@maudecode/kanvil 0.4.4 → 0.5.1

package/apps/server/dist/{auth-B-Tz8SF4.mjs → auth-Bm6cIseE.mjs}

@@ -1,5 +1,5 @@
-import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-CRADzIvL.mjs";
-import { $ as permissionLabels, A as hasAdminRole, At as workspaceSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, J as operationPermission, Lt as s3SettingsSchema, Mt as authenticationPolicySchema, N as importSecretFields, Nt as brokerSettingsSchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as instanceUpdateSchema, Q as parsePublicOutput, Rt as searchAuthentication, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, k as formatEvent, kt as workflowOrder, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchSettingsSchema } from "./src-BCtZ3wbK.mjs";
+import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-CrJuk5mY.mjs";
+import { $ as permissionLabels, A as hasAdminRole, At as workflowOrder, Bt as searchSettingsSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, Ft as instanceUpdateSchema, J as operationPermission, N as importSecretFields, Nt as authenticationPolicySchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as brokerSettingsSchema, Q as parsePublicOutput, Rt as s3SettingsSchema, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, jt as workspaceSchema, k as formatEvent, kt as ticketSummarySchema, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchAuthentication } from "./src-D80LNZKP.mjs";
 import { and, asc, count, desc, eq, getTableColumns, gt, ilike, inArray, isNotNull, isNull, lt, lte, ne, notInArray, or, sql } from "drizzle-orm";
 import { alias, bigint, boolean, check, customType, foreignKey, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unionAll, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 import { z } from "zod";
@@ -15,6 +15,7 @@ import { request as request$1 } from "node:https";
 import { BlockList, isIP } from "node:net";
 import nodemailer from "nodemailer";
 import { APIError, createAuthMiddleware } from "better-auth/api";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { betterAuth } from "better-auth";
 import { admin, genericOAuth, jwt } from "better-auth/plugins";
 import { emailOTP } from "better-auth/plugins/email-otp";
@@ -769,7 +770,7 @@ function createBlobStorage(database, instance, factory = createObjectStore, sche
 					skipLocked: true
 				});
 				for (const row of rows) {
-					const backend = await instance.backend(requireRow(row.backendId ?? void 0)), key = requireRow(row.objectKey ?? void 0), bytes = requireRow(row.data ?? void 0);
+					const backend = await instance.backend(requireRow(row.backendId ?? void 0), tx), key = requireRow(row.objectKey ?? void 0), bytes = requireRow(row.data ?? void 0);
 					await transfer(backend.spec, async (store) => {
 						await store.put(key, bytes, row.contentType);
 						const verified = await store.get(key, row.size);
@@ -818,7 +819,7 @@ function createBlobStorage(database, instance, factory = createObjectStore, sche
 			});
 			for (const { object } of rows) {
 				if (object.backendId && object.objectKey) {
-					const backend = await instance.backend(object.backendId), key = object.objectKey;
+					const backend = await instance.backend(object.backendId, tx), key = object.objectKey;
 					await transfer(backend.spec, (store) => store.remove(key));
 				}
 				await tx.delete(blobObjects).where(eq(blobObjects.id, object.id));
@@ -872,6 +873,14 @@ function imageResponse(blob) {
 }
 //#endregion
 //#region src/adapters/elasticsearch.ts
+const fields$1 = [
+	"title^3",
+	"key^3",
+	"description",
+	"acceptanceCriteria",
+	"labels",
+	"scopes"
+];
 function fail$1(_status, _code, message) {
 	throw new Error(message);
 }
@@ -970,37 +979,44 @@ function createElasticsearchIndex(configuration) {
 			let scrollId;
 			try {
 				const found = [];
+				let score;
 				let response = await accepted(await call$1(settings, `${settings.index}/_search?scroll=1m`, {
 					method: "POST",
 					body: JSON.stringify({
 						size: 1e3,
 						_source: false,
-						sort: ["_doc"],
 						query: { bool: {
 							filter: [{ terms: { projectId: [...projectIds] } }, { term: { instanceId: identity } }],
-							must: [{ multi_match: {
-								query,
-								fields: [
-									"title^3",
-									"key^3",
-									"description",
-									"acceptanceCriteria",
-									"labels",
-									"scopes"
-								],
+							must: [...query.terms ? [{ multi_match: {
+								query: query.terms,
+								fields: fields$1,
 								operator: "and",
 								fuzziness: "AUTO"
-							} }]
+							} }] : [], ...query.phrases.map((phrase) => ({ multi_match: {
+								query: phrase,
+								fields: fields$1,
+								type: "phrase"
+							} }))]
 						} }
 					})
 				}));
 				for (;;) {
 					const result = z.object({
 						_scroll_id: z.string().optional(),
-						hits: z.object({ hits: z.array(z.object({ _id: z.uuid() })) })
+						hits: z.object({ hits: z.array(z.object({
+							_id: z.uuid(),
+							_score: z.number()
+						})) })
 					}).parse(await response.json());
 					scrollId = result["_scroll_id"] ?? scrollId;
-					found.push(...result.hits.hits.map((hit) => hit["_id"]));
+					for (const hit of result.hits.hits) {
+						const rank = (found.at(-1)?.rank ?? 0) + (score === hit["_score"] ? 0 : 1);
+						score = hit["_score"];
+						found.push({
+							id: hit["_id"],
+							rank
+						});
+					}
 					if (found.length > 1e4) throw new Error("External search unavailable");
 					if (!result.hits.hits.length || !scrollId) break;
 					response = await accepted(await call$1(settings, "_search/scroll", {
@@ -1034,12 +1050,32 @@ const createTicketIndex = (configuration) => {
 //#endregion
 //#region src/search.ts
 const likePattern = (query) => `%${query.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_")}%`;
+function parseQuery(query) {
+	const phrases = [];
+	const terms = query.replace(/"([^"]*)"/gu, (_, phrase) => {
+		const value = phrase.replace(/\s+/gu, " ").trim();
+		if (value && phrases.length < 8 && !phrases.some((seen) => seen.toLowerCase() === value.toLowerCase())) phrases.push(value);
+		return " ";
+	}).replace(/\s+/gu, " ").trim();
+	return phrases.length || terms ? {
+		phrases,
+		terms
+	} : {
+		phrases,
+		terms: query
+	};
+}
+const querySegments = ({ phrases, terms }) => terms ? [...phrases, terms] : phrases;
 function postgresSearch(query) {
-	const value = likePattern(query);
-	return or(ilike(tickets.title, value), ilike(tickets.description, value), ilike(tickets.key, value), ilike(tickets.acceptanceCriteria, value), sql`array_to_string(${tickets.labels}, ' ') ILIKE ${value}`, sql`array_to_string(${tickets.scopes}, ' ') ILIKE ${value}`);
+	return and(...querySegments(parseQuery(query)).map((segment) => {
+		const value = likePattern(segment);
+		return or(ilike(tickets.title, value), ilike(tickets.description, value), ilike(tickets.key, value), ilike(tickets.acceptanceCriteria, value), sql`array_to_string(${tickets.labels}, ' ') ILIKE ${value}`, sql`array_to_string(${tickets.scopes}, ' ') ILIKE ${value}`);
+	}));
 }
+const postgresRank = (query) => sql`CASE WHEN ${and(...querySegments(parseQuery(query)).map((segment) => ilike(tickets.title, likePattern(segment))))} THEN 0 ELSE 1 END`;
 const builtinSearch = { where: async (_db, _ids, query) => ({
 	where: postgresSearch(query),
+	rank: postgresRank(query),
 	engine: "postgres",
 	indexing: false
 }) };
@@ -1093,6 +1129,7 @@ function createTicketSearch(database, instance, factory = createTicketIndex, sch
 		const settings = await instance.search();
 		const fallback = () => ({
 			where: postgresSearch(query),
+			rank: postgresRank(query),
 			engine: "postgres",
 			indexing: !!settings
 		});
@@ -1101,12 +1138,14 @@ function createTicketSearch(database, instance, factory = createTicketIndex, sch
 		if (!state || !clock || state.error || state.configHash !== fingerprint(settings) || state.cursor !== clock.value) return fallback();
 		const root = await instance.read();
 		try {
-			const ids = await factory({
+			const hits = await factory({
 				provider: "elasticsearch",
 				config: settings
-			}).find(root.identity, projectIds, query);
+			}).find(root.identity, projectIds, parseQuery(query));
+			const ids = hits.map((hit) => hit.id), ranks = hits.map((hit) => hit.rank);
 			return {
 				where: ids.length ? inArray(tickets.id, ids) : sql`false`,
+				rank: sql`(${`{${ranks.join(",")}}`}::int[])[array_position(${`{${ids.join(",")}}`}::uuid[], ${tickets.id})]`,
 				engine: "index",
 				indexing: false
 			};
@@ -2254,23 +2293,17 @@ async function validateReferences(ctx, ticketId, changes) {
 }
 async function assertNoCycle(ctx, sourceId, targetId) {
 	if (sourceId === targetId) fail(409, "dependency_cycle", "A ticket cannot depend on itself");
-	const all = await ctx.db.select({
-		id: tickets.id,
-		parentId: tickets.parentId
-	}).from(tickets).where(eq(tickets.projectId, project(ctx).id));
-	const links = await ctx.db.select().from(relations$1).where(and(eq(relations$1.projectId, project(ctx).id), eq(relations$1.type, "blocks")));
-	const edges = /* @__PURE__ */ new Map();
-	const add = (from, to) => edges.set(from, [...edges.get(from) ?? [], to]);
-	for (const row of all) if (row.parentId) add(row.id, row.parentId);
-	for (const row of links) add(row.sourceId, row.targetId);
-	const pending = [targetId], visited = /* @__PURE__ */ new Set();
-	while (pending.length) {
-		const node = pending.pop();
-		if (!node || visited.has(node)) continue;
-		if (node === sourceId) fail(409, "dependency_cycle", "This relationship would create a dependency cycle");
-		visited.add(node);
-		pending.push(...edges.get(node) ?? []);
-	}
+	const { rows } = await ctx.db.execute(sql`WITH RECURSIVE reach(id) AS (
+      SELECT ${targetId}::uuid
+      UNION
+      SELECT edge.next FROM reach JOIN (
+        SELECT source_id AS id, target_id AS next FROM ${relations$1} WHERE type = 'blocks'
+        UNION ALL
+        SELECT id, parent_id FROM ${tickets} WHERE parent_id IS NOT NULL
+      ) edge ON edge.id = reach.id
+    )
+    SELECT 1 FROM reach WHERE id = ${sourceId}::uuid LIMIT 1`);
+	if (rows.length) fail(409, "dependency_cycle", "This relationship would create a dependency cycle");
 }
 async function updateTicketRow(ctx, input) {
 	const current = await getTicket(ctx, input.ticketId);
@@ -2417,7 +2450,7 @@ async function createTicketRow(ctx, input) {
 		...fields,
 		...state,
 		...dates,
-		customFields: applyCustomFieldValues(await projectCustomFields(ctx), null, customFields),
+		customFields: intakeOnly(ctx.actor) ? {} : applyCustomFieldValues(await projectCustomFields(ctx), null, customFields),
 		...await allocateTicket(ctx),
 		id,
 		createdBy: ctx.actor.id
@@ -2464,6 +2497,20 @@ const hitRow = z.object({
 	title: z.string().nullable(),
 	status: z.enum(states).nullable()
 });
+const summarize = (ticket) => ticketSummarySchema.parse(json(ticket));
+const snippetLength = 240;
+function snippet(body, query) {
+	const text = body?.replace(/\s+/gu, " ").trim() ?? "", lower = text.toLowerCase(), parsed = parseQuery(query);
+	let at = -1, size = 0;
+	for (const needle of [...querySegments(parsed), ...parsed.terms.split(" ")]) {
+		const found = needle ? lower.indexOf(needle.toLowerCase()) : -1;
+		if (found >= 0 && (at < 0 || found < at)) [at, size] = [found, needle.length];
+	}
+	if (at < 0) return "";
+	if (text.length <= snippetLength) return text;
+	const start = Math.max(0, Math.min(at + Math.floor((size - snippetLength) / 2), text.length - snippetLength)), end = start + snippetLength;
+	return `${start > 0 ? "…" : ""}${text.slice(start > 0 ? start + 1 : start, end < text.length ? end - 1 : end)}${end < text.length ? "…" : ""}`;
+}
 function excerpt(body, query, radius = 80) {
 	const text = body?.replace(/\s+/gu, " ").trim() ?? "", at = text.toLowerCase().indexOf(query.toLowerCase());
 	if (at < 0) return "";
@@ -2481,25 +2528,29 @@ async function deleteTicketRows(ctx, selection) {
 	const ids = [...selected.keys()];
 	const [claimed] = await ctx.db.select({ ticketId: claims.ticketId }).from(claims).where(inArray(claims.ticketId, ids)).limit(1);
 	if (claimed) fail(409, "claim_conflict", "Release ownership before deleting this ticket", { ticketId: claimed.ticketId });
-	await publishMany(ctx, [...(await ctx.db.update(tickets).set({
-		parentId: null,
-		version: sql`${tickets.version} + 1`,
-		updatedAt: /* @__PURE__ */ new Date()
-	}).where(and(inArray(tickets.parentId, ids), notInArray(tickets.id, ids))).returning()).map((child) => ({
-		type: "ticket.updated",
-		ticketId: child.id,
-		data: {
-			version: child.version,
-			changedFields: ["parentId"]
-		}
-	})), ...[...selected.values()].map((ticket) => ({
-		type: "ticket.deleted",
-		ticketId: ticket.id,
-		data: {
-			key: ticket.key,
-			version: ticket.version
-		}
-	}))]);
+	await publishMany(ctx, [
+		...(await ctx.db.update(tickets).set({
+			parentId: null,
+			version: sql`${tickets.version} + 1`,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(and(inArray(tickets.parentId, ids), notInArray(tickets.id, ids))).returning()).map((child) => ({
+			type: "ticket.updated",
+			ticketId: child.id,
+			data: {
+				version: child.version,
+				changedFields: ["parentId"]
+			}
+		})),
+		...[...selected.values()].map((ticket) => ({
+			type: "ticket.deleted",
+			ticketId: ticket.id,
+			data: {
+				key: ticket.key,
+				version: ticket.version
+			}
+		})),
+		...await severedRelationEvents(ctx, ids)
+	]);
 	await ctx.db.delete(tickets).where(inArray(tickets.id, ids));
 }
 async function relocation(ctx, ticket, destinationProjectId) {
@@ -2568,6 +2619,16 @@ async function relocation(ctx, ticket, destinationProjectId) {
 		fields
 	};
 }
+async function readableTicket(ctx, identifier) {
+	const allowed = await accessibleProjectRows(ctx.db, ctx.actor);
+	const [ticket] = allowed.length ? await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, allowed.map((row) => row.id)), ticketMatch(identifier))).limit(1) : [];
+	const owner = allowed.find((row) => row.id === ticket?.projectId);
+	if (!ticket || !owner) fail(404, "not_found", "Ticket was not found");
+	return {
+		ticket,
+		project: owner
+	};
+}
 const ticketHandlers = {
 	async list_ticket_labels(ctx, input) {
 		const labels = labelUsage(ctx, input.archived).as("usage");
@@ -2578,7 +2639,11 @@ const ticketHandlers = {
 		const related = input.relatedTo ? await getTicket(ctx, input.relatedTo) : void 0;
 		const search = input.q ? await ctx.search.where(ctx.db, [project(ctx).id], input.q) : void 0;
 		await assertCustomFieldFilters(ctx, [project(ctx).id], input);
-		return pageOf(ctx, and(eq(tickets.projectId, project(ctx).id), parent ? eq(tickets.parentId, parent.id) : void 0, related ? or(inArray(tickets.id, ctx.db.select({ id: relations$1.targetId }).from(relations$1).where(eq(relations$1.sourceId, related.id))), inArray(tickets.id, ctx.db.select({ id: relations$1.sourceId }).from(relations$1).where(eq(relations$1.targetId, related.id)))) : void 0, predicateWhere(input), input.archived === "include" ? void 0 : eq(tickets.archived, input.archived === "only"), dueWhere(input.due), input.stateId ? eq(tickets.stateId, input.stateId) : void 0, input.scheduledFrom ? sql`${scheduleEnd} >= ${input.scheduledFrom}::timestamptz` : void 0, input.scheduledTo ? sql`${scheduleStart} < ${input.scheduledTo}::timestamptz` : void 0, search?.where), ticketOrder(input), input);
+		const page = await pageOf(ctx, and(eq(tickets.projectId, project(ctx).id), parent ? eq(tickets.parentId, parent.id) : void 0, related ? or(inArray(tickets.id, ctx.db.select({ id: relations$1.targetId }).from(relations$1).where(eq(relations$1.sourceId, related.id))), inArray(tickets.id, ctx.db.select({ id: relations$1.sourceId }).from(relations$1).where(eq(relations$1.targetId, related.id)))) : void 0, predicateWhere(input), input.archived === "include" ? void 0 : eq(tickets.archived, input.archived === "only"), dueWhere(input.due), input.stateId ? eq(tickets.stateId, input.stateId) : void 0, input.scheduledFrom ? sql`${scheduleEnd} >= ${input.scheduledFrom}::timestamptz` : void 0, input.scheduledTo ? sql`${scheduleStart} < ${input.scheduledTo}::timestamptz` : void 0, search?.where), ticketOrder(input), input);
+		return input.view === "summary" ? {
+			...page,
+			items: page.items.map(summarize)
+		} : page;
 	},
 	async list_my_work(ctx, input) {
 		const allowed = await accessibleProjectRows(ctx.db, ctx.actor, input.workspaceId, "exclude");
@@ -2607,6 +2672,21 @@ const ticketHandlers = {
 		};
 	},
 	async create_ticket(ctx, input) {
+		if (intakeOnly(ctx.actor)) input = {
+			...input,
+			automationReady: false,
+			holdReason: intakeHoldReason,
+			status: "todo",
+			stateId: void 0,
+			assigneeId: null,
+			parentId: null,
+			archived: false,
+			dueAt: null,
+			startAt: null,
+			customFields: {},
+			uploads: [],
+			labels: operations.create_ticket.input.shape.labels.parse([.../* @__PURE__ */ new Set([...input.labels, "intake"])])
+		};
 		const { row, event } = await createTicketRow(ctx, input);
 		await publishMany(ctx, [event, ...(await claimStagedUploads(ctx, row.id, input.uploads)).map((item) => ({
 			type: "attachment.created",
@@ -2652,7 +2732,7 @@ const ticketHandlers = {
 				...event.data,
 				duplicateOf: source.id
 			}
-		}, ...relationEvents("relation.added", relation)]);
+		}, ...relationEvents("relation.added", relation, [row, source])]);
 		return row;
 	},
 	update_ticket: updateTicket,
@@ -2742,10 +2822,7 @@ const ticketHandlers = {
 		return row;
 	},
 	async resolve_ticket(ctx, input) {
-		const allowed = await accessibleProjectRows(ctx.db, ctx.actor);
-		const [ticket] = allowed.length ? await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, allowed.map((row) => row.id)), ticketMatch(input.ticketId))).limit(1) : [];
-		const owner = allowed.find((row) => row.id === ticket?.projectId);
-		if (!ticket || !owner) fail(404, "not_found", "Ticket was not found");
+		const { ticket, project: owner } = await readableTicket(ctx, input.ticketId);
 		return {
 			ticket,
 			project: {
@@ -2793,17 +2870,20 @@ const ticketHandlers = {
 	async search_tickets(ctx, input) {
 		const allowed = await accessibleProjectRows(ctx.db, ctx.actor, input.workspaceId, "exclude");
 		if (!allowed.length) return { items: [] };
-		const ids = allowed.map((row) => row.id);
-		return { items: (await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, ids), eq(tickets.archived, false), or(ticketMatch(input.q), (await ctx.search.where(ctx.db, ids, input.q)).where))).orderBy(sql`CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END`, desc(tickets.updatedAt)).limit(input.limit)).flatMap((ticket) => {
+		const ids = allowed.map((row) => row.id), match = await ctx.search.where(ctx.db, ids, input.q);
+		return { items: (await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, ids), eq(tickets.archived, false), or(ticketMatch(input.q), match.where))).orderBy(sql`CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END`, sql`${match.rank} NULLS LAST`, desc(tickets.updatedAt)).limit(input.limit)).flatMap((ticket) => {
 			const owner = allowed.find((row) => row.id === ticket.projectId);
-			return owner ? [{
-				ticket,
+			if (!owner) return [];
+			const summary = input.view === "summary", body = `${ticket.description} ${ticket.acceptanceCriteria}`;
+			return [{
+				ticket: summary ? summarize(ticket) : ticket,
 				project: {
 					id: owner.id,
 					key: owner.key,
 					name: owner.name
-				}
-			}] : [];
+				},
+				...summary && { snippet: snippet(body, input.q) }
+			}];
 		}) };
 	},
 	async search_workspace(ctx, input) {
@@ -2828,23 +2908,26 @@ const ticketHandlers = {
 			filtered ? void 0 : sql`SELECT 'project' AS type, projects.id::text AS id, projects.id AS project_id,
               NULL::uuid AS ticket_id, NULL::text AS actor_id, projects.description AS body,
               NULL::text AS event_type, NULL::jsonb AS data, projects.updated_at AS at,
-              CASE WHEN projects.key = ${key} THEN 0 ELSE 1 END AS rank, 0 AS family
+              CASE WHEN projects.key = ${key} THEN 0 ELSE 1 END AS rank, 0 AS family,
+              NULL::int AS score
             FROM projects WHERE ${inArray(projects.id, ids)}
               AND (projects.name ILIKE ${like} OR projects.key ILIKE ${like} OR projects.description ILIKE ${like})`,
 			sql`SELECT 'ticket' AS type, tickets.id::text AS id, tickets.project_id,
               tickets.id AS ticket_id, NULL::text AS actor_id,
               concat_ws(' ', tickets.description, tickets.acceptance_criteria) AS body,
               NULL::text AS event_type, NULL::jsonb AS data, tickets.updated_at AS at,
-              CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END AS rank, 1 AS family
+              CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END AS rank, 1 AS family,
+              ${match.rank}::int AS score
             FROM tickets WHERE ${and(ticketScope, or(ticketMatch(input.q), match.where))}`,
 			sql`SELECT 'comment' AS type, comments.id::text AS id, comments.project_id,
               comments.ticket_id, comments.actor_id, comments.body, NULL::text AS event_type,
-              NULL::jsonb AS data, comments.created_at AS at, 1 AS rank, 2 AS family
+              NULL::jsonb AS data, comments.created_at AS at, 1 AS rank, 2 AS family,
+              NULL::int AS score
             FROM comments JOIN tickets ON tickets.id = comments.ticket_id
             WHERE ${and(ticketScope, sql`comments.body ILIKE ${like}`)}`,
 			sql`SELECT 'activity' AS type, events.id::text AS id, events.project_id,
               events.ticket_id, events.actor_id, NULL::text AS body, events.type AS event_type,
-              events.data, events.created_at AS at, 1 AS rank, 3 AS family
+              events.data, events.created_at AS at, 1 AS rank, 3 AS family, NULL::int AS score
             FROM events
             LEFT JOIN tickets ON tickets.id = events.ticket_id AND tickets.project_id = events.project_id
             LEFT JOIN "user" ON "user".id = events.actor_id
@@ -2861,14 +2944,15 @@ const ticketHandlers = {
         FROM (${hits}) AS hits
         LEFT JOIN tickets ON tickets.id = hits.ticket_id AND tickets.project_id = hits.project_id
         WHERE ${input.type ? sql`hits.type = ${input.type}` : sql`true`}
-        ORDER BY hits.rank, hits.family, hits.at DESC, hits.id DESC
+        ORDER BY hits.rank, hits.family, hits.score NULLS LAST, hits.at DESC, hits.id DESC
         LIMIT ${input.limit} OFFSET ${input.offset}`)).rows.map((row) => hitRow.parse(row));
 		const projectsById = new Map(allowed.map((row) => [row.id, row]));
+		const ticketIds = rows.flatMap((row) => row.ticket_id ? [row.ticket_id] : []), summaries = input.view === "summary" && ticketIds.length ? new Map((await ctx.db.select().from(tickets).where(inArray(tickets.id, ticketIds))).map((row) => [row.id, summarize(row)])) : void 0;
 		return {
 			items: rows.flatMap((row) => {
 				const owner = projectsById.get(row.project_id);
 				if (!owner) return [];
-				const ticket = row.ticket_id && row.key && row.title && row.status ? {
+				const ticket = row.ticket_id && row.key && row.title && row.status ? summaries?.get(row.ticket_id) ?? {
 					id: row.ticket_id,
 					key: row.key,
 					title: row.title,
@@ -2894,6 +2978,7 @@ const ticketHandlers = {
 						createdAt: at
 					}, true) : ticket?.title ?? "",
 					excerpt: excerpt(row.body, input.q),
+					...input.view === "summary" && { snippet: snippet(row.body, input.q) },
 					actorId: row.actor_id,
 					at
 				}];
@@ -2951,11 +3036,17 @@ const ticketHandlers = {
 	},
 	async recover_claim(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
-		const current = one(await ctx.db.select().from(claims).where(and(eq(claims.id, input.claimId), eq(claims.ticketId, ticket.id))));
-		if (input.cancelActive && !can(ctx, "project.manage")) fail(403, "forbidden", "Cancelling an active claim requires project management access and admin scope");
-		if (current.expiresAt > /* @__PURE__ */ new Date() && !input.cancelActive) fail(409, "claim_not_expired", "The current claim has not expired");
-		if (input.reschedule && input.expectedVersion !== void 0) {
-			assertVersion(ticket, input.expectedVersion, "ticket", "rescheduling recovered work");
+		const current = input.claimId === void 0 ? void 0 : one(await ctx.db.select().from(claims).where(and(eq(claims.id, input.claimId), eq(claims.ticketId, ticket.id))));
+		if (!current) {
+			const held = (await ctx.db.select({ id: claims.id }).from(claims).where(eq(claims.ticketId, ticket.id)).limit(1))[0];
+			if (held) fail(409, "claim_conflict", "This ticket has a claim; recover it by its claim ID", { claimId: held.id });
+			if (!ticket.claimRequired) fail(409, "claim_not_required", "This ticket does not require ownership to recover");
+		} else {
+			if (input.cancelActive && !can(ctx, "project.manage")) fail(403, "forbidden", "Cancelling an active claim requires project management access and admin scope");
+			if (current.expiresAt > /* @__PURE__ */ new Date() && !input.cancelActive) fail(409, "claim_not_expired", "The current claim has not expired");
+		}
+		if (input.expectedVersion !== void 0 && (input.reschedule || !current)) assertVersion(ticket, input.expectedVersion, "ticket", "recovering ownership");
+		if (input.reschedule) {
 			const row = one(await ctx.db.update(tickets).set({
 				...await resolveState(ctx, { status: "todo" }, ticket),
 				version: ticket.version + 1,
@@ -2976,12 +3067,12 @@ const ticketHandlers = {
 				changedFields: ["claimRequired"]
 			});
 		}
-		await ctx.db.delete(claims).where(eq(claims.id, current.id));
+		if (current) await ctx.db.delete(claims).where(eq(claims.id, current.id));
 		await publish(ctx, "claim.recovered", ticket.id, {
-			claimId: current.id,
+			claimId: current?.id ?? null,
 			reason: input.reason,
 			confirmedStopped: true,
-			...input.cancelActive && { cancelActive: true }
+			...current && input.cancelActive && { cancelActive: true }
 		});
 		return { ok: true };
 	}
@@ -3259,6 +3350,13 @@ function mentionedUserIds(markdown) {
 //#region src/collaboration-operations.ts
 const sourceTicket = alias(tickets, "source_ticket");
 const targetTicket = alias(tickets, "target_ticket");
+const sourceProject = alias(projects, "source_project");
+const targetProject = alias(projects, "target_project");
+async function assertMayConstrain(ctx, relation, sides) {
+	const constrained = relation.type === "blocks" ? relation.targetId : relation.type === "duplicate" ? relation.sourceId : null;
+	const side = sides.find((item) => item.id === constrained);
+	if (side && side.projectId !== project(ctx).id) await context(ctx.db, ctx.actor, "write", side.projectId);
+}
 async function editableComment(ctx, commentId, expectedVersion) {
 	const row = one(await ctx.db.select().from(comments).where(and(eq(comments.projectId, project(ctx).id), eq(comments.id, commentId))));
 	if (row.actorId !== ctx.actor.id && !can(ctx, "project.manage")) fail(403, "forbidden", "Only the author or a project administrator can edit this comment");
@@ -3289,18 +3387,45 @@ async function addComment(ctx, input) {
 const collaborationHandlers = {
 	async list_relations(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
-		return ctx.db.select({
+		const rows = await ctx.db.select({
 			...getTableColumns(relations$1),
 			sourceKey: sourceTicket.key,
 			sourceTitle: sourceTicket.title,
+			sourceProjectId: sourceTicket.projectId,
+			sourceProjectKey: sourceProject.key,
 			targetKey: targetTicket.key,
-			targetTitle: targetTicket.title
-		}).from(relations$1).innerJoin(sourceTicket, eq(sourceTicket.id, relations$1.sourceId)).innerJoin(targetTicket, eq(targetTicket.id, relations$1.targetId)).where(and(eq(relations$1.projectId, project(ctx).id), or(eq(relations$1.sourceId, ticket.id), eq(relations$1.targetId, ticket.id))));
+			targetTitle: targetTicket.title,
+			targetProjectId: targetTicket.projectId,
+			targetProjectKey: targetProject.key
+		}).from(relations$1).innerJoin(sourceTicket, eq(sourceTicket.id, relations$1.sourceId)).innerJoin(targetTicket, eq(targetTicket.id, relations$1.targetId)).innerJoin(sourceProject, eq(sourceProject.id, sourceTicket.projectId)).innerJoin(targetProject, eq(targetProject.id, targetTicket.projectId)).where(or(eq(relations$1.sourceId, ticket.id), eq(relations$1.targetId, ticket.id)));
+		const here = project(ctx).id, elsewhere = rows.some((row) => row.sourceProjectId !== here || row.targetProjectId !== here), readable = /* @__PURE__ */ new Set([here, ...(elsewhere ? await accessibleProjectRows(ctx.db, ctx.actor) : []).map((row) => row.id)]);
+		return rows.map(({ sourceTitle, sourceProjectId, sourceProjectKey, targetTitle, targetProjectId, targetProjectKey, ...row }) => {
+			const source = readable.has(sourceProjectId), target = readable.has(targetProjectId);
+			return {
+				...row,
+				...source && {
+					sourceTitle,
+					sourceProjectId,
+					sourceProjectKey
+				},
+				...target && {
+					targetTitle,
+					targetProjectId,
+					targetProjectKey
+				},
+				restricted: !source || !target
+			};
+		});
 	},
 	async add_relation(ctx, input) {
-		const current = await getTicket(ctx, input.ticketId), other = await getTicket(ctx, input.targetId);
+		const current = await getTicket(ctx, input.ticketId), { ticket: other } = await readableTicket(ctx, input.targetId);
 		const [source, target] = input.direction === "incoming" ? [other, current] : [current, other];
 		if (source.id === target.id) fail(409, "invalid_relation", "Choose a different ticket");
+		await assertMayConstrain(ctx, {
+			type: input.type,
+			sourceId: source.id,
+			targetId: target.id
+		}, [current, other]);
 		if (input.type === "blocks") await assertNoCycle(ctx, source.id, target.id);
 		const [sourceId, targetId] = input.type === "related" ? [source.id, target.id].toSorted() : [source.id, target.id];
 		const row = one(await ctx.db.insert(relations$1).values({
@@ -3316,12 +3441,19 @@ const collaborationHandlers = {
 			],
 			set: { type: input.type }
 		}).returning());
-		await publishMany(ctx, relationEvents("relation.added", row));
+		await publishMany(ctx, relationEvents("relation.added", row, [current, other]));
 		return row;
 	},
 	async remove_relation(ctx, input) {
-		const row = one(await ctx.db.delete(relations$1).where(and(eq(relations$1.projectId, project(ctx).id), eq(relations$1.id, input.relationId))).returning());
-		await publishMany(ctx, relationEvents("relation.removed", row));
+		const found = one(await ctx.db.select().from(relations$1).where(eq(relations$1.id, input.relationId)));
+		const sides = await ctx.db.select({
+			id: tickets.id,
+			projectId: tickets.projectId
+		}).from(tickets).where(inArray(tickets.id, [found.sourceId, found.targetId]));
+		if (!sides.some((side) => side.projectId === project(ctx).id)) fail(404, "not_found", "The requested record was not found");
+		await assertMayConstrain(ctx, found, sides);
+		const row = one(await ctx.db.delete(relations$1).where(eq(relations$1.id, found.id)).returning());
+		await publishMany(ctx, relationEvents("relation.removed", row, sides));
 		return { ok: true };
 	},
 	async list_comments(ctx, input) {
@@ -3974,7 +4106,7 @@ function matches(rule, names, labels) {
 	const has = (id) => carried.has(names.get(id)?.toLowerCase() ?? "\0");
 	return rule.match === "all" ? rule.labels.every(has) : rule.labels.some(has);
 }
-const qualifies = (rules, names, link, ticket) => link.origin === "outbound" ? matches(rules.outbound, names, ticket.labels) : matches(rules.inbound, names, link.remote?.labels ?? []);
+const qualifies = (rules, names, link, ticket) => !intakeQuarantined(ticket) && (link?.origin === "inbound" ? matches(rules.inbound, names, link.remote?.labels ?? []) : matches(rules.outbound, names, ticket.labels));
 const workspaceOf = async (db, projectId) => one(await db.select({ workspaceId: projects.workspaceId }).from(projects).where(eq(projects.id, projectId))).workspaceId;
 async function setLinks(db, projectId, links, changes) {
 	if (!links.length) return [];
@@ -4036,7 +4168,7 @@ async function queueIssueSync(db, rows) {
 	for (const ticket of found) for (const connection of connections) {
 		const link = links.find((item) => item.connectionId === connection.id && item.ticketId === ticket.id), labelled = names.get(connection.id) ?? /* @__PURE__ */ new Map();
 		if (!link) {
-			if (connection.projectId === ticket.projectId && !ticket.archived && !complete(ticket.status) && matches(connection.outbound, labelled, ticket.labels)) await queueSync(db, await db.insert(issueLinks).values({
+			if (connection.projectId === ticket.projectId && !ticket.archived && !complete(ticket.status) && qualifies(connection, labelled, null, ticket)) await queueSync(db, await db.insert(issueLinks).values({
 				connectionId: connection.id,
 				ticketId: ticket.id,
 				origin: "outbound",
@@ -4057,8 +4189,9 @@ async function queueIssueSync(db, rows) {
 			state: "review",
 			reason: "labels"
 		});
-		else if (link.state === "active" && !connection.paused) {
+		else if ((link.state === "active" || link.state === "creating") && qualified && !connection.paused) {
 			await queueSync(db, [link]);
+			if (link.state !== "active") continue;
 			const fresh = commentEvents.filter((event) => event.ticketId === ticket.id && !copied.has(`${link.id}:${String(event.data.commentId)}`));
 			if (fresh.length) await db.insert(deliveries).values(fresh.map((event) => ({
 				connectionId: connection.id,
@@ -4311,6 +4444,10 @@ async function sendIssueSync(database, senders, secrets, drivers, job, event) {
 	}).from(issueLinks).innerJoin(tickets, eq(tickets.id, issueLinks.ticketId)).innerJoin(repositoryConnections, eq(repositoryConnections.id, issueLinks.connectionId)).innerJoin(projects, eq(projects.id, repositoryConnections.projectId)).where(eq(issueLinks.id, job.issueLinkId ?? "")))[0];
 	if (!loaded) return finish(database.db, job, "link_removed");
 	const { link, ticket, connection } = loaded;
+	if (intakeQuarantined(ticket)) return locked(database, async (db) => {
+		const current = (await db.select({ holdReason: tickets.holdReason }).from(tickets).where(eq(tickets.id, ticket.id)))[0];
+		if (!current || intakeQuarantined(current)) await finish(db, job, current ? "quarantined" : "link_removed");
+	});
 	const skip = connection.paused ? "paused" : !loaded.writer ? "access_revoked" : loaded.archivedAt ? "project_archived" : ticket.projectId !== connection.projectId ? "moved" : null;
 	if (skip === "access_revoked" || skip === "project_archived") return locked(database, async (db) => {
 		await finish(db, job, skip);
@@ -4525,7 +4662,7 @@ async function plan(ctx, connection, { inbound, outbound }) {
 		if (link.state === "active") (qualified ? matching : pause).push(link);
 		else if (link.state === "paused" && link.reason === "labels" && qualified) review.push(link);
 	}
-	const exported = rules.outbound.enabled ? (await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, connection.projectId), eq(tickets.archived, false), notInArray(tickets.status, [...closedStates]), notInArray(tickets.id, ctx.db.select({ id: issueLinks.ticketId }).from(issueLinks).where(eq(issueLinks.connectionId, connection.id)))))).filter((ticket) => matches(rules.outbound, names, ticket.labels)) : [];
+	const exported = rules.outbound.enabled ? (await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, connection.projectId), eq(tickets.archived, false), notInArray(tickets.status, [...closedStates]), notInArray(tickets.id, ctx.db.select({ id: issueLinks.ticketId }).from(issueLinks).where(eq(issueLinks.connectionId, connection.id)))))).filter((ticket) => qualifies(rules, names, null, ticket)) : [];
 	return {
 		matching,
 		pause,
@@ -5769,22 +5906,26 @@ async function removeProject(ctx) {
 		key: tickets.key,
 		version: tickets.version
 	}).from(tickets).where(eq(tickets.projectId, current.id)).orderBy(asc(tickets.number));
-	await recordAudience(ctx, requireRow((await publishMany(ctx, [...removed.map((ticket) => ({
-		type: "ticket.deleted",
-		ticketId: ticket.id,
-		data: {
-			key: ticket.key,
-			version: ticket.version
-		}
-	})), {
-		type: "project.deleted",
-		ticketId: null,
-		data: {
-			key: current.key,
-			name: current.name,
-			tickets: removed.length
+	await recordAudience(ctx, requireRow((await publishMany(ctx, [
+		...removed.map((ticket) => ({
+			type: "ticket.deleted",
+			ticketId: ticket.id,
+			data: {
+				key: ticket.key,
+				version: ticket.version
+			}
+		})),
+		...await severedRelationEvents(ctx),
+		{
+			type: "project.deleted",
+			ticketId: null,
+			data: {
+				key: current.key,
+				name: current.name,
+				tickets: removed.length
+			}
 		}
-	}], false)).at(-1)), readers.map((person) => person.userId));
+	], false)).at(-1)), readers.map((person) => person.userId));
 	await ctx.db.delete(tickets).where(eq(tickets.projectId, current.id));
 	await ctx.db.delete(stagedUploads).where(eq(stagedUploads.projectId, current.id));
 	await ctx.db.delete(projectLabels).where(eq(projectLabels.projectId, current.id));
@@ -6021,7 +6162,8 @@ const timeEntryHandlers = {
 //#region src/public-operations.ts
 const listTickets = async (ctx, input) => parseOutput("list_tickets", json(await ticketHandlers.list_tickets(ctx, operations.list_tickets.input.parse({
 	...input,
-	projectId: project(ctx).id
+	projectId: project(ctx).id,
+	view: "full"
 }))));
 async function published(ctx, ids) {
 	if (!ids.length) return /* @__PURE__ */ new Set();
@@ -6824,7 +6966,13 @@ function json(value) {
 	return JSON.parse(JSON.stringify(value, (_, item) => typeof item === "bigint" ? item.toString() : item));
 }
 const complete = (status) => closedStates.some((closed) => closed === status);
-const hasScope = (actor, scope) => actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.length > 0;
+const intakeHoldReason = "Untrusted intake: human triage required";
+const intakeQuarantined = (ticket) => ticket.holdReason === intakeHoldReason;
+const intakeOnly = (actor) => actor.scopes.length > 0 && actor.scopes.every((scope) => scope === "intake");
+const hasScope = (actor, scope, operation) => intakeOnly(actor) ? operation === "create_ticket" : actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.some((value) => value !== "intake");
+function requireScope(actor, scope, operation) {
+	if (!hasScope(actor, scope, operation)) fail(403, "insufficient_scope", `This credential requires ${scope} permission`);
+}
 const capabilities = (actor, granted) => granted.filter((permission) => hasScope(actor, permissionScope(permission)));
 const can = (ctx, permission) => capabilities(ctx.actor, ctx.permissions).includes(permission);
 function requirePermission(granted, permission, where) {
@@ -6875,8 +7023,8 @@ function ticketMatch(identifier) {
 	const key = identifier.toUpperCase(), [, prefix, number] = issuedKey.exec(key) ?? [];
 	return or(sql`${tickets.id}::text = ${identifier}`, eq(tickets.key, key), sql`${tickets.id} IN (SELECT ta.ticket_id FROM ${ticketAliases} ta WHERE ta.key = ${key})`, prefix && number ? and(eq(tickets.number, Number(number)), sql`${tickets.projectId} IN (SELECT pp.project_id FROM ${projectPrefixes} pp WHERE pp.prefix = ${prefix})`) : void 0);
 }
-async function context(db, actor, scope, projectId, workspaceId, permission = scope === "read" ? null : scope === "admin" ? "project.manage" : "ticket.write") {
-	if (!hasScope(actor, scope)) fail(403, "insufficient_scope", `This credential requires ${scope} permission`);
+async function context(db, actor, scope, projectId, workspaceId, permission = scope === "read" ? null : scope === "admin" ? "project.manage" : "ticket.write", operation) {
+	requireScope(actor, scope, operation);
 	const ctx = baseContext(db, actor);
 	if (workspaceId) {
 		const access = await requireWorkspace(ctx, workspaceId, permission);
@@ -7052,11 +7200,26 @@ async function publish(ctx, type, ticketId, data) {
 		data
 	}]));
 }
-const relationEvents = (type, relation) => [relation.sourceId, relation.targetId].map((ticketId) => ({
+const relationEvents = (type, relation, sides) => [relation.sourceId, relation.targetId].map((ticketId) => ({
 	type,
 	ticketId,
-	data: { relation }
+	data: { relation },
+	projectId: requireRow(sides.find((side) => side.id === ticketId)).projectId
 }));
+const deletedSide = alias(tickets, "deleted_side");
+const survivingSide = alias(tickets, "surviving_side");
+async function severedRelationEvents(ctx, ticketIds) {
+	return (await ctx.db.select({
+		relation: relations$1,
+		ticketId: survivingSide.id,
+		projectId: survivingSide.projectId
+	}).from(relations$1).innerJoin(deletedSide, or(eq(deletedSide.id, relations$1.sourceId), eq(deletedSide.id, relations$1.targetId))).innerJoin(survivingSide, or(eq(survivingSide.id, relations$1.sourceId), eq(survivingSide.id, relations$1.targetId))).where(and(ticketIds ? inArray(deletedSide.id, [...ticketIds]) : eq(deletedSide.projectId, project(ctx).id), ne(survivingSide.projectId, project(ctx).id)))).map(({ relation, ticketId, projectId }) => ({
+		type: "relation.removed",
+		ticketId,
+		projectId,
+		data: { relation }
+	}));
+}
 function ownsLiveClaim(ctx, claim) {
 	return claim.ownerId === ctx.actor.ownerId && claim.expiresAt > /* @__PURE__ */ new Date() && hasScope(ctx.actor, "claim") && ctx.permissions.includes("ticket.write");
 }
@@ -7148,6 +7311,7 @@ function createDomain(database, services = {}) {
 		const input = spec.input.parse(value);
 		const projectId = "projectId" in input ? input.projectId : void 0;
 		const workspaceId = "workspaceId" in input && !workspaceIsFilter.has(name) ? input.workspaceId : void 0;
+		if (intakeOnly(actor)) requireScope(actor, spec.scope, name);
 		if (actor.machine && sessionOnly.has(name)) fail(403, "session_required", "Use a signed-in account for this action");
 		if (actor.projectIds && spec.method !== "GET" && !projectId) fail(403, "insufficient_scope", "Project-bound credentials can only change their configured projects");
 		const outgoing = [];
@@ -7161,19 +7325,20 @@ function createDomain(database, services = {}) {
 			return parseOutput(name, json(await handler(ctx, input)));
 		};
 		const permission = operationPermission(name);
-		if (spec.method === "GET" || remoteReads.has(name)) return invoke(await context(database.db, actor, spec.scope, projectId, workspaceId, permission));
+		if (spec.method === "GET" || remoteReads.has(name)) return invoke(await context(database.db, actor, spec.scope, projectId, workspaceId, permission, name));
 		const requestId = "requestId" in input ? input.requestId : void 0;
 		const reader = sourceReads[name];
-		if (reader && !(requestId && (await database.db.select({ id: receipts.requestId }).from(receipts).where(and(eq(receipts.actorId, actor.id), eq(receipts.requestId, requestId))).limit(1)).length)) read = await reader.read(withServices(await context(database.db, actor, spec.scope, projectId, workspaceId, permission)), input);
+		if (reader && !(requestId && (await database.db.select({ id: receipts.requestId }).from(receipts).where(and(eq(receipts.actorId, actor.id), eq(receipts.requestId, requestId))).limit(1)).length)) read = await reader.read(withServices(await context(database.db, actor, spec.scope, projectId, workspaceId, permission, name)), input);
 		const committed = await locked(async (tx) => {
 			const hash = createHash("sha256").update(JSON.stringify({
 				name,
-				input: reader ? reader.receipt(input) : input
+				input: reader ? reader.receipt(input) : input,
+				...intakeOnly(actor) && { intakeCredential: actor.ownerId }
 			})).digest("hex");
 			const receipt = requestId ? (await tx.select().from(receipts).where(and(eq(receipts.actorId, actor.id), eq(receipts.requestId, requestId))).limit(1))[0] : void 0;
 			if (receipt && (receipt.hash !== hash || receipt.operation !== name)) fail(409, "idempotency_conflict", "This requestId was already used for another write");
 			if (receipt && (name === "delete_project" || name === "delete_workspace")) return parseOutput(name, receipt.result);
-			const ctx = await context(tx, actor, spec.scope, projectId, workspaceId, permission);
+			const ctx = await context(tx, actor, spec.scope, projectId, workspaceId, permission, name);
 			if (receipt) {
 				if ((name === "create_time_entry" || name === "update_time_entry" || name === "delete_time_entry") && "ticketId" in input) await getTicket(ctx, input.ticketId);
 				const prior = parseOutput(name, receipt.result);
@@ -7670,6 +7835,8 @@ function createAuth(database, config) {
 		schema: auth_schema_exports,
 		transaction: true
 	});
+	const verification = new AsyncLocalStorage();
+	const consumed = () => verification.getStore()?.row ?? null;
 	const instance = createInstance(database, config);
 	const credentials = socialCredentials(config);
 	const mail = config.SMTP_URL && config.SMTP_FROM ? createMailSender(config.SMTP_URL, config.SMTP_FROM) : void 0;
@@ -7704,23 +7871,35 @@ function createAuth(database, config) {
 			disableIdTokenSignIn: true
 		};
 	};
-	return betterAuth({
+	const auth = betterAuth({
 		appName: "Kanvil",
 		baseURL: config.KANVIL_URL,
 		secret: config.BETTER_AUTH_SECRET,
 		database: (options) => {
 			const base = adapter(options);
-			const update = (input) => {
+			const update = async (input) => {
 				const fields = Object.keys(input.update);
-				if (input.model === "apikey" && fields.length > 0 && fields.every((field) => field === "lastRequest" || field === "updatedAt")) return base.findOne({
+				if (input.model === "apikey" && fields.length > 0 && fields.every((field) => field === "lastRequest" || field === "updatedAt")) return await base.findOne({
 					model: input.model,
 					where: input.where
-				});
+				}) ?? consumed();
 				return base.update(input);
 			};
+			const incrementOne = async (input) => {
+				const row = await base.incrementOne(input);
+				const store = input.model === "apikey" ? verification.getStore() : void 0;
+				if (!store) return row;
+				if (row) store.row = row;
+				else if (store.row && !await base.findOne({
+					model: input.model,
+					where: input.where.filter(({ field }) => field === "id")
+				})) return store.row;
+				return row;
+			};
 			return {
 				...base,
-				update
+				update,
+				incrementOne
 			};
 		},
 		trustedOrigins: config.trustedOrigins,
@@ -7871,6 +8050,14 @@ function createAuth(database, config) {
 			}] : [] })
 		]
 	});
+	const verifyApiKey = Object.assign((input) => verification.run({}, () => auth.api.verifyApiKey(input)), auth.api.verifyApiKey);
+	return {
+		...auth,
+		api: {
+			...auth.api,
+			verifyApiKey
+		}
+	};
 }
 //#endregion
-export { storageBackends as $, readCalendarFeed as A, attachments as B, deliverBatch as C, createWriteLimiter as D, createAccess as E, imageResponse as F, instanceSettings as G, deliveryCheckpoints as H, stagedUploadCutoff as I, notifications as J, members as K, createObjectStore as L, createTicketIndex as M, createBlobStorage as N, requireInstanceAdmin as O, decodeImage as P, stagedUploads as Q, createPollingJob as R, defaultSenders as S, createHttpSender as T, eventClock as U, blobObjects as V, events as W, projects as X, profilePhotos as Y, pushDevices as Z, reachable as _, deliverySecrets as a, processImports as b, ownerBlocker as c, createDomain as d, subscriptions as et, errorEnvelope as f, one as g, notify as h, createInstance as i, matchesOIDCBinding as it, createTicketSearch as j, requireSession as k, appendEvents as l, json as m, emailCodesAvailable as n, workspaceMembers as nt, otherActiveAdministrator as o, fail as p, notificationPreferences as q, signInProviders as r, workspaces as rt, ownedWorkspaces as s, createAuth as t, tickets as tt, assertVersion as u, recipientColumns as v, DeliveryError as w, receiveRepositoryWebhook as x, requireRow as y, attachmentContent as z };
+export { stagedUploads as $, requireSession as A, attachmentContent as B, defaultSenders as C, createAccess as D, createHttpSender as E, decodeImage as F, events as G, blobObjects as H, imageResponse as I, notificationPreferences as J, instanceSettings as K, stagedUploadCutoff as L, createTicketSearch as M, createTicketIndex as N, createWriteLimiter as O, createBlobStorage as P, pushDevices as Q, createObjectStore as R, receiveRepositoryWebhook as S, DeliveryError as T, deliveryCheckpoints as U, attachments as V, eventClock as W, profilePhotos as X, notifications as Y, projects as Z, one as _, deliverySecrets as a, matchesOIDCBinding as at, requireRow as b, ownerBlocker as c, createDomain as d, storageBackends as et, errorEnvelope as f, notify as g, json as h, createInstance as i, workspaces as it, readCalendarFeed as j, requireInstanceAdmin as k, appendEvents as l, intakeOnly as m, emailCodesAvailable as n, tickets as nt, otherActiveAdministrator as o, fail as p, members as q, signInProviders as r, workspaceMembers as rt, ownedWorkspaces as s, createAuth as t, subscriptions as tt, assertVersion as u, reachable as v, deliverBatch as w, processImports as x, recipientColumns as y, createPollingJob as z };