@maudecode/kanvil 0.5.0 → 0.6.1

package/apps/server/dist/{auth-Cs_whzgk.mjs → auth-CFjetlB4.mjs}

@@ -1,5 +1,5 @@
-import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-DKuNQY5b.mjs";
-import { $ as permissionLabels, A as hasAdminRole, At as workflowOrder, Bt as searchSettingsSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, Ft as instanceUpdateSchema, J as operationPermission, N as importSecretFields, Nt as authenticationPolicySchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as brokerSettingsSchema, Q as parsePublicOutput, Rt as s3SettingsSchema, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, jt as workspaceSchema, k as formatEvent, kt as ticketSummarySchema, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchAuthentication } from "./src-DptOUNRd.mjs";
+import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-BQw6mPzE.mjs";
+import { $ as permissionLabels, A as hasAdminRole, At as workflowOrder, Bt as searchSettingsSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, Ft as instanceUpdateSchema, J as operationPermission, N as importSecretFields, Nt as authenticationPolicySchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as brokerSettingsSchema, Q as parsePublicOutput, Rt as s3SettingsSchema, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, jt as workspaceSchema, k as formatEvent, kt as ticketSummarySchema, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchAuthentication } from "./src-BaTNDJB7.mjs";
 import { and, asc, count, desc, eq, getTableColumns, gt, ilike, inArray, isNotNull, isNull, lt, lte, ne, notInArray, or, sql } from "drizzle-orm";
 import { alias, bigint, boolean, check, customType, foreignKey, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unionAll, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 import { z } from "zod";
@@ -218,6 +218,7 @@ const tickets = pgTable("tickets", {
 	automationReady: boolean("automation_ready").notNull().default(false),
 	claimRequired: boolean("claim_required").notNull().default(false),
 	holdReason: text("hold_reason"),
+	intakeCredentialId: text("intake_credential_id"),
 	startAt: timestamp("start_at", { withTimezone: true }),
 	dueAt: timestamp("due_at", { withTimezone: true }),
 	archived: boolean("archived").notNull().default(false),
@@ -233,6 +234,7 @@ const tickets = pgTable("tickets", {
 	index("ticket_parent").on(table.parentId),
 	index("ticket_project_position").on(table.projectId, table.position),
 	index("ticket_state").on(table.stateId),
+	index("ticket_intake_credential").on(table.intakeCredentialId).where(sql`${table.intakeCredentialId} IS NOT NULL`),
 	foreignKey({
 		name: "ticket_workflow_state",
 		columns: [
@@ -711,8 +713,7 @@ const createObjectStore = (configuration) => {
 	if (!create) throw new Error("Unsupported object storage provider");
 	return create(configuration.config);
 };
-//#endregion
-//#region src/blob-storage.ts
+const intakeAttachmentLifetime = 2592e6;
 const stagedUploadCutoff = () => new Date(Date.now() - stagedUploadLifetime);
 const digest$1 = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function decodeBlobData(value, limit) {
@@ -811,6 +812,31 @@ function createBlobStorage(database, instance, factory = createObjectStore, sche
 		});
 	}
 	async function collectBatch() {
+		await database.db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361080)`);
+			const expired = await tx.select({
+				attachment: attachments,
+				key: tickets.key,
+				title: tickets.title
+			}).from(attachments).innerJoin(tickets, eq(tickets.id, attachments.ticketId)).where(and(isNotNull(tickets.intakeCredentialId), eq(tickets.holdReason, intakeHoldReason), lt(attachments.createdAt, /* @__PURE__ */ new Date(Date.now() - intakeAttachmentLifetime)))).orderBy(asc(attachments.createdAt), asc(attachments.id)).limit(100);
+			if (!expired.length) return;
+			await tx.delete(attachments).where(inArray(attachments.id, expired.map(({ attachment }) => attachment.id)));
+			await appendEvents(tx, expired.map(({ attachment, key, title }) => ({
+				projectId: attachment.projectId,
+				ticketId: attachment.ticketId,
+				actorId: null,
+				type: "attachment.deleted",
+				data: {
+					attachmentId: attachment.id,
+					key,
+					title,
+					source: {
+						kind: "system",
+						id: "blob-cleanup"
+					}
+				}
+			})));
+		});
 		return database.db.transaction(async (tx) => {
 			await tx.delete(stagedUploads).where(lt(stagedUploads.createdAt, stagedUploadCutoff()));
 			const rows = await tx.select({ object: blobObjects }).from(blobObjects).leftJoin(attachments, eq(attachments.objectId, blobObjects.id)).leftJoin(profilePhotos, eq(profilePhotos.objectId, blobObjects.id)).leftJoin(stagedUploads, eq(stagedUploads.id, blobObjects.id)).leftJoin(projects, or(eq(projects.iconObjectId, blobObjects.id), eq(projects.backgroundObjectId, blobObjects.id))).where(and(isNull(attachments.id), isNull(profilePhotos.userId), isNull(stagedUploads.id), isNull(projects.id), lt(blobObjects.createdAt, /* @__PURE__ */ new Date(Date.now() - 864e5)))).limit(20).for("update", {
@@ -2453,7 +2479,8 @@ async function createTicketRow(ctx, input) {
 		customFields: intakeOnly(ctx.actor) ? {} : applyCustomFieldValues(await projectCustomFields(ctx), null, customFields),
 		...await allocateTicket(ctx),
 		id,
-		createdBy: ctx.actor.id
+		createdBy: ctx.actor.id,
+		intakeCredentialId: intakeOnly(ctx.actor) ? ctx.actor.ownerId : null
 	}).returning());
 	await subscribe(ctx, row.projectId, row.id, [ctx.actor.id, row.assigneeId]);
 	return {
@@ -3036,11 +3063,17 @@ const ticketHandlers = {
 	},
 	async recover_claim(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
-		const current = one(await ctx.db.select().from(claims).where(and(eq(claims.id, input.claimId), eq(claims.ticketId, ticket.id))));
-		if (input.cancelActive && !can(ctx, "project.manage")) fail(403, "forbidden", "Cancelling an active claim requires project management access and admin scope");
-		if (current.expiresAt > /* @__PURE__ */ new Date() && !input.cancelActive) fail(409, "claim_not_expired", "The current claim has not expired");
-		if (input.reschedule && input.expectedVersion !== void 0) {
-			assertVersion(ticket, input.expectedVersion, "ticket", "rescheduling recovered work");
+		const current = input.claimId === void 0 ? void 0 : one(await ctx.db.select().from(claims).where(and(eq(claims.id, input.claimId), eq(claims.ticketId, ticket.id))));
+		if (!current) {
+			const held = (await ctx.db.select({ id: claims.id }).from(claims).where(eq(claims.ticketId, ticket.id)).limit(1))[0];
+			if (held) fail(409, "claim_conflict", "This ticket has a claim; recover it by its claim ID", { claimId: held.id });
+			if (!ticket.claimRequired) fail(409, "claim_not_required", "This ticket does not require ownership to recover");
+		} else {
+			if (input.cancelActive && !can(ctx, "project.manage")) fail(403, "forbidden", "Cancelling an active claim requires project management access and admin scope");
+			if (current.expiresAt > /* @__PURE__ */ new Date() && !input.cancelActive) fail(409, "claim_not_expired", "The current claim has not expired");
+		}
+		if (input.expectedVersion !== void 0 && (input.reschedule || !current)) assertVersion(ticket, input.expectedVersion, "ticket", "recovering ownership");
+		if (input.reschedule) {
 			const row = one(await ctx.db.update(tickets).set({
 				...await resolveState(ctx, { status: "todo" }, ticket),
 				version: ticket.version + 1,
@@ -3061,12 +3094,12 @@ const ticketHandlers = {
 				changedFields: ["claimRequired"]
 			});
 		}
-		await ctx.db.delete(claims).where(eq(claims.id, current.id));
+		if (current) await ctx.db.delete(claims).where(eq(claims.id, current.id));
 		await publish(ctx, "claim.recovered", ticket.id, {
-			claimId: current.id,
+			claimId: current?.id ?? null,
 			reason: input.reason,
 			confirmedStopped: true,
-			...input.cancelActive && { cancelActive: true }
+			...current && input.cancelActive && { cancelActive: true }
 		});
 		return { ok: true };
 	}
@@ -3489,6 +3522,14 @@ const collaborationHandlers = {
 	async upload_attachment(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
 		const bytes = decodeBlobData(input.data, attachmentLimit);
+		if (intakeOnly(ctx.actor)) {
+			const stored = one(await ctx.db.select({
+				files: sql`count(*) filter (where ${attachments.ticketId} = ${ticket.id})`.mapWith(Number),
+				bytes: sql`coalesce(sum(${attachments.size}), 0)`.mapWith(Number)
+			}).from(attachments).innerJoin(tickets, eq(tickets.id, attachments.ticketId)).where(and(eq(tickets.intakeCredentialId, ctx.actor.ownerId), eq(tickets.holdReason, intakeHoldReason))));
+			if (stored.files >= 10) fail(409, "attachment_limit", `An intake credential can attach at most 10 files to a ticket`);
+			if (stored.bytes + bytes.length > 1e9) fail(409, "attachment_limit", "This intake credential's untriaged tickets hold too many attachment bytes");
+		}
 		const id = crypto.randomUUID();
 		await ctx.blobs.put(ctx.db, id, bytes, input.contentType);
 		const row = one(await ctx.db.insert(attachments).values({
@@ -6963,7 +7004,12 @@ const complete = (status) => closedStates.some((closed) => closed === status);
 const intakeHoldReason = "Untrusted intake: human triage required";
 const intakeQuarantined = (ticket) => ticket.holdReason === intakeHoldReason;
 const intakeOnly = (actor) => actor.scopes.length > 0 && actor.scopes.every((scope) => scope === "intake");
-const hasScope = (actor, scope, operation) => intakeOnly(actor) ? operation === "create_ticket" : actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.some((value) => value !== "intake");
+const intakeOperations = /* @__PURE__ */ new Set([
+	"create_ticket",
+	"upload_attachment",
+	"list_attachments"
+]);
+const hasScope = (actor, scope, operation) => intakeOnly(actor) ? !!operation && intakeOperations.has(operation) : actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.some((value) => value !== "intake");
 function requireScope(actor, scope, operation) {
 	if (!hasScope(actor, scope, operation)) fail(403, "insufficient_scope", `This credential requires ${scope} permission`);
 }
@@ -7040,7 +7086,9 @@ async function context(db, actor, scope, projectId, workspaceId, permission = sc
 	};
 }
 async function getTicket(ctx, identifier) {
-	return one(await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), ticketMatch(identifier))).limit(1));
+	const ticket = one(await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), ticketMatch(identifier))).limit(1));
+	if (intakeOnly(ctx.actor) && !(ticket.intakeCredentialId === ctx.actor.ownerId && intakeQuarantined(ticket))) fail(404, "not_found", "The requested record was not found");
+	return ticket;
 }
 const insertBatch = 1e3;
 async function insertAll(rows, insert) {

package/apps/server/dist/client.mjs

@@ -1,4 +1,4 @@
-import { C as errorSchema, Ct as streamErrorSchema, E as eventSchema, G as notificationReadInput, H as notificationIdsInput, K as notificationsSchema, Q as parsePublicOutput, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, Z as parseOutput, a as checkpointSchema, at as publicOperations, q as okSchema, t as ApiError, yt as snapshotSchema } from "./src-DptOUNRd.mjs";
+import { C as errorSchema, Ct as streamErrorSchema, E as eventSchema, G as notificationReadInput, H as notificationIdsInput, K as notificationsSchema, Q as parsePublicOutput, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, Z as parseOutput, a as checkpointSchema, at as publicOperations, q as okSchema, t as ApiError, yt as snapshotSchema } from "./src-BaTNDJB7.mjs";
 import { z } from "zod";
 import { parseArgs } from "node:util";
 import { constants } from "node:fs";
@@ -403,7 +403,7 @@ function createClient(options) {
 			return request(url, init);
 		}
 	};
-	const send = async (spec, input, base) => {
+	const send = async (spec, input, base, signal) => {
 		const values = { ...spec.input.parse(input) };
 		const path = spec.path.replace(/\{(\w+)\}/g, (_, key) => {
 			const value = values[key];
@@ -416,7 +416,8 @@ function createClient(options) {
 		const init = {
 			method: spec.method,
 			credentials: options.credentials ?? "include",
-			headers
+			headers,
+			...signal ? { signal } : {}
 		};
 		if (spec.method === "GET") {
 			for (const [key, value] of Object.entries(values)) for (const item of Array.isArray(value) ? value : [value]) if (typeof item === "string" || typeof item === "number" || typeof item === "boolean") url.searchParams.append(key, String(item));
@@ -437,11 +438,11 @@ function createClient(options) {
 				credentials: options.credentials ?? "include"
 			})));
 		},
-		async call(name, input) {
-			return parseOutput(name, await send(operations[name], input, "/api/v1"));
+		async call(name, input, signal) {
+			return parseOutput(name, await send(operations[name], input, "/api/v1", signal));
 		},
-		async callPublic(name, input) {
-			return parsePublicOutput(name, await send(publicOperations[name], input, "/api/public"));
+		async callPublic(name, input, signal) {
+			return parsePublicOutput(name, await send(publicOperations[name], input, "/api/public", signal));
 		},
 		async subscribe(subscription) {
 			let cursor = subscription.cursor, backoff = 1e3;
@@ -599,7 +600,7 @@ function createClient(options) {
 					name,
 					input
 				],
-				queryFn: () => api.call(name, input)
+				queryFn: ({ signal } = {}) => api.call(name, input, signal)
 			};
 		},
 		publicQuery(name, input) {
@@ -610,7 +611,7 @@ function createClient(options) {
 					name,
 					input
 				],
-				queryFn: () => api.callPublic(name, input)
+				queryFn: ({ signal } = {}) => api.callPublic(name, input, signal)
 			};
 		},
 		action(name) {

package/apps/server/dist/{config-DKuNQY5b.mjs → config-BQw6mPzE.mjs}

@@ -1,4 +1,4 @@
-import { Bt as searchSettingsSchema, Pt as brokerSettingsSchema, Rt as s3SettingsSchema, m as defaultClaimMaxLeaseSeconds, o as claimLeaseSecondsSchema } from "./src-DptOUNRd.mjs";
+import { Bt as searchSettingsSchema, Pt as brokerSettingsSchema, Rt as s3SettingsSchema, m as defaultClaimMaxLeaseSeconds, o as claimLeaseSecondsSchema } from "./src-BaTNDJB7.mjs";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { relations } from "drizzle-orm";

package/apps/server/dist/index.mjs

@@ -1,7 +1,7 @@
-import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DKuNQY5b.mjs";
-import { A as hasAdminRole, B as memberSchema, Bt as searchSettingsSchema, C as errorSchema, Ft as instanceUpdateSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoInputSchema, L as isPresetColor, Lt as photoResultSchema, M as importProviderDefinitions, Mt as adminInstanceSchema, Pt as brokerSettingsSchema, R as isPublicOperation, Rt as s3SettingsSchema, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels } from "./src-DptOUNRd.mjs";
+import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-BQw6mPzE.mjs";
+import { A as hasAdminRole, B as memberSchema, Bt as searchSettingsSchema, C as errorSchema, Ft as instanceUpdateSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoInputSchema, L as isPresetColor, Lt as photoResultSchema, M as importProviderDefinitions, Mt as adminInstanceSchema, Pt as brokerSettingsSchema, R as isPublicOperation, Rt as s3SettingsSchema, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels } from "./src-BaTNDJB7.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { $ as stagedUploads, A as requireSession, B as attachmentContent, C as defaultSenders, D as createAccess, E as createHttpSender, F as decodeImage, G as events, H as blobObjects, I as imageResponse, J as notificationPreferences, L as stagedUploadCutoff, M as createTicketSearch, N as createTicketIndex, O as createWriteLimiter, P as createBlobStorage, Q as pushDevices, R as createObjectStore, S as receiveRepositoryWebhook, T as DeliveryError, U as deliveryCheckpoints, V as attachments, W as eventClock, X as profilePhotos, Y as notifications, Z as projects, _ as one, a as deliverySecrets, at as matchesOIDCBinding, b as requireRow, c as ownerBlocker, d as createDomain, et as storageBackends, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaces, j as readCalendarFeed, k as requireInstanceAdmin, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as tickets, o as otherActiveAdministrator, p as fail, q as members, r as signInProviders, rt as workspaceMembers, s as ownedWorkspaces, t as createAuth, tt as subscriptions, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createPollingJob } from "./auth-Cs_whzgk.mjs";
+import { $ as stagedUploads, A as requireSession, B as attachmentContent, C as defaultSenders, D as createAccess, E as createHttpSender, F as decodeImage, G as events, H as blobObjects, I as imageResponse, J as notificationPreferences, L as stagedUploadCutoff, M as createTicketSearch, N as createTicketIndex, O as createWriteLimiter, P as createBlobStorage, Q as pushDevices, R as createObjectStore, S as receiveRepositoryWebhook, T as DeliveryError, U as deliveryCheckpoints, V as attachments, W as eventClock, X as profilePhotos, Y as notifications, Z as projects, _ as one, a as deliverySecrets, at as matchesOIDCBinding, b as requireRow, c as ownerBlocker, d as createDomain, et as storageBackends, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaces, j as readCalendarFeed, k as requireInstanceAdmin, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as tickets, o as otherActiveAdministrator, p as fail, q as members, r as signInProviders, rt as workspaceMembers, s as ownedWorkspaces, t as createAuth, tt as subscriptions, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createPollingJob } from "./auth-CFjetlB4.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
@@ -359,7 +359,7 @@ function createCleanup() {
 }
 //#endregion
 //#region src/version.ts
-const applicationVersion = "0.5.0";
+const applicationVersion = "0.6.1";
 //#endregion
 //#region src/realtime.ts
 async function createRealtime(config) {
@@ -3436,10 +3436,15 @@ async function initializeApplication(database, config, adapters, cleanup) {
 		const result = await receiveRepositoryWebhook(domain, repositories, secrets, c.req.param("connectionId"), c.req.raw.headers, await c.req.text());
 		return c.json(result, result.outcome === "duplicate" ? 200 : 202);
 	});
+	const intakeRoutes = [
+		["POST", /^\/api\/v1\/projects\/[^/]+\/tickets$/],
+		["POST", /^\/api\/v1\/projects\/[^/]+\/tickets\/[^/]+\/attachments$/],
+		["GET", /^\/api\/v1\/projects\/[^/]+\/tickets\/[^/]+\/attachments$/]
+	];
 	app.use("/api/v1/*", async (c, next) => {
 		access.checkOrigin(c.req.raw);
 		const actor = await access.authenticate(c.req.raw);
-		if (intakeOnly(actor) && !(c.req.method === "POST" && /^\/api\/v1\/projects\/[^/]+\/tickets$/.test(c.req.path))) fail(403, "insufficient_scope", "Intake credentials can only create tickets");
+		if (intakeOnly(actor) && !intakeRoutes.some(([method, path]) => c.req.method === method && path.test(c.req.path))) fail(403, "insufficient_scope", "Intake credentials can only create tickets and attach files to them");
 		c.set("actor", actor);
 		if (!actor.machine && ![
 			"GET",

package/apps/server/dist/migrate.mjs

@@ -1,4 +1,4 @@
-import { n as createDatabase, t as readConfig } from "./config-DKuNQY5b.mjs";
+import { n as createDatabase, t as readConfig } from "./config-BQw6mPzE.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
 const database = createDatabase(readConfig());

package/apps/server/dist/recover.mjs

@@ -1,6 +1,6 @@
-import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DKuNQY5b.mjs";
-import { A as hasAdminRole } from "./src-DptOUNRd.mjs";
-import { K as instanceSettings, p as fail, t as createAuth } from "./auth-Cs_whzgk.mjs";
+import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-BQw6mPzE.mjs";
+import { A as hasAdminRole } from "./src-BaTNDJB7.mjs";
+import { K as instanceSettings, p as fail, t as createAuth } from "./auth-CFjetlB4.mjs";
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";

package/apps/server/dist/{src-DptOUNRd.mjs → src-BaTNDJB7.mjs}

@@ -1,5 +1,79 @@
 import { z } from "zod";
 import i18next from "i18next";
+//#region ../../packages/contracts/src/icons.ts
+const ticketSymbols = {
+	status: {
+		backlog: {
+			icon: "circle-dashed",
+			tone: "muted"
+		},
+		todo: {
+			icon: "circle",
+			tone: "muted"
+		},
+		in_progress: {
+			icon: "circle-dot",
+			tone: "accent"
+		},
+		in_review: {
+			icon: "clock",
+			tone: "warning"
+		},
+		done: {
+			icon: "circle-check",
+			tone: "success"
+		},
+		cancelled: {
+			icon: "circle-x",
+			tone: "muted"
+		}
+	},
+	priority: {
+		urgent: {
+			icon: "octagon-alert",
+			tone: "danger"
+		},
+		high: {
+			icon: "arrow-up",
+			tone: "warning"
+		},
+		medium: {
+			icon: "equal",
+			tone: "foreground"
+		},
+		low: {
+			icon: "arrow-down",
+			tone: "accent"
+		},
+		none: {
+			icon: "minus",
+			tone: "muted"
+		}
+	},
+	kind: {
+		feature: {
+			icon: "sparkles",
+			tone: "muted"
+		},
+		bug: {
+			icon: "bug",
+			tone: "muted"
+		},
+		chore: {
+			icon: "wrench",
+			tone: "muted"
+		},
+		research: {
+			icon: "flask-conical",
+			tone: "muted"
+		},
+		documentation: {
+			icon: "book-open",
+			tone: "muted"
+		}
+	}
+};
+//#endregion
 //#region ../../packages/contracts/src/instance.ts
 const endpoint$1 = z.url({ protocol: /^https?$/ }).refine((value) => !/^https?:\/\/[^/]*@/.test(value) && !/[?#]/.test(value), "Use an HTTP(S) endpoint without embedded credentials");
 const s3SettingsSchema = z.object({
@@ -930,6 +1004,7 @@ var en_US_default = {
 	},
 	ticket: {
 		list: {
+			manageViews: "Manage views",
 			selectSection: "Select {{section}} tickets",
 			expandSection: "Expand {{section}} tickets",
 			collapseSection: "Collapse {{section}} tickets",
@@ -1058,6 +1133,7 @@ var en_US_default = {
 			noDue: "No due date"
 		},
 		filter: {
+			add: "Add filter",
 			me: "Me",
 			searchTickets: "Search tickets",
 			searchTicketsPlaceholder: "Search tickets…",
@@ -1550,7 +1626,7 @@ var en_US_default = {
 			permission: {
 				intake: {
 					name: "Submit reports",
-					description: "Create quarantined tickets only. Cannot read or edit tickets. Use alone."
+					description: "Create quarantined tickets and attach files to them only. Cannot read or edit tickets. Use alone."
 				},
 				read: {
 					name: "Read tickets",
@@ -2497,6 +2573,9 @@ var en_US_default = {
 		}
 	},
 	native: {
+		"navigation.projectButton": "{{project}} ⌄",
+		"navigation.recentProjects": "Recent projects",
+		"navigation.switchProject": "Switch workspace or project",
 		labelValue: "{{label}}: {{value}}",
 		ui: {
 			dismiss: "Dismiss",
@@ -2545,6 +2624,10 @@ var en_US_default = {
 			create: "Create project"
 		},
 		tickets: {
+			options: "List options",
+			expandAll: "Expand all sections",
+			collapseAll: "Collapse all sections",
+			select: "Select tickets",
 			search: "Search tickets",
 			searchPlaceholder: "Title, description, or key",
 			allStatuses: "All statuses",
@@ -2671,6 +2754,7 @@ var en_US_default = {
 			next: "Next activity"
 		},
 		inbox: {
+			read: "Read",
 			markAllRead: "Mark all read",
 			empty: "No notifications"
 		},
@@ -2855,6 +2939,7 @@ const attachmentLimit = 1e7;
 const stagedUploadLifetime = 864e5;
 const stateLabels = labelTable(states, (value) => t(`common.status.${value}`));
 const priorityLabels = labelTable(priorities, (value) => t(`common.priority.${value}`));
+ticketSymbols.status.backlog.tone, ticketSymbols.status.todo.tone, ticketSymbols.status.in_progress.tone, ticketSymbols.status.in_review.tone, ticketSymbols.status.done.tone, ticketSymbols.status.cancelled.tone;
 const id = z.string().min(1).max(80);
 const timestamp = z.iso.datetime();
 const version = z.number().int().positive();
@@ -4635,7 +4720,7 @@ const operations = {
 	upload_attachment: op(ticketInput.extend({
 		...mutation,
 		...fileFields
-	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path."),
+	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path. An intake credential can attach up to 10 files to a quarantined ticket it created, within 1 GB across its quarantined tickets."),
 	stage_upload: op(projectInput.extend({
 		...mutation,
 		...fileFields
@@ -4644,7 +4729,7 @@ const operations = {
 		...mutation,
 		uploadId: z.uuid()
 	}).strict(), okSchema, "DELETE", "/projects/{projectId}/uploads/{uploadId}", "write", "Delete one of your unclaimed staged uploads and its bytes."),
-	list_attachments: op(ticketInput, z.array(attachmentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/attachments", "read", "List authorized attachment metadata."),
+	list_attachments: op(ticketInput, z.array(attachmentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/attachments", "read", "List authorized attachment metadata. An intake credential can list them on a quarantined ticket it created."),
 	delete_attachment: op(projectInput.extend({
 		...mutation,
 		attachmentId: z.uuid()
@@ -4714,7 +4799,7 @@ const operations = {
 	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/release", "claim", "Release the caller's claim."),
 	recover_claim: op(ticketInput.extend({
 		...mutation,
-		claimId: z.uuid(),
+		claimId: z.uuid().optional(),
 		reason: text.min(10).max(2e3),
 		confirmedStopped: z.literal(true),
 		cancelActive: z.boolean().optional(),
@@ -4723,7 +4808,10 @@ const operations = {
 	}).strict().refine((input) => !input.reschedule || input.expectedVersion !== void 0, {
 		message: "expectedVersion is required to reschedule recovered work",
 		path: ["expectedVersion"]
-	}), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/recover", "claim", "Recover an expired claim after confirming the worker stopped. Optionally reschedule it to To do at its expectedVersion. Project managers with admin scope may explicitly cancel an active claim."),
+	}).refine((input) => input.claimId !== void 0 || input.expectedVersion !== void 0, {
+		message: "expectedVersion is required to recover ownership without a claim",
+		path: ["expectedVersion"]
+	}), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/recover", "claim", "Recover an expired claim after confirming the worker stopped. Optionally reschedule it to To do at its expectedVersion. Project managers with admin scope may explicitly cancel an active claim. Omit claimId, with the ticket's expectedVersion, to lift the ownership requirement of a ticket that has no claim left, such as one released outside To do."),
 	set_subscription: op(ticketInput.extend({
 		...mutation,
 		enabled: z.boolean()

package/apps/server/drizzle/0039_intake_credential.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "tickets" ADD COLUMN "intake_credential_id" text;--> statement-breakpoint
+CREATE INDEX "ticket_intake_credential" ON "tickets" USING btree ("intake_credential_id") WHERE "tickets"."intake_credential_id" IS NOT NULL;