@maudecode/kanvil 0.4.3 → 0.5.0

package/apps/server/dist/{auth-CnAQzKyq.mjs → auth-Cs_whzgk.mjs}

@@ -1,5 +1,5 @@
-import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-DOT1SDQO.mjs";
-import { $ as permissionLabels, A as hasAdminRole, At as workspaceSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, J as operationPermission, Lt as s3SettingsSchema, Mt as authenticationPolicySchema, N as importSecretFields, Nt as brokerSettingsSchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as instanceUpdateSchema, Q as parsePublicOutput, Rt as searchAuthentication, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, k as formatEvent, kt as workflowOrder, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchSettingsSchema } from "./src-VxR5jZiK.mjs";
+import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-DKuNQY5b.mjs";
+import { $ as permissionLabels, A as hasAdminRole, At as workflowOrder, Bt as searchSettingsSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, Ft as instanceUpdateSchema, J as operationPermission, N as importSecretFields, Nt as authenticationPolicySchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as brokerSettingsSchema, Q as parsePublicOutput, Rt as s3SettingsSchema, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, jt as workspaceSchema, k as formatEvent, kt as ticketSummarySchema, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchAuthentication } from "./src-DptOUNRd.mjs";
 import { and, asc, count, desc, eq, getTableColumns, gt, ilike, inArray, isNotNull, isNull, lt, lte, ne, notInArray, or, sql } from "drizzle-orm";
 import { alias, bigint, boolean, check, customType, foreignKey, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unionAll, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 import { z } from "zod";
@@ -15,6 +15,7 @@ import { request as request$1 } from "node:https";
 import { BlockList, isIP } from "node:net";
 import nodemailer from "nodemailer";
 import { APIError, createAuthMiddleware } from "better-auth/api";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { betterAuth } from "better-auth";
 import { admin, genericOAuth, jwt } from "better-auth/plugins";
 import { emailOTP } from "better-auth/plugins/email-otp";
@@ -769,7 +770,7 @@ function createBlobStorage(database, instance, factory = createObjectStore, sche
 					skipLocked: true
 				});
 				for (const row of rows) {
-					const backend = await instance.backend(requireRow(row.backendId ?? void 0)), key = requireRow(row.objectKey ?? void 0), bytes = requireRow(row.data ?? void 0);
+					const backend = await instance.backend(requireRow(row.backendId ?? void 0), tx), key = requireRow(row.objectKey ?? void 0), bytes = requireRow(row.data ?? void 0);
 					await transfer(backend.spec, async (store) => {
 						await store.put(key, bytes, row.contentType);
 						const verified = await store.get(key, row.size);
@@ -818,7 +819,7 @@ function createBlobStorage(database, instance, factory = createObjectStore, sche
 			});
 			for (const { object } of rows) {
 				if (object.backendId && object.objectKey) {
-					const backend = await instance.backend(object.backendId), key = object.objectKey;
+					const backend = await instance.backend(object.backendId, tx), key = object.objectKey;
 					await transfer(backend.spec, (store) => store.remove(key));
 				}
 				await tx.delete(blobObjects).where(eq(blobObjects.id, object.id));
@@ -872,6 +873,14 @@ function imageResponse(blob) {
 }
 //#endregion
 //#region src/adapters/elasticsearch.ts
+const fields$1 = [
+	"title^3",
+	"key^3",
+	"description",
+	"acceptanceCriteria",
+	"labels",
+	"scopes"
+];
 function fail$1(_status, _code, message) {
 	throw new Error(message);
 }
@@ -970,37 +979,44 @@ function createElasticsearchIndex(configuration) {
 			let scrollId;
 			try {
 				const found = [];
+				let score;
 				let response = await accepted(await call$1(settings, `${settings.index}/_search?scroll=1m`, {
 					method: "POST",
 					body: JSON.stringify({
 						size: 1e3,
 						_source: false,
-						sort: ["_doc"],
 						query: { bool: {
 							filter: [{ terms: { projectId: [...projectIds] } }, { term: { instanceId: identity } }],
-							must: [{ multi_match: {
-								query,
-								fields: [
-									"title^3",
-									"key^3",
-									"description",
-									"acceptanceCriteria",
-									"labels",
-									"scopes"
-								],
+							must: [...query.terms ? [{ multi_match: {
+								query: query.terms,
+								fields: fields$1,
 								operator: "and",
 								fuzziness: "AUTO"
-							} }]
+							} }] : [], ...query.phrases.map((phrase) => ({ multi_match: {
+								query: phrase,
+								fields: fields$1,
+								type: "phrase"
+							} }))]
 						} }
 					})
 				}));
 				for (;;) {
 					const result = z.object({
 						_scroll_id: z.string().optional(),
-						hits: z.object({ hits: z.array(z.object({ _id: z.uuid() })) })
+						hits: z.object({ hits: z.array(z.object({
+							_id: z.uuid(),
+							_score: z.number()
+						})) })
 					}).parse(await response.json());
 					scrollId = result["_scroll_id"] ?? scrollId;
-					found.push(...result.hits.hits.map((hit) => hit["_id"]));
+					for (const hit of result.hits.hits) {
+						const rank = (found.at(-1)?.rank ?? 0) + (score === hit["_score"] ? 0 : 1);
+						score = hit["_score"];
+						found.push({
+							id: hit["_id"],
+							rank
+						});
+					}
 					if (found.length > 1e4) throw new Error("External search unavailable");
 					if (!result.hits.hits.length || !scrollId) break;
 					response = await accepted(await call$1(settings, "_search/scroll", {
@@ -1034,12 +1050,32 @@ const createTicketIndex = (configuration) => {
 //#endregion
 //#region src/search.ts
 const likePattern = (query) => `%${query.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_")}%`;
+function parseQuery(query) {
+	const phrases = [];
+	const terms = query.replace(/"([^"]*)"/gu, (_, phrase) => {
+		const value = phrase.replace(/\s+/gu, " ").trim();
+		if (value && phrases.length < 8 && !phrases.some((seen) => seen.toLowerCase() === value.toLowerCase())) phrases.push(value);
+		return " ";
+	}).replace(/\s+/gu, " ").trim();
+	return phrases.length || terms ? {
+		phrases,
+		terms
+	} : {
+		phrases,
+		terms: query
+	};
+}
+const querySegments = ({ phrases, terms }) => terms ? [...phrases, terms] : phrases;
 function postgresSearch(query) {
-	const value = likePattern(query);
-	return or(ilike(tickets.title, value), ilike(tickets.description, value), ilike(tickets.key, value), ilike(tickets.acceptanceCriteria, value), sql`array_to_string(${tickets.labels}, ' ') ILIKE ${value}`, sql`array_to_string(${tickets.scopes}, ' ') ILIKE ${value}`);
+	return and(...querySegments(parseQuery(query)).map((segment) => {
+		const value = likePattern(segment);
+		return or(ilike(tickets.title, value), ilike(tickets.description, value), ilike(tickets.key, value), ilike(tickets.acceptanceCriteria, value), sql`array_to_string(${tickets.labels}, ' ') ILIKE ${value}`, sql`array_to_string(${tickets.scopes}, ' ') ILIKE ${value}`);
+	}));
 }
+const postgresRank = (query) => sql`CASE WHEN ${and(...querySegments(parseQuery(query)).map((segment) => ilike(tickets.title, likePattern(segment))))} THEN 0 ELSE 1 END`;
 const builtinSearch = { where: async (_db, _ids, query) => ({
 	where: postgresSearch(query),
+	rank: postgresRank(query),
 	engine: "postgres",
 	indexing: false
 }) };
@@ -1093,6 +1129,7 @@ function createTicketSearch(database, instance, factory = createTicketIndex, sch
 		const settings = await instance.search();
 		const fallback = () => ({
 			where: postgresSearch(query),
+			rank: postgresRank(query),
 			engine: "postgres",
 			indexing: !!settings
 		});
@@ -1101,12 +1138,14 @@ function createTicketSearch(database, instance, factory = createTicketIndex, sch
 		if (!state || !clock || state.error || state.configHash !== fingerprint(settings) || state.cursor !== clock.value) return fallback();
 		const root = await instance.read();
 		try {
-			const ids = await factory({
+			const hits = await factory({
 				provider: "elasticsearch",
 				config: settings
-			}).find(root.identity, projectIds, query);
+			}).find(root.identity, projectIds, parseQuery(query));
+			const ids = hits.map((hit) => hit.id), ranks = hits.map((hit) => hit.rank);
 			return {
 				where: ids.length ? inArray(tickets.id, ids) : sql`false`,
+				rank: sql`(${`{${ranks.join(",")}}`}::int[])[array_position(${`{${ids.join(",")}}`}::uuid[], ${tickets.id})]`,
 				engine: "index",
 				indexing: false
 			};
@@ -1700,7 +1739,7 @@ async function rememberLabelColor(ctx, color) {
 async function changeLabelUsage(ctx, name, replacement) {
 	const affected = await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), sql`${name} = ANY(${tickets.labels})`));
 	const pending = [];
-	for (const ticket of affected) pending.push((await updateTicketLabelsForDefinition(ctx, {
+	for (const ticket of affected) pending.push((await updateTicketLabels(ctx, {
 		ticketId: ticket.id,
 		expectedVersion: ticket.version,
 		labels: [...new Set(replacement ? ticket.labels.map((tag) => tag === name ? replacement : tag) : ticket.labels.filter((tag) => tag !== name))]
@@ -1997,7 +2036,7 @@ async function rewriteTicketValues(ctx, fieldId, map) {
 		if (value === void 0) continue;
 		const next = map(value);
 		if (JSON.stringify(next) === JSON.stringify(value)) continue;
-		await assertWorkerClaim(ctx, ticket);
+		await assertDefinitionMigration(ctx, [ticket]);
 		const values = { ...ticket.customFields };
 		if (next === null) delete values[fieldId];
 		else values[fieldId] = next;
@@ -2254,23 +2293,17 @@ async function validateReferences(ctx, ticketId, changes) {
 }
 async function assertNoCycle(ctx, sourceId, targetId) {
 	if (sourceId === targetId) fail(409, "dependency_cycle", "A ticket cannot depend on itself");
-	const all = await ctx.db.select({
-		id: tickets.id,
-		parentId: tickets.parentId
-	}).from(tickets).where(eq(tickets.projectId, project(ctx).id));
-	const links = await ctx.db.select().from(relations$1).where(and(eq(relations$1.projectId, project(ctx).id), eq(relations$1.type, "blocks")));
-	const edges = /* @__PURE__ */ new Map();
-	const add = (from, to) => edges.set(from, [...edges.get(from) ?? [], to]);
-	for (const row of all) if (row.parentId) add(row.id, row.parentId);
-	for (const row of links) add(row.sourceId, row.targetId);
-	const pending = [targetId], visited = /* @__PURE__ */ new Set();
-	while (pending.length) {
-		const node = pending.pop();
-		if (!node || visited.has(node)) continue;
-		if (node === sourceId) fail(409, "dependency_cycle", "This relationship would create a dependency cycle");
-		visited.add(node);
-		pending.push(...edges.get(node) ?? []);
-	}
+	const { rows } = await ctx.db.execute(sql`WITH RECURSIVE reach(id) AS (
+      SELECT ${targetId}::uuid
+      UNION
+      SELECT edge.next FROM reach JOIN (
+        SELECT source_id AS id, target_id AS next FROM ${relations$1} WHERE type = 'blocks'
+        UNION ALL
+        SELECT id, parent_id FROM ${tickets} WHERE parent_id IS NOT NULL
+      ) edge ON edge.id = reach.id
+    )
+    SELECT 1 FROM reach WHERE id = ${sourceId}::uuid LIMIT 1`);
+	if (rows.length) fail(409, "dependency_cycle", "This relationship would create a dependency cycle");
 }
 async function updateTicketRow(ctx, input) {
 	const current = await getTicket(ctx, input.ticketId);
@@ -2278,12 +2311,18 @@ async function updateTicketRow(ctx, input) {
 	await assertWorkerClaim(ctx, current, input.claimId);
 	return persistTicketChanges(ctx, current, input.changes);
 }
-async function updateTicketLabelsForDefinition(ctx, input) {
+async function updateTicketLabels(ctx, input) {
 	if (!can(ctx, "project.manage") && !can(ctx, "workspace.manage")) fail(403, "forbidden", "Label administration permission is required");
 	const current = await getTicket(ctx, input.ticketId);
 	assertVersion(current, input.expectedVersion, "ticket");
 	return persistTicketChanges(ctx, current, { labels: input.labels });
 }
+async function migrateTicketRow(ctx, input) {
+	const current = await getTicket(ctx, input.ticketId);
+	assertVersion(current, input.expectedVersion, "ticket");
+	await assertDefinitionMigration(ctx, [current]);
+	return persistTicketChanges(ctx, current, input.changes);
+}
 async function persistTicketChanges(ctx, current, changes) {
 	await validateReferences(ctx, current.id, changes);
 	const state = await resolveState(ctx, changes, current);
@@ -2411,7 +2450,7 @@ async function createTicketRow(ctx, input) {
 		...fields,
 		...state,
 		...dates,
-		customFields: applyCustomFieldValues(await projectCustomFields(ctx), null, customFields),
+		customFields: intakeOnly(ctx.actor) ? {} : applyCustomFieldValues(await projectCustomFields(ctx), null, customFields),
 		...await allocateTicket(ctx),
 		id,
 		createdBy: ctx.actor.id
@@ -2458,6 +2497,20 @@ const hitRow = z.object({
 	title: z.string().nullable(),
 	status: z.enum(states).nullable()
 });
+const summarize = (ticket) => ticketSummarySchema.parse(json(ticket));
+const snippetLength = 240;
+function snippet(body, query) {
+	const text = body?.replace(/\s+/gu, " ").trim() ?? "", lower = text.toLowerCase(), parsed = parseQuery(query);
+	let at = -1, size = 0;
+	for (const needle of [...querySegments(parsed), ...parsed.terms.split(" ")]) {
+		const found = needle ? lower.indexOf(needle.toLowerCase()) : -1;
+		if (found >= 0 && (at < 0 || found < at)) [at, size] = [found, needle.length];
+	}
+	if (at < 0) return "";
+	if (text.length <= snippetLength) return text;
+	const start = Math.max(0, Math.min(at + Math.floor((size - snippetLength) / 2), text.length - snippetLength)), end = start + snippetLength;
+	return `${start > 0 ? "…" : ""}${text.slice(start > 0 ? start + 1 : start, end < text.length ? end - 1 : end)}${end < text.length ? "…" : ""}`;
+}
 function excerpt(body, query, radius = 80) {
 	const text = body?.replace(/\s+/gu, " ").trim() ?? "", at = text.toLowerCase().indexOf(query.toLowerCase());
 	if (at < 0) return "";
@@ -2475,25 +2528,29 @@ async function deleteTicketRows(ctx, selection) {
 	const ids = [...selected.keys()];
 	const [claimed] = await ctx.db.select({ ticketId: claims.ticketId }).from(claims).where(inArray(claims.ticketId, ids)).limit(1);
 	if (claimed) fail(409, "claim_conflict", "Release ownership before deleting this ticket", { ticketId: claimed.ticketId });
-	await publishMany(ctx, [...(await ctx.db.update(tickets).set({
-		parentId: null,
-		version: sql`${tickets.version} + 1`,
-		updatedAt: /* @__PURE__ */ new Date()
-	}).where(and(inArray(tickets.parentId, ids), notInArray(tickets.id, ids))).returning()).map((child) => ({
-		type: "ticket.updated",
-		ticketId: child.id,
-		data: {
-			version: child.version,
-			changedFields: ["parentId"]
-		}
-	})), ...[...selected.values()].map((ticket) => ({
-		type: "ticket.deleted",
-		ticketId: ticket.id,
-		data: {
-			key: ticket.key,
-			version: ticket.version
-		}
-	}))]);
+	await publishMany(ctx, [
+		...(await ctx.db.update(tickets).set({
+			parentId: null,
+			version: sql`${tickets.version} + 1`,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(and(inArray(tickets.parentId, ids), notInArray(tickets.id, ids))).returning()).map((child) => ({
+			type: "ticket.updated",
+			ticketId: child.id,
+			data: {
+				version: child.version,
+				changedFields: ["parentId"]
+			}
+		})),
+		...[...selected.values()].map((ticket) => ({
+			type: "ticket.deleted",
+			ticketId: ticket.id,
+			data: {
+				key: ticket.key,
+				version: ticket.version
+			}
+		})),
+		...await severedRelationEvents(ctx, ids)
+	]);
 	await ctx.db.delete(tickets).where(inArray(tickets.id, ids));
 }
 async function relocation(ctx, ticket, destinationProjectId) {
@@ -2511,6 +2568,10 @@ async function relocation(ctx, ticket, destinationProjectId) {
 		code: "claimed",
 		message: `Claimed by ${claim.workerId}; release or recover the claim first`
 	});
+	else if (ctx.actor.machine && ticket.claimRequired) blockers.push({
+		code: "claim_conflict",
+		message: "A worker needs a claim to move this ticket once it has been claimed; a person can move it, or return it to To do so a worker can claim it again"
+	});
 	const [parent] = ticket.parentId ? await ctx.db.select({
 		id: tickets.id,
 		key: tickets.key
@@ -2558,6 +2619,16 @@ async function relocation(ctx, ticket, destinationProjectId) {
 		fields
 	};
 }
+async function readableTicket(ctx, identifier) {
+	const allowed = await accessibleProjectRows(ctx.db, ctx.actor);
+	const [ticket] = allowed.length ? await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, allowed.map((row) => row.id)), ticketMatch(identifier))).limit(1) : [];
+	const owner = allowed.find((row) => row.id === ticket?.projectId);
+	if (!ticket || !owner) fail(404, "not_found", "Ticket was not found");
+	return {
+		ticket,
+		project: owner
+	};
+}
 const ticketHandlers = {
 	async list_ticket_labels(ctx, input) {
 		const labels = labelUsage(ctx, input.archived).as("usage");
@@ -2568,7 +2639,11 @@ const ticketHandlers = {
 		const related = input.relatedTo ? await getTicket(ctx, input.relatedTo) : void 0;
 		const search = input.q ? await ctx.search.where(ctx.db, [project(ctx).id], input.q) : void 0;
 		await assertCustomFieldFilters(ctx, [project(ctx).id], input);
-		return pageOf(ctx, and(eq(tickets.projectId, project(ctx).id), parent ? eq(tickets.parentId, parent.id) : void 0, related ? or(inArray(tickets.id, ctx.db.select({ id: relations$1.targetId }).from(relations$1).where(eq(relations$1.sourceId, related.id))), inArray(tickets.id, ctx.db.select({ id: relations$1.sourceId }).from(relations$1).where(eq(relations$1.targetId, related.id)))) : void 0, predicateWhere(input), input.archived === "include" ? void 0 : eq(tickets.archived, input.archived === "only"), dueWhere(input.due), input.stateId ? eq(tickets.stateId, input.stateId) : void 0, input.scheduledFrom ? sql`${scheduleEnd} >= ${input.scheduledFrom}::timestamptz` : void 0, input.scheduledTo ? sql`${scheduleStart} < ${input.scheduledTo}::timestamptz` : void 0, search?.where), ticketOrder(input), input);
+		const page = await pageOf(ctx, and(eq(tickets.projectId, project(ctx).id), parent ? eq(tickets.parentId, parent.id) : void 0, related ? or(inArray(tickets.id, ctx.db.select({ id: relations$1.targetId }).from(relations$1).where(eq(relations$1.sourceId, related.id))), inArray(tickets.id, ctx.db.select({ id: relations$1.sourceId }).from(relations$1).where(eq(relations$1.targetId, related.id)))) : void 0, predicateWhere(input), input.archived === "include" ? void 0 : eq(tickets.archived, input.archived === "only"), dueWhere(input.due), input.stateId ? eq(tickets.stateId, input.stateId) : void 0, input.scheduledFrom ? sql`${scheduleEnd} >= ${input.scheduledFrom}::timestamptz` : void 0, input.scheduledTo ? sql`${scheduleStart} < ${input.scheduledTo}::timestamptz` : void 0, search?.where), ticketOrder(input), input);
+		return input.view === "summary" ? {
+			...page,
+			items: page.items.map(summarize)
+		} : page;
 	},
 	async list_my_work(ctx, input) {
 		const allowed = await accessibleProjectRows(ctx.db, ctx.actor, input.workspaceId, "exclude");
@@ -2597,6 +2672,21 @@ const ticketHandlers = {
 		};
 	},
 	async create_ticket(ctx, input) {
+		if (intakeOnly(ctx.actor)) input = {
+			...input,
+			automationReady: false,
+			holdReason: intakeHoldReason,
+			status: "todo",
+			stateId: void 0,
+			assigneeId: null,
+			parentId: null,
+			archived: false,
+			dueAt: null,
+			startAt: null,
+			customFields: {},
+			uploads: [],
+			labels: operations.create_ticket.input.shape.labels.parse([.../* @__PURE__ */ new Set([...input.labels, "intake"])])
+		};
 		const { row, event } = await createTicketRow(ctx, input);
 		await publishMany(ctx, [event, ...(await claimStagedUploads(ctx, row.id, input.uploads)).map((item) => ({
 			type: "attachment.created",
@@ -2642,10 +2732,15 @@ const ticketHandlers = {
 				...event.data,
 				duplicateOf: source.id
 			}
-		}, ...relationEvents("relation.added", relation)]);
+		}, ...relationEvents("relation.added", relation, [row, source])]);
 		return row;
 	},
 	update_ticket: updateTicket,
+	async update_ticket_labels(ctx, input) {
+		const { row, event } = await updateTicketLabels(ctx, input);
+		await publish(ctx, event.type, event.ticketId, event.data);
+		return row;
+	},
 	async move_ticket(ctx, input) {
 		const current = await getTicket(ctx, input.ticketId);
 		assertVersion(current, input.expectedVersion, "ticket", "moving");
@@ -2686,7 +2781,6 @@ const ticketHandlers = {
 		assertVersion(current, input.expectedVersion, "ticket", "moving");
 		const { target, blockers, fields } = await relocation(ctx, current, input.destinationProjectId);
 		if (blockers.length) fail(409, "relocation_blocked", blockers.map((item) => item.message).join(". "), { blockers });
-		await assertWorkerClaim(ctx, current);
 		const state = requireRow(await resolveState(target, {
 			status: input.status ?? (input.stateId ? void 0 : z.enum(states).parse(current.status)),
 			stateId: input.stateId
@@ -2728,10 +2822,7 @@ const ticketHandlers = {
 		return row;
 	},
 	async resolve_ticket(ctx, input) {
-		const allowed = await accessibleProjectRows(ctx.db, ctx.actor);
-		const [ticket] = allowed.length ? await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, allowed.map((row) => row.id)), ticketMatch(input.ticketId))).limit(1) : [];
-		const owner = allowed.find((row) => row.id === ticket?.projectId);
-		if (!ticket || !owner) fail(404, "not_found", "Ticket was not found");
+		const { ticket, project: owner } = await readableTicket(ctx, input.ticketId);
 		return {
 			ticket,
 			project: {
@@ -2748,6 +2839,7 @@ const ticketHandlers = {
 				projectId: input.projectId,
 				ticketId: item.ticketId,
 				expectedVersion: item.expectedVersion,
+				claimId: item.claimId,
 				changes: input.changes
 			});
 			result.push(row);
@@ -2778,17 +2870,20 @@ const ticketHandlers = {
 	async search_tickets(ctx, input) {
 		const allowed = await accessibleProjectRows(ctx.db, ctx.actor, input.workspaceId, "exclude");
 		if (!allowed.length) return { items: [] };
-		const ids = allowed.map((row) => row.id);
-		return { items: (await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, ids), eq(tickets.archived, false), or(ticketMatch(input.q), (await ctx.search.where(ctx.db, ids, input.q)).where))).orderBy(sql`CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END`, desc(tickets.updatedAt)).limit(input.limit)).flatMap((ticket) => {
+		const ids = allowed.map((row) => row.id), match = await ctx.search.where(ctx.db, ids, input.q);
+		return { items: (await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, ids), eq(tickets.archived, false), or(ticketMatch(input.q), match.where))).orderBy(sql`CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END`, sql`${match.rank} NULLS LAST`, desc(tickets.updatedAt)).limit(input.limit)).flatMap((ticket) => {
 			const owner = allowed.find((row) => row.id === ticket.projectId);
-			return owner ? [{
-				ticket,
+			if (!owner) return [];
+			const summary = input.view === "summary", body = `${ticket.description} ${ticket.acceptanceCriteria}`;
+			return [{
+				ticket: summary ? summarize(ticket) : ticket,
 				project: {
 					id: owner.id,
 					key: owner.key,
 					name: owner.name
-				}
-			}] : [];
+				},
+				...summary && { snippet: snippet(body, input.q) }
+			}];
 		}) };
 	},
 	async search_workspace(ctx, input) {
@@ -2813,23 +2908,26 @@ const ticketHandlers = {
 			filtered ? void 0 : sql`SELECT 'project' AS type, projects.id::text AS id, projects.id AS project_id,
               NULL::uuid AS ticket_id, NULL::text AS actor_id, projects.description AS body,
               NULL::text AS event_type, NULL::jsonb AS data, projects.updated_at AS at,
-              CASE WHEN projects.key = ${key} THEN 0 ELSE 1 END AS rank, 0 AS family
+              CASE WHEN projects.key = ${key} THEN 0 ELSE 1 END AS rank, 0 AS family,
+              NULL::int AS score
             FROM projects WHERE ${inArray(projects.id, ids)}
               AND (projects.name ILIKE ${like} OR projects.key ILIKE ${like} OR projects.description ILIKE ${like})`,
 			sql`SELECT 'ticket' AS type, tickets.id::text AS id, tickets.project_id,
               tickets.id AS ticket_id, NULL::text AS actor_id,
               concat_ws(' ', tickets.description, tickets.acceptance_criteria) AS body,
               NULL::text AS event_type, NULL::jsonb AS data, tickets.updated_at AS at,
-              CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END AS rank, 1 AS family
+              CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END AS rank, 1 AS family,
+              ${match.rank}::int AS score
             FROM tickets WHERE ${and(ticketScope, or(ticketMatch(input.q), match.where))}`,
 			sql`SELECT 'comment' AS type, comments.id::text AS id, comments.project_id,
               comments.ticket_id, comments.actor_id, comments.body, NULL::text AS event_type,
-              NULL::jsonb AS data, comments.created_at AS at, 1 AS rank, 2 AS family
+              NULL::jsonb AS data, comments.created_at AS at, 1 AS rank, 2 AS family,
+              NULL::int AS score
             FROM comments JOIN tickets ON tickets.id = comments.ticket_id
             WHERE ${and(ticketScope, sql`comments.body ILIKE ${like}`)}`,
 			sql`SELECT 'activity' AS type, events.id::text AS id, events.project_id,
               events.ticket_id, events.actor_id, NULL::text AS body, events.type AS event_type,
-              events.data, events.created_at AS at, 1 AS rank, 3 AS family
+              events.data, events.created_at AS at, 1 AS rank, 3 AS family, NULL::int AS score
             FROM events
             LEFT JOIN tickets ON tickets.id = events.ticket_id AND tickets.project_id = events.project_id
             LEFT JOIN "user" ON "user".id = events.actor_id
@@ -2846,14 +2944,15 @@ const ticketHandlers = {
         FROM (${hits}) AS hits
         LEFT JOIN tickets ON tickets.id = hits.ticket_id AND tickets.project_id = hits.project_id
         WHERE ${input.type ? sql`hits.type = ${input.type}` : sql`true`}
-        ORDER BY hits.rank, hits.family, hits.at DESC, hits.id DESC
+        ORDER BY hits.rank, hits.family, hits.score NULLS LAST, hits.at DESC, hits.id DESC
         LIMIT ${input.limit} OFFSET ${input.offset}`)).rows.map((row) => hitRow.parse(row));
 		const projectsById = new Map(allowed.map((row) => [row.id, row]));
+		const ticketIds = rows.flatMap((row) => row.ticket_id ? [row.ticket_id] : []), summaries = input.view === "summary" && ticketIds.length ? new Map((await ctx.db.select().from(tickets).where(inArray(tickets.id, ticketIds))).map((row) => [row.id, summarize(row)])) : void 0;
 		return {
 			items: rows.flatMap((row) => {
 				const owner = projectsById.get(row.project_id);
 				if (!owner) return [];
-				const ticket = row.ticket_id && row.key && row.title && row.status ? {
+				const ticket = row.ticket_id && row.key && row.title && row.status ? summaries?.get(row.ticket_id) ?? {
 					id: row.ticket_id,
 					key: row.key,
 					title: row.title,
@@ -2879,6 +2978,7 @@ const ticketHandlers = {
 						createdAt: at
 					}, true) : ticket?.title ?? "",
 					excerpt: excerpt(row.body, input.q),
+					...input.view === "summary" && { snippet: snippet(row.body, input.q) },
 					actorId: row.actor_id,
 					at
 				}];
@@ -2950,6 +3050,16 @@ const ticketHandlers = {
 				version: row.version,
 				changedFields: ["status", "stateId"]
 			});
+		} else if (ticket.claimRequired) {
+			const row = one(await ctx.db.update(tickets).set({
+				claimRequired: false,
+				version: ticket.version + 1,
+				updatedAt: /* @__PURE__ */ new Date()
+			}).where(eq(tickets.id, ticket.id)).returning());
+			await publish(ctx, "ticket.updated", ticket.id, {
+				version: row.version,
+				changedFields: ["claimRequired"]
+			});
 		}
 		await ctx.db.delete(claims).where(eq(claims.id, current.id));
 		await publish(ctx, "claim.recovered", ticket.id, {
@@ -3234,6 +3344,13 @@ function mentionedUserIds(markdown) {
 //#region src/collaboration-operations.ts
 const sourceTicket = alias(tickets, "source_ticket");
 const targetTicket = alias(tickets, "target_ticket");
+const sourceProject = alias(projects, "source_project");
+const targetProject = alias(projects, "target_project");
+async function assertMayConstrain(ctx, relation, sides) {
+	const constrained = relation.type === "blocks" ? relation.targetId : relation.type === "duplicate" ? relation.sourceId : null;
+	const side = sides.find((item) => item.id === constrained);
+	if (side && side.projectId !== project(ctx).id) await context(ctx.db, ctx.actor, "write", side.projectId);
+}
 async function editableComment(ctx, commentId, expectedVersion) {
 	const row = one(await ctx.db.select().from(comments).where(and(eq(comments.projectId, project(ctx).id), eq(comments.id, commentId))));
 	if (row.actorId !== ctx.actor.id && !can(ctx, "project.manage")) fail(403, "forbidden", "Only the author or a project administrator can edit this comment");
@@ -3264,18 +3381,45 @@ async function addComment(ctx, input) {
 const collaborationHandlers = {
 	async list_relations(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
-		return ctx.db.select({
+		const rows = await ctx.db.select({
 			...getTableColumns(relations$1),
 			sourceKey: sourceTicket.key,
 			sourceTitle: sourceTicket.title,
+			sourceProjectId: sourceTicket.projectId,
+			sourceProjectKey: sourceProject.key,
 			targetKey: targetTicket.key,
-			targetTitle: targetTicket.title
-		}).from(relations$1).innerJoin(sourceTicket, eq(sourceTicket.id, relations$1.sourceId)).innerJoin(targetTicket, eq(targetTicket.id, relations$1.targetId)).where(and(eq(relations$1.projectId, project(ctx).id), or(eq(relations$1.sourceId, ticket.id), eq(relations$1.targetId, ticket.id))));
+			targetTitle: targetTicket.title,
+			targetProjectId: targetTicket.projectId,
+			targetProjectKey: targetProject.key
+		}).from(relations$1).innerJoin(sourceTicket, eq(sourceTicket.id, relations$1.sourceId)).innerJoin(targetTicket, eq(targetTicket.id, relations$1.targetId)).innerJoin(sourceProject, eq(sourceProject.id, sourceTicket.projectId)).innerJoin(targetProject, eq(targetProject.id, targetTicket.projectId)).where(or(eq(relations$1.sourceId, ticket.id), eq(relations$1.targetId, ticket.id)));
+		const here = project(ctx).id, elsewhere = rows.some((row) => row.sourceProjectId !== here || row.targetProjectId !== here), readable = /* @__PURE__ */ new Set([here, ...(elsewhere ? await accessibleProjectRows(ctx.db, ctx.actor) : []).map((row) => row.id)]);
+		return rows.map(({ sourceTitle, sourceProjectId, sourceProjectKey, targetTitle, targetProjectId, targetProjectKey, ...row }) => {
+			const source = readable.has(sourceProjectId), target = readable.has(targetProjectId);
+			return {
+				...row,
+				...source && {
+					sourceTitle,
+					sourceProjectId,
+					sourceProjectKey
+				},
+				...target && {
+					targetTitle,
+					targetProjectId,
+					targetProjectKey
+				},
+				restricted: !source || !target
+			};
+		});
 	},
 	async add_relation(ctx, input) {
-		const current = await getTicket(ctx, input.ticketId), other = await getTicket(ctx, input.targetId);
+		const current = await getTicket(ctx, input.ticketId), { ticket: other } = await readableTicket(ctx, input.targetId);
 		const [source, target] = input.direction === "incoming" ? [other, current] : [current, other];
 		if (source.id === target.id) fail(409, "invalid_relation", "Choose a different ticket");
+		await assertMayConstrain(ctx, {
+			type: input.type,
+			sourceId: source.id,
+			targetId: target.id
+		}, [current, other]);
 		if (input.type === "blocks") await assertNoCycle(ctx, source.id, target.id);
 		const [sourceId, targetId] = input.type === "related" ? [source.id, target.id].toSorted() : [source.id, target.id];
 		const row = one(await ctx.db.insert(relations$1).values({
@@ -3291,12 +3435,19 @@ const collaborationHandlers = {
 			],
 			set: { type: input.type }
 		}).returning());
-		await publishMany(ctx, relationEvents("relation.added", row));
+		await publishMany(ctx, relationEvents("relation.added", row, [current, other]));
 		return row;
 	},
 	async remove_relation(ctx, input) {
-		const row = one(await ctx.db.delete(relations$1).where(and(eq(relations$1.projectId, project(ctx).id), eq(relations$1.id, input.relationId))).returning());
-		await publishMany(ctx, relationEvents("relation.removed", row));
+		const found = one(await ctx.db.select().from(relations$1).where(eq(relations$1.id, input.relationId)));
+		const sides = await ctx.db.select({
+			id: tickets.id,
+			projectId: tickets.projectId
+		}).from(tickets).where(inArray(tickets.id, [found.sourceId, found.targetId]));
+		if (!sides.some((side) => side.projectId === project(ctx).id)) fail(404, "not_found", "The requested record was not found");
+		await assertMayConstrain(ctx, found, sides);
+		const row = one(await ctx.db.delete(relations$1).where(eq(relations$1.id, found.id)).returning());
+		await publishMany(ctx, relationEvents("relation.removed", row, sides));
 		return { ok: true };
 	},
 	async list_comments(ctx, input) {
@@ -3949,7 +4100,7 @@ function matches(rule, names, labels) {
 	const has = (id) => carried.has(names.get(id)?.toLowerCase() ?? "\0");
 	return rule.match === "all" ? rule.labels.every(has) : rule.labels.some(has);
 }
-const qualifies = (rules, names, link, ticket) => link.origin === "outbound" ? matches(rules.outbound, names, ticket.labels) : matches(rules.inbound, names, link.remote?.labels ?? []);
+const qualifies = (rules, names, link, ticket) => !intakeQuarantined(ticket) && (link?.origin === "inbound" ? matches(rules.inbound, names, link.remote?.labels ?? []) : matches(rules.outbound, names, ticket.labels));
 const workspaceOf = async (db, projectId) => one(await db.select({ workspaceId: projects.workspaceId }).from(projects).where(eq(projects.id, projectId))).workspaceId;
 async function setLinks(db, projectId, links, changes) {
 	if (!links.length) return [];
@@ -4011,7 +4162,7 @@ async function queueIssueSync(db, rows) {
 	for (const ticket of found) for (const connection of connections) {
 		const link = links.find((item) => item.connectionId === connection.id && item.ticketId === ticket.id), labelled = names.get(connection.id) ?? /* @__PURE__ */ new Map();
 		if (!link) {
-			if (connection.projectId === ticket.projectId && !ticket.archived && !complete(ticket.status) && matches(connection.outbound, labelled, ticket.labels)) await queueSync(db, await db.insert(issueLinks).values({
+			if (connection.projectId === ticket.projectId && !ticket.archived && !complete(ticket.status) && qualifies(connection, labelled, null, ticket)) await queueSync(db, await db.insert(issueLinks).values({
 				connectionId: connection.id,
 				ticketId: ticket.id,
 				origin: "outbound",
@@ -4032,8 +4183,9 @@ async function queueIssueSync(db, rows) {
 			state: "review",
 			reason: "labels"
 		});
-		else if (link.state === "active" && !connection.paused) {
+		else if ((link.state === "active" || link.state === "creating") && qualified && !connection.paused) {
 			await queueSync(db, [link]);
+			if (link.state !== "active") continue;
 			const fresh = commentEvents.filter((event) => event.ticketId === ticket.id && !copied.has(`${link.id}:${String(event.data.commentId)}`));
 			if (fresh.length) await db.insert(deliveries).values(fresh.map((event) => ({
 				connectionId: connection.id,
@@ -4286,6 +4438,10 @@ async function sendIssueSync(database, senders, secrets, drivers, job, event) {
 	}).from(issueLinks).innerJoin(tickets, eq(tickets.id, issueLinks.ticketId)).innerJoin(repositoryConnections, eq(repositoryConnections.id, issueLinks.connectionId)).innerJoin(projects, eq(projects.id, repositoryConnections.projectId)).where(eq(issueLinks.id, job.issueLinkId ?? "")))[0];
 	if (!loaded) return finish(database.db, job, "link_removed");
 	const { link, ticket, connection } = loaded;
+	if (intakeQuarantined(ticket)) return locked(database, async (db) => {
+		const current = (await db.select({ holdReason: tickets.holdReason }).from(tickets).where(eq(tickets.id, ticket.id)))[0];
+		if (!current || intakeQuarantined(current)) await finish(db, job, current ? "quarantined" : "link_removed");
+	});
 	const skip = connection.paused ? "paused" : !loaded.writer ? "access_revoked" : loaded.archivedAt ? "project_archived" : ticket.projectId !== connection.projectId ? "moved" : null;
 	if (skip === "access_revoked" || skip === "project_archived") return locked(database, async (db) => {
 		await finish(db, job, skip);
@@ -4500,7 +4656,7 @@ async function plan(ctx, connection, { inbound, outbound }) {
 		if (link.state === "active") (qualified ? matching : pause).push(link);
 		else if (link.state === "paused" && link.reason === "labels" && qualified) review.push(link);
 	}
-	const exported = rules.outbound.enabled ? (await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, connection.projectId), eq(tickets.archived, false), notInArray(tickets.status, [...closedStates]), notInArray(tickets.id, ctx.db.select({ id: issueLinks.ticketId }).from(issueLinks).where(eq(issueLinks.connectionId, connection.id)))))).filter((ticket) => matches(rules.outbound, names, ticket.labels)) : [];
+	const exported = rules.outbound.enabled ? (await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, connection.projectId), eq(tickets.archived, false), notInArray(tickets.status, [...closedStates]), notInArray(tickets.id, ctx.db.select({ id: issueLinks.ticketId }).from(issueLinks).where(eq(issueLinks.connectionId, connection.id)))))).filter((ticket) => qualifies(rules, names, null, ticket)) : [];
 	return {
 		matching,
 		pause,
@@ -5063,7 +5219,7 @@ const workflowHandlers = {
 		if (moving) assertNotLast(all, current, "move");
 		const siblings = all.filter((state) => state.category === next && state.id !== current.id), at = Math.min(input.position ?? (moving ? siblings.length : current.position), siblings.length);
 		const held = moving ? await ctx.db.select().from(tickets).where(eq(tickets.stateId, current.id)) : [];
-		for (const ticket of held) await assertWorkerClaim(ctx, ticket);
+		await assertDefinitionMigration(ctx, held);
 		const row = one(await ctx.db.update(workflowStates).set({
 			...input.name === void 0 ? {} : { name: input.name },
 			...input.color === void 0 ? {} : { color: input.color },
@@ -5101,8 +5257,7 @@ const workflowHandlers = {
 		assertNotLast(all, current, "delete");
 		const held = await ctx.db.select().from(tickets).where(eq(tickets.stateId, current.id));
 		const pending = [];
-		for (const ticket of held) pending.push((await updateTicketRow(ctx, {
-			projectId: project(ctx).id,
+		for (const ticket of held) pending.push((await migrateTicketRow(ctx, {
 			ticketId: ticket.id,
 			expectedVersion: ticket.version,
 			changes: { stateId: target.id }
@@ -5745,22 +5900,26 @@ async function removeProject(ctx) {
 		key: tickets.key,
 		version: tickets.version
 	}).from(tickets).where(eq(tickets.projectId, current.id)).orderBy(asc(tickets.number));
-	await recordAudience(ctx, requireRow((await publishMany(ctx, [...removed.map((ticket) => ({
-		type: "ticket.deleted",
-		ticketId: ticket.id,
-		data: {
-			key: ticket.key,
-			version: ticket.version
-		}
-	})), {
-		type: "project.deleted",
-		ticketId: null,
-		data: {
-			key: current.key,
-			name: current.name,
-			tickets: removed.length
+	await recordAudience(ctx, requireRow((await publishMany(ctx, [
+		...removed.map((ticket) => ({
+			type: "ticket.deleted",
+			ticketId: ticket.id,
+			data: {
+				key: ticket.key,
+				version: ticket.version
+			}
+		})),
+		...await severedRelationEvents(ctx),
+		{
+			type: "project.deleted",
+			ticketId: null,
+			data: {
+				key: current.key,
+				name: current.name,
+				tickets: removed.length
+			}
 		}
-	}], false)).at(-1)), readers.map((person) => person.userId));
+	], false)).at(-1)), readers.map((person) => person.userId));
 	await ctx.db.delete(tickets).where(eq(tickets.projectId, current.id));
 	await ctx.db.delete(stagedUploads).where(eq(stagedUploads.projectId, current.id));
 	await ctx.db.delete(projectLabels).where(eq(projectLabels.projectId, current.id));
@@ -5997,7 +6156,8 @@ const timeEntryHandlers = {
 //#region src/public-operations.ts
 const listTickets = async (ctx, input) => parseOutput("list_tickets", json(await ticketHandlers.list_tickets(ctx, operations.list_tickets.input.parse({
 	...input,
-	projectId: project(ctx).id
+	projectId: project(ctx).id,
+	view: "full"
 }))));
 async function published(ctx, ids) {
 	if (!ids.length) return /* @__PURE__ */ new Set();
@@ -6739,6 +6899,36 @@ function requireRecentSignIn(actor, message) {
 function fail(status, code, message, details) {
 	throw new ApiError(status, code, message, details);
 }
+function errorEnvelope(error) {
+	if (error instanceof ApiError) return {
+		status: error.status,
+		body: { error: {
+			status: error.status,
+			code: error.code,
+			message: error.message,
+			details: error.details
+		} }
+	};
+	if (error instanceof z.ZodError) return {
+		status: 400,
+		body: { error: {
+			code: "validation_error",
+			message: "Invalid request",
+			details: error.issues.map((issue) => ({
+				path: issue.path.join("."),
+				message: issue.message
+			}))
+		} }
+	};
+	console.error("Kanvil request failed", { name: error instanceof Error ? error.name : typeof error });
+	return {
+		status: 500,
+		body: { error: {
+			code: "internal_error",
+			message: "The request could not be completed"
+		} }
+	};
+}
 function requireRow(row) {
 	if (!row) fail(404, "not_found", "The requested record was not found");
 	return row;
@@ -6770,7 +6960,13 @@ function json(value) {
 	return JSON.parse(JSON.stringify(value, (_, item) => typeof item === "bigint" ? item.toString() : item));
 }
 const complete = (status) => closedStates.some((closed) => closed === status);
-const hasScope = (actor, scope) => actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.length > 0;
+const intakeHoldReason = "Untrusted intake: human triage required";
+const intakeQuarantined = (ticket) => ticket.holdReason === intakeHoldReason;
+const intakeOnly = (actor) => actor.scopes.length > 0 && actor.scopes.every((scope) => scope === "intake");
+const hasScope = (actor, scope, operation) => intakeOnly(actor) ? operation === "create_ticket" : actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.some((value) => value !== "intake");
+function requireScope(actor, scope, operation) {
+	if (!hasScope(actor, scope, operation)) fail(403, "insufficient_scope", `This credential requires ${scope} permission`);
+}
 const capabilities = (actor, granted) => granted.filter((permission) => hasScope(actor, permissionScope(permission)));
 const can = (ctx, permission) => capabilities(ctx.actor, ctx.permissions).includes(permission);
 function requirePermission(granted, permission, where) {
@@ -6821,8 +7017,8 @@ function ticketMatch(identifier) {
 	const key = identifier.toUpperCase(), [, prefix, number] = issuedKey.exec(key) ?? [];
 	return or(sql`${tickets.id}::text = ${identifier}`, eq(tickets.key, key), sql`${tickets.id} IN (SELECT ta.ticket_id FROM ${ticketAliases} ta WHERE ta.key = ${key})`, prefix && number ? and(eq(tickets.number, Number(number)), sql`${tickets.projectId} IN (SELECT pp.project_id FROM ${projectPrefixes} pp WHERE pp.prefix = ${prefix})`) : void 0);
 }
-async function context(db, actor, scope, projectId, workspaceId, permission = scope === "read" ? null : scope === "admin" ? "project.manage" : "ticket.write") {
-	if (!hasScope(actor, scope)) fail(403, "insufficient_scope", `This credential requires ${scope} permission`);
+async function context(db, actor, scope, projectId, workspaceId, permission = scope === "read" ? null : scope === "admin" ? "project.manage" : "ticket.write", operation) {
+	requireScope(actor, scope, operation);
 	const ctx = baseContext(db, actor);
 	if (workspaceId) {
 		const access = await requireWorkspace(ctx, workspaceId, permission);
@@ -6998,11 +7194,26 @@ async function publish(ctx, type, ticketId, data) {
 		data
 	}]));
 }
-const relationEvents = (type, relation) => [relation.sourceId, relation.targetId].map((ticketId) => ({
+const relationEvents = (type, relation, sides) => [relation.sourceId, relation.targetId].map((ticketId) => ({
 	type,
 	ticketId,
-	data: { relation }
+	data: { relation },
+	projectId: requireRow(sides.find((side) => side.id === ticketId)).projectId
 }));
+const deletedSide = alias(tickets, "deleted_side");
+const survivingSide = alias(tickets, "surviving_side");
+async function severedRelationEvents(ctx, ticketIds) {
+	return (await ctx.db.select({
+		relation: relations$1,
+		ticketId: survivingSide.id,
+		projectId: survivingSide.projectId
+	}).from(relations$1).innerJoin(deletedSide, or(eq(deletedSide.id, relations$1.sourceId), eq(deletedSide.id, relations$1.targetId))).innerJoin(survivingSide, or(eq(survivingSide.id, relations$1.sourceId), eq(survivingSide.id, relations$1.targetId))).where(and(ticketIds ? inArray(deletedSide.id, [...ticketIds]) : eq(deletedSide.projectId, project(ctx).id), ne(survivingSide.projectId, project(ctx).id)))).map(({ relation, ticketId, projectId }) => ({
+		type: "relation.removed",
+		ticketId,
+		projectId,
+		data: { relation }
+	}));
+}
 function ownsLiveClaim(ctx, claim) {
 	return claim.ownerId === ctx.actor.ownerId && claim.expiresAt > /* @__PURE__ */ new Date() && hasScope(ctx.actor, "claim") && ctx.permissions.includes("ticket.write");
 }
@@ -7012,6 +7223,11 @@ async function assertWorkerClaim(ctx, ticket, claimId) {
 	if (claim && (claim.id !== claimId || !ownsLiveClaim(ctx, claim))) fail(409, "claim_conflict", "An active matching claim is required for this worker write");
 	if (!claim && (claimId || ticket.claimRequired)) fail(409, "claim_conflict", "This ticket requires current ownership for worker writes");
 }
+async function assertDefinitionMigration(ctx, affected) {
+	if (!can(ctx, "project.manage")) fail(403, "forbidden", "Project administration permission is required");
+	if (!ctx.actor.machine || !affected.length) return;
+	if ((await ctx.db.select({ id: claims.id }).from(claims).where(inArray(claims.ticketId, affected.map((ticket) => ticket.id))).limit(1)).length) fail(409, "claim_conflict", "A claimed ticket blocks this definition change");
+}
 function createDomain(database, services = {}) {
 	const handlers = {
 		...workspaceHandlers,
@@ -7089,6 +7305,7 @@ function createDomain(database, services = {}) {
 		const input = spec.input.parse(value);
 		const projectId = "projectId" in input ? input.projectId : void 0;
 		const workspaceId = "workspaceId" in input && !workspaceIsFilter.has(name) ? input.workspaceId : void 0;
+		if (intakeOnly(actor)) requireScope(actor, spec.scope, name);
 		if (actor.machine && sessionOnly.has(name)) fail(403, "session_required", "Use a signed-in account for this action");
 		if (actor.projectIds && spec.method !== "GET" && !projectId) fail(403, "insufficient_scope", "Project-bound credentials can only change their configured projects");
 		const outgoing = [];
@@ -7102,19 +7319,20 @@ function createDomain(database, services = {}) {
 			return parseOutput(name, json(await handler(ctx, input)));
 		};
 		const permission = operationPermission(name);
-		if (spec.method === "GET" || remoteReads.has(name)) return invoke(await context(database.db, actor, spec.scope, projectId, workspaceId, permission));
+		if (spec.method === "GET" || remoteReads.has(name)) return invoke(await context(database.db, actor, spec.scope, projectId, workspaceId, permission, name));
 		const requestId = "requestId" in input ? input.requestId : void 0;
 		const reader = sourceReads[name];
-		if (reader && !(requestId && (await database.db.select({ id: receipts.requestId }).from(receipts).where(and(eq(receipts.actorId, actor.id), eq(receipts.requestId, requestId))).limit(1)).length)) read = await reader.read(withServices(await context(database.db, actor, spec.scope, projectId, workspaceId, permission)), input);
+		if (reader && !(requestId && (await database.db.select({ id: receipts.requestId }).from(receipts).where(and(eq(receipts.actorId, actor.id), eq(receipts.requestId, requestId))).limit(1)).length)) read = await reader.read(withServices(await context(database.db, actor, spec.scope, projectId, workspaceId, permission, name)), input);
 		const committed = await locked(async (tx) => {
 			const hash = createHash("sha256").update(JSON.stringify({
 				name,
-				input: reader ? reader.receipt(input) : input
+				input: reader ? reader.receipt(input) : input,
+				...intakeOnly(actor) && { intakeCredential: actor.ownerId }
 			})).digest("hex");
 			const receipt = requestId ? (await tx.select().from(receipts).where(and(eq(receipts.actorId, actor.id), eq(receipts.requestId, requestId))).limit(1))[0] : void 0;
 			if (receipt && (receipt.hash !== hash || receipt.operation !== name)) fail(409, "idempotency_conflict", "This requestId was already used for another write");
 			if (receipt && (name === "delete_project" || name === "delete_workspace")) return parseOutput(name, receipt.result);
-			const ctx = await context(tx, actor, spec.scope, projectId, workspaceId, permission);
+			const ctx = await context(tx, actor, spec.scope, projectId, workspaceId, permission, name);
 			if (receipt) {
 				if ((name === "create_time_entry" || name === "update_time_entry" || name === "delete_time_entry") && "ticketId" in input) await getTicket(ctx, input.ticketId);
 				const prior = parseOutput(name, receipt.result);
@@ -7606,6 +7824,13 @@ const googleProfileSchema = z.object({
 	picture: z.string().default("")
 });
 function createAuth(database, config) {
+	const adapter = drizzleAdapter(database.db, {
+		provider: "pg",
+		schema: auth_schema_exports,
+		transaction: true
+	});
+	const verification = new AsyncLocalStorage();
+	const consumed = () => verification.getStore()?.row ?? null;
 	const instance = createInstance(database, config);
 	const credentials = socialCredentials(config);
 	const mail = config.SMTP_URL && config.SMTP_FROM ? createMailSender(config.SMTP_URL, config.SMTP_FROM) : void 0;
@@ -7640,15 +7865,37 @@ function createAuth(database, config) {
 			disableIdTokenSignIn: true
 		};
 	};
-	return betterAuth({
+	const auth = betterAuth({
 		appName: "Kanvil",
 		baseURL: config.KANVIL_URL,
 		secret: config.BETTER_AUTH_SECRET,
-		database: drizzleAdapter(database.db, {
-			provider: "pg",
-			schema: auth_schema_exports,
-			transaction: true
-		}),
+		database: (options) => {
+			const base = adapter(options);
+			const update = async (input) => {
+				const fields = Object.keys(input.update);
+				if (input.model === "apikey" && fields.length > 0 && fields.every((field) => field === "lastRequest" || field === "updatedAt")) return await base.findOne({
+					model: input.model,
+					where: input.where
+				}) ?? consumed();
+				return base.update(input);
+			};
+			const incrementOne = async (input) => {
+				const row = await base.incrementOne(input);
+				const store = input.model === "apikey" ? verification.getStore() : void 0;
+				if (!store) return row;
+				if (row) store.row = row;
+				else if (store.row && !await base.findOne({
+					model: input.model,
+					where: input.where.filter(({ field }) => field === "id")
+				})) return store.row;
+				return row;
+			};
+			return {
+				...base,
+				update,
+				incrementOne
+			};
+		},
 		trustedOrigins: config.trustedOrigins,
 		emailAndPassword: {
 			enabled: true,
@@ -7797,6 +8044,14 @@ function createAuth(database, config) {
 			}] : [] })
 		]
 	});
+	const verifyApiKey = Object.assign((input) => verification.run({}, () => auth.api.verifyApiKey(input)), auth.api.verifyApiKey);
+	return {
+		...auth,
+		api: {
+			...auth.api,
+			verifyApiKey
+		}
+	};
 }
 //#endregion
-export { subscriptions as $, createTicketSearch as A, blobObjects as B, DeliveryError as C, requireInstanceAdmin as D, createWriteLimiter as E, stagedUploadCutoff as F, members as G, eventClock as H, createObjectStore as I, profilePhotos as J, notificationPreferences as K, createPollingJob as L, createBlobStorage as M, decodeImage as N, requireSession as O, imageResponse as P, storageBackends as Q, attachmentContent as R, deliverBatch as S, createAccess as T, events as U, deliveryCheckpoints as V, instanceSettings as W, pushDevices as X, projects as Y, stagedUploads as Z, recipientColumns as _, deliverySecrets as a, receiveRepositoryWebhook as b, ownerBlocker as c, createDomain as d, tickets as et, fail as f, reachable as g, one as h, createInstance as i, createTicketIndex as j, readCalendarFeed as k, appendEvents as l, notify as m, emailCodesAvailable as n, workspaces as nt, otherActiveAdministrator as o, json as p, notifications as q, signInProviders as r, matchesOIDCBinding as rt, ownedWorkspaces as s, createAuth as t, workspaceMembers as tt, assertVersion as u, requireRow as v, createHttpSender as w, defaultSenders as x, processImports as y, attachments as z };
+export { stagedUploads as $, requireSession as A, attachmentContent as B, defaultSenders as C, createAccess as D, createHttpSender as E, decodeImage as F, events as G, blobObjects as H, imageResponse as I, notificationPreferences as J, instanceSettings as K, stagedUploadCutoff as L, createTicketSearch as M, createTicketIndex as N, createWriteLimiter as O, createBlobStorage as P, pushDevices as Q, createObjectStore as R, receiveRepositoryWebhook as S, DeliveryError as T, deliveryCheckpoints as U, attachments as V, eventClock as W, profilePhotos as X, notifications as Y, projects as Z, one as _, deliverySecrets as a, matchesOIDCBinding as at, requireRow as b, ownerBlocker as c, createDomain as d, storageBackends as et, errorEnvelope as f, notify as g, json as h, createInstance as i, workspaces as it, readCalendarFeed as j, requireInstanceAdmin as k, appendEvents as l, intakeOnly as m, emailCodesAvailable as n, tickets as nt, otherActiveAdministrator as o, fail as p, members as q, signInProviders as r, workspaceMembers as rt, ownedWorkspaces as s, createAuth as t, subscriptions as tt, assertVersion as u, reachable as v, deliverBatch as w, processImports as x, recipientColumns as y, createPollingJob as z };