@maudecode/kanvil 0.5.1 → 0.7.0

package/apps/server/dist/{src-D80LNZKP.mjs → src-D70GmZ5R.mjs}

@@ -1,5 +1,79 @@
 import { z } from "zod";
 import i18next from "i18next";
+//#region ../../packages/contracts/src/icons.ts
+const ticketSymbols = {
+	status: {
+		backlog: {
+			icon: "circle-dashed",
+			tone: "muted"
+		},
+		todo: {
+			icon: "circle",
+			tone: "muted"
+		},
+		in_progress: {
+			icon: "circle-dot",
+			tone: "accent"
+		},
+		in_review: {
+			icon: "clock",
+			tone: "warning"
+		},
+		done: {
+			icon: "circle-check",
+			tone: "success"
+		},
+		cancelled: {
+			icon: "circle-x",
+			tone: "muted"
+		}
+	},
+	priority: {
+		urgent: {
+			icon: "octagon-alert",
+			tone: "danger"
+		},
+		high: {
+			icon: "arrow-up",
+			tone: "warning"
+		},
+		medium: {
+			icon: "equal",
+			tone: "foreground"
+		},
+		low: {
+			icon: "arrow-down",
+			tone: "accent"
+		},
+		none: {
+			icon: "minus",
+			tone: "muted"
+		}
+	},
+	kind: {
+		feature: {
+			icon: "sparkles",
+			tone: "muted"
+		},
+		bug: {
+			icon: "bug",
+			tone: "muted"
+		},
+		chore: {
+			icon: "wrench",
+			tone: "muted"
+		},
+		research: {
+			icon: "flask-conical",
+			tone: "muted"
+		},
+		documentation: {
+			icon: "book-open",
+			tone: "muted"
+		}
+	}
+};
+//#endregion
 //#region ../../packages/contracts/src/instance.ts
 const endpoint$1 = z.url({ protocol: /^https?$/ }).refine((value) => !/^https?:\/\/[^/]*@/.test(value) && !/[?#]/.test(value), "Use an HTTP(S) endpoint without embedded credentials");
 const s3SettingsSchema = z.object({
@@ -216,10 +290,15 @@ var en_US_default = {
 			priority: "Priority",
 			kind: "Kind",
 			difficulty: "Difficulty",
+			automation: "Agent readiness",
 			label: "Label",
 			assigneeId: "Assignee",
 			customField: "Field"
 		},
+		automationFilter: {
+			ready: "Ready for agents",
+			manual: "Needs a person"
+		},
 		sort: {
 			priority: "Priority",
 			updated: "Recently updated",
@@ -461,6 +540,7 @@ var en_US_default = {
 				time_entry_conflict: "This actor already has a running entry on the ticket.",
 				claim_conflict: "Another worker holds this ticket.",
 				idempotency_conflict: "This request was already used for another change.",
+				duplicate_repository: "Another project in this workspace links this repository.",
 				project_archived: "Restore the archived project before changing it.",
 				rate_limited: "Too many changes in a short time. Wait and retry.",
 				snapshot_required: "The live feed fell behind. Reload to continue.",
@@ -930,6 +1010,7 @@ var en_US_default = {
 	},
 	ticket: {
 		list: {
+			manageViews: "Manage views",
 			selectSection: "Select {{section}} tickets",
 			expandSection: "Expand {{section}} tickets",
 			collapseSection: "Collapse {{section}} tickets",
@@ -1058,6 +1139,7 @@ var en_US_default = {
 			noDue: "No due date"
 		},
 		filter: {
+			add: "Add filter",
 			me: "Me",
 			searchTickets: "Search tickets",
 			searchTicketsPlaceholder: "Search tickets…",
@@ -1086,6 +1168,7 @@ var en_US_default = {
 				priority: "All priorities",
 				kind: "All kinds",
 				difficulty: "All difficulties",
+				automation: "Any readiness",
 				label: "All labels",
 				assigneeId: "Anyone",
 				customField: "Any field value"
@@ -1095,6 +1178,7 @@ var en_US_default = {
 				priority: "Search priorities",
 				kind: "Search kinds",
 				difficulty: "Search difficulties",
+				automation: "Search readiness",
 				label: "Search labels",
 				assigneeId: "Search people",
 				customField: "Search fields"
@@ -1550,7 +1634,7 @@ var en_US_default = {
 			permission: {
 				intake: {
 					name: "Submit reports",
-					description: "Create quarantined tickets only. Cannot read or edit tickets. Use alone."
+					description: "Create quarantined tickets and attach files to them only. Cannot read or edit tickets. Use alone."
 				},
 				read: {
 					name: "Read tickets",
@@ -1627,6 +1711,9 @@ var en_US_default = {
 			changePrefixDescription: "Every ticket in {{name}} takes the new prefix and keeps its number.",
 			changing: "Changing…",
 			prefixChanged: "Tickets now use {{key}}",
+			repositories: "Repositories",
+			repositoriesDescription: "Agents can pass one of these git remotes as the project ID.",
+			repositoriesInvalid: "Enter up to 20 git remotes, such as git@github.com:owner/repo.git.",
 			publicLink: "Public link",
 			publicDisclosure: "Anyone with the link can read every unarchived ticket's title, description, acceptance criteria, status, priority, kind, difficulty, labels, scopes, dates, and links to other tickets in this project. People, comments, activity, attachments, evidence, and claims stay private.",
 			publicOn: "Public link on",
@@ -2497,6 +2584,9 @@ var en_US_default = {
 		}
 	},
 	native: {
+		"navigation.projectButton": "{{project}} ⌄",
+		"navigation.recentProjects": "Recent projects",
+		"navigation.switchProject": "Switch workspace or project",
 		labelValue: "{{label}}: {{value}}",
 		ui: {
 			dismiss: "Dismiss",
@@ -2545,6 +2635,10 @@ var en_US_default = {
 			create: "Create project"
 		},
 		tickets: {
+			options: "List options",
+			expandAll: "Expand all sections",
+			collapseAll: "Collapse all sections",
+			select: "Select tickets",
 			search: "Search tickets",
 			searchPlaceholder: "Title, description, or key",
 			allStatuses: "All statuses",
@@ -2671,6 +2765,7 @@ var en_US_default = {
 			next: "Next activity"
 		},
 		inbox: {
+			read: "Read",
 			markAllRead: "Mark all read",
 			empty: "No notifications"
 		},
@@ -2853,8 +2948,10 @@ const scopes = [
 ];
 const attachmentLimit = 1e7;
 const stagedUploadLifetime = 864e5;
+const uploadUrlLifetime = 9e5;
 const stateLabels = labelTable(states, (value) => t(`common.status.${value}`));
 const priorityLabels = labelTable(priorities, (value) => t(`common.priority.${value}`));
+ticketSymbols.status.backlog.tone, ticketSymbols.status.todo.tone, ticketSymbols.status.in_progress.tone, ticketSymbols.status.in_review.tone, ticketSymbols.status.done.tone, ticketSymbols.status.cancelled.tone;
 const id = z.string().min(1).max(80);
 const timestamp = z.iso.datetime();
 const version = z.number().int().positive();
@@ -2968,9 +3065,30 @@ const placement = {
 	after: id.optional()
 };
 const oneNeighbor = (input) => input.before === void 0 || input.after === void 0;
-const projectInput = z.object({ projectId: id });
+const projectInput = z.object({ projectId: z.string().min(1).max(300) });
 const ticketInput = projectInput.extend({ ticketId: id });
 const projectKey = z.string().trim().regex(/^[A-Z][A-Z0-9]{1,9}$/);
+const remoteHost = "(?<host>[a-z0-9][a-z0-9.-]*)";
+const remotePath = "(?<path>[^?#]+)";
+const remoteForms = [
+	new RegExp(`^(?<scheme>https|ssh)://(?:[^/]*@)?${remoteHost}(?::(?<port>\\d+))?/${remotePath}$`),
+	new RegExp(`^[^/:@]+@${remoteHost}:${remotePath}$`),
+	new RegExp(`^${remoteHost}(?::(?<port>\\d+))?/${remotePath}$`)
+];
+const defaultRemotePorts = {
+	https: "443",
+	ssh: "22"
+};
+function normalizeRemote(value) {
+	const remote = value.trim().toLowerCase();
+	if (/\s/.test(remote)) return null;
+	const { scheme, host, port, path } = remoteForms.map((form) => form.exec(remote)).find(Boolean)?.groups ?? {};
+	const segments = path?.replace(/\/+$/, "").replace(/\.git$/, "").split("/").filter(Boolean);
+	if (!host || !segments?.length) return null;
+	return `${host}${port && port !== defaultRemotePorts[scheme ?? ""] ? `:${port}` : ""}/${segments.join("/")}`;
+}
+const repositoryRemote = z.string().max(300).refine((value) => normalizeRemote(value) !== null, "Enter a git remote URL").overwrite((value) => normalizeRemote(value) ?? value);
+const projectRepositories = z.array(repositoryRemote).max(20).overwrite((remotes) => [...new Set(remotes)]);
 const reason = z.object({
 	code: z.string(),
 	message: z.string(),
@@ -2987,15 +3105,19 @@ const filterFieldNames = [
 	"priority",
 	"kind",
 	"difficulty",
+	"automation",
 	"label",
 	"assigneeId",
 	"customField"
 ];
+const automationFilters = ["ready", "manual"];
+labelTable(automationFilters, (value) => t(`common.automationFilter.${value}`));
 const filterFields = {
 	status: z.enum(states),
 	priority: z.enum(priorities),
 	kind: z.enum(kinds),
 	difficulty: z.enum(difficulties),
+	automation: z.enum(automationFilters),
 	label: z.string().max(40),
 	assigneeId: z.union([id, z.literal("none")]),
 	customField: z.string().regex(/^[0-9a-f-]{36}:(?:none|true|[0-9a-f-]{36})$/)
@@ -3013,6 +3135,8 @@ const filterShape = {
 	kindNot: filterValues(filterFields.kind),
 	difficulty: filterValues(filterFields.difficulty),
 	difficultyNot: filterValues(filterFields.difficulty),
+	automation: filterValues(filterFields.automation),
+	automationNot: filterValues(filterFields.automation),
 	label: filterValues(filterFields.label),
 	labelNot: filterValues(filterFields.label),
 	assigneeId: filterValues(filterFields.assigneeId),
@@ -3082,6 +3206,7 @@ const ticketFilter = z.object({
 	]).default("priority"),
 	order: z.enum(["asc", "desc"]).optional()
 }).strict().superRefine(rejectConflicts);
+const listSort = ticketFilter.shape.sort.unwrap().optional();
 labelTable(ticketFilter.shape.sort.unwrap().options, (sort) => t(`common.sort.${sort}`));
 const defaultOrder = {
 	priority: "asc",
@@ -3190,6 +3315,7 @@ const projectSchema = z.object({
 	key: z.string(),
 	name: z.string(),
 	description: z.string(),
+	repositories: z.array(z.string()).default([]),
 	version,
 	archivedAt: timestamp.nullable().default(null),
 	createdAt: timestamp,
@@ -3360,6 +3486,11 @@ const attachmentSchema = z.object({
 	createdAt: timestamp
 });
 const stagedUploadSchema = attachmentSchema.omit({ ticketId: true }).extend({ expiresAt: timestamp });
+const uploadUrlSchema = z.object({
+	uploadId: z.uuid(),
+	url: z.url(),
+	expiresAt: timestamp
+});
 const httpUrl = z.url().regex(/^https?:\/\//i, "Use an HTTP or HTTPS URL");
 const evidenceFields = z.object({
 	kind: z.enum([
@@ -4125,21 +4256,25 @@ const page = (item) => z.object({
 	items: z.array(item),
 	total: z.number().int().nonnegative()
 });
-const fileFields = {
+const fileMetadata = {
 	name: text.max(255).refine((value) => {
 		for (const character of value) if (character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) return false;
 		return true;
 	}, "Use a filename without control characters"),
-	contentType: z.string().max(120).regex(/^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/i).default("application/octet-stream"),
+	contentType: z.string().max(120).regex(/^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/i).default("application/octet-stream")
+};
+const fileFields = {
+	...fileMetadata,
 	data: z.string().max(Math.ceil(attachmentLimit / 3) * 4)
 };
-const op = (input, output, method, path, scope, description) => ({
+const op = (input, output, method, path, scope, description, options = {}) => ({
 	input,
 	output,
 	method,
 	path,
 	scope,
-	description
+	description,
+	...options
 });
 const operations = {
 	list_workspaces: op(z.object({}), z.array(workspaceSchema), "GET", "/workspaces", "read", "List accessible workspaces and the current membership role."),
@@ -4329,8 +4464,9 @@ const operations = {
 		publicReadEnabled: z.boolean().optional(),
 		name: text.max(120),
 		description: z.string().max(5e3),
-		key: projectKey.optional()
-	}).strict(), projectSchema, "PATCH", "/projects/{projectId}", "admin", "Update project details. A new `key` re-keys every ticket of the project; the previous prefix stays reserved for the project, and the project and every key issued under it keep resolving. `publicReadEnabled` shares or stops sharing the project's read-only public view (see the public operations)."),
+		key: projectKey.optional(),
+		repositories: projectRepositories.optional()
+	}).strict(), projectSchema, "PATCH", "/projects/{projectId}", "admin", "Update project details. A new `key` re-keys every ticket of the project; the previous prefix stays reserved for the project, and the project and every key issued under it keep resolving. `publicReadEnabled` shares or stops sharing the project's read-only public view (see the public operations). `repositories` replaces the project's linked git remotes (at most 20), and any `projectId` then accepts one of them; within a workspace only one unarchived project can hold a remote."),
 	move_project: op(projectInput.extend({
 		...mutation,
 		expectedVersion: version,
@@ -4394,13 +4530,14 @@ const operations = {
 	}).strict(), okSchema, "POST", "/projects/{projectId}/members", "admin", "Add or update an existing user's membership with a seeded role or a custom role of the project's workspace, or remove it with a null role. Needs `member.manage`; the role, and any role the person holds now, must grant nothing the caller lacks."),
 	list_tickets: op(projectInput.extend({
 		...ticketFilter.shape,
+		sort: listSort,
 		...pagination,
 		relatedTo: id.optional(),
 		stateId: z.uuid().optional(),
 		scheduledFrom: timestamp.optional(),
 		scheduledTo: timestamp.optional(),
 		...ticketView
-	}).superRefine(rejectConflicts), page(ticketRow), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination. Each property filter takes one value or a repeated list (any of them); its `Not` twin excludes values. Double-quoted segments of `q` match as exact phrases. Pass `view: \"summary\"` when scanning results: rows then omit the description and acceptance criteria."),
+	}).superRefine(rejectConflicts), page(ticketRow), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination. Each property filter takes one value or a repeated list (any of them); its `Not` twin excludes values. `q` keeps only tickets whose key, title, description, acceptance criteria, labels, or scopes contain its text as written, or whose key or ID it names exactly; double-quoted segments are exact phrases that must each appear on word boundaries, so `\"IME\"` does not match `time` while unquoted `IME` does. With `q` and no `sort`, results order by relevance as in search_tickets; otherwise by `sort` (default `priority`). With `view: \"summary\"`, rows omit the description and acceptance criteria."),
 	list_ticket_labels: op(projectInput.extend({ archived: ticketFilter.shape.archived }), z.array(z.object({
 		name: z.string(),
 		count: z.number().int().nonnegative()
@@ -4494,7 +4631,7 @@ const operations = {
 		claim: claimSchema.nullable(),
 		subscribed: z.boolean(),
 		canReleaseClaim: z.boolean()
-	}), "GET", "/projects/{projectId}/tickets/{ticketId}", "read", "Read a ticket by ID or key, with readiness and ownership."),
+	}), "GET", "/projects/{projectId}/tickets/{ticketId}", "read", "Read a ticket by ID or key, with readiness and ownership.", { mcp: "core" }),
 	create_ticket: op(projectInput.extend({
 		...mutation,
 		title: ticketFields.shape.title,
@@ -4516,14 +4653,14 @@ const operations = {
 		archived: z.boolean().default(false),
 		uploads: z.array(z.uuid()).max(50).default([]),
 		customFields: customFieldValues.default({})
-	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets", "write", "Create a ticket. `customFields` maps field IDs from list_custom_fields to values; omitted fields take their default, and a required field must end with a value. `uploads` lists your staged inline uploads in this project; they become its attachments in the same write, or nothing is created. Reuse requestId when retrying this write."),
+	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets", "write", "Create a ticket. `customFields` maps field IDs from list_custom_fields to values; omitted fields take their default, and a required field must end with a value. `uploads` lists your staged inline uploads in this project; they become its attachments in the same write, or nothing is created. Reuse requestId when retrying this write.", { mcp: "core" }),
 	duplicate_ticket: op(ticketInput.extend(mutation).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/duplicate", "write", "Copy a ticket into a new To do ticket in the same project, linked to the original by a clones relationship. Copies requirements, properties, labels, scopes, and parent; resets agent readiness and never copies claims, comments, evidence, attachments, or children. Reuse requestId when retrying this write."),
 	update_ticket: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version,
 		changes: ticketChanges,
 		claimId: z.uuid().optional()
-	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}", "write", "Update a ticket with optimistic concurrency. Worker completion requires its active claim. `changes.customFields` sets only the named fields; null clears one."),
+	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}", "write", "Update a ticket with optimistic concurrency. Worker completion requires its active claim. `changes.customFields` sets only the named fields; null clears one.", { mcp: "core" }),
 	update_ticket_labels: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version,
@@ -4553,7 +4690,7 @@ const operations = {
 	resolve_ticket: op(z.object({ ticketId: id }).strict(), z.object({
 		ticket: ticketSchema,
 		project: projectRef
-	}), "GET", "/tickets/resolve", "read", "Find a ticket by ID, current key, or any earlier key from a prefix change or a move, across every accessible project. An unknown or inaccessible ticket reads as not found."),
+	}), "GET", "/tickets/resolve", "read", "Find a ticket by ID, current key, or any earlier key from a prefix change or a move, across every accessible project. An unknown or inaccessible ticket reads as not found.", { mcp: "core" }),
 	bulk_update_tickets: op(projectInput.extend({
 		...mutation,
 		tickets: claimedTicketSelection,
@@ -4576,7 +4713,7 @@ const operations = {
 		ticket: ticketRow,
 		project: projectRef,
 		snippet: z.string().optional()
-	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace. Results order by exact key match, then relevance, then recency. Double-quoted segments of `q` match as exact phrases. Pass `view: \"summary\"` when scanning results: each ticket is then a compact row and the result carries a `snippet` of the matching text."),
+	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace. Results order by exact key match, then relevance, then recency. Double-quoted segments of `q` match as exact phrases on word boundaries, so `\"IME\"` does not match `time`. With `view: \"summary\"`, each ticket is a compact row and the result carries a `snippet` of the matching text.", { mcp: "core" }),
 	search_workspace: op(z.object({
 		q: z.string().trim().min(1).max(200),
 		workspaceId: z.uuid().optional(),
@@ -4591,19 +4728,19 @@ const operations = {
 		counts: z.record(z.enum(searchResultTypes), z.number().int().nonnegative()),
 		engine: z.enum(["postgres", "index"]),
 		indexing: z.boolean()
-	}), "GET", "/search", "read", "Search accessible tickets, projects, comments, and activity by text or ticket key, optionally within one workspace or one result type. Property filters restrict results to matching tickets. Results order by exact key match, then type, then ticket relevance, then recency. Double-quoted segments of `q` match ticket text as exact phrases. Pass `view: \"summary\"` when scanning results: ticket results then carry their summary row and each result a `snippet` of the matching text."),
+	}), "GET", "/search", "read", "Search accessible tickets, projects, comments, and activity by text or ticket key, optionally within one workspace or one result type. Property filters restrict results to matching tickets. Results order by exact key match, then type, then ticket relevance, then recency. Double-quoted segments of `q` match ticket text as exact phrases on word boundaries. With `view: \"summary\"`, ticket results carry their summary row and each result a `snippet` of the matching text."),
 	list_my_work: op(z.object({
 		workspaceId: z.uuid().optional(),
 		q: ticketFilter.shape.q,
-		sort: ticketFilter.shape.sort,
+		sort: listSort,
 		order: ticketFilter.shape.order,
 		activity: z.coerce.number().int().min(0).max(50).default(0),
 		...pagination
-	}).strict(), page(ticketSchema).extend({ activity: z.array(eventSchema).default([]) }), "GET", "/my-work", "read", "List open, unarchived tickets assigned to the current identity across every accessible project, optionally within one workspace, with the most recent accessible activity when `activity` is set."),
+	}).strict(), page(ticketSchema).extend({ activity: z.array(eventSchema).default([]) }), "GET", "/my-work", "read", "List open, unarchived tickets assigned to the current identity across every accessible project, optionally within one workspace, with the most recent accessible activity when `activity` is set. `q` and `sort` work as in list_tickets.", { mcp: "core" }),
 	list_eligible_tickets: op(projectInput.extend(pagination), page(z.object({
 		ticket: ticketSchema,
 		readiness: readinessSchema
-	})), "GET", "/projects/{projectId}/eligibility", "read", "Inspect eligibility and explicit blocking reasons for open tickets."),
+	})), "GET", "/projects/{projectId}/eligibility", "read", "Inspect eligibility and explicit blocking reasons for open tickets.", { mcp: "core" }),
 	list_relations: op(ticketInput, z.array(relationSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/relations", "read", "List incoming and outgoing ticket relationships with each side's key, title, and project. A ticket in a project the caller cannot read appears by ID and key alone, with `restricted: true`."),
 	add_relation: op(ticketInput.extend({
 		...mutation,
@@ -4619,7 +4756,7 @@ const operations = {
 	add_comment: op(ticketInput.extend({
 		...mutation,
 		body: text.max(5e4)
-	}).strict(), commentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/comments", "write", "Add a comment with authenticated attribution. Mention a project member with `[@Name](mention:<user id>)` from list_members; members who can read the project are notified."),
+	}).strict(), commentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/comments", "write", "Add a comment with authenticated attribution. Mention a project member with `[@Name](mention:<user id>)` from list_members; members who can read the project are notified.", { mcp: "core" }),
 	update_comment: op(projectInput.extend({
 		...mutation,
 		commentId: z.uuid(),
@@ -4635,16 +4772,21 @@ const operations = {
 	upload_attachment: op(ticketInput.extend({
 		...mutation,
 		...fileFields
-	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path."),
+	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path. An intake credential can attach up to 10 files to a quarantined ticket it created, within 1 GB across its quarantined tickets. For a file on disk, use create_upload_url instead of inlining it."),
 	stage_upload: op(projectInput.extend({
 		...mutation,
 		...fileFields
-	}).strict(), stagedUploadSchema, "POST", "/projects/{projectId}/uploads", "write", "Stage up to 10 MB of base64-encoded bytes for a ticket that does not exist yet. Only you can read it, at its attachment content address, until create_ticket claims it; unclaimed uploads expire after 24 hours."),
+	}).strict(), stagedUploadSchema, "POST", "/projects/{projectId}/uploads", "write", "Stage up to 10 MB of base64-encoded bytes for a ticket that does not exist yet. Only you can read it, at its attachment content address, until create_ticket claims it; unclaimed uploads expire after 24 hours. For a file on disk, use create_upload_url instead of inlining it."),
+	create_upload_url: op(projectInput.extend({
+		...fileMetadata,
+		ticketId: id.optional(),
+		size: z.number().int().nonnegative().max(attachmentLimit)
+	}).strict(), uploadUrlSchema, "POST", "/projects/{projectId}/upload-urls", "write", "Get a single-use URL for one file of up to 10 MB, so its bytes never pass through the tool call. PUT exactly `size` bytes to `url` within 15 minutes, for example `curl --upload-file <path> <url>`; the URL needs no other credential and reads nothing. With `ticketId` the file becomes that ticket's attachment; without it, it is a staged upload that create_ticket `uploads` claims by `uploadId`."),
 	discard_upload: op(projectInput.extend({
 		...mutation,
 		uploadId: z.uuid()
 	}).strict(), okSchema, "DELETE", "/projects/{projectId}/uploads/{uploadId}", "write", "Delete one of your unclaimed staged uploads and its bytes."),
-	list_attachments: op(ticketInput, z.array(attachmentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/attachments", "read", "List authorized attachment metadata."),
+	list_attachments: op(ticketInput, z.array(attachmentSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/attachments", "read", "List authorized attachment metadata. An intake credential can list them on a quarantined ticket it created."),
 	delete_attachment: op(projectInput.extend({
 		...mutation,
 		attachmentId: z.uuid()
@@ -4654,7 +4796,7 @@ const operations = {
 		...mutation,
 		...evidenceFields.shape,
 		claimId: z.uuid().optional()
-	}).strict(), evidenceSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/evidence", "write", "Attach evidence with its commit and provenance."),
+	}).strict(), evidenceSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/evidence", "write", "Attach evidence with its commit and provenance.", { mcp: "core" }),
 	list_time_entries: op(ticketInput.extend(pagination), page(timeEntrySchema), "GET", "/projects/{projectId}/tickets/{ticketId}/time-entries", "read", "List observed time entries, newest first. Running entries have null endAt and durationMs."),
 	get_time_entry: op(ticketInput.extend({ timeEntryId: z.uuid() }), timeEntrySchema, "GET", "/projects/{projectId}/tickets/{ticketId}/time-entries/{timeEntryId}", "read", "Read one attributed time entry within its current ticket and project."),
 	create_time_entry: op(ticketInput.extend({
@@ -4700,18 +4842,18 @@ const operations = {
 	claim_ticket: op(ticketInput.extend({
 		...mutation,
 		workerId: text.max(200),
-		expectedVersion: version,
+		expectedVersion: version.optional(),
 		leaseSeconds: claimLeaseSecondsSchema.optional()
-	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim", "claim", "Atomically claim ready work. Expired claims require explicit recovery."),
+	}).strict(), claimSchema.extend({ ticket: ticketSchema }), "POST", "/projects/{projectId}/tickets/{ticketId}/claim", "claim", "Atomically claim ready work and return the claim with the claimed ticket. expectedVersion is optional; readiness always applies. Expired claims require explicit recovery.", { mcp: "core" }),
 	renew_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid(),
 		leaseSeconds: claimLeaseSecondsSchema.optional()
-	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/renew", "claim", "Renew the caller's unexpired claim."),
+	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/renew", "claim", "Renew the caller's unexpired claim.", { mcp: "core" }),
 	release_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid()
-	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/release", "claim", "Release the caller's claim."),
+	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/release", "claim", "Release the caller's claim.", { mcp: "core" }),
 	recover_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid().optional(),
@@ -4999,4 +5141,4 @@ function parseOutput(name, value) {
 	return operations[name].output.parse(value);
 }
 //#endregion
-export { permissionLabels as $, hasAdminRole as A, workflowOrder as At, memberSchema as B, searchSettingsSchema as Bt, errorSchema as C, streamErrorSchema as Ct, filterKey as D, ticketPredicates as Dt, eventSchema as E, ticketImportSchema as Et, isHexColor as F, instanceUpdateSchema as Ft, notificationReadInput as G, notificationIdsInput as H, isOperation as I, photoInputSchema as It, operationPermission as J, notificationsSchema as K, isPresetColor as L, photoResultSchema as Lt, importProviderDefinitions as M, adminInstanceSchema as Mt, importSecretFields as N, authenticationPolicySchema as Nt, filterList as O, ticketSchema as Ot, invitationStatuses as P, brokerSettingsSchema as Pt, parsePublicOutput as Q, isPublicOperation as R, s3SettingsSchema as Rt, difficulties as S, states as St, eventLabels as T, ticketFilter as Tt, notificationPreferencesInput as U, mentionScheme as V, notificationPreferencesSchema as W, parseCustomFieldFilter as X, operations as Y, parseOutput as Z, deletedAccountName as _, seededPermissions as _t, checkpointSchema as a, publicOperations as at, destinationEventKeys as b, stagedUploadLifetime as bt, credentialInput as c, repositoryProviderDefinitions as ct, customFieldSchema as d, resourceProvider as dt, permissionScope as et, customFieldValue as f, roleCategory as ft, defaultWorkflow as g, searchResultTypes as gt, defaultOrder as h, scopes as ht, channelRouteAllows as i, projectSchema as it, importLimits as j, workspaceSchema as jt, formatEvent as k, ticketSummarySchema as kt, credentialProjectsSchema as l, repositoryProviders as lt, defaultClaimMaxLeaseSeconds as m, roles as mt, attachmentLimit as n, priorities as nt, claimLeaseSecondsSchema as o, pushDeviceInput as ot, customFieldValueSchema as p, roleLabels as pt, okSchema as q, channelKinds as r, priorityLabels as rt, closedStates as s, remoteKinds as st, ApiError as t, permissions as tt, customFieldFilterTokens as u, repositorySecretFields as ut, deliverySecretFields as v, signInMethodLabels as vt, eventCategories as w, ticketExportFormat as wt, destinationKinds as x, stateLabels as xt, deliverySettingsSchema as y, snapshotSchema as yt, isSeededRole as z, searchAuthentication as zt };
+export { parseCustomFieldFilter as $, filterList as A, ticketImportSchema as At, isPublicOperation as B, instanceUpdateSchema as Bt, destinationKinds as C, stagedUploadLifetime as Ct, eventLabels as D, streamErrorSchema as Dt, eventCategories as E, states as Et, importSecretFields as F, workflowOrder as Ft, notificationIdsInput as G, searchSettingsSchema as Gt, memberSchema as H, photoResultSchema as Ht, invitationStatuses as I, workspaceSchema as It, notificationReadInput as J, notificationPreferencesInput as K, isHexColor as L, adminInstanceSchema as Lt, hasAdminRole as M, ticketSchema as Mt, importLimits as N, ticketSummarySchema as Nt, eventSchema as O, ticketExportFormat as Ot, importProviderDefinitions as P, uploadUrlLifetime as Pt, operations as Q, isOperation as R, authenticationPolicySchema as Rt, destinationEventKeys as S, snapshotSchema as St, errorSchema as T, stateLabels as Tt, mentionScheme as U, s3SettingsSchema as Ut, isSeededRole as V, photoInputSchema as Vt, normalizeRemote as W, searchAuthentication as Wt, okSchema as X, notificationsSchema as Y, operationPermission as Z, defaultOrder as _, roles as _t, channelRouteAllows as a, priorities as at, deliverySecretFields as b, seededPermissions as bt, claimSchema as c, publicOperations as ct, credentialProjectsSchema as d, repositoryProviderDefinitions as dt, parseOutput as et, customFieldFilterTokens as f, repositoryProviders as ft, defaultClaimMaxLeaseSeconds as g, roleLabels as gt, customFieldValueSchema as h, roleCategory as ht, channelKinds as i, permissions as it, formatEvent as j, ticketPredicates as jt, filterKey as k, ticketFilter as kt, closedStates as l, pushDeviceInput as lt, customFieldValue as m, resourceProvider as mt, attachmentLimit as n, permissionLabels as nt, checkpointSchema as o, priorityLabels as ot, customFieldSchema as p, repositorySecretFields as pt, notificationPreferencesSchema as q, attachmentSchema as r, permissionScope as rt, claimLeaseSecondsSchema as s, projectSchema as st, ApiError as t, parsePublicOutput as tt, credentialInput as u, remoteKinds as ut, defaultWorkflow as v, scopes as vt, difficulties as w, stagedUploadSchema as wt, deliverySettingsSchema as x, signInMethodLabels as xt, deletedAccountName as y, searchResultTypes as yt, isPresetColor as z, brokerSettingsSchema as zt };

package/apps/server/drizzle/0039_intake_credential.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "tickets" ADD COLUMN "intake_credential_id" text;--> statement-breakpoint
+CREATE INDEX "ticket_intake_credential" ON "tickets" USING btree ("intake_credential_id") WHERE "tickets"."intake_credential_id" IS NOT NULL;

package/apps/server/drizzle/0040_upload_urls.sql

@@ -0,0 +1,20 @@
+CREATE TABLE "upload_urls" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"project_id" uuid NOT NULL,
+	"ticket_id" uuid,
+	"actor_id" text NOT NULL,
+	"credential" jsonb,
+	"name" text NOT NULL,
+	"content_type" text NOT NULL,
+	"size" integer NOT NULL,
+	"token_hash" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"used_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "upload_urls_token_hash_unique" UNIQUE("token_hash")
+);
+--> statement-breakpoint
+ALTER TABLE "upload_urls" ADD CONSTRAINT "upload_urls_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "upload_urls" ADD CONSTRAINT "upload_urls_ticket_id_tickets_id_fk" FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "upload_urls" ADD CONSTRAINT "upload_urls_actor_id_user_id_fk" FOREIGN KEY ("actor_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "upload_urls_expires" ON "upload_urls" USING btree ("expires_at");

package/apps/server/drizzle/0041_project_repositories.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "projects" ADD COLUMN "repositories" text[] DEFAULT '{}' NOT NULL;--> statement-breakpoint
+ALTER TABLE "mutation_receipts" ADD COLUMN "project_id" uuid;