reconnecting", { cursor: clock.value.toString() });
-		const rows = ids.length ? await database.db.select().from(events).where(and(inArray(events.projectId, ids), gt(events.id, cursor))).orderBy(asc(events.id)).limit(200) : [];
-		const last = rows.at(-1)?.id ?? cursor;
-		return {
-			items: rows,
-			cursor: rows.length === 200 || last > clock.value ? last : clock.value
-		};
-	}
-	async function snapshot(identity, identifier) {
-		return database.db.transaction(async (tx) => {
-			const ctx = await context(tx, identity, "read", identifier);
-			const clock = one(await tx.select().from(eventClock).where(eq(eventClock.id, 1)));
-			const rows = await tx.select().from(tickets).where(eq(tickets.projectId, project(ctx).id)).orderBy(asc(tickets.number));
-			return snapshotSchema.parse(json({
-				project: project(ctx),
-				tickets: rows,
-				cursor: clock.value.toString()
-			}));
-		}, {
-			isolationLevel: "repeatable read",
-			accessMode: "read only"
-		});
-	}
-	return {
-		execute,
-		actor: resolveActor,
-		accessibleProjects,
-		readEvents,
-		snapshot,
-		database
-	};
-}
-//#endregion
-//#region src/instance.ts
-function storageIdentity(settings) {
-	return createHash("sha256").update(JSON.stringify([
-		settings.endpoint,
-		settings.region,
-		settings.bucket,
-		settings.prefix,
-		settings.forcePathStyle
-	])).digest("hex");
-}
-function createInstance(database, config) {
-	const key = createHash("sha256").update("kanvil:instance-config:v1:").update(config.BETTER_AUTH_SECRET).digest();
-	function seal(value) {
-		const iv = randomBytes(12), cipher = createCipheriv("aes-256-gcm", key, iv);
-		const bytes = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);
-		return Buffer.concat([
-			iv,
-			cipher.getAuthTag(),
-			bytes
-		]).toString("base64");
-	}
-	function unseal(value) {
-		try {
-			const bytes = Buffer.from(value, "base64"), decipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(0, 12));
-			decipher.setAuthTag(bytes.subarray(12, 28));
-			return JSON.parse(Buffer.concat([decipher.update(bytes.subarray(28)), decipher.final()]).toString());
-		} catch {
-			return fail(503, "configuration_key_changed", "Saved integration credentials cannot be decrypted. Restore the instance secret from your backup.");
-		}
-	}
-	async function read(db = database.db) {
-		await db.insert(instanceSettings).values({ id: 1 }).onConflictDoNothing();
-		return one(await db.select().from(instanceSettings).where(eq(instanceSettings.id, 1)));
-	}
-	async function backend(id, db = database.db) {
-		const row = one(await db.select().from(storageBackends).where(eq(storageBackends.id, id)));
-		const settings = s3SettingsSchema.parse(unseal(row.config));
-		return {
-			...row,
-			settings,
-			spec: {
-				provider: "s3",
-				config: settings
-			}
-		};
-	}
-	async function resolveS3(settings, db = database.db) {
-		settings = s3SettingsSchema.strip().parse(settings);
-		const identity = storageIdentity(settings);
-		const previous = (await db.select().from(storageBackends).where(eq(storageBackends.identity, identity)))[0];
-		const old = previous ? s3SettingsSchema.parse(unseal(previous.config)) : void 0;
-		const { secretAccessKey: suppliedSecret, ...publicSettings } = settings, secret = suppliedSecret || (old?.accessKeyId === settings.accessKeyId ? old.secretAccessKey : void 0);
-		if (settings.accessKeyId && !secret) fail(400, "missing_secret", "Provide the S3 secret access key");
-		return {
-			...publicSettings,
-			...secret ? { secretAccessKey: secret } : {}
-		};
-	}
-	async function resolveSearch(settings, db = database.db) {
-		settings = searchSettingsSchema.strip().parse(settings);
-		const row = await read(db), old = row.searchConfig ? searchSettingsSchema.parse(unseal(row.searchConfig)) : null, same = old?.url === settings.url && old.index === settings.index;
-		const { apiKey: suppliedKey, password: suppliedPassword, auth: requestedAuth, ...publicSettings } = settings, auth = requestedAuth ?? (suppliedKey ? "apiKey" : suppliedPassword && settings.username ? "basic" : same && old ? searchAuthentication(old) : searchAuthentication(settings)), apiKey = suppliedKey || (same ? old?.apiKey : void 0), password = suppliedPassword || (same && old?.username === settings.username ? old?.password : void 0);
-		if (auth === "apiKey" && !apiKey) fail(400, "missing_secret", "Provide the search API key");
-		if (auth === "basic" && (!settings.username || !password)) fail(400, "missing_secret", "Provide the search username and password");
-		return {
-			...publicSettings,
-			auth,
-			...auth === "apiKey" && apiKey ? { apiKey } : {},
-			...auth === "basic" && password ? { password } : {}
-		};
-	}
-	async function saveBackend(settings, db = database.db) {
-		const complete = await resolveS3(settings, db), identity = storageIdentity(settings);
-		return one(await db.insert(storageBackends).values({
-			identity,
-			config: seal(complete)
-		}).onConflictDoUpdate({
-			target: storageBackends.identity,
-			set: { config: seal(complete) }
-		}).returning());
-	}
-	async function storage() {
-		if (config.KANVIL_STORAGE_PROVIDER === "local") return null;
-		if (config.KANVIL_STORAGE_PROVIDER === "s3") return saveBackend(s3SettingsSchema.parse({
-			endpoint: config.S3_ENDPOINT ?? "",
-			region: config.S3_REGION,
-			bucket: config.S3_BUCKET,
-			prefix: config.S3_PREFIX,
-			forcePathStyle: config.S3_FORCE_PATH_STYLE,
-			accessKeyId: config.S3_ACCESS_KEY_ID ?? "",
-			secretAccessKey: config.S3_SECRET_ACCESS_KEY
-		}));
-		const row = await read();
-		return row.storageBackendId ? backend(row.storageBackendId) : null;
-	}
-	async function search() {
-		const row = await read();
-		if (config.KANVIL_SEARCH_PROVIDER === "postgres") return null;
-		if (config.KANVIL_SEARCH_PROVIDER === "elasticsearch") {
-			const settings = searchSettingsSchema.parse({
-				url: config.ELASTICSEARCH_URL,
-				index: config.ELASTICSEARCH_INDEX ?? `kanvil-${row.identity}`,
-				auth: config.ELASTICSEARCH_AUTH,
-				apiKey: config.ELASTICSEARCH_API_KEY,
-				username: config.ELASTICSEARCH_USERNAME,
-				password: config.ELASTICSEARCH_PASSWORD
-			});
-			return {
-				...settings,
-				auth: searchAuthentication(settings)
-			};
-		}
-		const settings = row.searchConfig ? searchSettingsSchema.parse(unseal(row.searchConfig)) : null;
-		return settings ? {
-			...settings,
-			auth: searchAuthentication(settings)
-		} : null;
-	}
-	async function broker() {
-		if (config.KANVIL_BROKER_PROVIDER === "postgres") return null;
-		if (config.KANVIL_BROKER_PROVIDER === "rabbitmq") return brokerSettingsSchema.parse({
-			url: config.RABBITMQ_URL,
-			exchange: config.RABBITMQ_EXCHANGE
-		});
-		const row = await read();
-		return row.brokerConfig ? brokerSettingsSchema.parse(unseal(row.brokerConfig)) : null;
-	}
-	async function resolveBroker(settings, db = database.db) {
-		settings = brokerSettingsSchema.strip().parse(settings);
-		const row = await read(db), old = row.brokerConfig ? brokerSettingsSchema.parse(unseal(row.brokerConfig)) : null;
-		const url = settings.url || old?.url;
-		if (!url) return fail(400, "missing_secret", "Provide the RabbitMQ connection URL");
-		return {
-			...settings,
-			url
-		};
-	}
-	async function authentication() {
-		return authenticationPolicySchema.strip().parse(await read());
-	}
-	async function update(value, actorId, oidcIssuer) {
-		const input = instanceUpdateSchema.parse(value);
-		return database.db.transaction(async (tx) => {
-			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361083)`);
-			const current = await read(tx);
-			assertVersion(current, input.expectedVersion, "instance settings", "saving");
-			if (input.authentication && !input.authentication.emailPasswordEnabled) {
-				if (!config.OIDC_DISCOVERY_URL || !config.OIDC_CLIENT_ID || !config.OIDC_CLIENT_SECRET) fail(409, "oidc_required", "Configure an OIDC provider before disabling password sign-in");
-				if (!(actorId ? await tx.select({
-					idToken: account.idToken,
-					accountId: account.accountId
-				}).from(account).where(and(eq(account.userId, actorId), eq(account.providerId, "oidc"))) : []).some((binding) => matchesOIDCBinding(binding, oidcIssuer, config.OIDC_CLIENT_ID))) fail(409, "oidc_binding_required", "Link your OIDC account in User settings using the configured provider before disabling password sign-in");
-			}
-			let storageId = current.storageBackendId, searchConfig = current.searchConfig, brokerConfig = current.brokerConfig;
-			if (!config.KANVIL_STORAGE_PROVIDER) storageId = input.storage.provider === "s3" ? (await saveBackend(input.storage, tx)).id : null;
-			if (!config.KANVIL_SEARCH_PROVIDER) {
-				if (input.search.provider === "postgres") searchConfig = null;
-				else searchConfig = seal(await resolveSearch(input.search, tx));
-			}
-			if (!config.KANVIL_BROKER_PROVIDER && input.broker) brokerConfig = input.broker.provider === "postgres" ? null : seal(await resolveBroker(input.broker, tx));
-			await tx.update(instanceSettings).set({
-				...input.authentication,
-				name: input.name,
-				description: input.description,
-				storageBackendId: storageId,
-				searchConfig,
-				brokerConfig,
-				version: current.version + 1
-			}).where(eq(instanceSettings.id, 1));
-		});
-	}
-	return {
-		read,
-		authentication,
-		storage,
-		search,
-		backend,
-		saveBackend,
-		resolveS3,
-		resolveSearch,
-		broker,
-		resolveBroker,
-		update,
-		config
-	};
-}
-//#endregion
-//#region src/auth.ts
-function createAuth(database, config) {
-	const instance = createInstance(database, config);
-	return betterAuth({
-		appName: "Kanvil",
-		baseURL: config.KANVIL_URL,
-		secret: config.BETTER_AUTH_SECRET,
-		database: drizzleAdapter(database.db, {
-			provider: "pg",
-			schema: auth_schema_exports,
-			transaction: true
-		}),
-		trustedOrigins: config.trustedOrigins,
-		emailAndPassword: {
-			enabled: true,
-			disableSignUp: true,
-			minPasswordLength: 12
-		},
-		account: { accountLinking: {
-			enabled: true,
-			disableImplicitLinking: true,
-			allowDifferentEmails: true
-		} },
-		onAPIError: { errorURL: `${config.KANVIL_URL}/login` },
-		hooks: { before: createAuthMiddleware(async (ctx) => {
-			if (ctx.path === "/sign-in/email" && !(await instance.authentication()).emailPasswordEnabled) throw new APIError("FORBIDDEN", {
-				code: "password_sign_in_disabled",
-				message: "Use your identity provider to sign in"
-			});
-		}) },
-		user: { validateUserInfo: async ({ user, source }) => {
-			if (source.method !== "oauth") return void 0;
-			if (source.oauth?.providerId !== "oidc" || !user.email || user.emailVerified !== true) return {
-				error: "email_not_verified",
-				errorDescription: "The identity provider must verify your email address"
-			};
-			if (source.action === "create-user" && !(await instance.authentication()).ssoAutoProvision) return {
-				error: "signup_disabled",
-				errorDescription: "Ask an administrator to create and link your account"
-			};
-		} },
-		telemetry: { enabled: false },
-		plugins: [
-			admin(),
-			apiKey({
-				defaultPrefix: "kv_",
-				enableMetadata: true,
-				maximumNameLength: 100,
-				keyExpiration: {
-					minExpiresIn: 1 / 24,
-					maxExpiresIn: 365
-				}
-			}),
-			expo(),
-			jwt(),
-			mcp({
-				loginPage: "/login",
-				consentPage: "/authorize",
-				resource: `${config.KANVIL_URL}/mcp`,
-				scopes: [
-					"openid",
-					"profile",
-					"offline_access",
-					"kanvil:read",
-					"kanvil:write",
-					"kanvil:claim",
-					"kanvil:admin"
-				]
-			}),
-			cimd({
-				fetchClientMetadataResource,
-				metadataProfile: "mcp-2026-07-28"
-			}),
-			genericOAuth({ config: config.OIDC_DISCOVERY_URL && config.OIDC_CLIENT_ID && config.OIDC_CLIENT_SECRET ? [{
-				providerId: "oidc",
-				discoveryUrl: config.OIDC_DISCOVERY_URL,
-				requireIdTokenVerification: true,
-				getUserInfo: createOIDCUserInfo(config),
-				clientId: config.OIDC_CLIENT_ID,
-				clientSecret: config.OIDC_CLIENT_SECRET,
-				scopes: [
-					"openid",
-					"profile",
-					"email"
-				],
-				pkce: true,
-				disableSignUp: false
-			}] : [] })
-		]
-	});
-}
-//#endregion
-export { pushDevices as A, memberSchema as B, instanceSettings as C, profilePhotos as D, notifications as E, workspaces as F, pushDeviceInput as G, notificationPreferencesSchema as H, ApiError as I, matchesOIDCBinding as J, roles as K, errorSchema as L, subscriptions as M, tickets as N, projects as O, workspaceMembers as P, hasAdminRole as R, events as S, notificationPreferences as T, okSchema as U, notificationPreferencesInput as V, operations as W, attachmentContent as _, fail as a, deliveryCheckpoints as b, requireRow as c, createTicketIndex as d, createBlobStorage as f, createPollingJob as g, createObjectStore as h, createDomain as i, storageBackends as j, pushDeliveries as k, projectRoleSQL as l, imageResponse as m, createInstance as n, json as o, decodeImage as p, scopes as q, assertVersion as r, one as s, createAuth as t, createTicketSearch as u, attachments as v, members as w, eventClock as x, blobObjects as y, isOperation as z };