@maudecode/kanvil 0.5.1 → 0.6.1

package/apps/server/dist/{auth-Bm6cIseE.mjs → auth-CFjetlB4.mjs}

@@ -1,5 +1,5 @@
-import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-CrJuk5mY.mjs";
-import { $ as permissionLabels, A as hasAdminRole, At as workflowOrder, Bt as searchSettingsSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, Ft as instanceUpdateSchema, J as operationPermission, N as importSecretFields, Nt as authenticationPolicySchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as brokerSettingsSchema, Q as parsePublicOutput, Rt as s3SettingsSchema, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, jt as workspaceSchema, k as formatEvent, kt as ticketSummarySchema, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchAuthentication } from "./src-D80LNZKP.mjs";
+import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-BQw6mPzE.mjs";
+import { $ as permissionLabels, A as hasAdminRole, At as workflowOrder, Bt as searchSettingsSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, Ft as instanceUpdateSchema, J as operationPermission, N as importSecretFields, Nt as authenticationPolicySchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as brokerSettingsSchema, Q as parsePublicOutput, Rt as s3SettingsSchema, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, jt as workspaceSchema, k as formatEvent, kt as ticketSummarySchema, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchAuthentication } from "./src-BaTNDJB7.mjs";
 import { and, asc, count, desc, eq, getTableColumns, gt, ilike, inArray, isNotNull, isNull, lt, lte, ne, notInArray, or, sql } from "drizzle-orm";
 import { alias, bigint, boolean, check, customType, foreignKey, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unionAll, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 import { z } from "zod";
@@ -218,6 +218,7 @@ const tickets = pgTable("tickets", {
 	automationReady: boolean("automation_ready").notNull().default(false),
 	claimRequired: boolean("claim_required").notNull().default(false),
 	holdReason: text("hold_reason"),
+	intakeCredentialId: text("intake_credential_id"),
 	startAt: timestamp("start_at", { withTimezone: true }),
 	dueAt: timestamp("due_at", { withTimezone: true }),
 	archived: boolean("archived").notNull().default(false),
@@ -233,6 +234,7 @@ const tickets = pgTable("tickets", {
 	index("ticket_parent").on(table.parentId),
 	index("ticket_project_position").on(table.projectId, table.position),
 	index("ticket_state").on(table.stateId),
+	index("ticket_intake_credential").on(table.intakeCredentialId).where(sql`${table.intakeCredentialId} IS NOT NULL`),
 	foreignKey({
 		name: "ticket_workflow_state",
 		columns: [
@@ -711,8 +713,7 @@ const createObjectStore = (configuration) => {
 	if (!create) throw new Error("Unsupported object storage provider");
 	return create(configuration.config);
 };
-//#endregion
-//#region src/blob-storage.ts
+const intakeAttachmentLifetime = 2592e6;
 const stagedUploadCutoff = () => new Date(Date.now() - stagedUploadLifetime);
 const digest$1 = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function decodeBlobData(value, limit) {
@@ -811,6 +812,31 @@ function createBlobStorage(database, instance, factory = createObjectStore, sche
 		});
 	}
 	async function collectBatch() {
+		await database.db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361080)`);
+			const expired = await tx.select({
+				attachment: attachments,
+				key: tickets.key,
+				title: tickets.title
+			}).from(attachments).innerJoin(tickets, eq(tickets.id, attachments.ticketId)).where(and(isNotNull(tickets.intakeCredentialId), eq(tickets.holdReason, intakeHoldReason), lt(attachments.createdAt, /* @__PURE__ */ new Date(Date.now() - intakeAttachmentLifetime)))).orderBy(asc(attachments.createdAt), asc(attachments.id)).limit(100);
+			if (!expired.length) return;
+			await tx.delete(attachments).where(inArray(attachments.id, expired.map(({ attachment }) => attachment.id)));
+			await appendEvents(tx, expired.map(({ attachment, key, title }) => ({
+				projectId: attachment.projectId,
+				ticketId: attachment.ticketId,
+				actorId: null,
+				type: "attachment.deleted",
+				data: {
+					attachmentId: attachment.id,
+					key,
+					title,
+					source: {
+						kind: "system",
+						id: "blob-cleanup"
+					}
+				}
+			})));
+		});
 		return database.db.transaction(async (tx) => {
 			await tx.delete(stagedUploads).where(lt(stagedUploads.createdAt, stagedUploadCutoff()));
 			const rows = await tx.select({ object: blobObjects }).from(blobObjects).leftJoin(attachments, eq(attachments.objectId, blobObjects.id)).leftJoin(profilePhotos, eq(profilePhotos.objectId, blobObjects.id)).leftJoin(stagedUploads, eq(stagedUploads.id, blobObjects.id)).leftJoin(projects, or(eq(projects.iconObjectId, blobObjects.id), eq(projects.backgroundObjectId, blobObjects.id))).where(and(isNull(attachments.id), isNull(profilePhotos.userId), isNull(stagedUploads.id), isNull(projects.id), lt(blobObjects.createdAt, /* @__PURE__ */ new Date(Date.now() - 864e5)))).limit(20).for("update", {
@@ -2453,7 +2479,8 @@ async function createTicketRow(ctx, input) {
 		customFields: intakeOnly(ctx.actor) ? {} : applyCustomFieldValues(await projectCustomFields(ctx), null, customFields),
 		...await allocateTicket(ctx),
 		id,
-		createdBy: ctx.actor.id
+		createdBy: ctx.actor.id,
+		intakeCredentialId: intakeOnly(ctx.actor) ? ctx.actor.ownerId : null
 	}).returning());
 	await subscribe(ctx, row.projectId, row.id, [ctx.actor.id, row.assigneeId]);
 	return {
@@ -3495,6 +3522,14 @@ const collaborationHandlers = {
 	async upload_attachment(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
 		const bytes = decodeBlobData(input.data, attachmentLimit);
+		if (intakeOnly(ctx.actor)) {
+			const stored = one(await ctx.db.select({
+				files: sql`count(*) filter (where ${attachments.ticketId} = ${ticket.id})`.mapWith(Number),
+				bytes: sql`coalesce(sum(${attachments.size}), 0)`.mapWith(Number)
+			}).from(attachments).innerJoin(tickets, eq(tickets.id, attachments.ticketId)).where(and(eq(tickets.intakeCredentialId, ctx.actor.ownerId), eq(tickets.holdReason, intakeHoldReason))));
+			if (stored.files >= 10) fail(409, "attachment_limit", `An intake credential can attach at most 10 files to a ticket`);
+			if (stored.bytes + bytes.length > 1e9) fail(409, "attachment_limit", "This intake credential's untriaged tickets hold too many attachment bytes");
+		}
 		const id = crypto.randomUUID();
 		await ctx.blobs.put(ctx.db, id, bytes, input.contentType);
 		const row = one(await ctx.db.insert(attachments).values({
@@ -6969,7 +7004,12 @@ const complete = (status) => closedStates.some((closed) => closed === status);
 const intakeHoldReason = "Untrusted intake: human triage required";
 const intakeQuarantined = (ticket) => ticket.holdReason === intakeHoldReason;
 const intakeOnly = (actor) => actor.scopes.length > 0 && actor.scopes.every((scope) => scope === "intake");
-const hasScope = (actor, scope, operation) => intakeOnly(actor) ? operation === "create_ticket" : actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.some((value) => value !== "intake");
+const intakeOperations = /* @__PURE__ */ new Set([
+	"create_ticket",
+	"upload_attachment",
+	"list_attachments"
+]);
+const hasScope = (actor, scope, operation) => intakeOnly(actor) ? !!operation && intakeOperations.has(operation) : actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.some((value) => value !== "intake");
 function requireScope(actor, scope, operation) {
 	if (!hasScope(actor, scope, operation)) fail(403, "insufficient_scope", `This credential requires ${scope} permission`);
 }
@@ -7046,7 +7086,9 @@ async function context(db, actor, scope, projectId, workspaceId, permission = sc
 	};
 }
 async function getTicket(ctx, identifier) {
-	return one(await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), ticketMatch(identifier))).limit(1));
+	const ticket = one(await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), ticketMatch(identifier))).limit(1));
+	if (intakeOnly(ctx.actor) && !(ticket.intakeCredentialId === ctx.actor.ownerId && intakeQuarantined(ticket))) fail(404, "not_found", "The requested record was not found");
+	return ticket;
 }
 const insertBatch = 1e3;
 async function insertAll(rows, insert) {

package/apps/server/dist/client.mjs

@@ -1,4 +1,4 @@
-import { C as errorSchema, Ct as streamErrorSchema, E as eventSchema, G as notificationReadInput, H as notificationIdsInput, K as notificationsSchema, Q as parsePublicOutput, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, Z as parseOutput, a as checkpointSchema, at as publicOperations, q as okSchema, t as ApiError, yt as snapshotSchema } from "./src-D80LNZKP.mjs";
+import { C as errorSchema, Ct as streamErrorSchema, E as eventSchema, G as notificationReadInput, H as notificationIdsInput, K as notificationsSchema, Q as parsePublicOutput, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, Z as parseOutput, a as checkpointSchema, at as publicOperations, q as okSchema, t as ApiError, yt as snapshotSchema } from "./src-BaTNDJB7.mjs";
 import { z } from "zod";
 import { parseArgs } from "node:util";
 import { constants } from "node:fs";

package/apps/server/dist/{config-CrJuk5mY.mjs → config-BQw6mPzE.mjs}

@@ -1,4 +1,4 @@
-import { Bt as searchSettingsSchema, Pt as brokerSettingsSchema, Rt as s3SettingsSchema, m as defaultClaimMaxLeaseSeconds, o as claimLeaseSecondsSchema } from "./src-D80LNZKP.mjs";
+import { Bt as searchSettingsSchema, Pt as brokerSettingsSchema, Rt as s3SettingsSchema, m as defaultClaimMaxLeaseSeconds, o as claimLeaseSecondsSchema } from "./src-BaTNDJB7.mjs";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { relations } from "drizzle-orm";

package/apps/server/dist/index.mjs

@@ -1,7 +1,7 @@
-import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CrJuk5mY.mjs";
-import { A as hasAdminRole, B as memberSchema, Bt as searchSettingsSchema, C as errorSchema, Ft as instanceUpdateSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoInputSchema, L as isPresetColor, Lt as photoResultSchema, M as importProviderDefinitions, Mt as adminInstanceSchema, Pt as brokerSettingsSchema, R as isPublicOperation, Rt as s3SettingsSchema, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels } from "./src-D80LNZKP.mjs";
+import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-BQw6mPzE.mjs";
+import { A as hasAdminRole, B as memberSchema, Bt as searchSettingsSchema, C as errorSchema, Ft as instanceUpdateSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoInputSchema, L as isPresetColor, Lt as photoResultSchema, M as importProviderDefinitions, Mt as adminInstanceSchema, Pt as brokerSettingsSchema, R as isPublicOperation, Rt as s3SettingsSchema, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels } from "./src-BaTNDJB7.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { $ as stagedUploads, A as requireSession, B as attachmentContent, C as defaultSenders, D as createAccess, E as createHttpSender, F as decodeImage, G as events, H as blobObjects, I as imageResponse, J as notificationPreferences, L as stagedUploadCutoff, M as createTicketSearch, N as createTicketIndex, O as createWriteLimiter, P as createBlobStorage, Q as pushDevices, R as createObjectStore, S as receiveRepositoryWebhook, T as DeliveryError, U as deliveryCheckpoints, V as attachments, W as eventClock, X as profilePhotos, Y as notifications, Z as projects, _ as one, a as deliverySecrets, at as matchesOIDCBinding, b as requireRow, c as ownerBlocker, d as createDomain, et as storageBackends, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaces, j as readCalendarFeed, k as requireInstanceAdmin, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as tickets, o as otherActiveAdministrator, p as fail, q as members, r as signInProviders, rt as workspaceMembers, s as ownedWorkspaces, t as createAuth, tt as subscriptions, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createPollingJob } from "./auth-Bm6cIseE.mjs";
+import { $ as stagedUploads, A as requireSession, B as attachmentContent, C as defaultSenders, D as createAccess, E as createHttpSender, F as decodeImage, G as events, H as blobObjects, I as imageResponse, J as notificationPreferences, L as stagedUploadCutoff, M as createTicketSearch, N as createTicketIndex, O as createWriteLimiter, P as createBlobStorage, Q as pushDevices, R as createObjectStore, S as receiveRepositoryWebhook, T as DeliveryError, U as deliveryCheckpoints, V as attachments, W as eventClock, X as profilePhotos, Y as notifications, Z as projects, _ as one, a as deliverySecrets, at as matchesOIDCBinding, b as requireRow, c as ownerBlocker, d as createDomain, et as storageBackends, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaces, j as readCalendarFeed, k as requireInstanceAdmin, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as tickets, o as otherActiveAdministrator, p as fail, q as members, r as signInProviders, rt as workspaceMembers, s as ownedWorkspaces, t as createAuth, tt as subscriptions, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createPollingJob } from "./auth-CFjetlB4.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
@@ -359,7 +359,7 @@ function createCleanup() {
 }
 //#endregion
 //#region src/version.ts
-const applicationVersion = "0.5.1";
+const applicationVersion = "0.6.1";
 //#endregion
 //#region src/realtime.ts
 async function createRealtime(config) {
@@ -3436,10 +3436,15 @@ async function initializeApplication(database, config, adapters, cleanup) {
 		const result = await receiveRepositoryWebhook(domain, repositories, secrets, c.req.param("connectionId"), c.req.raw.headers, await c.req.text());
 		return c.json(result, result.outcome === "duplicate" ? 200 : 202);
 	});
+	const intakeRoutes = [
+		["POST", /^\/api\/v1\/projects\/[^/]+\/tickets$/],
+		["POST", /^\/api\/v1\/projects\/[^/]+\/tickets\/[^/]+\/attachments$/],
+		["GET", /^\/api\/v1\/projects\/[^/]+\/tickets\/[^/]+\/attachments$/]
+	];
 	app.use("/api/v1/*", async (c, next) => {
 		access.checkOrigin(c.req.raw);
 		const actor = await access.authenticate(c.req.raw);
-		if (intakeOnly(actor) && !(c.req.method === "POST" && /^\/api\/v1\/projects\/[^/]+\/tickets$/.test(c.req.path))) fail(403, "insufficient_scope", "Intake credentials can only create tickets");
+		if (intakeOnly(actor) && !intakeRoutes.some(([method, path]) => c.req.method === method && path.test(c.req.path))) fail(403, "insufficient_scope", "Intake credentials can only create tickets and attach files to them");
 		c.set("actor", actor);
 		if (!actor.machine && ![
 			"GET",

package/apps/server/dist/migrate.mjs

@@ -1,4 +1,4 @@
-import { n as createDatabase, t as readConfig } from "./config-CrJuk5mY.mjs";
+import { n as createDatabase, t as readConfig } from "./config-BQw6mPzE.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
 const database = createDatabase(readConfig());

package/apps/server/dist/recover.mjs

@@ -1,6 +1,6 @@
-import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CrJuk5mY.mjs";
-import { A as hasAdminRole } from "./src-D80LNZKP.mjs";
-import { K as instanceSettings, p as fail, t as createAuth } from "./auth-Bm6cIseE.mjs";
+import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-BQw6mPzE.mjs";
+import { A as hasAdminRole } from "./src-BaTNDJB7.mjs";
+import { K as instanceSettings, p as fail, t as createAuth } from "./auth-CFjetlB4.mjs";
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";

package/apps/server/dist/{src-D80LNZKP.mjs → src-BaTNDJB7.mjs}

@@ -1,5 +1,79 @@
 import { z } from "zod";
 import i18next from "i18next";
+//#region ../../packages/contracts/src/icons.ts
+const ticketSymbols = {
+	status: {
+		backlog: {
+			icon: "circle-dashed",
+			tone: "muted"
+		},
+		todo: {
+			icon: "circle",
+			tone: "muted"
+		},
+		in_progress: {
+			icon: "circle-dot",
+			tone: "accent"
+		},
+		in_review: {
+			icon: "clock",
+			tone: "warning"
+		},
+		done: {
+			icon: "circle-check",
+			tone: "success"
+		},
+		cancelled: {
+			icon: "circle-x",
+			tone: "muted"
+		}
+	},
+	priority: {
+		urgent: {
+			icon: "octagon-alert",
+			tone: "danger"
+		},
+		high: {
+			icon: "arrow-up",
+			tone: "warning"
+		},
+		medium: {
+			icon: "equal",
+			tone: "foreground"
+		},
+		low: {
+			icon: "arrow-down",
+			tone: "accent"
+		},
+		none: {
+			icon: "minus",
+			tone: "muted"
+		}
+	},
+	kind: {
+		feature: {
+			icon: "sparkles",
+			tone: "muted"
+		},
+		bug: {
+			icon: "bug",
+			tone: "muted"
+		},
+		chore: {
+			icon: "wrench",
+			tone: "muted"
+		},
+		research: {
+			icon: "flask-conical",
+			tone: "muted"
+		},
+		documentation: {
+			icon: "book-open",
+			tone: "muted"
+		}
+	}
+};
+//#endregion
 //#region ../../packages/contracts/src/instance.ts
 const endpoint$1 = z.url({ protocol: /^https?$/ }).refine((value) => !/^https?:\/\/[^/]*@/.test(value) && !/[?#]/.test(value), "Use an HTTP(S) endpoint without embedded credentials");
 const s3SettingsSchema = z.object({
@@ -930,6 +1004,7 @@ var en_US_default = {
 	},
 	ticket: {
 		list: {
+			manageViews: "Manage views",
 			selectSection: "Select {{section}} tickets",
 			expandSection: "Expand {{section}} tickets",
 			collapseSection: "Collapse {{section}} tickets",
@@ -1058,6 +1133,7 @@ var en_US_default = {
 			noDue: "No due date"
 		},
 		filter: {
+			add: "Add filter",
 			me: "Me",
 			searchTickets: "Search tickets",
 			searchTicketsPlaceholder: "Search tickets…",
@@ -1550,7 +1626,7 @@ var en_US_default = {
 			permission: {
 				intake: {
 					name: "Submit reports",
-					description: "Create quarantined tickets only. Cannot read or edit tickets. Use alone."
+					description: "Create quarantined tickets and attach files to them only. Cannot read or edit tickets. Use alone."
 				},
 				read: {
 					name: "Read tickets",
@@ -2497,6 +2573,9 @@ var en_US_default = {
 		}
 	},
 	native: {
+		"navigation.projectButton": "{{project}} ⌄",
+		"navigation.recentProjects": "Recent projects",
+		"navigation.switchProject": "Switch workspace or project",
 		labelValue: "{{label}}: {{value}}",
 		ui: {
 			dismiss: "Dismiss",
@@ -2545,6 +2624,10 @@ var en_US_default = {
 			create: "Create project"
 		},
 		tickets: {
+			options: "List options",
+			expandAll: "Expand all sections",
+			collapseAll: "Collapse all sections",
+			select: "Select tickets",
 			search: "Search tickets",
 			searchPlaceholder: "Title, description, or key",
 			allStatuses: "All statuses",
@@ -2671,6 +2754,7 @@ var en_US_default = {
 			next: "Next activity"
 		},
 		inbox: {
+			read: "Read",
 			markAllRead: "Mark all read",
 			empty: "No notifications"
 		},
@@ -2855,6 +2939,7 @@ const attachmentLimit = 1e7;
 const stagedUploadLifetime = 864e5;
 const stateLabels = labelTable(states, (value) => t(`common.status.${value}`));
 const priorityLabels = labelTable(priorities, (value) => t(`common.priority.${value}`));
+ticketSymbols.status.backlog.tone, ticketSymbols.status.todo.tone, ticketSymbols.status.in_progress.tone, ticketSymbols.status.in_review.tone, ticketSymbols.status.done.tone, ticketSymbols.status.cancelled.tone;
 const id = z.string().min(1).max(80);
 const timestamp = z.iso.datetime();
 const version = z.number().int().positive();
@@ -4635,7 +4720,7 @@ const operations = {
 	upload_attachment: op(ticketInput.extend({
 		...mutation,
 		...fileFields
-	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path."),
+	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path. An intake credential can attach up to 10 files to a quarantined ticket it created, within 1 GB across its quarantined tickets."),
 	stage_upload: op(projectInput.extend({
 		...mutation,
 		...fileFields
@@ -4644,7 +4729,7 @@ const operations = {
 		...mutation,
 		uploadId: z.uuid()
 	}).strict(), okSchema, "DELETE", "/projects/{projectId}/uploads/{uploadId}", "write", "Delete one of your unclaimed staged uploads and its bytes."),
-	list_attachments: op(ticketInput, z.array(attachmentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/attachments", "read", "List authorized attachment metadata."),
+	list_attachments: op(ticketInput, z.array(attachmentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/attachments", "read", "List authorized attachment metadata. An intake credential can list them on a quarantined ticket it created."),
 	delete_attachment: op(projectInput.extend({
 		...mutation,
 		attachmentId: z.uuid()

package/apps/server/drizzle/0039_intake_credential.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "tickets" ADD COLUMN "intake_credential_id" text;--> statement-breakpoint
+CREATE INDEX "ticket_intake_credential" ON "tickets" USING btree ("intake_credential_id") WHERE "tickets"."intake_credential_id" IS NOT NULL;