@maudecode/kanvil 0.4.3 → 0.5.0

package/apps/server/dist/client.mjs

@@ -1,4 +1,4 @@
-import { C as errorSchema, Ct as streamErrorSchema, E as eventSchema, G as notificationReadInput, H as notificationIdsInput, K as notificationsSchema, Q as parsePublicOutput, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, Z as parseOutput, a as checkpointSchema, at as publicOperations, q as okSchema, t as ApiError, yt as snapshotSchema } from "./src-VxR5jZiK.mjs";
+import { C as errorSchema, Ct as streamErrorSchema, E as eventSchema, G as notificationReadInput, H as notificationIdsInput, K as notificationsSchema, Q as parsePublicOutput, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, Z as parseOutput, a as checkpointSchema, at as publicOperations, q as okSchema, t as ApiError, yt as snapshotSchema } from "./src-DptOUNRd.mjs";
 import { z } from "zod";
 import { parseArgs } from "node:util";
 import { constants } from "node:fs";
@@ -639,7 +639,8 @@ const commands = {
 	"comment add": "add_comment",
 	"claim acquire": "claim_ticket",
 	"claim renew": "renew_claim",
-	"claim release": "release_claim"
+	"claim release": "release_claim",
+	"claim recover": "recover_claim"
 };
 const clientHelp = `Usage: kanvil <namespace> <action> [ticket-key] [options]
 ${Object.keys(commands).join("\n")}
@@ -651,7 +652,7 @@ profile list | profile remove <name> --yes
 --input <json|->       Operation input as a JSON object; - reads stdin
 --title <text>         Ticket title
 --body <markdown>      Comment body
---expected-version <n> Required version for update, delete and acquire
+--expected-version <n> Required version for update, delete, acquire and rescheduling recovery
 --changes <json>       Ticket update changes as a JSON object
 --request-id <uuid>    Reuse for a deliberate retry across invocations
 --json                Compact JSON output (default: indented JSON)

package/apps/server/dist/{config-DOT1SDQO.mjs → config-DKuNQY5b.mjs}

@@ -1,4 +1,4 @@
-import { Lt as s3SettingsSchema, Nt as brokerSettingsSchema, m as defaultClaimMaxLeaseSeconds, o as claimLeaseSecondsSchema, zt as searchSettingsSchema } from "./src-VxR5jZiK.mjs";
+import { Bt as searchSettingsSchema, Pt as brokerSettingsSchema, Rt as s3SettingsSchema, m as defaultClaimMaxLeaseSeconds, o as claimLeaseSecondsSchema } from "./src-DptOUNRd.mjs";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { relations } from "drizzle-orm";
@@ -341,12 +341,17 @@ const oauthConsentRelations = relations(oauthConsent, ({ one }) => ({
 }));
 //#endregion
 //#region src/database.ts
-function createDatabase(url) {
-	const pool = new pg.Pool({
-		connectionString: url,
-		max: 10,
-		idleTimeoutMillis: 3e4
-	});
+function poolOptions(config, role) {
+	return {
+		connectionString: config.DATABASE_URL,
+		application_name: role === "domain" ? "kanvil" : "kanvil-integration",
+		max: role === "domain" ? config.KANVIL_DATABASE_POOL_MAX : config.KANVIL_INTEGRATION_POOL_MAX,
+		idleTimeoutMillis: 3e4,
+		connectionTimeoutMillis: config.KANVIL_DATABASE_ACQUIRE_TIMEOUT_MS
+	};
+}
+function createDatabase(config, role = "domain") {
+	const pool = new pg.Pool(poolOptions(config, role));
 	pool.on("error", () => {
 		console.error("A PostgreSQL idle connection was lost; the pool will reconnect.");
 	});
@@ -360,6 +365,9 @@ function createDatabase(url) {
 const optionalEnv = (schema) => z.preprocess((value) => value === "" ? void 0 : value, schema.optional());
 const envSchema = z.object({
 	DATABASE_URL: z.url(),
+	KANVIL_DATABASE_POOL_MAX: z.coerce.number().int().min(2).max(1e3).default(10),
+	KANVIL_INTEGRATION_POOL_MAX: z.coerce.number().int().min(1).max(1e3).default(4),
+	KANVIL_DATABASE_ACQUIRE_TIMEOUT_MS: z.coerce.number().int().min(100).max(6e5).default(3e4),
 	KANVIL_STORAGE_PROVIDER: optionalEnv(z.enum(["local", "s3"])),
 	S3_ENDPOINT: optionalEnv(s3SettingsSchema.shape.endpoint),
 	S3_REGION: s3SettingsSchema.shape.region,

package/apps/server/dist/index.mjs

@@ -1,7 +1,7 @@
-import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DOT1SDQO.mjs";
-import { A as hasAdminRole, B as memberSchema, C as errorSchema, Ft as photoInputSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoResultSchema, L as isPresetColor, Lt as s3SettingsSchema, M as importProviderDefinitions, Nt as brokerSettingsSchema, Pt as instanceUpdateSchema, R as isPublicOperation, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, jt as adminInstanceSchema, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels, zt as searchSettingsSchema } from "./src-VxR5jZiK.mjs";
+import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DKuNQY5b.mjs";
+import { A as hasAdminRole, B as memberSchema, Bt as searchSettingsSchema, C as errorSchema, Ft as instanceUpdateSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoInputSchema, L as isPresetColor, Lt as photoResultSchema, M as importProviderDefinitions, Mt as adminInstanceSchema, Pt as brokerSettingsSchema, R as isPublicOperation, Rt as s3SettingsSchema, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels } from "./src-DptOUNRd.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { $ as subscriptions, A as createTicketSearch, B as blobObjects, C as DeliveryError, D as requireInstanceAdmin, E as createWriteLimiter, F as stagedUploadCutoff, G as members, H as eventClock, I as createObjectStore, J as profilePhotos, K as notificationPreferences, L as createPollingJob, M as createBlobStorage, N as decodeImage, O as requireSession, P as imageResponse, Q as storageBackends, R as attachmentContent, S as deliverBatch, T as createAccess, U as events, V as deliveryCheckpoints, X as pushDevices, Y as projects, Z as stagedUploads, _ as recipientColumns, a as deliverySecrets, b as receiveRepositoryWebhook, c as ownerBlocker, d as createDomain, et as tickets, f as fail, g as reachable, h as one, i as createInstance, j as createTicketIndex, k as readCalendarFeed, l as appendEvents, m as notify, n as emailCodesAvailable, nt as workspaces, o as otherActiveAdministrator, p as json, q as notifications, r as signInProviders, rt as matchesOIDCBinding, s as ownedWorkspaces, t as createAuth, tt as workspaceMembers, u as assertVersion, v as requireRow, w as createHttpSender, x as defaultSenders, y as processImports, z as attachments } from "./auth-CnAQzKyq.mjs";
+import { $ as stagedUploads, A as requireSession, B as attachmentContent, C as defaultSenders, D as createAccess, E as createHttpSender, F as decodeImage, G as events, H as blobObjects, I as imageResponse, J as notificationPreferences, L as stagedUploadCutoff, M as createTicketSearch, N as createTicketIndex, O as createWriteLimiter, P as createBlobStorage, Q as pushDevices, R as createObjectStore, S as receiveRepositoryWebhook, T as DeliveryError, U as deliveryCheckpoints, V as attachments, W as eventClock, X as profilePhotos, Y as notifications, Z as projects, _ as one, a as deliverySecrets, at as matchesOIDCBinding, b as requireRow, c as ownerBlocker, d as createDomain, et as storageBackends, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaces, j as readCalendarFeed, k as requireInstanceAdmin, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as tickets, o as otherActiveAdministrator, p as fail, q as members, r as signInProviders, rt as workspaceMembers, s as ownedWorkspaces, t as createAuth, tt as subscriptions, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createPollingJob } from "./auth-Cs_whzgk.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
@@ -324,8 +324,42 @@ function createAccountAdministration(database, auth, config) {
 	};
 }
 //#endregion
+//#region src/cleanup.ts
+function createCleanup() {
+	const resources = [];
+	let closing;
+	function close() {
+		return closing ??= Promise.resolve().then(async () => {
+			const failures = [];
+			for (const resource of resources.toReversed()) try {
+				await resource.close();
+			} catch {
+				failures.push(/* @__PURE__ */ new Error(`Could not close ${resource.name}.`));
+			}
+			if (failures.length) throw new AggregateError(failures, "Resource cleanup failed.");
+		});
+	}
+	return {
+		add(name, release) {
+			resources.push({
+				name,
+				close: release
+			});
+		},
+		close,
+		async fail(error) {
+			try {
+				await close();
+			} catch (cleanupError) {
+				console.error("Startup cleanup failed.", cleanupError);
+			}
+			throw error;
+		}
+	};
+}
+//#endregion
 //#region src/version.ts
-const applicationVersion = "0.4.3";
+const applicationVersion = "0.5.0";
 //#endregion
 //#region src/realtime.ts
 async function createRealtime(config) {
@@ -334,7 +368,10 @@ async function createRealtime(config) {
 	let client, closed = false, retry;
 	async function connect() {
 		if (closed) return;
-		const connection = new pg.Client({ connectionString: config.DATABASE_URL });
+		const connection = new pg.Client({
+			connectionString: config.DATABASE_URL,
+			application_name: "kanvil-realtime"
+		});
 		client = connection;
 		const disconnected = () => {
 			if (client !== connection || closed) return;
@@ -497,8 +534,25 @@ function brokerEndpoint(settings) {
 	return `${url.protocol}//${url.host}${url.pathname}`;
 }
 async function createEventDelivery(config, instance, database, factory = createWakeupBus) {
-	const postgres = await createRealtime(config), emitter = new EventEmitter();
+	const cleanup = createCleanup();
+	try {
+		const postgres = await createRealtime(config);
+		cleanup.add("PostgreSQL realtime client", () => postgres.close());
+		return await initializeEventDelivery(instance, database, factory, postgres, cleanup);
+	} catch (error) {
+		return cleanup.fail(error);
+	}
+}
+async function initializeEventDelivery(instance, database, factory, postgres, cleanup) {
+	const emitter = new EventEmitter();
 	emitter.setMaxListeners(0);
+	cleanup.add("realtime listeners", () => {
+		try {
+			emitter.emit("close");
+		} finally {
+			emitter.removeAllListeners();
+		}
+	});
 	const identity = (await instance.read()).identity;
 	let bus, fingerprint = "", destination = "", closed = false, pending, dirty = false, error = null;
 	const wake = () => emitter.emit("change");
@@ -580,11 +634,23 @@ async function createEventDelivery(config, instance, database, factory = createW
 		if (!bus?.ready() || error) wake();
 		trigger();
 	});
+	cleanup.add("broker connection", async () => {
+		await bus?.close();
+	});
+	cleanup.add("broker worker", async () => {
+		closed = true;
+		await pending;
+	});
+	cleanup.add("PostgreSQL subscription", unsubscribe);
 	const timer = setInterval(() => {
 		if (error) wake();
 		trigger();
 	}, 1e3);
 	timer.unref();
+	cleanup.add("broker timer", () => {
+		closed = true;
+		clearInterval(timer);
+	});
 	trigger();
 	return {
 		subscribe(listener) {
@@ -631,16 +697,7 @@ async function createEventDelivery(config, instance, database, factory = createW
 				await probe.close().catch(() => {});
 			}
 		},
-		async close() {
-			closed = true;
-			clearInterval(timer);
-			unsubscribe();
-			await pending;
-			await bus?.close().catch(() => {});
-			emitter.emit("close");
-			emitter.removeAllListeners();
-			await postgres.close();
-		}
+		close: cleanup.close
 	};
 }
 //#endregion
@@ -3095,12 +3152,11 @@ function createMcp(auth, domain, access, config, limitWrite) {
 						structuredContent: { result }
 					};
 				} catch (error) {
-					if (!(error instanceof ApiError) && !(error instanceof z.ZodError)) throw error;
 					return {
 						isError: true,
 						content: [{
 							type: "text",
-							text: error instanceof ApiError ? `${error.code}: ${error.message}` : "validation_error: Invalid tool arguments"
+							text: JSON.stringify(errorEnvelope(error).body)
 						}]
 					};
 				}
@@ -3205,11 +3261,28 @@ const toPreferences = (row) => notificationPreferencesSchema.parse(row ? {
 } : {});
 const digest = (value) => createHash("sha256").update(value).digest();
 async function createApplication(database, config, overrides = {}) {
+	const cleanup = createCleanup();
 	const adapters = {
 		...defaultAdapters,
 		...overrides
 	};
-	const integrationDatabase = createDatabase(config.DATABASE_URL);
+	const jobs = (name, interval, run) => {
+		const job = adapters.jobs(name, interval, run);
+		cleanup.add(name, () => job.close());
+		return job;
+	};
+	try {
+		return await initializeApplication(database, config, {
+			...adapters,
+			jobs
+		}, cleanup);
+	} catch (error) {
+		return cleanup.fail(error);
+	}
+}
+async function initializeApplication(database, config, adapters, cleanup) {
+	const integrationDatabase = createDatabase(config, "integration");
+	cleanup.add("integration database", () => integrationDatabase.pool.end());
 	const instance = createInstance(integrationDatabase, config);
 	await instance.read();
 	const blobs = createBlobStorage(integrationDatabase, instance, adapters.objectStore, adapters.jobs), search = createTicketSearch(integrationDatabase, instance, adapters.ticketIndex, adapters.jobs);
@@ -3223,12 +3296,14 @@ async function createApplication(database, config, overrides = {}) {
 		sources: adapters.importSources(config),
 		claimMaxLeaseSeconds: config.KANVIL_CLAIM_MAX_LEASE_SECONDS
 	}), access = createAccess(auth, domain, config, database), realtime = await adapters.realtime(config, instance, integrationDatabase);
+	cleanup.add("realtime", () => realtime.close());
 	const unsubscribeJobs = realtime.subscribe(() => {
 		blobs.sync().catch(() => {});
 		search.sync().catch(() => {});
 	});
-	const outbox = adapters.jobs("outbox", 5e3, () => deliverBatch(database, config, senders, secrets, repositories));
-	const reminders = adapters.jobs("due-reminders", 6e4, () => sendDueReminders(database));
+	cleanup.add("job subscription", unsubscribeJobs);
+	adapters.jobs("outbox", 5e3, () => deliverBatch(database, config, senders, secrets, repositories));
+	adapters.jobs("due-reminders", 6e4, () => sendDueReminders(database));
 	const imports = adapters.jobs("imports", 2e3, async () => {
 		if (await processImports(domain)) imports.trigger().catch(() => {});
 	});
@@ -3256,35 +3331,16 @@ async function createApplication(database, config, overrides = {}) {
 			code: typeof error.body?.code === "string" ? error.body.code : "authentication_error",
 			message: typeof error.body?.message === "string" ? error.body.message : "Authentication request failed"
 		} }, { status: error.statusCode });
-		if (error instanceof ApiError) {
-			const retry = error.status === 429 && error.details && typeof error.details === "object" && "retryAfterSeconds" in error.details ? String(error.details.retryAfterSeconds) : void 0;
-			return Response.json({ error: {
-				status: error.status,
-				code: error.code,
-				message: error.message,
-				details: error.details
-			} }, {
-				status: error.status,
-				headers: retry ? { "Retry-After": retry } : {}
-			});
-		}
-		if (error instanceof z$1.ZodError) return Response.json({ error: {
-			code: "validation_error",
-			message: "Invalid request",
-			details: error.issues.map((issue) => ({
-				path: issue.path.join("."),
-				message: issue.message
-			}))
-		} }, { status: 400 });
 		if (error instanceof SyntaxError || error instanceof HTTPException) return Response.json({ error: {
 			code: "invalid_request",
 			message: "The request could not be parsed"
 		} }, { status: error instanceof HTTPException ? error.status : 400 });
-		console.error("Kanvil request failed", { name: error.name });
-		return Response.json({ error: {
-			code: "internal_error",
-			message: "The request could not be completed"
-		} }, { status: 500 });
+		const retry = error instanceof ApiError && error.status === 429 && error.details && typeof error.details === "object" && "retryAfterSeconds" in error.details ? String(error.details.retryAfterSeconds) : void 0;
+		const envelope = errorEnvelope(error);
+		return Response.json(envelope.body, {
+			status: envelope.status,
+			headers: retry ? { "Retry-After": retry } : {}
+		});
 	});
 	app.notFound(() => Response.json({ error: {
 		code: "not_found",
@@ -3383,6 +3439,7 @@ async function createApplication(database, config, overrides = {}) {
 	app.use("/api/v1/*", async (c, next) => {
 		access.checkOrigin(c.req.raw);
 		const actor = await access.authenticate(c.req.raw);
+		if (intakeOnly(actor) && !(c.req.method === "POST" && /^\/api\/v1\/projects\/[^/]+\/tickets$/.test(c.req.path))) fail(403, "insufficient_scope", "Intake credentials can only create tickets");
 		c.set("actor", actor);
 		if (!actor.machine && ![
 			"GET",
@@ -3757,22 +3814,13 @@ async function createApplication(database, config, overrides = {}) {
 		blobs,
 		search,
 		realtime,
-		close: async () => {
-			await imports.close();
-			unsubscribeJobs();
-			await realtime.close();
-			await search.close();
-			await blobs.close();
-			await integrationDatabase.pool.end();
-			await outbox.close();
-			await reminders.close();
-		}
+		close: cleanup.close
 	};
 }
 //#endregion
 //#region src/index.ts
 const config = readConfig();
-const database = createDatabase(config.DATABASE_URL);
+const database = createDatabase(config);
 await migrateDatabase(database);
 const application = await createApplication(database, config);
 const server = serve({

package/apps/server/dist/migrate.mjs

@@ -1,7 +1,7 @@
-import { n as createDatabase, t as readConfig } from "./config-DOT1SDQO.mjs";
+import { n as createDatabase, t as readConfig } from "./config-DKuNQY5b.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
-const database = createDatabase(readConfig().DATABASE_URL);
+const database = createDatabase(readConfig());
 try {
 	await migrateDatabase(database);
 	console.info("Kanvil database is current.");

package/apps/server/dist/recover.mjs

@@ -1,6 +1,6 @@
-import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DOT1SDQO.mjs";
-import { A as hasAdminRole } from "./src-VxR5jZiK.mjs";
-import { W as instanceSettings, f as fail, t as createAuth } from "./auth-CnAQzKyq.mjs";
+import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DKuNQY5b.mjs";
+import { A as hasAdminRole } from "./src-DptOUNRd.mjs";
+import { K as instanceSettings, p as fail, t as createAuth } from "./auth-Cs_whzgk.mjs";
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";
@@ -56,7 +56,7 @@ const password = process.stdin.isTTY ? await passwordPrompt({
 	validate: (value) => localPasswordSchema.safeParse(value).success || "Use 12 to 128 characters"
 }) : readFileSync(0, "utf8").replace(/\r?\n$/, "");
 const config = readConfig();
-const database = createDatabase(config.DATABASE_URL);
+const database = createDatabase(config);
 try {
 	await recoverLocalPassword(database, config, values.email, password, values["enable-password-sign-in"]);
 	if (values["enable-password-sign-in"]) console.info("Instance password sign-in enabled.");

package/apps/server/dist/{src-VxR5jZiK.mjs → src-DptOUNRd.mjs}

@@ -1548,6 +1548,10 @@ var en_US_default = {
 				custom: "Custom permissions"
 			},
 			permission: {
+				intake: {
+					name: "Submit reports",
+					description: "Create quarantined tickets only. Cannot read or edit tickets. Use alone."
+				},
 				read: {
 					name: "Read tickets",
 					description: "View projects, tickets, comments, and attachments."
@@ -2844,7 +2848,8 @@ const scopes = [
 	"read",
 	"write",
 	"claim",
-	"admin"
+	"admin",
+	"intake"
 ];
 const attachmentLimit = 1e7;
 const stagedUploadLifetime = 864e5;
@@ -3037,10 +3042,13 @@ function rejectConflicts(filter, context) {
 		});
 	}
 }
-const ticketSelection = z.array(z.object({
+const selectedTicket = z.object({
 	ticketId: id,
 	expectedVersion: version
-})).min(1).max(100).refine((values) => new Set(values.map((v) => v.ticketId)).size === values.length, "Tickets must be unique");
+});
+const selectionOf = (item) => z.array(item).min(1).max(100).refine((values) => new Set(values.map((v) => v.ticketId)).size === values.length, "Tickets must be unique");
+const ticketSelection = selectionOf(selectedTicket);
+const claimedTicketSelection = selectionOf(selectedTicket.extend({ claimId: z.uuid().optional() }));
 const ticketFilter = z.object({
 	q: z.string().trim().max(200).optional(),
 	...filterShape,
@@ -3257,6 +3265,26 @@ const ticketSchema = z.object({
 	createdAt: timestamp,
 	updatedAt: timestamp
 });
+const ticketSummarySchema = ticketSchema.pick({
+	id: true,
+	key: true,
+	number: true,
+	projectId: true,
+	title: true,
+	status: true,
+	stateId: true,
+	kind: true,
+	difficulty: true,
+	priority: true,
+	labels: true,
+	scopes: true,
+	archived: true,
+	automationReady: true,
+	updatedAt: true,
+	version: true
+});
+const ticketView = { view: z.enum(["summary", "full"]).default("full") };
+const ticketRow = z.union([ticketSchema, ticketSummarySchema]);
 const snapshotSchema = z.object({
 	project: projectSchema,
 	tickets: z.array(ticketSchema),
@@ -3292,8 +3320,13 @@ const relationSchema = z.object({
 	]),
 	sourceKey: z.string().optional(),
 	sourceTitle: z.string().optional(),
+	sourceProjectId: z.uuid().optional(),
+	sourceProjectKey: z.string().optional(),
 	targetKey: z.string().optional(),
-	targetTitle: z.string().optional()
+	targetTitle: z.string().optional(),
+	targetProjectId: z.uuid().optional(),
+	targetProjectKey: z.string().optional(),
+	restricted: z.boolean().optional()
 });
 const relationDirections = z.enum(["outgoing", "incoming"]);
 const relationLabel = (type, outgoing) => t(`common.relation.${type}.${outgoing ? "outgoing" : "incoming"}`);
@@ -3440,14 +3473,15 @@ const searchResultSchema = z.object({
 	type: z.enum(searchResultTypes),
 	id: z.string(),
 	project: projectRef,
-	ticket: z.object({
+	ticket: z.union([ticketSummarySchema, z.object({
 		id: z.uuid(),
 		key: z.string(),
 		title: z.string(),
 		status: z.enum(states)
-	}).nullable(),
+	})]).nullable(),
 	title: z.string(),
 	excerpt: z.string(),
+	snippet: z.string().optional(),
 	actorId: z.string().nullable(),
 	at: timestamp
 });
@@ -3789,7 +3823,7 @@ const credentialProjectsSchema = z.object({ projectIds: z.array(z.uuid()).max(1e
 const credentialInput = z.object({
 	name: z.string().trim().min(1).max(100),
 	projectIds: credentialProjectsSchema.shape.projectIds.refine((ids) => ids === null || ids.length > 0),
-	scopes: z.array(z.enum(scopes)).min(1),
+	scopes: z.array(z.enum(scopes)).min(1).refine((values) => !values.includes("intake") || values.every((value) => value === "intake"), "Intake cannot be combined with other scopes"),
 	expiresIn: z.number().int().min(3600).max(31536e3).nullable().default(7776e3)
 }).strict();
 z.object({
@@ -4364,8 +4398,9 @@ const operations = {
 		relatedTo: id.optional(),
 		stateId: z.uuid().optional(),
 		scheduledFrom: timestamp.optional(),
-		scheduledTo: timestamp.optional()
-	}).superRefine(rejectConflicts), page(ticketSchema), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination. Each property filter takes one value or a repeated list (any of them); its `Not` twin excludes values."),
+		scheduledTo: timestamp.optional(),
+		...ticketView
+	}).superRefine(rejectConflicts), page(ticketRow), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination. Each property filter takes one value or a repeated list (any of them); its `Not` twin excludes values. Double-quoted segments of `q` match as exact phrases. Pass `view: \"summary\"` when scanning results: rows then omit the description and acceptance criteria."),
 	list_ticket_labels: op(projectInput.extend({ archived: ticketFilter.shape.archived }), z.array(z.object({
 		name: z.string(),
 		count: z.number().int().nonnegative()
@@ -4489,6 +4524,11 @@ const operations = {
 		changes: ticketChanges,
 		claimId: z.uuid().optional()
 	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}", "write", "Update a ticket with optimistic concurrency. Worker completion requires its active claim. `changes.customFields` sets only the named fields; null clears one."),
+	update_ticket_labels: op(ticketInput.extend({
+		...mutation,
+		expectedVersion: version,
+		labels: tags
+	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}/labels", "admin", "Replace one ticket's labels with optimistic concurrency, for label administration and triage. Takes no worker claim and leaves any claim, ownership requirement, readiness, and every other field unchanged; ordinary edits use update_ticket. Reuse requestId when retrying this write."),
 	move_ticket: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version,
@@ -4509,16 +4549,16 @@ const operations = {
 		destinationProjectId: id,
 		status: z.enum(states).optional(),
 		stateId: z.uuid().optional()
-	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/relocate", "write", "Move a ticket to another project of the same workspace. It keeps its ID, comments, attachments, evidence, links, and followers, takes the destination's next number as its new key, and its previous key keeps resolving. A claim, a parent or children, relationships, an assignee without destination access, custom field values, or a destination field that is required without a default block the move with `relocation_blocked`; the ticket takes the destination's custom field defaults. Activity before the move stays with the original project. Reuse requestId when retrying this write."),
+	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/relocate", "write", "Move a ticket to another project of the same workspace. It keeps its ID, comments, attachments, evidence, links, and followers, takes the destination's next number as its new key, and its previous key keeps resolving. A claim (or, for a worker, a ticket that was claimed and has no claim now), a parent or children, relationships, an assignee without destination access, custom field values, or a destination field that is required without a default block the move with `relocation_blocked`; the ticket takes the destination's custom field defaults. Activity before the move stays with the original project. Reuse requestId when retrying this write."),
 	resolve_ticket: op(z.object({ ticketId: id }).strict(), z.object({
 		ticket: ticketSchema,
 		project: projectRef
 	}), "GET", "/tickets/resolve", "read", "Find a ticket by ID, current key, or any earlier key from a prefix change or a move, across every accessible project. An unknown or inaccessible ticket reads as not found."),
 	bulk_update_tickets: op(projectInput.extend({
 		...mutation,
-		tickets: ticketSelection,
+		tickets: claimedTicketSelection,
 		changes: ticketChanges
-	}).strict(), z.array(ticketSchema), "POST", "/projects/{projectId}/tickets/bulk", "write", "Apply an atomic bulk edit using each ticket's current version."),
+	}).strict(), z.array(ticketSchema), "POST", "/projects/{projectId}/tickets/bulk", "write", "Apply an atomic bulk edit using each ticket's current version. A worker passes each claimed ticket's active `claimId`."),
 	delete_ticket: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version
@@ -4530,25 +4570,28 @@ const operations = {
 	search_tickets: op(z.object({
 		q: z.string().trim().min(1).max(200),
 		workspaceId: z.uuid().optional(),
-		limit: z.coerce.number().int().min(1).max(50).default(20)
+		limit: z.coerce.number().int().min(1).max(50).default(20),
+		...ticketView
 	}).strict(), z.object({ items: z.array(z.object({
-		ticket: ticketSchema,
-		project: projectRef
-	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace."),
+		ticket: ticketRow,
+		project: projectRef,
+		snippet: z.string().optional()
+	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace. Results order by exact key match, then relevance, then recency. Double-quoted segments of `q` match as exact phrases. Pass `view: \"summary\"` when scanning results: each ticket is then a compact row and the result carries a `snippet` of the matching text."),
 	search_workspace: op(z.object({
 		q: z.string().trim().min(1).max(200),
 		workspaceId: z.uuid().optional(),
 		type: z.enum(searchResultTypes).optional(),
 		...filterShape,
 		limit: z.coerce.number().int().min(1).max(50).default(20),
-		offset: z.coerce.number().int().min(0).max(1e3).default(0)
+		offset: z.coerce.number().int().min(0).max(1e3).default(0),
+		...ticketView
 	}).strict().superRefine(rejectConflicts), z.object({
 		items: z.array(searchResultSchema),
 		total: z.number().int().nonnegative(),
 		counts: z.record(z.enum(searchResultTypes), z.number().int().nonnegative()),
 		engine: z.enum(["postgres", "index"]),
 		indexing: z.boolean()
-	}), "GET", "/search", "read", "Search accessible tickets, projects, comments, and activity by text or ticket key, optionally within one workspace or one result type. Property filters restrict results to matching tickets. Results order by exact key match, then type, then recency."),
+	}), "GET", "/search", "read", "Search accessible tickets, projects, comments, and activity by text or ticket key, optionally within one workspace or one result type. Property filters restrict results to matching tickets. Results order by exact key match, then type, then ticket relevance, then recency. Double-quoted segments of `q` match ticket text as exact phrases. Pass `view: \"summary\"` when scanning results: ticket results then carry their summary row and each result a `snippet` of the matching text."),
 	list_my_work: op(z.object({
 		workspaceId: z.uuid().optional(),
 		q: ticketFilter.shape.q,
@@ -4561,17 +4604,17 @@ const operations = {
 		ticket: ticketSchema,
 		readiness: readinessSchema
 	})), "GET", "/projects/{projectId}/eligibility", "read", "Inspect eligibility and explicit blocking reasons for open tickets."),
-	list_relations: op(ticketInput, z.array(relationSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/relations", "read", "List incoming and outgoing ticket relationships."),
+	list_relations: op(ticketInput, z.array(relationSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/relations", "read", "List incoming and outgoing ticket relationships with each side's key, title, and project. A ticket in a project the caller cannot read appears by ID and key alone, with `restricted: true`."),
 	add_relation: op(ticketInput.extend({
 		...mutation,
-		targetId: z.uuid(),
+		targetId: id,
 		type: relationSchema.shape.type,
 		direction: relationDirections.optional()
-	}).strict(), relationSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/relations", "write", "Relate tickets while rejecting dependency cycles."),
+	}).strict(), relationSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/relations", "write", "Relate a ticket to another by ID or key, in this project or any project the caller can read, while rejecting dependency cycles across projects. Blocking or marking as duplicate a ticket of another project also needs write there. Both projects' feeds record the change."),
 	remove_relation: op(projectInput.extend({
 		...mutation,
 		relationId: z.uuid()
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/relations/{relationId}", "write", "Remove a ticket relationship."),
+	}).strict(), okSchema, "DELETE", "/projects/{projectId}/relations/{relationId}", "write", "Remove a ticket relationship that names a ticket of this project."),
 	list_comments: op(ticketInput.extend(pagination), page(commentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/comments", "read", "Read ticket discussion."),
 	add_comment: op(ticketInput.extend({
 		...mutation,
@@ -4927,6 +4970,7 @@ function isOperation(name) {
 	return Object.hasOwn(operations, name);
 }
 const errorSchema = z.object({ error: z.object({
+	status: z.number().int().optional(),
 	code: z.string(),
 	message: z.string(),
 	details: z.unknown().optional()
@@ -4952,4 +4996,4 @@ function parseOutput(name, value) {
 	return operations[name].output.parse(value);
 }
 //#endregion
-export { permissionLabels as $, hasAdminRole as A, workspaceSchema as At, memberSchema as B, errorSchema as C, streamErrorSchema as Ct, filterKey as D, ticketPredicates as Dt, eventSchema as E, ticketImportSchema as Et, isHexColor as F, photoInputSchema as Ft, notificationReadInput as G, notificationIdsInput as H, isOperation as I, photoResultSchema as It, operationPermission as J, notificationsSchema as K, isPresetColor as L, s3SettingsSchema as Lt, importProviderDefinitions as M, authenticationPolicySchema as Mt, importSecretFields as N, brokerSettingsSchema as Nt, filterList as O, ticketSchema as Ot, invitationStatuses as P, instanceUpdateSchema as Pt, parsePublicOutput as Q, isPublicOperation as R, searchAuthentication as Rt, difficulties as S, states as St, eventLabels as T, ticketFilter as Tt, notificationPreferencesInput as U, mentionScheme as V, notificationPreferencesSchema as W, parseCustomFieldFilter as X, operations as Y, parseOutput as Z, deletedAccountName as _, seededPermissions as _t, checkpointSchema as a, publicOperations as at, destinationEventKeys as b, stagedUploadLifetime as bt, credentialInput as c, repositoryProviderDefinitions as ct, customFieldSchema as d, resourceProvider as dt, permissionScope as et, customFieldValue as f, roleCategory as ft, defaultWorkflow as g, searchResultTypes as gt, defaultOrder as h, scopes as ht, channelRouteAllows as i, projectSchema as it, importLimits as j, adminInstanceSchema as jt, formatEvent as k, workflowOrder as kt, credentialProjectsSchema as l, repositoryProviders as lt, defaultClaimMaxLeaseSeconds as m, roles as mt, attachmentLimit as n, priorities as nt, claimLeaseSecondsSchema as o, pushDeviceInput as ot, customFieldValueSchema as p, roleLabels as pt, okSchema as q, channelKinds as r, priorityLabels as rt, closedStates as s, remoteKinds as st, ApiError as t, permissions as tt, customFieldFilterTokens as u, repositorySecretFields as ut, deliverySecretFields as v, signInMethodLabels as vt, eventCategories as w, ticketExportFormat as wt, destinationKinds as x, stateLabels as xt, deliverySettingsSchema as y, snapshotSchema as yt, isSeededRole as z, searchSettingsSchema as zt };
+export { permissionLabels as $, hasAdminRole as A, workflowOrder as At, memberSchema as B, searchSettingsSchema as Bt, errorSchema as C, streamErrorSchema as Ct, filterKey as D, ticketPredicates as Dt, eventSchema as E, ticketImportSchema as Et, isHexColor as F, instanceUpdateSchema as Ft, notificationReadInput as G, notificationIdsInput as H, isOperation as I, photoInputSchema as It, operationPermission as J, notificationsSchema as K, isPresetColor as L, photoResultSchema as Lt, importProviderDefinitions as M, adminInstanceSchema as Mt, importSecretFields as N, authenticationPolicySchema as Nt, filterList as O, ticketSchema as Ot, invitationStatuses as P, brokerSettingsSchema as Pt, parsePublicOutput as Q, isPublicOperation as R, s3SettingsSchema as Rt, difficulties as S, states as St, eventLabels as T, ticketFilter as Tt, notificationPreferencesInput as U, mentionScheme as V, notificationPreferencesSchema as W, parseCustomFieldFilter as X, operations as Y, parseOutput as Z, deletedAccountName as _, seededPermissions as _t, checkpointSchema as a, publicOperations as at, destinationEventKeys as b, stagedUploadLifetime as bt, credentialInput as c, repositoryProviderDefinitions as ct, customFieldSchema as d, resourceProvider as dt, permissionScope as et, customFieldValue as f, roleCategory as ft, defaultWorkflow as g, searchResultTypes as gt, defaultOrder as h, scopes as ht, channelRouteAllows as i, projectSchema as it, importLimits as j, workspaceSchema as jt, formatEvent as k, ticketSummarySchema as kt, credentialProjectsSchema as l, repositoryProviders as lt, defaultClaimMaxLeaseSeconds as m, roles as mt, attachmentLimit as n, priorities as nt, claimLeaseSecondsSchema as o, pushDeviceInput as ot, customFieldValueSchema as p, roleLabels as pt, okSchema as q, channelKinds as r, priorityLabels as rt, closedStates as s, remoteKinds as st, ApiError as t, permissions as tt, customFieldFilterTokens as u, repositorySecretFields as ut, deliverySecretFields as v, signInMethodLabels as vt, eventCategories as w, ticketExportFormat as wt, destinationKinds as x, stateLabels as xt, deliverySettingsSchema as y, snapshotSchema as yt, isSeededRole as z, searchAuthentication as zt };

package/apps/web/dist/assets/{CompositeItem-B5Qlh5m0.js → CompositeItem-CXqewtEL.js}

@@ -1 +1 @@
-import{Ga as e,_a as t,ba as n,ya as r}from"./search-B3-w3oCd.js";import{i}from"./forms-BbWAl0BZ.js";var a={name:`chevrons-up-down`,size:24,node:[[`path`,{d:`m7 15 5 5 5-5`,key:`1hf1tw`}],[`path`,{d:`m7 9 5-5 5 5`,key:`sgt6xg`}]]};a.node;var o=e(a),s={name:`pencil`,size:24,node:[[`path`,{d:`M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z`,key:`1a8usu`}],[`path`,{d:`m15 5 4 4`,key:`1mk7zo`}]]};s.node;var c=e(s),l={name:`trash`,size:24,node:[[`path`,{d:`M10 11v6`,key:`nco0om`}],[`path`,{d:`M14 11v6`,key:`outv1u`}],[`path`,{d:`M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6`,key:`miytrc`}],[`path`,{d:`M3 6h18`,key:`d0wm0j`}],[`path`,{d:`M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2`,key:`e791ji`}]],aliases:[`trash-2`]};l.node;var u=e(l);function d(e){let{render:a,className:o,style:s,state:c=n,props:l=r,refs:u=r,metadata:d,stateAttributesMapping:f,tag:p=`div`,...m}=e,{compositeProps:h,compositeRef:g}=i({metadata:d});return t(p,e,{state:c,ref:[g,...u],props:[h,...l,m],stateAttributesMapping:f})}export{o as i,u as n,c as r,d as t};
+import{Ga as e,_a as t,ba as n,ya as r}from"./search-Ble6WSEU.js";import{i}from"./forms-BlEL8C_P.js";var a={name:`chevrons-up-down`,size:24,node:[[`path`,{d:`m7 15 5 5 5-5`,key:`1hf1tw`}],[`path`,{d:`m7 9 5-5 5 5`,key:`sgt6xg`}]]};a.node;var o=e(a),s={name:`pencil`,size:24,node:[[`path`,{d:`M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z`,key:`1a8usu`}],[`path`,{d:`m15 5 4 4`,key:`1mk7zo`}]]};s.node;var c=e(s),l={name:`trash`,size:24,node:[[`path`,{d:`M10 11v6`,key:`nco0om`}],[`path`,{d:`M14 11v6`,key:`outv1u`}],[`path`,{d:`M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6`,key:`miytrc`}],[`path`,{d:`M3 6h18`,key:`d0wm0j`}],[`path`,{d:`M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2`,key:`e791ji`}]],aliases:[`trash-2`]};l.node;var u=e(l);function d(e){let{render:a,className:o,style:s,state:c=n,props:l=r,refs:u=r,metadata:d,stateAttributesMapping:f,tag:p=`div`,...m}=e,{compositeProps:h,compositeRef:g}=i({metadata:d});return t(p,e,{state:c,ref:[g,...u],props:[h,...l,m],stateAttributesMapping:f})}export{o as i,u as n,c as r,d as t};