@maudecode/kanvil 0.5.1 → 0.7.0

package/apps/server/dist/{auth-Bm6cIseE.mjs → auth-D43XyHdK.mjs}

@@ -1,11 +1,12 @@
-import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-CrJuk5mY.mjs";
-import { $ as permissionLabels, A as hasAdminRole, At as workflowOrder, Bt as searchSettingsSchema, D as filterKey, Dt as ticketPredicates, E as eventSchema, Et as ticketImportSchema, F as isHexColor, Ft as instanceUpdateSchema, J as operationPermission, N as importSecretFields, Nt as authenticationPolicySchema, O as filterList, Ot as ticketSchema, P as invitationStatuses, Pt as brokerSettingsSchema, Q as parsePublicOutput, Rt as s3SettingsSchema, S as difficulties, St as states, T as eventLabels, Tt as ticketFilter, V as mentionScheme, X as parseCustomFieldFilter, Y as operations, Z as parseOutput, _ as deletedAccountName, _t as seededPermissions, at as publicOperations, b as destinationEventKeys, bt as stagedUploadLifetime, ct as repositoryProviderDefinitions, d as customFieldSchema, dt as resourceProvider, et as permissionScope, f as customFieldValue, ft as roleCategory, g as defaultWorkflow, gt as searchResultTypes, h as defaultOrder, ht as scopes, i as channelRouteAllows, it as projectSchema, jt as workspaceSchema, k as formatEvent, kt as ticketSummarySchema, l as credentialProjectsSchema, lt as repositoryProviders, m as defaultClaimMaxLeaseSeconds, mt as roles, n as attachmentLimit, nt as priorities, p as customFieldValueSchema, pt as roleLabels, r as channelKinds, rt as priorityLabels, s as closedStates, st as remoteKinds, t as ApiError, tt as permissions, u as customFieldFilterTokens, ut as repositorySecretFields, v as deliverySecretFields, vt as signInMethodLabels, w as eventCategories, wt as ticketExportFormat, x as destinationKinds, xt as stateLabels, y as deliverySettingsSchema, yt as snapshotSchema, z as isSeededRole, zt as searchAuthentication } from "./src-D80LNZKP.mjs";
-import { and, asc, count, desc, eq, getTableColumns, gt, ilike, inArray, isNotNull, isNull, lt, lte, ne, notInArray, or, sql } from "drizzle-orm";
+import { a as auth_schema_exports, c as oauthConsent, d as user, i as apikey, l as oauthRefreshToken, o as oauthAccessToken, r as account, s as oauthClient, u as session } from "./config-CQVdVhXv.mjs";
+import { $ as parseCustomFieldFilter, A as filterList, At as ticketImportSchema, Bt as instanceUpdateSchema, C as destinationKinds, Ct as stagedUploadLifetime, D as eventLabels, E as eventCategories, Et as states, F as importSecretFields, Ft as workflowOrder, Gt as searchSettingsSchema, I as invitationStatuses, It as workspaceSchema, L as isHexColor, M as hasAdminRole, Mt as ticketSchema, Nt as ticketSummarySchema, O as eventSchema, Ot as ticketExportFormat, Pt as uploadUrlLifetime, Q as operations, Rt as authenticationPolicySchema, S as destinationEventKeys, St as snapshotSchema, Tt as stateLabels, U as mentionScheme, Ut as s3SettingsSchema, V as isSeededRole, W as normalizeRemote, Wt as searchAuthentication, Z as operationPermission, _ as defaultOrder, _t as roles, a as channelRouteAllows, at as priorities, b as deliverySecretFields, bt as seededPermissions, c as claimSchema, ct as publicOperations, d as credentialProjectsSchema, dt as repositoryProviderDefinitions, et as parseOutput, f as customFieldFilterTokens, ft as repositoryProviders, g as defaultClaimMaxLeaseSeconds, gt as roleLabels, h as customFieldValueSchema, ht as roleCategory, i as channelKinds, it as permissions, j as formatEvent, jt as ticketPredicates, k as filterKey, kt as ticketFilter, l as closedStates, m as customFieldValue, mt as resourceProvider, n as attachmentLimit, nt as permissionLabels, ot as priorityLabels, p as customFieldSchema, pt as repositorySecretFields, r as attachmentSchema, rt as permissionScope, st as projectSchema, t as ApiError, tt as parsePublicOutput, ut as remoteKinds, v as defaultWorkflow, vt as scopes, w as difficulties, wt as stagedUploadSchema, x as deliverySettingsSchema, xt as signInMethodLabels, y as deletedAccountName, yt as searchResultTypes, zt as brokerSettingsSchema } from "./src-D70GmZ5R.mjs";
+import { and, arrayContains, arrayOverlaps, asc, count, desc, eq, getTableColumns, gt, inArray, isNotNull, isNull, lt, lte, ne, notInArray, or, sql } from "drizzle-orm";
 import { alias, bigint, boolean, check, customType, foreignKey, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unionAll, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 import { z } from "zod";
 import { decodeJwt } from "jose";
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "node:crypto";
 import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { isDeepStrictEqual } from "node:util";
 import { icons } from "@iconify-json/lucide";
 import { fromMarkdown } from "mdast-util-from-markdown";
 import { Expo } from "expo-server-sdk";
@@ -136,6 +137,7 @@ const projects = pgTable("projects", {
 	key: text("key").notNull().unique(),
 	name: text("name").notNull(),
 	description: text("description").notNull().default(""),
+	repositories: text("repositories").array().notNull().default([]),
 	nextNumber: integer("next_number").notNull().default(1),
 	position: bigint("position", { mode: "number" }).notNull().default(0),
 	version: integer("version").notNull().default(1),
@@ -218,6 +220,7 @@ const tickets = pgTable("tickets", {
 	automationReady: boolean("automation_ready").notNull().default(false),
 	claimRequired: boolean("claim_required").notNull().default(false),
 	holdReason: text("hold_reason"),
+	intakeCredentialId: text("intake_credential_id"),
 	startAt: timestamp("start_at", { withTimezone: true }),
 	dueAt: timestamp("due_at", { withTimezone: true }),
 	archived: boolean("archived").notNull().default(false),
@@ -233,6 +236,7 @@ const tickets = pgTable("tickets", {
 	index("ticket_parent").on(table.parentId),
 	index("ticket_project_position").on(table.projectId, table.position),
 	index("ticket_state").on(table.stateId),
+	index("ticket_intake_credential").on(table.intakeCredentialId).where(sql`${table.intakeCredentialId} IS NOT NULL`),
 	foreignKey({
 		name: "ticket_workflow_state",
 		columns: [
@@ -302,6 +306,7 @@ const receipts = pgTable("mutation_receipts", {
 	operation: text("operation").notNull(),
 	hash: text("hash").notNull(),
 	result: jsonb("result").notNull(),
+	projectId: uuid("project_id"),
 	createdAt: time("created_at")
 }, (table) => [primaryKey({ columns: [table.actorId, table.requestId] })]);
 const storageBackends = pgTable("storage_backends", {
@@ -367,6 +372,20 @@ const stagedUploads = pgTable("staged_uploads", {
 	size: integer("size").notNull(),
 	createdAt: time("created_at")
 }, (table) => [index("staged_uploads_created").on(table.createdAt)]);
+const uploadUrls = pgTable("upload_urls", {
+	id: uuid("id").primaryKey(),
+	projectId: uuid("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+	ticketId: uuid("ticket_id").references(() => tickets.id, { onDelete: "cascade" }),
+	actorId: text("actor_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+	credential: jsonb("credential"),
+	name: text("name").notNull(),
+	contentType: text("content_type").notNull(),
+	size: integer("size").notNull(),
+	tokenHash: text("token_hash").notNull().unique(),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+	usedAt: timestamp("used_at", { withTimezone: true }),
+	createdAt: time("created_at")
+}, (table) => [index("upload_urls_expires").on(table.expiresAt)]);
 const bytea = customType({ dataType: () => "bytea" });
 const attachmentContent = pgTable("attachment_content", {
 	id: uuid("id").primaryKey().references(() => attachments.id, { onDelete: "cascade" }),
@@ -711,8 +730,7 @@ const createObjectStore = (configuration) => {
 	if (!create) throw new Error("Unsupported object storage provider");
 	return create(configuration.config);
 };
-//#endregion
-//#region src/blob-storage.ts
+const intakeAttachmentLifetime = 2592e6;
 const stagedUploadCutoff = () => new Date(Date.now() - stagedUploadLifetime);
 const digest$1 = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function decodeBlobData(value, limit) {
@@ -811,8 +829,34 @@ function createBlobStorage(database, instance, factory = createObjectStore, sche
 		});
 	}
 	async function collectBatch() {
+		await database.db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361080)`);
+			const expired = await tx.select({
+				attachment: attachments,
+				key: tickets.key,
+				title: tickets.title
+			}).from(attachments).innerJoin(tickets, eq(tickets.id, attachments.ticketId)).where(and(isNotNull(tickets.intakeCredentialId), eq(tickets.holdReason, intakeHoldReason), lt(attachments.createdAt, /* @__PURE__ */ new Date(Date.now() - intakeAttachmentLifetime)))).orderBy(asc(attachments.createdAt), asc(attachments.id)).limit(100);
+			if (!expired.length) return;
+			await tx.delete(attachments).where(inArray(attachments.id, expired.map(({ attachment }) => attachment.id)));
+			await appendEvents(tx, expired.map(({ attachment, key, title }) => ({
+				projectId: attachment.projectId,
+				ticketId: attachment.ticketId,
+				actorId: null,
+				type: "attachment.deleted",
+				data: {
+					attachmentId: attachment.id,
+					key,
+					title,
+					source: {
+						kind: "system",
+						id: "blob-cleanup"
+					}
+				}
+			})));
+		});
 		return database.db.transaction(async (tx) => {
 			await tx.delete(stagedUploads).where(lt(stagedUploads.createdAt, stagedUploadCutoff()));
+			await tx.delete(uploadUrls).where(lt(uploadUrls.expiresAt, /* @__PURE__ */ new Date()));
 			const rows = await tx.select({ object: blobObjects }).from(blobObjects).leftJoin(attachments, eq(attachments.objectId, blobObjects.id)).leftJoin(profilePhotos, eq(profilePhotos.objectId, blobObjects.id)).leftJoin(stagedUploads, eq(stagedUploads.id, blobObjects.id)).leftJoin(projects, or(eq(projects.iconObjectId, blobObjects.id), eq(projects.backgroundObjectId, blobObjects.id))).where(and(isNull(attachments.id), isNull(profilePhotos.userId), isNull(stagedUploads.id), isNull(projects.id), lt(blobObjects.createdAt, /* @__PURE__ */ new Date(Date.now() - 864e5)))).limit(20).for("update", {
 				of: blobObjects,
 				skipLocked: true
@@ -1065,14 +1109,23 @@ function parseQuery(query) {
 		terms: query
 	};
 }
-const querySegments = ({ phrases, terms }) => terms ? [...phrases, terms] : phrases;
-function postgresSearch(query) {
-	return and(...querySegments(parseQuery(query)).map((segment) => {
-		const value = likePattern(segment);
-		return or(ilike(tickets.title, value), ilike(tickets.description, value), ilike(tickets.key, value), ilike(tickets.acceptanceCriteria, value), sql`array_to_string(${tickets.labels}, ' ') ILIKE ${value}`, sql`array_to_string(${tickets.scopes}, ' ') ILIKE ${value}`);
-	}));
-}
-const postgresRank = (query) => sql`CASE WHEN ${and(...querySegments(parseQuery(query)).map((segment) => ilike(tickets.title, likePattern(segment))))} THEN 0 ELSE 1 END`;
+const phrasePattern = (phrase, word) => `(?<!${word})${phrase.replace(/[\\^$.|?*+()[\]{}]/gu, "\\$&").replaceAll(" ", "\\s+")}(?!${word})`;
+const phraseRegExp = (phrase) => new RegExp(phrasePattern(phrase, "[\\p{L}\\p{N}_]"), "iu");
+const segmentTests = ({ phrases, terms }) => [...phrases.map((phrase) => {
+	const pattern = phrasePattern(phrase, "[[:alnum:]_]");
+	return (text) => sql`${text} ~* ${pattern}`;
+}), ...terms ? [(text) => sql`${text} ILIKE ${likePattern(terms)}`] : []];
+const searchedText = [
+	tickets.title,
+	tickets.description,
+	tickets.key,
+	tickets.acceptanceCriteria,
+	sql`array_to_string(${tickets.labels}, ' ')`,
+	sql`array_to_string(${tickets.scopes}, ' ')`
+];
+const textMatch = (query) => and(...segmentTests(query).map((test) => or(...searchedText.map(test))));
+const postgresSearch = (query) => textMatch(parseQuery(query));
+const postgresRank = (query) => sql`CASE WHEN ${and(...segmentTests(parseQuery(query)).map((test) => test(tickets.title)))} THEN 0 ELSE 1 END`;
 const builtinSearch = { where: async (_db, _ids, query) => ({
 	where: postgresSearch(query),
 	rank: postgresRank(query),
@@ -1138,13 +1191,17 @@ function createTicketSearch(database, instance, factory = createTicketIndex, sch
 		if (!state || !clock || state.error || state.configHash !== fingerprint(settings) || state.cursor !== clock.value) return fallback();
 		const root = await instance.read();
 		try {
+			const parsed = parseQuery(query);
 			const hits = await factory({
 				provider: "elasticsearch",
 				config: settings
-			}).find(root.identity, projectIds, parseQuery(query));
+			}).find(root.identity, projectIds, parsed);
 			const ids = hits.map((hit) => hit.id), ranks = hits.map((hit) => hit.rank);
 			return {
-				where: ids.length ? inArray(tickets.id, ids) : sql`false`,
+				where: ids.length ? and(inArray(tickets.id, ids), textMatch({
+					phrases: parsed.phrases,
+					terms: ""
+				})) : sql`false`,
 				rank: sql`(${`{${ranks.join(",")}}`}::int[])[array_position(${`{${ids.join(",")}}`}::uuid[], ${tickets.id})]`,
 				engine: "index",
 				indexing: false
@@ -2387,14 +2444,19 @@ function predicateSQL({ field, operator, values }) {
 		const overlap = sql`${tickets.labels} && ${sql.param(values)}::text[]`;
 		return operator === "any" ? overlap : sql`NOT (${overlap})`;
 	}
+	if (field === "automation") {
+		const ready = sql`(${tickets.automationReady} AND ${tickets.holdReason} IS NULL)`;
+		const match = or(...values.map((value) => value === "ready" ? ready : sql`NOT ${ready}`));
+		return operator === "any" ? match : sql`NOT (${match})`;
+	}
 	const column = field === "assigneeId" ? tickets.assigneeId : filterColumns[field];
 	const named = field === "assigneeId" ? values.filter((value) => value !== "none") : values, unset = field === "assigneeId" && values.includes("none");
 	if (operator === "any") return or(named.length ? inArray(column, named) : void 0, unset ? isNull(column) : void 0);
 	return and(named.length ? or(isNull(column), notInArray(column, named)) : void 0, unset ? isNotNull(column) : void 0);
 }
 const predicateWhere = (filter) => and(...ticketPredicates(filter).map(predicateSQL));
-function ticketOrder(input) {
-	const direction = input.order ?? defaultOrder[input.sort];
+function ticketOrder({ sort = "priority", order }) {
+	const direction = order ?? defaultOrder[sort];
 	const by = (column) => direction === "asc" ? sql`${column} ASC NULLS LAST` : sql`${column} DESC NULLS LAST`;
 	return [{
 		priority: by(rank(tickets.priority, priorities)),
@@ -2410,7 +2472,28 @@ function ticketOrder(input) {
 		kind: by(tickets.kind),
 		assignee: by(sql`(SELECT lower(name) FROM "user" WHERE id = ${tickets.assigneeId})`),
 		manual: by(tickets.position)
-	}[input.sort], asc(tickets.number)];
+	}[sort], asc(tickets.number)];
+}
+const relevanceOrder = (q, relevance) => [
+	sql`CASE WHEN ${ticketMatch(q)} THEN 0 ELSE 1 END`,
+	sql`${relevance} NULLS LAST`,
+	desc(tickets.updatedAt)
+];
+async function listQuery(ctx, projectIds, input) {
+	if (!input.q) return {
+		where: void 0,
+		order: ticketOrder(input)
+	};
+	const where = or(ticketMatch(input.q), postgresSearch(input.q));
+	if (input.sort) return {
+		where,
+		order: ticketOrder(input)
+	};
+	const match = await ctx.search.where(ctx.db, projectIds, input.q);
+	return {
+		where,
+		order: [...relevanceOrder(input.q, match.rank), asc(tickets.number)]
+	};
 }
 async function pageOf(ctx, where, order, input) {
 	const rows = await ctx.db.select({
@@ -2453,7 +2536,8 @@ async function createTicketRow(ctx, input) {
 		customFields: intakeOnly(ctx.actor) ? {} : applyCustomFieldValues(await projectCustomFields(ctx), null, customFields),
 		...await allocateTicket(ctx),
 		id,
-		createdBy: ctx.actor.id
+		createdBy: ctx.actor.id,
+		intakeCredentialId: intakeOnly(ctx.actor) ? ctx.actor.ownerId : null
 	}).returning());
 	await subscribe(ctx, row.projectId, row.id, [ctx.actor.id, row.assigneeId]);
 	return {
@@ -2500,12 +2584,16 @@ const hitRow = z.object({
 const summarize = (ticket) => ticketSummarySchema.parse(json(ticket));
 const snippetLength = 240;
 function snippet(body, query) {
-	const text = body?.replace(/\s+/gu, " ").trim() ?? "", lower = text.toLowerCase(), parsed = parseQuery(query);
+	const text = body?.replace(/\s+/gu, " ").trim() ?? "", lower = text.toLowerCase(), { phrases, terms } = parseQuery(query);
 	let at = -1, size = 0;
-	for (const needle of [...querySegments(parsed), ...parsed.terms.split(" ")]) {
-		const found = needle ? lower.indexOf(needle.toLowerCase()) : -1;
-		if (found >= 0 && (at < 0 || found < at)) [at, size] = [found, needle.length];
+	const closest = (found, length) => {
+		if (found >= 0 && (at < 0 || found < at)) [at, size] = [found, length];
+	};
+	for (const phrase of phrases) {
+		const found = phraseRegExp(phrase).exec(text);
+		if (found) closest(found.index, found[0].length);
 	}
+	for (const needle of [terms, ...terms.split(" ")]) if (needle) closest(lower.indexOf(needle.toLowerCase()), needle.length);
 	if (at < 0) return "";
 	if (text.length <= snippetLength) return text;
 	const start = Math.max(0, Math.min(at + Math.floor((size - snippetLength) / 2), text.length - snippetLength)), end = start + snippetLength;
@@ -2637,9 +2725,9 @@ const ticketHandlers = {
 	async list_tickets(ctx, input) {
 		const parent = input.parentId ? await getTicket(ctx, input.parentId) : void 0;
 		const related = input.relatedTo ? await getTicket(ctx, input.relatedTo) : void 0;
-		const search = input.q ? await ctx.search.where(ctx.db, [project(ctx).id], input.q) : void 0;
+		const search = await listQuery(ctx, [project(ctx).id], input);
 		await assertCustomFieldFilters(ctx, [project(ctx).id], input);
-		const page = await pageOf(ctx, and(eq(tickets.projectId, project(ctx).id), parent ? eq(tickets.parentId, parent.id) : void 0, related ? or(inArray(tickets.id, ctx.db.select({ id: relations$1.targetId }).from(relations$1).where(eq(relations$1.sourceId, related.id))), inArray(tickets.id, ctx.db.select({ id: relations$1.sourceId }).from(relations$1).where(eq(relations$1.targetId, related.id)))) : void 0, predicateWhere(input), input.archived === "include" ? void 0 : eq(tickets.archived, input.archived === "only"), dueWhere(input.due), input.stateId ? eq(tickets.stateId, input.stateId) : void 0, input.scheduledFrom ? sql`${scheduleEnd} >= ${input.scheduledFrom}::timestamptz` : void 0, input.scheduledTo ? sql`${scheduleStart} < ${input.scheduledTo}::timestamptz` : void 0, search?.where), ticketOrder(input), input);
+		const page = await pageOf(ctx, and(eq(tickets.projectId, project(ctx).id), parent ? eq(tickets.parentId, parent.id) : void 0, related ? or(inArray(tickets.id, ctx.db.select({ id: relations$1.targetId }).from(relations$1).where(eq(relations$1.sourceId, related.id))), inArray(tickets.id, ctx.db.select({ id: relations$1.sourceId }).from(relations$1).where(eq(relations$1.targetId, related.id)))) : void 0, predicateWhere(input), input.archived === "include" ? void 0 : eq(tickets.archived, input.archived === "only"), dueWhere(input.due), input.stateId ? eq(tickets.stateId, input.stateId) : void 0, input.scheduledFrom ? sql`${scheduleEnd} >= ${input.scheduledFrom}::timestamptz` : void 0, input.scheduledTo ? sql`${scheduleStart} < ${input.scheduledTo}::timestamptz` : void 0, search.where), search.order, input);
 		return input.view === "summary" ? {
 			...page,
 			items: page.items.map(summarize)
@@ -2652,11 +2740,11 @@ const ticketHandlers = {
 			total: 0,
 			activity: []
 		};
-		const ids = allowed.map((row) => row.id);
-		const where = and(inArray(tickets.projectId, ids), eq(tickets.assigneeId, ctx.actor.id), eq(tickets.archived, false), openTicket, input.q ? (await ctx.search.where(ctx.db, ids, input.q)).where : void 0);
+		const ids = allowed.map((row) => row.id), search = await listQuery(ctx, ids, input);
+		const where = and(inArray(tickets.projectId, ids), eq(tickets.assigneeId, ctx.actor.id), eq(tickets.archived, false), openTicket, search.where);
 		const activity = input.activity ? await ctx.db.select().from(events).where(inArray(events.projectId, ids)).orderBy(desc(events.id)).limit(input.activity) : [];
 		return {
-			...await pageOf(ctx, where, ticketOrder(input), input),
+			...await pageOf(ctx, where, search.order, input),
 			activity
 		};
 	},
@@ -2871,7 +2959,7 @@ const ticketHandlers = {
 		const allowed = await accessibleProjectRows(ctx.db, ctx.actor, input.workspaceId, "exclude");
 		if (!allowed.length) return { items: [] };
 		const ids = allowed.map((row) => row.id), match = await ctx.search.where(ctx.db, ids, input.q);
-		return { items: (await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, ids), eq(tickets.archived, false), or(ticketMatch(input.q), match.where))).orderBy(sql`CASE WHEN ${ticketMatch(input.q)} THEN 0 ELSE 1 END`, sql`${match.rank} NULLS LAST`, desc(tickets.updatedAt)).limit(input.limit)).flatMap((ticket) => {
+		return { items: (await ctx.db.select().from(tickets).where(and(inArray(tickets.projectId, ids), eq(tickets.archived, false), or(ticketMatch(input.q), match.where))).orderBy(...relevanceOrder(input.q, match.rank)).limit(input.limit)).flatMap((ticket) => {
 			const owner = allowed.find((row) => row.id === ticket.projectId);
 			if (!owner) return [];
 			const summary = input.view === "summary", body = `${ticket.description} ${ticket.acceptanceCriteria}`;
@@ -2991,7 +3079,7 @@ const ticketHandlers = {
 	},
 	async claim_ticket(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
-		assertVersion(ticket, input.expectedVersion, "ticket", "claiming");
+		if (input.expectedVersion !== void 0) assertVersion(ticket, input.expectedVersion, "ticket", "claiming");
 		const eligible = await readiness(ctx, ticket);
 		if (!eligible.ready) fail(409, "not_ready", "The ticket is not ready to claim", eligible);
 		const claim = one(await ctx.db.insert(claims).values({
@@ -3013,7 +3101,10 @@ const ticketHandlers = {
 			workerId: claim.workerId,
 			version: row.version
 		});
-		return claim;
+		return {
+			...claim,
+			ticket: row
+		};
 	},
 	async renew_claim(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
@@ -3384,6 +3475,90 @@ async function addComment(ctx, input) {
 	});
 	return row;
 }
+async function attachFile(ctx, ticket, id, bytes, file) {
+	if (intakeOnly(ctx.actor)) {
+		const stored = one(await ctx.db.select({
+			files: sql`count(*) filter (where ${attachments.ticketId} = ${ticket.id})`.mapWith(Number),
+			bytes: sql`coalesce(sum(${attachments.size}), 0)`.mapWith(Number)
+		}).from(attachments).innerJoin(tickets, eq(tickets.id, attachments.ticketId)).where(and(eq(tickets.intakeCredentialId, ctx.actor.ownerId), eq(tickets.holdReason, intakeHoldReason))));
+		if (stored.files >= 10) fail(409, "attachment_limit", `An intake credential can attach at most 10 files to a ticket`);
+		if (stored.bytes + bytes.length > 1e9) fail(409, "attachment_limit", "This intake credential's untriaged tickets hold too many attachment bytes");
+	}
+	await ctx.blobs.put(ctx.db, id, bytes, file.contentType);
+	const row = one(await ctx.db.insert(attachments).values({
+		id,
+		objectId: id,
+		projectId: project(ctx).id,
+		ticketId: ticket.id,
+		actorId: ctx.actor.id,
+		name: file.name,
+		contentType: file.contentType,
+		size: bytes.length
+	}).returning());
+	await publish(ctx, "attachment.created", ticket.id, {
+		attachmentId: row.id,
+		size: row.size
+	});
+	return row;
+}
+async function stageFile(ctx, id, bytes, file) {
+	await ctx.blobs.put(ctx.db, id, bytes, file.contentType);
+	const row = one(await ctx.db.insert(stagedUploads).values({
+		id,
+		projectId: project(ctx).id,
+		actorId: ctx.actor.id,
+		name: file.name,
+		contentType: file.contentType,
+		size: bytes.length
+	}).returning());
+	return {
+		...row,
+		expiresAt: new Date(row.createdAt.getTime() + stagedUploadLifetime)
+	};
+}
+const uploadToken = /^kvup_[A-Za-z0-9_-]{43}$/;
+const hashUploadToken = (token) => createHash("sha256").update(token).digest("hex");
+const uploadCredential = z.object({
+	ownerId: z.string(),
+	scopes: z.array(z.enum(scopes)),
+	projectIds: z.array(z.string()).optional(),
+	apiKey: z.boolean()
+}).nullable();
+function assertUploadUrlOpen(row) {
+	if (row.usedAt) fail(410, "upload_url_unavailable", "This upload URL was already used");
+	if (row.expiresAt.getTime() <= Date.now()) fail(410, "upload_url_unavailable", "This upload URL expired; request a new one");
+}
+async function receiveUpload(domain, token, contentLength, read) {
+	const { db } = domain.database, row = uploadToken.test(token) ? (await db.select().from(uploadUrls).where(eq(uploadUrls.tokenHash, hashUploadToken(token))))[0] : void 0;
+	if (!row) return fail(404, "not_found", "This upload URL does not exist");
+	assertUploadUrlOpen(row);
+	const wrongSize = (sent) => fail(400, "invalid_attachment", `This upload URL takes exactly ${row.size} bytes with that Content-Length; the request sent ${sent}`);
+	if (contentLength !== String(row.size)) wrongSize(contentLength ?? "no Content-Length");
+	const reserved = /* @__PURE__ */ new Date();
+	const [held] = await db.update(uploadUrls).set({ usedAt: reserved }).where(and(eq(uploadUrls.id, row.id), isNull(uploadUrls.usedAt), gt(uploadUrls.expiresAt, reserved))).returning({ id: uploadUrls.id });
+	if (!held) fail(410, "upload_url_unavailable", "This upload URL is already receiving an upload");
+	try {
+		const bytes = await read(row.size);
+		if (bytes.length !== row.size) wrongSize(bytes.length > row.size ? "more" : String(bytes.length));
+		const credential = uploadCredential.parse(row.credential);
+		if (credential?.apiKey) {
+			const key = (await db.select().from(apikey).where(eq(apikey.id, credential.ownerId)))[0];
+			if (!key?.enabled || key.expiresAt && key.expiresAt <= /* @__PURE__ */ new Date()) fail(401, "unauthorized", "The API credential that requested this upload URL was revoked");
+		}
+		const actor = await domain.actor(row.actorId, credential ? {
+			ownerId: credential.ownerId,
+			scopes: credential.scopes,
+			...credential.projectIds ? { projectIds: credential.projectIds } : {}
+		} : void 0);
+		return await domain.transact(async (tx, as) => {
+			const ctx = await as(actor, row.projectId);
+			return row.ticketId ? attachmentSchema.parse(json(await attachFile(ctx, await getTicket(ctx, row.ticketId), row.id, bytes, row))) : stagedUploadSchema.parse(json(await stageFile(ctx, row.id, bytes, row)));
+		});
+	} catch (error) {
+		await db.update(uploadUrls).set({ usedAt: null }).where(and(eq(uploadUrls.id, row.id), eq(uploadUrls.usedAt, reserved)));
+		throw error;
+	}
+}
 const collaborationHandlers = {
 	async list_relations(ctx, input) {
 		const ticket = await getTicket(ctx, input.ticketId);
@@ -3493,41 +3668,34 @@ const collaborationHandlers = {
 		};
 	},
 	async upload_attachment(ctx, input) {
-		const ticket = await getTicket(ctx, input.ticketId);
-		const bytes = decodeBlobData(input.data, attachmentLimit);
-		const id = crypto.randomUUID();
-		await ctx.blobs.put(ctx.db, id, bytes, input.contentType);
-		const row = one(await ctx.db.insert(attachments).values({
-			id,
-			objectId: id,
-			projectId: project(ctx).id,
-			ticketId: ticket.id,
-			actorId: ctx.actor.id,
-			name: input.name,
-			contentType: input.contentType,
-			size: bytes.length
-		}).returning());
-		await publish(ctx, "attachment.created", ticket.id, {
-			attachmentId: row.id,
-			size: row.size
-		});
-		return row;
+		return attachFile(ctx, await getTicket(ctx, input.ticketId), crypto.randomUUID(), decodeBlobData(input.data, attachmentLimit), input);
 	},
 	async stage_upload(ctx, input) {
-		const bytes = decodeBlobData(input.data, attachmentLimit);
-		const id = crypto.randomUUID();
-		await ctx.blobs.put(ctx.db, id, bytes, input.contentType);
-		const row = one(await ctx.db.insert(stagedUploads).values({
-			id,
+		return stageFile(ctx, crypto.randomUUID(), decodeBlobData(input.data, attachmentLimit), input);
+	},
+	async create_upload_url(ctx, input) {
+		const ticket = input.ticketId ? await getTicket(ctx, input.ticketId) : void 0, token = `kvup_${randomBytes(32).toString("base64url")}`, { id, ownerId, scopes: granted, projectIds, machine } = ctx.actor, apiKey = machine && (await ctx.db.select({ id: apikey.id }).from(apikey).where(eq(apikey.id, ownerId))).length > 0;
+		const row = one(await ctx.db.insert(uploadUrls).values({
+			id: crypto.randomUUID(),
 			projectId: project(ctx).id,
-			actorId: ctx.actor.id,
+			ticketId: ticket?.id ?? null,
+			actorId: id,
+			credential: machine ? {
+				ownerId,
+				scopes: granted,
+				projectIds,
+				apiKey
+			} : null,
 			name: input.name,
 			contentType: input.contentType,
-			size: bytes.length
+			size: input.size,
+			tokenHash: hashUploadToken(token),
+			expiresAt: new Date(Date.now() + uploadUrlLifetime)
 		}).returning());
 		return {
-			...row,
-			expiresAt: new Date(row.createdAt.getTime() + stagedUploadLifetime)
+			uploadId: row.id,
+			url: new URL(`/api/uploads/${token}`, ctx.publicUrl).href,
+			expiresAt: row.expiresAt
 		};
 	},
 	async discard_upload(ctx, input) {
@@ -5291,6 +5459,11 @@ async function takePrefix(ctx, prefix, projectId) {
 		projectId: owner
 	}).onConflictDoNothing();
 }
+async function assertRepositoriesFree(ctx, projectId, workspaceId, repositories) {
+	if (!repositories.length) return;
+	const [holder] = await ctx.db.select({ id: projects.id }).from(projects).where(and(eq(projects.workspaceId, workspaceId), isNull(projects.deletedAt), isNull(projects.archivedAt), ne(projects.id, projectId), arrayOverlaps(projects.repositories, repositories))).limit(1);
+	if (holder) fail(409, "duplicate_repository", "Another project in this workspace links this repository");
+}
 async function storeImage(ctx, image) {
 	const objectId = crypto.randomUUID();
 	await ctx.blobs.put(ctx.db, objectId, decodeImage(image), image.contentType);
@@ -5406,18 +5579,20 @@ const projectHandlers = {
 		const current = project(ctx);
 		assertVersion(current, input.expectedVersion, "project");
 		const key = input.key ?? current.key;
-		const sharing = input.publicReadEnabled !== void 0 && input.publicReadEnabled !== current.publicReadEnabled, details = key !== current.key || input.name !== current.name || input.description !== current.description || !!input.visibility && input.visibility !== current.visibility;
+		const sharing = input.publicReadEnabled !== void 0 && input.publicReadEnabled !== current.publicReadEnabled, details = key !== current.key || input.name !== current.name || input.description !== current.description || !!input.visibility && input.visibility !== current.visibility || !!input.repositories && !isDeepStrictEqual(input.repositories, current.repositories);
 		if (sharing) requirePermission(ctx.permissions, "sharing.manage", "project");
 		if (details || !sharing) requirePermission(ctx.permissions, "project.manage", "project");
 		if (key !== current.key) {
 			await (await takePrefix(ctx, key, current.id))(current.id);
 			await ctx.db.update(tickets).set({ key: sql`${key}::text || '-' || ${tickets.number}` }).where(eq(tickets.projectId, current.id));
 		}
+		if (input.repositories && !current.archivedAt) await assertRepositoriesFree(ctx, current.id, current.workspaceId, input.repositories);
 		const row = one(await ctx.db.update(projects).set({
 			key,
 			name: input.name,
 			...input.visibility ? { visibility: input.visibility } : {},
 			...input.publicReadEnabled === void 0 ? {} : { publicReadEnabled: input.publicReadEnabled },
+			...input.repositories ? { repositories: input.repositories } : {},
 			description: input.description,
 			version: current.version + 1,
 			updatedAt: /* @__PURE__ */ new Date()
@@ -5835,6 +6010,7 @@ async function assertTransferable(ctx, workspaceId) {
 	const current = project(ctx);
 	if (workspaceId === current.workspaceId) fail(400, "validation_error", "The project is already in this workspace");
 	await requireWorkspace(ctx, current.workspaceId, "project.manage");
+	if (!current.archivedAt) await assertRepositoriesFree(ctx, current.id, workspaceId, current.repositories);
 }
 async function projectPeople(ctx, workspaceId = project(ctx).workspaceId) {
 	const current = project(ctx), qualifiedUser = sql`${user}."id"`;
@@ -5997,6 +6173,7 @@ const lifecycleHandlers = {
 		assertVersion(current, input.expectedVersion, "project", input.archived ? "archiving" : "restoring");
 		if (!!current.archivedAt === input.archived) return current;
 		if (input.archived) assertNoBlockers(await claimBlockers(ctx));
+		else await assertRepositoriesFree(ctx, current.id, current.workspaceId, current.repositories);
 		const row = await changed(ctx, { archivedAt: input.archived ? /* @__PURE__ */ new Date() : null });
 		await publish(ctx, input.archived ? "project.archived" : "project.restored", null, { version: row.version });
 		return row;
@@ -6969,7 +7146,12 @@ const complete = (status) => closedStates.some((closed) => closed === status);
 const intakeHoldReason = "Untrusted intake: human triage required";
 const intakeQuarantined = (ticket) => ticket.holdReason === intakeHoldReason;
 const intakeOnly = (actor) => actor.scopes.length > 0 && actor.scopes.every((scope) => scope === "intake");
-const hasScope = (actor, scope, operation) => intakeOnly(actor) ? operation === "create_ticket" : actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.some((value) => value !== "intake");
+const intakeOperations = /* @__PURE__ */ new Set([
+	"create_ticket",
+	"upload_attachment",
+	"list_attachments"
+]);
+const hasScope = (actor, scope, operation) => intakeOnly(actor) ? !!operation && intakeOperations.has(operation) : actor.scopes.includes("admin") || actor.scopes.includes(scope) || scope === "read" && actor.scopes.some((value) => value !== "intake");
 function requireScope(actor, scope, operation) {
 	if (!hasScope(actor, scope, operation)) fail(403, "insufficient_scope", `This credential requires ${scope} permission`);
 }
@@ -7018,6 +7200,16 @@ const publicActor = {
 	projectIds: []
 };
 const projectMatch = (identifier) => or(sql`${projects.id}::text = ${identifier}`, eq(projects.key, identifier.toUpperCase()), sql`${projects.id} IN (SELECT pp.project_id FROM ${projectPrefixes} pp WHERE pp.prefix = ${identifier.toUpperCase()})`);
+const namesRemote = (identifier) => /[/@]/.test(identifier);
+async function projectByRemote(db, actor, identifier) {
+	const remote = normalizeRemote(identifier);
+	const linked = remote ? await db.select().from(projects).where(and(isNull(projects.deletedAt), arrayContains(projects.repositories, [remote]))) : [];
+	const reachable = [];
+	for (const row of linked) if ((!actor.projectIds || actor.projectIds.includes(row.id)) && await projectAccess(db, actor, row)) reachable.push(row);
+	const live = reachable.filter((row) => !row.archivedAt), named = live.length ? live : reachable;
+	if (named.length > 1) fail(409, "ambiguous_project", "More than one of your projects links this repository", { projects: named.map((row) => row.key) });
+	return one(named);
+}
 const issuedKey = /^([A-Z][A-Z0-9]{1,9})-([1-9]\d{0,8})$/;
 function ticketMatch(identifier) {
 	const key = identifier.toUpperCase(), [, prefix, number] = issuedKey.exec(key) ?? [];
@@ -7033,7 +7225,7 @@ async function context(db, actor, scope, projectId, workspaceId, permission = sc
 		ctx.permissions = access.permissions;
 	}
 	if (!projectId) return ctx;
-	const row = one(await db.select().from(projects).where(and(isNull(projects.deletedAt), projectMatch(projectId))).limit(1));
+	const row = namesRemote(projectId) ? await projectByRemote(db, actor, projectId) : one(await db.select().from(projects).where(and(isNull(projects.deletedAt), projectMatch(projectId))).limit(1));
 	if (actor.projectIds && !actor.projectIds.includes(row.id)) fail(404, "not_found", "Project was not found");
 	const access = await projectAccess(db, actor, row);
 	if (!access) fail(404, "not_found", "Project was not found");
@@ -7046,7 +7238,9 @@ async function context(db, actor, scope, projectId, workspaceId, permission = sc
 	};
 }
 async function getTicket(ctx, identifier) {
-	return one(await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), ticketMatch(identifier))).limit(1));
+	const ticket = one(await ctx.db.select().from(tickets).where(and(eq(tickets.projectId, project(ctx).id), ticketMatch(identifier))).limit(1));
+	if (intakeOnly(ctx.actor) && !(ticket.intakeCredentialId === ctx.actor.ownerId && intakeQuarantined(ticket))) fail(404, "not_found", "The requested record was not found");
+	return ticket;
 }
 const insertBatch = 1e3;
 async function insertAll(rows, insert) {
@@ -7338,10 +7532,13 @@ function createDomain(database, services = {}) {
 			const receipt = requestId ? (await tx.select().from(receipts).where(and(eq(receipts.actorId, actor.id), eq(receipts.requestId, requestId))).limit(1))[0] : void 0;
 			if (receipt && (receipt.hash !== hash || receipt.operation !== name)) fail(409, "idempotency_conflict", "This requestId was already used for another write");
 			if (receipt && (name === "delete_project" || name === "delete_workspace")) return parseOutput(name, receipt.result);
-			const ctx = await context(tx, actor, spec.scope, projectId, workspaceId, permission, name);
+			const ctx = await context(tx, actor, spec.scope, receipt?.projectId ?? projectId, workspaceId, permission, name);
 			if (receipt) {
 				if ((name === "create_time_entry" || name === "update_time_entry" || name === "delete_time_entry") && "ticketId" in input) await getTicket(ctx, input.ticketId);
-				const prior = parseOutput(name, receipt.result);
+				const prior = parseOutput(name, name === "claim_ticket" && "ticketId" in input && !operations.claim_ticket.output.safeParse(receipt.result).success ? json({
+					...claimSchema.parse(receipt.result),
+					ticket: await getTicket(ctx, input.ticketId)
+				}) : receipt.result);
 				if (name === "create_project") await context(tx, actor, "read", projectSchema.parse(prior).id);
 				if (name === "create_workspace") await requireWorkspace(ctx, workspaceSchema.parse(prior).id, null);
 				if (name === "relocate_ticket") await context(tx, actor, "write", ticketSchema.parse(prior).projectId);
@@ -7354,7 +7551,8 @@ function createDomain(database, services = {}) {
 				requestId,
 				hash,
 				operation: name,
-				result
+				result,
+				projectId: ctx.project?.id ?? null
 			});
 			return result;
 		});
@@ -7379,7 +7577,7 @@ function createDomain(database, services = {}) {
 	}
 	async function readEvents(identity, cursor, projectId) {
 		if (!hasScope(identity, "read")) fail(403, "insufficient_scope", "Read permission is required");
-		const allowed = await accessibleProjects(identity), named = projectId ? await database.db.select({ id: projects.id }).from(projects).where(projectMatch(projectId)) : [];
+		const allowed = await accessibleProjects(identity), named = !projectId ? [] : namesRemote(projectId) ? [await projectByRemote(database.db, identity, projectId)] : await database.db.select({ id: projects.id }).from(projects).where(projectMatch(projectId));
 		const ids = allowed.filter((row) => !projectId || named.some((match) => match.id === row.id)).map((row) => row.id);
 		if (projectId && !ids.length) fail(404, "not_found", "Project was not found");
 		const clock = one(await database.db.select().from(eventClock).where(eq(eventClock.id, 1)));
@@ -8060,4 +8258,4 @@ function createAuth(database, config) {
 	};
 }
 //#endregion
-export { stagedUploads as $, requireSession as A, attachmentContent as B, defaultSenders as C, createAccess as D, createHttpSender as E, decodeImage as F, events as G, blobObjects as H, imageResponse as I, notificationPreferences as J, instanceSettings as K, stagedUploadCutoff as L, createTicketSearch as M, createTicketIndex as N, createWriteLimiter as O, createBlobStorage as P, pushDevices as Q, createObjectStore as R, receiveRepositoryWebhook as S, DeliveryError as T, deliveryCheckpoints as U, attachments as V, eventClock as W, profilePhotos as X, notifications as Y, projects as Z, one as _, deliverySecrets as a, matchesOIDCBinding as at, requireRow as b, ownerBlocker as c, createDomain as d, storageBackends as et, errorEnvelope as f, notify as g, json as h, createInstance as i, workspaces as it, readCalendarFeed as j, requireInstanceAdmin as k, appendEvents as l, intakeOnly as m, emailCodesAvailable as n, tickets as nt, otherActiveAdministrator as o, fail as p, members as q, signInProviders as r, workspaceMembers as rt, ownedWorkspaces as s, createAuth as t, subscriptions as tt, assertVersion as u, reachable as v, deliverBatch as w, processImports as x, recipientColumns as y, createPollingJob as z };
+export { pushDevices as $, requireInstanceAdmin as A, createPollingJob as B, defaultSenders as C, receiveUpload as D, createHttpSender as E, createBlobStorage as F, eventClock as G, attachments as H, decodeImage as I, members as J, events as K, imageResponse as L, readCalendarFeed as M, createTicketSearch as N, createAccess as O, createTicketIndex as P, projects as Q, stagedUploadCutoff as R, receiveRepositoryWebhook as S, DeliveryError as T, blobObjects as U, attachmentContent as V, deliveryCheckpoints as W, notifications as X, notificationPreferences as Y, profilePhotos as Z, one as _, deliverySecrets as a, workspaces as at, requireRow as b, ownerBlocker as c, createDomain as d, stagedUploads as et, errorEnvelope as f, notify as g, json as h, createInstance as i, workspaceMembers as it, requireSession as j, createWriteLimiter as k, appendEvents as l, intakeOnly as m, emailCodesAvailable as n, subscriptions as nt, otherActiveAdministrator as o, matchesOIDCBinding as ot, fail as p, instanceSettings as q, signInProviders as r, tickets as rt, ownedWorkspaces as s, createAuth as t, storageBackends as tt, assertVersion as u, reachable as v, deliverBatch as w, processImports as x, recipientColumns as y, createObjectStore as z };

package/apps/server/dist/client.mjs

@@ -1,4 +1,4 @@
-import { C as errorSchema, Ct as streamErrorSchema, E as eventSchema, G as notificationReadInput, H as notificationIdsInput, K as notificationsSchema, Q as parsePublicOutput, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, Z as parseOutput, a as checkpointSchema, at as publicOperations, q as okSchema, t as ApiError, yt as snapshotSchema } from "./src-D80LNZKP.mjs";
+import { Dt as streamErrorSchema, G as notificationIdsInput, J as notificationReadInput, K as notificationPreferencesInput, O as eventSchema, Q as operations, St as snapshotSchema, T as errorSchema, X as okSchema, Y as notificationsSchema, ct as publicOperations, et as parseOutput, o as checkpointSchema, q as notificationPreferencesSchema, t as ApiError, tt as parsePublicOutput } from "./src-D70GmZ5R.mjs";
 import { z } from "zod";
 import { parseArgs } from "node:util";
 import { constants } from "node:fs";
@@ -653,7 +653,7 @@ profile list | profile remove <name> --yes
 --input <json|->       Operation input as a JSON object; - reads stdin
 --title <text>         Ticket title
 --body <markdown>      Comment body
---expected-version <n> Required version for update, delete, acquire and rescheduling recovery
+--expected-version <n> Required version for update, delete and rescheduling recovery; optional for acquire
 --changes <json>       Ticket update changes as a JSON object
 --request-id <uuid>    Reuse for a deliberate retry across invocations
 --json                Compact JSON output (default: indented JSON)

package/apps/server/dist/{config-CrJuk5mY.mjs → config-CQVdVhXv.mjs}

@@ -1,4 +1,4 @@
-import { Bt as searchSettingsSchema, Pt as brokerSettingsSchema, Rt as s3SettingsSchema, m as defaultClaimMaxLeaseSeconds, o as claimLeaseSecondsSchema } from "./src-D80LNZKP.mjs";
+import { Gt as searchSettingsSchema, Ut as s3SettingsSchema, g as defaultClaimMaxLeaseSeconds, s as claimLeaseSecondsSchema, zt as brokerSettingsSchema } from "./src-D70GmZ5R.mjs";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { relations } from "drizzle-orm";