@maudecode/kanvil 0.5.1 → 0.7.0

package/apps/server/dist/index.mjs

@@ -1,7 +1,7 @@
-import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CrJuk5mY.mjs";
-import { A as hasAdminRole, B as memberSchema, Bt as searchSettingsSchema, C as errorSchema, Ft as instanceUpdateSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoInputSchema, L as isPresetColor, Lt as photoResultSchema, M as importProviderDefinitions, Mt as adminInstanceSchema, Pt as brokerSettingsSchema, R as isPublicOperation, Rt as s3SettingsSchema, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels } from "./src-D80LNZKP.mjs";
+import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CQVdVhXv.mjs";
+import { B as isPublicOperation, Bt as instanceUpdateSchema, G as notificationIdsInput, Gt as searchSettingsSchema, H as memberSchema, Ht as photoResultSchema, J as notificationReadInput, K as notificationPreferencesInput, Lt as adminInstanceSchema, M as hasAdminRole, N as importLimits, Ot as ticketExportFormat, P as importProviderDefinitions, Q as operations, R as isOperation, T as errorSchema, Tt as stateLabels, Ut as s3SettingsSchema, Vt as photoInputSchema, X as okSchema, _t as roles, ct as publicOperations, l as closedStates, lt as pushDeviceInput, q as notificationPreferencesSchema, t as ApiError, u as credentialInput, v as defaultWorkflow, vt as scopes, z as isPresetColor, zt as brokerSettingsSchema } from "./src-D70GmZ5R.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { $ as stagedUploads, A as requireSession, B as attachmentContent, C as defaultSenders, D as createAccess, E as createHttpSender, F as decodeImage, G as events, H as blobObjects, I as imageResponse, J as notificationPreferences, L as stagedUploadCutoff, M as createTicketSearch, N as createTicketIndex, O as createWriteLimiter, P as createBlobStorage, Q as pushDevices, R as createObjectStore, S as receiveRepositoryWebhook, T as DeliveryError, U as deliveryCheckpoints, V as attachments, W as eventClock, X as profilePhotos, Y as notifications, Z as projects, _ as one, a as deliverySecrets, at as matchesOIDCBinding, b as requireRow, c as ownerBlocker, d as createDomain, et as storageBackends, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaces, j as readCalendarFeed, k as requireInstanceAdmin, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as tickets, o as otherActiveAdministrator, p as fail, q as members, r as signInProviders, rt as workspaceMembers, s as ownedWorkspaces, t as createAuth, tt as subscriptions, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createPollingJob } from "./auth-Bm6cIseE.mjs";
+import { $ as pushDevices, A as requireInstanceAdmin, B as createPollingJob, C as defaultSenders, D as receiveUpload, E as createHttpSender, F as createBlobStorage, G as eventClock, H as attachments, I as decodeImage, J as members, K as events, L as imageResponse, M as readCalendarFeed, N as createTicketSearch, O as createAccess, P as createTicketIndex, Q as projects, R as stagedUploadCutoff, S as receiveRepositoryWebhook, T as DeliveryError, U as blobObjects, V as attachmentContent, W as deliveryCheckpoints, X as notifications, Y as notificationPreferences, Z as profilePhotos, _ as one, a as deliverySecrets, at as workspaces, b as requireRow, c as ownerBlocker, d as createDomain, et as stagedUploads, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaceMembers, j as requireSession, k as createWriteLimiter, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as subscriptions, o as otherActiveAdministrator, ot as matchesOIDCBinding, p as fail, r as signInProviders, rt as tickets, s as ownedWorkspaces, t as createAuth, tt as storageBackends, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createObjectStore } from "./auth-D43XyHdK.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
@@ -9,8 +9,8 @@ import { and, asc, count, desc, eq, gt, ilike, inArray, isNotNull, isNull, notIn
 import { z } from "zod";
 import { fileURLToPath } from "node:url";
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
-import { Expo } from "expo-server-sdk";
 import { isDeepStrictEqual } from "node:util";
+import { Expo } from "expo-server-sdk";
 import { EventEmitter } from "node:events";
 import { connect } from "amqplib";
 import { OpenAPIHono, createRoute, z as z$1 } from "@hono/zod-openapi";
@@ -359,7 +359,7 @@ function createCleanup() {
 }
 //#endregion
 //#region src/version.ts
-const applicationVersion = "0.5.1";
+const applicationVersion = "0.7.0";
 //#endregion
 //#region src/realtime.ts
 async function createRealtime(config) {
@@ -3121,49 +3121,138 @@ const defaultAdapters = {
 };
 //#endregion
 //#region src/mcp.ts
+const operationNames = Object.keys(operations).filter(isOperation);
+const coreNames = operationNames.filter((name) => operations[name].mcp === "core");
+const instructions = "Ticket keys look like KAN-12, and a key's prefix or the project's linked git remote works as projectId. To work a ticket: claim_ticket, keep its status current with update_ticket, add_comment on what you did, add_evidence, then set status done and release_claim. Leave tickets with automationReady false to people. The core tools are listed. Reach every other operation with find_operation, then read_operation for reads or run_operation for writes. In replies, a missing key means null or empty; lists return summary rows unless view is full.";
+const defaultView = "summary";
+const toolInput = (name) => {
+	const input = operations[name].input;
+	return "view" in input.shape ? input.safeExtend({ view: z.enum([defaultView, "full"]).default(defaultView) }) : input;
+};
+const echoedFields = (name) => {
+	const { shape } = toolInput(name);
+	const { changes } = shape;
+	return ["description", "acceptanceCriteria"].filter((field) => field in shape || changes instanceof z.ZodObject && field in changes.shape);
+};
+const isEmpty = (value) => value === null || typeof value === "object" && Object.keys(value).length === 0;
+const compact = (value, echoed) => {
+	if (Array.isArray(value)) return value.map((item) => compact(item, echoed));
+	if (typeof value !== "object" || value === null) return value;
+	const dropped = "acceptanceCriteria" in value ? echoed : [];
+	return Object.fromEntries(Object.entries(value).filter(([key]) => !dropped.includes(key)).map(([key, field]) => [key, compact(field, echoed)]).filter(([, field]) => !isEmpty(field)));
+};
+const known = (name) => {
+	if (!isOperation(name)) throw new ApiError(404, "not_found", `No operation is named ${name}`);
+	return name;
+};
+const summary = (name) => ({
+	name,
+	description: operations[name].description,
+	access: operations[name].method === "GET" ? "read" : "write"
+});
+function findOperation({ query = "", name }) {
+	if (name !== void 0) {
+		const operation = known(name), spec = operations[operation];
+		return {
+			...summary(operation),
+			method: spec.method,
+			scope: spec.scope,
+			inputSchema: z.toJSONSchema(toolInput(operation), { io: "input" })
+		};
+	}
+	const terms = query.toLowerCase().split(/\s+/);
+	return { operations: operationNames.map(summary).filter((row) => terms.every((term) => `${row.name} ${row.description}`.toLowerCase().includes(term))) };
+}
+const reply = async (name, work) => {
+	try {
+		return {
+			content: [{
+				type: "text",
+				text: `${name} completed.`
+			}],
+			structuredContent: { result: await work() }
+		};
+	} catch (error) {
+		return {
+			isError: true,
+			content: [{
+				type: "text",
+				text: JSON.stringify(errorEnvelope(error).body)
+			}]
+		};
+	}
+};
+const runnerInput = {
+	name: z.string().max(80).describe("Operation name from find_operation."),
+	input: z.record(z.string(), z.unknown()).default({}).describe("The operation's input.")
+};
 function createMcp(auth, domain, access, config, limitWrite) {
-	const serve = (request, identity, limited = false) => createMcpHandler(() => {
-		const server = new McpServer({
-			name: "Kanvil",
-			version: applicationVersion
+	const serve = (request, identity, limited = false) => {
+		const execute = async (name, input) => {
+			if (limited && operations[name].method !== "GET") limitWrite(identity.ownerId);
+			const value = "view" in operations[name].input.shape ? {
+				view: defaultView,
+				...input
+			} : input;
+			return compact(await domain.execute(name, value, identity), echoedFields(name));
+		};
+		const runner = (write) => (args) => reply(args.name, () => {
+			const name = known(args.name);
+			if (operations[name].method !== "GET" !== write) throw new ApiError(400, "invalid_request", `${name} ${write ? "only reads; use read_operation" : "writes; use run_operation"}`);
+			return execute(name, args.input);
 		});
-		for (const name of Object.keys(operations).filter(isOperation)) {
-			const spec = operations[name];
-			const inputSchema = spec.input.shape;
-			server.registerTool(name, {
-				description: spec.description,
-				inputSchema,
-				outputSchema: { result: spec.output },
+		return createMcpHandler(() => {
+			const server = new McpServer({
+				name: "Kanvil",
+				version: applicationVersion
+			}, { instructions });
+			for (const name of coreNames) {
+				const spec = operations[name];
+				const inputSchema = toolInput(name).shape;
+				server.registerTool(name, {
+					description: spec.description,
+					inputSchema,
+					annotations: {
+						readOnlyHint: spec.method === "GET",
+						destructiveHint: false,
+						idempotentHint: spec.method === "GET",
+						openWorldHint: false
+					}
+				}, (input) => reply(name, () => execute(name, input)));
+			}
+			server.registerTool("find_operation", {
+				description: "Find an operation that is not a listed tool. `query` matches names and descriptions and marks each match as read or write; `name` returns one operation with its input JSON Schema, method, and scope.",
+				inputSchema: {
+					query: z.string().max(200).optional(),
+					name: z.string().max(80).optional()
+				},
 				annotations: {
-					readOnlyHint: spec.method === "GET",
-					destructiveHint: /^(delete|remove|recover)_/.test(name),
-					idempotentHint: spec.method === "GET",
+					readOnlyHint: true,
+					idempotentHint: true,
 					openWorldHint: false
 				}
-			}, async (input) => {
-				try {
-					if (limited && spec.method !== "GET") limitWrite(identity.ownerId);
-					const result = await domain.execute(name, input, identity);
-					return {
-						content: [{
-							type: "text",
-							text: `${name} completed.`
-						}],
-						structuredContent: { result }
-					};
-				} catch (error) {
-					return {
-						isError: true,
-						content: [{
-							type: "text",
-							text: JSON.stringify(errorEnvelope(error).body)
-						}]
-					};
+			}, (input) => reply("find_operation", () => findOperation(input)));
+			server.registerTool("read_operation", {
+				description: "Run a read operation found with find_operation.",
+				inputSchema: runnerInput,
+				annotations: {
+					readOnlyHint: true,
+					idempotentHint: true,
+					openWorldHint: false
 				}
-			});
-		}
-		return server;
-	}, { legacy: "stateless" }).fetch(request);
+			}, runner(false));
+			server.registerTool("run_operation", {
+				description: "Run a write operation found with find_operation.",
+				inputSchema: runnerInput,
+				annotations: {
+					readOnlyHint: false,
+					destructiveHint: true,
+					openWorldHint: false
+				}
+			}, runner(true));
+			return server;
+		}, { legacy: "stateless" }).fetch(request);
+	};
 	const oauth = requireMcpAuth(auth, async (request, claims) => {
 		if (typeof claims.sub !== "string") throw new ApiError(401, "unauthorized", "A user subject is required");
 		const granted = typeof claims.scope === "string" ? claims.scope.split(" ") : [];
@@ -3319,13 +3408,14 @@ async function initializeApplication(database, config, adapters, cleanup) {
 		} }, { status: 400 });
 	} });
 	app.use("*", secureHeaders());
-	app.use("*", bodyLimit({
+	const limitBody = bodyLimit({
 		maxSize: 15e6,
 		onError: () => Response.json({ error: {
 			code: "payload_too_large",
 			message: "The request exceeds the upload limit"
 		} }, { status: 413 })
-	}));
+	});
+	app.use("*", (c, next) => c.req.path.startsWith("/api/uploads/") ? next() : limitBody(c, next));
 	app.onError((error) => {
 		if (error instanceof APIError && error.statusCode >= 400 && error.statusCode < 500) return Response.json({ error: {
 			code: typeof error.body?.code === "string" ? error.body.code : "authentication_error",
@@ -3421,6 +3511,33 @@ async function initializeApplication(database, config, adapters, cleanup) {
 			"Referrer-Policy": "no-referrer"
 		} });
 	});
+	app.openAPIRegistry.registerPath({
+		method: "put",
+		path: "/api/uploads/{token}",
+		request: {
+			params: z$1.object({ token: z$1.string() }),
+			body: { content: { "application/octet-stream": { schema: z$1.string() } } }
+		},
+		responses: {
+			200: { description: "The staged upload, or the attachment when the URL names a ticket" },
+			400: { description: "The body or its Content-Length is not the declared size" },
+			404: { description: "Unknown upload URL" },
+			410: { description: "The upload URL was already used or expired" }
+		}
+	});
+	app.put("/api/uploads/:token", async (c) => Response.json(await receiveUpload(domain, c.req.param("token"), c.req.header("content-length"), async (limit) => {
+		const chunks = [], reader = c.req.raw.body?.getReader();
+		if (!reader) return Buffer.alloc(0);
+		let total = 0;
+		while (total <= limit) {
+			const { done, value } = await reader.read();
+			if (done) return Buffer.concat(chunks);
+			chunks.push(value);
+			total += value.length;
+		}
+		await reader.cancel();
+		return Buffer.concat(chunks);
+	})));
 	app.openAPIRegistry.registerPath({
 		method: "post",
 		path: "/api/repository-hooks/{connectionId}",
@@ -3436,10 +3553,15 @@ async function initializeApplication(database, config, adapters, cleanup) {
 		const result = await receiveRepositoryWebhook(domain, repositories, secrets, c.req.param("connectionId"), c.req.raw.headers, await c.req.text());
 		return c.json(result, result.outcome === "duplicate" ? 200 : 202);
 	});
+	const intakeRoutes = [
+		["POST", /^\/api\/v1\/projects\/[^/]+\/tickets$/],
+		["POST", /^\/api\/v1\/projects\/[^/]+\/tickets\/[^/]+\/attachments$/],
+		["GET", /^\/api\/v1\/projects\/[^/]+\/tickets\/[^/]+\/attachments$/]
+	];
 	app.use("/api/v1/*", async (c, next) => {
 		access.checkOrigin(c.req.raw);
 		const actor = await access.authenticate(c.req.raw);
-		if (intakeOnly(actor) && !(c.req.method === "POST" && /^\/api\/v1\/projects\/[^/]+\/tickets$/.test(c.req.path))) fail(403, "insufficient_scope", "Intake credentials can only create tickets");
+		if (intakeOnly(actor) && !intakeRoutes.some(([method, path]) => c.req.method === method && path.test(c.req.path))) fail(403, "insufficient_scope", "Intake credentials can only create tickets and attach files to them");
 		c.set("actor", actor);
 		if (!actor.machine && ![
 			"GET",

package/apps/server/dist/migrate.mjs

@@ -1,4 +1,4 @@
-import { n as createDatabase, t as readConfig } from "./config-CrJuk5mY.mjs";
+import { n as createDatabase, t as readConfig } from "./config-CQVdVhXv.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
 const database = createDatabase(readConfig());

package/apps/server/dist/recover.mjs

@@ -1,6 +1,6 @@
-import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CrJuk5mY.mjs";
-import { A as hasAdminRole } from "./src-D80LNZKP.mjs";
-import { K as instanceSettings, p as fail, t as createAuth } from "./auth-Bm6cIseE.mjs";
+import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CQVdVhXv.mjs";
+import { M as hasAdminRole } from "./src-D70GmZ5R.mjs";
+import { p as fail, q as instanceSettings, t as createAuth } from "./auth-D43XyHdK.mjs";
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";