@maudecode/kanvil 0.6.1 → 0.7.0

package/apps/server/dist/index.mjs

@@ -1,7 +1,7 @@
-import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-BQw6mPzE.mjs";
-import { A as hasAdminRole, B as memberSchema, Bt as searchSettingsSchema, C as errorSchema, Ft as instanceUpdateSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoInputSchema, L as isPresetColor, Lt as photoResultSchema, M as importProviderDefinitions, Mt as adminInstanceSchema, Pt as brokerSettingsSchema, R as isPublicOperation, Rt as s3SettingsSchema, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels } from "./src-BaTNDJB7.mjs";
+import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CQVdVhXv.mjs";
+import { B as isPublicOperation, Bt as instanceUpdateSchema, G as notificationIdsInput, Gt as searchSettingsSchema, H as memberSchema, Ht as photoResultSchema, J as notificationReadInput, K as notificationPreferencesInput, Lt as adminInstanceSchema, M as hasAdminRole, N as importLimits, Ot as ticketExportFormat, P as importProviderDefinitions, Q as operations, R as isOperation, T as errorSchema, Tt as stateLabels, Ut as s3SettingsSchema, Vt as photoInputSchema, X as okSchema, _t as roles, ct as publicOperations, l as closedStates, lt as pushDeviceInput, q as notificationPreferencesSchema, t as ApiError, u as credentialInput, v as defaultWorkflow, vt as scopes, z as isPresetColor, zt as brokerSettingsSchema } from "./src-D70GmZ5R.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { $ as stagedUploads, A as requireSession, B as attachmentContent, C as defaultSenders, D as createAccess, E as createHttpSender, F as decodeImage, G as events, H as blobObjects, I as imageResponse, J as notificationPreferences, L as stagedUploadCutoff, M as createTicketSearch, N as createTicketIndex, O as createWriteLimiter, P as createBlobStorage, Q as pushDevices, R as createObjectStore, S as receiveRepositoryWebhook, T as DeliveryError, U as deliveryCheckpoints, V as attachments, W as eventClock, X as profilePhotos, Y as notifications, Z as projects, _ as one, a as deliverySecrets, at as matchesOIDCBinding, b as requireRow, c as ownerBlocker, d as createDomain, et as storageBackends, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaces, j as readCalendarFeed, k as requireInstanceAdmin, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as tickets, o as otherActiveAdministrator, p as fail, q as members, r as signInProviders, rt as workspaceMembers, s as ownedWorkspaces, t as createAuth, tt as subscriptions, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createPollingJob } from "./auth-CFjetlB4.mjs";
+import { $ as pushDevices, A as requireInstanceAdmin, B as createPollingJob, C as defaultSenders, D as receiveUpload, E as createHttpSender, F as createBlobStorage, G as eventClock, H as attachments, I as decodeImage, J as members, K as events, L as imageResponse, M as readCalendarFeed, N as createTicketSearch, O as createAccess, P as createTicketIndex, Q as projects, R as stagedUploadCutoff, S as receiveRepositoryWebhook, T as DeliveryError, U as blobObjects, V as attachmentContent, W as deliveryCheckpoints, X as notifications, Y as notificationPreferences, Z as profilePhotos, _ as one, a as deliverySecrets, at as workspaces, b as requireRow, c as ownerBlocker, d as createDomain, et as stagedUploads, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaceMembers, j as requireSession, k as createWriteLimiter, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as subscriptions, o as otherActiveAdministrator, ot as matchesOIDCBinding, p as fail, r as signInProviders, rt as tickets, s as ownedWorkspaces, t as createAuth, tt as storageBackends, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createObjectStore } from "./auth-D43XyHdK.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
@@ -9,8 +9,8 @@ import { and, asc, count, desc, eq, gt, ilike, inArray, isNotNull, isNull, notIn
 import { z } from "zod";
 import { fileURLToPath } from "node:url";
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
-import { Expo } from "expo-server-sdk";
 import { isDeepStrictEqual } from "node:util";
+import { Expo } from "expo-server-sdk";
 import { EventEmitter } from "node:events";
 import { connect } from "amqplib";
 import { OpenAPIHono, createRoute, z as z$1 } from "@hono/zod-openapi";
@@ -359,7 +359,7 @@ function createCleanup() {
 }
 //#endregion
 //#region src/version.ts
-const applicationVersion = "0.6.1";
+const applicationVersion = "0.7.0";
 //#endregion
 //#region src/realtime.ts
 async function createRealtime(config) {
@@ -3121,49 +3121,138 @@ const defaultAdapters = {
 };
 //#endregion
 //#region src/mcp.ts
+const operationNames = Object.keys(operations).filter(isOperation);
+const coreNames = operationNames.filter((name) => operations[name].mcp === "core");
+const instructions = "Ticket keys look like KAN-12, and a key's prefix or the project's linked git remote works as projectId. To work a ticket: claim_ticket, keep its status current with update_ticket, add_comment on what you did, add_evidence, then set status done and release_claim. Leave tickets with automationReady false to people. The core tools are listed. Reach every other operation with find_operation, then read_operation for reads or run_operation for writes. In replies, a missing key means null or empty; lists return summary rows unless view is full.";
+const defaultView = "summary";
+const toolInput = (name) => {
+	const input = operations[name].input;
+	return "view" in input.shape ? input.safeExtend({ view: z.enum([defaultView, "full"]).default(defaultView) }) : input;
+};
+const echoedFields = (name) => {
+	const { shape } = toolInput(name);
+	const { changes } = shape;
+	return ["description", "acceptanceCriteria"].filter((field) => field in shape || changes instanceof z.ZodObject && field in changes.shape);
+};
+const isEmpty = (value) => value === null || typeof value === "object" && Object.keys(value).length === 0;
+const compact = (value, echoed) => {
+	if (Array.isArray(value)) return value.map((item) => compact(item, echoed));
+	if (typeof value !== "object" || value === null) return value;
+	const dropped = "acceptanceCriteria" in value ? echoed : [];
+	return Object.fromEntries(Object.entries(value).filter(([key]) => !dropped.includes(key)).map(([key, field]) => [key, compact(field, echoed)]).filter(([, field]) => !isEmpty(field)));
+};
+const known = (name) => {
+	if (!isOperation(name)) throw new ApiError(404, "not_found", `No operation is named ${name}`);
+	return name;
+};
+const summary = (name) => ({
+	name,
+	description: operations[name].description,
+	access: operations[name].method === "GET" ? "read" : "write"
+});
+function findOperation({ query = "", name }) {
+	if (name !== void 0) {
+		const operation = known(name), spec = operations[operation];
+		return {
+			...summary(operation),
+			method: spec.method,
+			scope: spec.scope,
+			inputSchema: z.toJSONSchema(toolInput(operation), { io: "input" })
+		};
+	}
+	const terms = query.toLowerCase().split(/\s+/);
+	return { operations: operationNames.map(summary).filter((row) => terms.every((term) => `${row.name} ${row.description}`.toLowerCase().includes(term))) };
+}
+const reply = async (name, work) => {
+	try {
+		return {
+			content: [{
+				type: "text",
+				text: `${name} completed.`
+			}],
+			structuredContent: { result: await work() }
+		};
+	} catch (error) {
+		return {
+			isError: true,
+			content: [{
+				type: "text",
+				text: JSON.stringify(errorEnvelope(error).body)
+			}]
+		};
+	}
+};
+const runnerInput = {
+	name: z.string().max(80).describe("Operation name from find_operation."),
+	input: z.record(z.string(), z.unknown()).default({}).describe("The operation's input.")
+};
 function createMcp(auth, domain, access, config, limitWrite) {
-	const serve = (request, identity, limited = false) => createMcpHandler(() => {
-		const server = new McpServer({
-			name: "Kanvil",
-			version: applicationVersion
+	const serve = (request, identity, limited = false) => {
+		const execute = async (name, input) => {
+			if (limited && operations[name].method !== "GET") limitWrite(identity.ownerId);
+			const value = "view" in operations[name].input.shape ? {
+				view: defaultView,
+				...input
+			} : input;
+			return compact(await domain.execute(name, value, identity), echoedFields(name));
+		};
+		const runner = (write) => (args) => reply(args.name, () => {
+			const name = known(args.name);
+			if (operations[name].method !== "GET" !== write) throw new ApiError(400, "invalid_request", `${name} ${write ? "only reads; use read_operation" : "writes; use run_operation"}`);
+			return execute(name, args.input);
 		});
-		for (const name of Object.keys(operations).filter(isOperation)) {
-			const spec = operations[name];
-			const inputSchema = spec.input.shape;
-			server.registerTool(name, {
-				description: spec.description,
-				inputSchema,
-				outputSchema: { result: spec.output },
+		return createMcpHandler(() => {
+			const server = new McpServer({
+				name: "Kanvil",
+				version: applicationVersion
+			}, { instructions });
+			for (const name of coreNames) {
+				const spec = operations[name];
+				const inputSchema = toolInput(name).shape;
+				server.registerTool(name, {
+					description: spec.description,
+					inputSchema,
+					annotations: {
+						readOnlyHint: spec.method === "GET",
+						destructiveHint: false,
+						idempotentHint: spec.method === "GET",
+						openWorldHint: false
+					}
+				}, (input) => reply(name, () => execute(name, input)));
+			}
+			server.registerTool("find_operation", {
+				description: "Find an operation that is not a listed tool. `query` matches names and descriptions and marks each match as read or write; `name` returns one operation with its input JSON Schema, method, and scope.",
+				inputSchema: {
+					query: z.string().max(200).optional(),
+					name: z.string().max(80).optional()
+				},
 				annotations: {
-					readOnlyHint: spec.method === "GET",
-					destructiveHint: /^(delete|remove|recover)_/.test(name),
-					idempotentHint: spec.method === "GET",
+					readOnlyHint: true,
+					idempotentHint: true,
 					openWorldHint: false
 				}
-			}, async (input) => {
-				try {
-					if (limited && spec.method !== "GET") limitWrite(identity.ownerId);
-					const result = await domain.execute(name, input, identity);
-					return {
-						content: [{
-							type: "text",
-							text: `${name} completed.`
-						}],
-						structuredContent: { result }
-					};
-				} catch (error) {
-					return {
-						isError: true,
-						content: [{
-							type: "text",
-							text: JSON.stringify(errorEnvelope(error).body)
-						}]
-					};
+			}, (input) => reply("find_operation", () => findOperation(input)));
+			server.registerTool("read_operation", {
+				description: "Run a read operation found with find_operation.",
+				inputSchema: runnerInput,
+				annotations: {
+					readOnlyHint: true,
+					idempotentHint: true,
+					openWorldHint: false
 				}
-			});
-		}
-		return server;
-	}, { legacy: "stateless" }).fetch(request);
+			}, runner(false));
+			server.registerTool("run_operation", {
+				description: "Run a write operation found with find_operation.",
+				inputSchema: runnerInput,
+				annotations: {
+					readOnlyHint: false,
+					destructiveHint: true,
+					openWorldHint: false
+				}
+			}, runner(true));
+			return server;
+		}, { legacy: "stateless" }).fetch(request);
+	};
 	const oauth = requireMcpAuth(auth, async (request, claims) => {
 		if (typeof claims.sub !== "string") throw new ApiError(401, "unauthorized", "A user subject is required");
 		const granted = typeof claims.scope === "string" ? claims.scope.split(" ") : [];
@@ -3319,13 +3408,14 @@ async function initializeApplication(database, config, adapters, cleanup) {
 		} }, { status: 400 });
 	} });
 	app.use("*", secureHeaders());
-	app.use("*", bodyLimit({
+	const limitBody = bodyLimit({
 		maxSize: 15e6,
 		onError: () => Response.json({ error: {
 			code: "payload_too_large",
 			message: "The request exceeds the upload limit"
 		} }, { status: 413 })
-	}));
+	});
+	app.use("*", (c, next) => c.req.path.startsWith("/api/uploads/") ? next() : limitBody(c, next));
 	app.onError((error) => {
 		if (error instanceof APIError && error.statusCode >= 400 && error.statusCode < 500) return Response.json({ error: {
 			code: typeof error.body?.code === "string" ? error.body.code : "authentication_error",
@@ -3421,6 +3511,33 @@ async function initializeApplication(database, config, adapters, cleanup) {
 			"Referrer-Policy": "no-referrer"
 		} });
 	});
+	app.openAPIRegistry.registerPath({
+		method: "put",
+		path: "/api/uploads/{token}",
+		request: {
+			params: z$1.object({ token: z$1.string() }),
+			body: { content: { "application/octet-stream": { schema: z$1.string() } } }
+		},
+		responses: {
+			200: { description: "The staged upload, or the attachment when the URL names a ticket" },
+			400: { description: "The body or its Content-Length is not the declared size" },
+			404: { description: "Unknown upload URL" },
+			410: { description: "The upload URL was already used or expired" }
+		}
+	});
+	app.put("/api/uploads/:token", async (c) => Response.json(await receiveUpload(domain, c.req.param("token"), c.req.header("content-length"), async (limit) => {
+		const chunks = [], reader = c.req.raw.body?.getReader();
+		if (!reader) return Buffer.alloc(0);
+		let total = 0;
+		while (total <= limit) {
+			const { done, value } = await reader.read();
+			if (done) return Buffer.concat(chunks);
+			chunks.push(value);
+			total += value.length;
+		}
+		await reader.cancel();
+		return Buffer.concat(chunks);
+	})));
 	app.openAPIRegistry.registerPath({
 		method: "post",
 		path: "/api/repository-hooks/{connectionId}",

package/apps/server/dist/migrate.mjs

@@ -1,4 +1,4 @@
-import { n as createDatabase, t as readConfig } from "./config-BQw6mPzE.mjs";
+import { n as createDatabase, t as readConfig } from "./config-CQVdVhXv.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
 const database = createDatabase(readConfig());

package/apps/server/dist/recover.mjs

@@ -1,6 +1,6 @@
-import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-BQw6mPzE.mjs";
-import { A as hasAdminRole } from "./src-BaTNDJB7.mjs";
-import { K as instanceSettings, p as fail, t as createAuth } from "./auth-CFjetlB4.mjs";
+import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CQVdVhXv.mjs";
+import { M as hasAdminRole } from "./src-D70GmZ5R.mjs";
+import { p as fail, q as instanceSettings, t as createAuth } from "./auth-D43XyHdK.mjs";
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";

package/apps/server/dist/{src-BaTNDJB7.mjs → src-D70GmZ5R.mjs}

@@ -290,10 +290,15 @@ var en_US_default = {
 			priority: "Priority",
 			kind: "Kind",
 			difficulty: "Difficulty",
+			automation: "Agent readiness",
 			label: "Label",
 			assigneeId: "Assignee",
 			customField: "Field"
 		},
+		automationFilter: {
+			ready: "Ready for agents",
+			manual: "Needs a person"
+		},
 		sort: {
 			priority: "Priority",
 			updated: "Recently updated",
@@ -535,6 +540,7 @@ var en_US_default = {
 				time_entry_conflict: "This actor already has a running entry on the ticket.",
 				claim_conflict: "Another worker holds this ticket.",
 				idempotency_conflict: "This request was already used for another change.",
+				duplicate_repository: "Another project in this workspace links this repository.",
 				project_archived: "Restore the archived project before changing it.",
 				rate_limited: "Too many changes in a short time. Wait and retry.",
 				snapshot_required: "The live feed fell behind. Reload to continue.",
@@ -1162,6 +1168,7 @@ var en_US_default = {
 				priority: "All priorities",
 				kind: "All kinds",
 				difficulty: "All difficulties",
+				automation: "Any readiness",
 				label: "All labels",
 				assigneeId: "Anyone",
 				customField: "Any field value"
@@ -1171,6 +1178,7 @@ var en_US_default = {
 				priority: "Search priorities",
 				kind: "Search kinds",
 				difficulty: "Search difficulties",
+				automation: "Search readiness",
 				label: "Search labels",
 				assigneeId: "Search people",
 				customField: "Search fields"
@@ -1703,6 +1711,9 @@ var en_US_default = {
 			changePrefixDescription: "Every ticket in {{name}} takes the new prefix and keeps its number.",
 			changing: "Changing…",
 			prefixChanged: "Tickets now use {{key}}",
+			repositories: "Repositories",
+			repositoriesDescription: "Agents can pass one of these git remotes as the project ID.",
+			repositoriesInvalid: "Enter up to 20 git remotes, such as git@github.com:owner/repo.git.",
 			publicLink: "Public link",
 			publicDisclosure: "Anyone with the link can read every unarchived ticket's title, description, acceptance criteria, status, priority, kind, difficulty, labels, scopes, dates, and links to other tickets in this project. People, comments, activity, attachments, evidence, and claims stay private.",
 			publicOn: "Public link on",
@@ -2937,6 +2948,7 @@ const scopes = [
 ];
 const attachmentLimit = 1e7;
 const stagedUploadLifetime = 864e5;
+const uploadUrlLifetime = 9e5;
 const stateLabels = labelTable(states, (value) => t(`common.status.${value}`));
 const priorityLabels = labelTable(priorities, (value) => t(`common.priority.${value}`));
 ticketSymbols.status.backlog.tone, ticketSymbols.status.todo.tone, ticketSymbols.status.in_progress.tone, ticketSymbols.status.in_review.tone, ticketSymbols.status.done.tone, ticketSymbols.status.cancelled.tone;
@@ -3053,9 +3065,30 @@ const placement = {
 	after: id.optional()
 };
 const oneNeighbor = (input) => input.before === void 0 || input.after === void 0;
-const projectInput = z.object({ projectId: id });
+const projectInput = z.object({ projectId: z.string().min(1).max(300) });
 const ticketInput = projectInput.extend({ ticketId: id });
 const projectKey = z.string().trim().regex(/^[A-Z][A-Z0-9]{1,9}$/);
+const remoteHost = "(?<host>[a-z0-9][a-z0-9.-]*)";
+const remotePath = "(?<path>[^?#]+)";
+const remoteForms = [
+	new RegExp(`^(?<scheme>https|ssh)://(?:[^/]*@)?${remoteHost}(?::(?<port>\\d+))?/${remotePath}$`),
+	new RegExp(`^[^/:@]+@${remoteHost}:${remotePath}$`),
+	new RegExp(`^${remoteHost}(?::(?<port>\\d+))?/${remotePath}$`)
+];
+const defaultRemotePorts = {
+	https: "443",
+	ssh: "22"
+};
+function normalizeRemote(value) {
+	const remote = value.trim().toLowerCase();
+	if (/\s/.test(remote)) return null;
+	const { scheme, host, port, path } = remoteForms.map((form) => form.exec(remote)).find(Boolean)?.groups ?? {};
+	const segments = path?.replace(/\/+$/, "").replace(/\.git$/, "").split("/").filter(Boolean);
+	if (!host || !segments?.length) return null;
+	return `${host}${port && port !== defaultRemotePorts[scheme ?? ""] ? `:${port}` : ""}/${segments.join("/")}`;
+}
+const repositoryRemote = z.string().max(300).refine((value) => normalizeRemote(value) !== null, "Enter a git remote URL").overwrite((value) => normalizeRemote(value) ?? value);
+const projectRepositories = z.array(repositoryRemote).max(20).overwrite((remotes) => [...new Set(remotes)]);
 const reason = z.object({
 	code: z.string(),
 	message: z.string(),
@@ -3072,15 +3105,19 @@ const filterFieldNames = [
 	"priority",
 	"kind",
 	"difficulty",
+	"automation",
 	"label",
 	"assigneeId",
 	"customField"
 ];
+const automationFilters = ["ready", "manual"];
+labelTable(automationFilters, (value) => t(`common.automationFilter.${value}`));
 const filterFields = {
 	status: z.enum(states),
 	priority: z.enum(priorities),
 	kind: z.enum(kinds),
 	difficulty: z.enum(difficulties),
+	automation: z.enum(automationFilters),
 	label: z.string().max(40),
 	assigneeId: z.union([id, z.literal("none")]),
 	customField: z.string().regex(/^[0-9a-f-]{36}:(?:none|true|[0-9a-f-]{36})$/)
@@ -3098,6 +3135,8 @@ const filterShape = {
 	kindNot: filterValues(filterFields.kind),
 	difficulty: filterValues(filterFields.difficulty),
 	difficultyNot: filterValues(filterFields.difficulty),
+	automation: filterValues(filterFields.automation),
+	automationNot: filterValues(filterFields.automation),
 	label: filterValues(filterFields.label),
 	labelNot: filterValues(filterFields.label),
 	assigneeId: filterValues(filterFields.assigneeId),
@@ -3167,6 +3206,7 @@ const ticketFilter = z.object({
 	]).default("priority"),
 	order: z.enum(["asc", "desc"]).optional()
 }).strict().superRefine(rejectConflicts);
+const listSort = ticketFilter.shape.sort.unwrap().optional();
 labelTable(ticketFilter.shape.sort.unwrap().options, (sort) => t(`common.sort.${sort}`));
 const defaultOrder = {
 	priority: "asc",
@@ -3275,6 +3315,7 @@ const projectSchema = z.object({
 	key: z.string(),
 	name: z.string(),
 	description: z.string(),
+	repositories: z.array(z.string()).default([]),
 	version,
 	archivedAt: timestamp.nullable().default(null),
 	createdAt: timestamp,
@@ -3445,6 +3486,11 @@ const attachmentSchema = z.object({
 	createdAt: timestamp
 });
 const stagedUploadSchema = attachmentSchema.omit({ ticketId: true }).extend({ expiresAt: timestamp });
+const uploadUrlSchema = z.object({
+	uploadId: z.uuid(),
+	url: z.url(),
+	expiresAt: timestamp
+});
 const httpUrl = z.url().regex(/^https?:\/\//i, "Use an HTTP or HTTPS URL");
 const evidenceFields = z.object({
 	kind: z.enum([
@@ -4210,21 +4256,25 @@ const page = (item) => z.object({
 	items: z.array(item),
 	total: z.number().int().nonnegative()
 });
-const fileFields = {
+const fileMetadata = {
 	name: text.max(255).refine((value) => {
 		for (const character of value) if (character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) return false;
 		return true;
 	}, "Use a filename without control characters"),
-	contentType: z.string().max(120).regex(/^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/i).default("application/octet-stream"),
+	contentType: z.string().max(120).regex(/^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/i).default("application/octet-stream")
+};
+const fileFields = {
+	...fileMetadata,
 	data: z.string().max(Math.ceil(attachmentLimit / 3) * 4)
 };
-const op = (input, output, method, path, scope, description) => ({
+const op = (input, output, method, path, scope, description, options = {}) => ({
 	input,
 	output,
 	method,
 	path,
 	scope,
-	description
+	description,
+	...options
 });
 const operations = {
 	list_workspaces: op(z.object({}), z.array(workspaceSchema), "GET", "/workspaces", "read", "List accessible workspaces and the current membership role."),
@@ -4414,8 +4464,9 @@ const operations = {
 		publicReadEnabled: z.boolean().optional(),
 		name: text.max(120),
 		description: z.string().max(5e3),
-		key: projectKey.optional()
-	}).strict(), projectSchema, "PATCH", "/projects/{projectId}", "admin", "Update project details. A new `key` re-keys every ticket of the project; the previous prefix stays reserved for the project, and the project and every key issued under it keep resolving. `publicReadEnabled` shares or stops sharing the project's read-only public view (see the public operations)."),
+		key: projectKey.optional(),
+		repositories: projectRepositories.optional()
+	}).strict(), projectSchema, "PATCH", "/projects/{projectId}", "admin", "Update project details. A new `key` re-keys every ticket of the project; the previous prefix stays reserved for the project, and the project and every key issued under it keep resolving. `publicReadEnabled` shares or stops sharing the project's read-only public view (see the public operations). `repositories` replaces the project's linked git remotes (at most 20), and any `projectId` then accepts one of them; within a workspace only one unarchived project can hold a remote."),
 	move_project: op(projectInput.extend({
 		...mutation,
 		expectedVersion: version,
@@ -4479,13 +4530,14 @@ const operations = {
 	}).strict(), okSchema, "POST", "/projects/{projectId}/members", "admin", "Add or update an existing user's membership with a seeded role or a custom role of the project's workspace, or remove it with a null role. Needs `member.manage`; the role, and any role the person holds now, must grant nothing the caller lacks."),
 	list_tickets: op(projectInput.extend({
 		...ticketFilter.shape,
+		sort: listSort,
 		...pagination,
 		relatedTo: id.optional(),
 		stateId: z.uuid().optional(),
 		scheduledFrom: timestamp.optional(),
 		scheduledTo: timestamp.optional(),
 		...ticketView
-	}).superRefine(rejectConflicts), page(ticketRow), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination. Each property filter takes one value or a repeated list (any of them); its `Not` twin excludes values. Double-quoted segments of `q` match as exact phrases. Pass `view: \"summary\"` when scanning results: rows then omit the description and acceptance criteria."),
+	}).superRefine(rejectConflicts), page(ticketRow), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination. Each property filter takes one value or a repeated list (any of them); its `Not` twin excludes values. `q` keeps only tickets whose key, title, description, acceptance criteria, labels, or scopes contain its text as written, or whose key or ID it names exactly; double-quoted segments are exact phrases that must each appear on word boundaries, so `\"IME\"` does not match `time` while unquoted `IME` does. With `q` and no `sort`, results order by relevance as in search_tickets; otherwise by `sort` (default `priority`). With `view: \"summary\"`, rows omit the description and acceptance criteria."),
 	list_ticket_labels: op(projectInput.extend({ archived: ticketFilter.shape.archived }), z.array(z.object({
 		name: z.string(),
 		count: z.number().int().nonnegative()
@@ -4579,7 +4631,7 @@ const operations = {
 		claim: claimSchema.nullable(),
 		subscribed: z.boolean(),
 		canReleaseClaim: z.boolean()
-	}), "GET", "/projects/{projectId}/tickets/{ticketId}", "read", "Read a ticket by ID or key, with readiness and ownership."),
+	}), "GET", "/projects/{projectId}/tickets/{ticketId}", "read", "Read a ticket by ID or key, with readiness and ownership.", { mcp: "core" }),
 	create_ticket: op(projectInput.extend({
 		...mutation,
 		title: ticketFields.shape.title,
@@ -4601,14 +4653,14 @@ const operations = {
 		archived: z.boolean().default(false),
 		uploads: z.array(z.uuid()).max(50).default([]),
 		customFields: customFieldValues.default({})
-	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets", "write", "Create a ticket. `customFields` maps field IDs from list_custom_fields to values; omitted fields take their default, and a required field must end with a value. `uploads` lists your staged inline uploads in this project; they become its attachments in the same write, or nothing is created. Reuse requestId when retrying this write."),
+	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets", "write", "Create a ticket. `customFields` maps field IDs from list_custom_fields to values; omitted fields take their default, and a required field must end with a value. `uploads` lists your staged inline uploads in this project; they become its attachments in the same write, or nothing is created. Reuse requestId when retrying this write.", { mcp: "core" }),
 	duplicate_ticket: op(ticketInput.extend(mutation).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/duplicate", "write", "Copy a ticket into a new To do ticket in the same project, linked to the original by a clones relationship. Copies requirements, properties, labels, scopes, and parent; resets agent readiness and never copies claims, comments, evidence, attachments, or children. Reuse requestId when retrying this write."),
 	update_ticket: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version,
 		changes: ticketChanges,
 		claimId: z.uuid().optional()
-	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}", "write", "Update a ticket with optimistic concurrency. Worker completion requires its active claim. `changes.customFields` sets only the named fields; null clears one."),
+	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}", "write", "Update a ticket with optimistic concurrency. Worker completion requires its active claim. `changes.customFields` sets only the named fields; null clears one.", { mcp: "core" }),
 	update_ticket_labels: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version,
@@ -4638,7 +4690,7 @@ const operations = {
 	resolve_ticket: op(z.object({ ticketId: id }).strict(), z.object({
 		ticket: ticketSchema,
 		project: projectRef
-	}), "GET", "/tickets/resolve", "read", "Find a ticket by ID, current key, or any earlier key from a prefix change or a move, across every accessible project. An unknown or inaccessible ticket reads as not found."),
+	}), "GET", "/tickets/resolve", "read", "Find a ticket by ID, current key, or any earlier key from a prefix change or a move, across every accessible project. An unknown or inaccessible ticket reads as not found.", { mcp: "core" }),
 	bulk_update_tickets: op(projectInput.extend({
 		...mutation,
 		tickets: claimedTicketSelection,
@@ -4661,7 +4713,7 @@ const operations = {
 		ticket: ticketRow,
 		project: projectRef,
 		snippet: z.string().optional()
-	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace. Results order by exact key match, then relevance, then recency. Double-quoted segments of `q` match as exact phrases. Pass `view: \"summary\"` when scanning results: each ticket is then a compact row and the result carries a `snippet` of the matching text."),
+	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace. Results order by exact key match, then relevance, then recency. Double-quoted segments of `q` match as exact phrases on word boundaries, so `\"IME\"` does not match `time`. With `view: \"summary\"`, each ticket is a compact row and the result carries a `snippet` of the matching text.", { mcp: "core" }),
 	search_workspace: op(z.object({
 		q: z.string().trim().min(1).max(200),
 		workspaceId: z.uuid().optional(),
@@ -4676,19 +4728,19 @@ const operations = {
 		counts: z.record(z.enum(searchResultTypes), z.number().int().nonnegative()),
 		engine: z.enum(["postgres", "index"]),
 		indexing: z.boolean()
-	}), "GET", "/search", "read", "Search accessible tickets, projects, comments, and activity by text or ticket key, optionally within one workspace or one result type. Property filters restrict results to matching tickets. Results order by exact key match, then type, then ticket relevance, then recency. Double-quoted segments of `q` match ticket text as exact phrases. Pass `view: \"summary\"` when scanning results: ticket results then carry their summary row and each result a `snippet` of the matching text."),
+	}), "GET", "/search", "read", "Search accessible tickets, projects, comments, and activity by text or ticket key, optionally within one workspace or one result type. Property filters restrict results to matching tickets. Results order by exact key match, then type, then ticket relevance, then recency. Double-quoted segments of `q` match ticket text as exact phrases on word boundaries. With `view: \"summary\"`, ticket results carry their summary row and each result a `snippet` of the matching text."),
 	list_my_work: op(z.object({
 		workspaceId: z.uuid().optional(),
 		q: ticketFilter.shape.q,
-		sort: ticketFilter.shape.sort,
+		sort: listSort,
 		order: ticketFilter.shape.order,
 		activity: z.coerce.number().int().min(0).max(50).default(0),
 		...pagination
-	}).strict(), page(ticketSchema).extend({ activity: z.array(eventSchema).default([]) }), "GET", "/my-work", "read", "List open, unarchived tickets assigned to the current identity across every accessible project, optionally within one workspace, with the most recent accessible activity when `activity` is set."),
+	}).strict(), page(ticketSchema).extend({ activity: z.array(eventSchema).default([]) }), "GET", "/my-work", "read", "List open, unarchived tickets assigned to the current identity across every accessible project, optionally within one workspace, with the most recent accessible activity when `activity` is set. `q` and `sort` work as in list_tickets.", { mcp: "core" }),
 	list_eligible_tickets: op(projectInput.extend(pagination), page(z.object({
 		ticket: ticketSchema,
 		readiness: readinessSchema
-	})), "GET", "/projects/{projectId}/eligibility", "read", "Inspect eligibility and explicit blocking reasons for open tickets."),
+	})), "GET", "/projects/{projectId}/eligibility", "read", "Inspect eligibility and explicit blocking reasons for open tickets.", { mcp: "core" }),
 	list_relations: op(ticketInput, z.array(relationSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/relations", "read", "List incoming and outgoing ticket relationships with each side's key, title, and project. A ticket in a project the caller cannot read appears by ID and key alone, with `restricted: true`."),
 	add_relation: op(ticketInput.extend({
 		...mutation,
@@ -4704,7 +4756,7 @@ const operations = {
 	add_comment: op(ticketInput.extend({
 		...mutation,
 		body: text.max(5e4)
-	}).strict(), commentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/comments", "write", "Add a comment with authenticated attribution. Mention a project member with `[@Name](mention:<user id>)` from list_members; members who can read the project are notified."),
+	}).strict(), commentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/comments", "write", "Add a comment with authenticated attribution. Mention a project member with `[@Name](mention:<user id>)` from list_members; members who can read the project are notified.", { mcp: "core" }),
 	update_comment: op(projectInput.extend({
 		...mutation,
 		commentId: z.uuid(),
@@ -4720,11 +4772,16 @@ const operations = {
 	upload_attachment: op(ticketInput.extend({
 		...mutation,
 		...fileFields
-	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path. An intake credential can attach up to 10 files to a quarantined ticket it created, within 1 GB across its quarantined tickets."),
+	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path. An intake credential can attach up to 10 files to a quarantined ticket it created, within 1 GB across its quarantined tickets. For a file on disk, use create_upload_url instead of inlining it."),
 	stage_upload: op(projectInput.extend({
 		...mutation,
 		...fileFields
-	}).strict(), stagedUploadSchema, "POST", "/projects/{projectId}/uploads", "write", "Stage up to 10 MB of base64-encoded bytes for a ticket that does not exist yet. Only you can read it, at its attachment content address, until create_ticket claims it; unclaimed uploads expire after 24 hours."),
+	}).strict(), stagedUploadSchema, "POST", "/projects/{projectId}/uploads", "write", "Stage up to 10 MB of base64-encoded bytes for a ticket that does not exist yet. Only you can read it, at its attachment content address, until create_ticket claims it; unclaimed uploads expire after 24 hours. For a file on disk, use create_upload_url instead of inlining it."),
+	create_upload_url: op(projectInput.extend({
+		...fileMetadata,
+		ticketId: id.optional(),
+		size: z.number().int().nonnegative().max(attachmentLimit)
+	}).strict(), uploadUrlSchema, "POST", "/projects/{projectId}/upload-urls", "write", "Get a single-use URL for one file of up to 10 MB, so its bytes never pass through the tool call. PUT exactly `size` bytes to `url` within 15 minutes, for example `curl --upload-file <path> <url>`; the URL needs no other credential and reads nothing. With `ticketId` the file becomes that ticket's attachment; without it, it is a staged upload that create_ticket `uploads` claims by `uploadId`."),
 	discard_upload: op(projectInput.extend({
 		...mutation,
 		uploadId: z.uuid()
@@ -4739,7 +4796,7 @@ const operations = {
 		...mutation,
 		...evidenceFields.shape,
 		claimId: z.uuid().optional()
-	}).strict(), evidenceSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/evidence", "write", "Attach evidence with its commit and provenance."),
+	}).strict(), evidenceSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/evidence", "write", "Attach evidence with its commit and provenance.", { mcp: "core" }),
 	list_time_entries: op(ticketInput.extend(pagination), page(timeEntrySchema), "GET", "/projects/{projectId}/tickets/{ticketId}/time-entries", "read", "List observed time entries, newest first. Running entries have null endAt and durationMs."),
 	get_time_entry: op(ticketInput.extend({ timeEntryId: z.uuid() }), timeEntrySchema, "GET", "/projects/{projectId}/tickets/{ticketId}/time-entries/{timeEntryId}", "read", "Read one attributed time entry within its current ticket and project."),
 	create_time_entry: op(ticketInput.extend({
@@ -4785,18 +4842,18 @@ const operations = {
 	claim_ticket: op(ticketInput.extend({
 		...mutation,
 		workerId: text.max(200),
-		expectedVersion: version,
+		expectedVersion: version.optional(),
 		leaseSeconds: claimLeaseSecondsSchema.optional()
-	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim", "claim", "Atomically claim ready work. Expired claims require explicit recovery."),
+	}).strict(), claimSchema.extend({ ticket: ticketSchema }), "POST", "/projects/{projectId}/tickets/{ticketId}/claim", "claim", "Atomically claim ready work and return the claim with the claimed ticket. expectedVersion is optional; readiness always applies. Expired claims require explicit recovery.", { mcp: "core" }),
 	renew_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid(),
 		leaseSeconds: claimLeaseSecondsSchema.optional()
-	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/renew", "claim", "Renew the caller's unexpired claim."),
+	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/renew", "claim", "Renew the caller's unexpired claim.", { mcp: "core" }),
 	release_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid()
-	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/release", "claim", "Release the caller's claim."),
+	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/release", "claim", "Release the caller's claim.", { mcp: "core" }),
 	recover_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid().optional(),
@@ -5084,4 +5141,4 @@ function parseOutput(name, value) {
 	return operations[name].output.parse(value);
 }
 //#endregion
-export { permissionLabels as $, hasAdminRole as A, workflowOrder as At, memberSchema as B, searchSettingsSchema as Bt, errorSchema as C, streamErrorSchema as Ct, filterKey as D, ticketPredicates as Dt, eventSchema as E, ticketImportSchema as Et, isHexColor as F, instanceUpdateSchema as Ft, notificationReadInput as G, notificationIdsInput as H, isOperation as I, photoInputSchema as It, operationPermission as J, notificationsSchema as K, isPresetColor as L, photoResultSchema as Lt, importProviderDefinitions as M, adminInstanceSchema as Mt, importSecretFields as N, authenticationPolicySchema as Nt, filterList as O, ticketSchema as Ot, invitationStatuses as P, brokerSettingsSchema as Pt, parsePublicOutput as Q, isPublicOperation as R, s3SettingsSchema as Rt, difficulties as S, states as St, eventLabels as T, ticketFilter as Tt, notificationPreferencesInput as U, mentionScheme as V, notificationPreferencesSchema as W, parseCustomFieldFilter as X, operations as Y, parseOutput as Z, deletedAccountName as _, seededPermissions as _t, checkpointSchema as a, publicOperations as at, destinationEventKeys as b, stagedUploadLifetime as bt, credentialInput as c, repositoryProviderDefinitions as ct, customFieldSchema as d, resourceProvider as dt, permissionScope as et, customFieldValue as f, roleCategory as ft, defaultWorkflow as g, searchResultTypes as gt, defaultOrder as h, scopes as ht, channelRouteAllows as i, projectSchema as it, importLimits as j, workspaceSchema as jt, formatEvent as k, ticketSummarySchema as kt, credentialProjectsSchema as l, repositoryProviders as lt, defaultClaimMaxLeaseSeconds as m, roles as mt, attachmentLimit as n, priorities as nt, claimLeaseSecondsSchema as o, pushDeviceInput as ot, customFieldValueSchema as p, roleLabels as pt, okSchema as q, channelKinds as r, priorityLabels as rt, closedStates as s, remoteKinds as st, ApiError as t, permissions as tt, customFieldFilterTokens as u, repositorySecretFields as ut, deliverySecretFields as v, signInMethodLabels as vt, eventCategories as w, ticketExportFormat as wt, destinationKinds as x, stateLabels as xt, deliverySettingsSchema as y, snapshotSchema as yt, isSeededRole as z, searchAuthentication as zt };
+export { parseCustomFieldFilter as $, filterList as A, ticketImportSchema as At, isPublicOperation as B, instanceUpdateSchema as Bt, destinationKinds as C, stagedUploadLifetime as Ct, eventLabels as D, streamErrorSchema as Dt, eventCategories as E, states as Et, importSecretFields as F, workflowOrder as Ft, notificationIdsInput as G, searchSettingsSchema as Gt, memberSchema as H, photoResultSchema as Ht, invitationStatuses as I, workspaceSchema as It, notificationReadInput as J, notificationPreferencesInput as K, isHexColor as L, adminInstanceSchema as Lt, hasAdminRole as M, ticketSchema as Mt, importLimits as N, ticketSummarySchema as Nt, eventSchema as O, ticketExportFormat as Ot, importProviderDefinitions as P, uploadUrlLifetime as Pt, operations as Q, isOperation as R, authenticationPolicySchema as Rt, destinationEventKeys as S, snapshotSchema as St, errorSchema as T, stateLabels as Tt, mentionScheme as U, s3SettingsSchema as Ut, isSeededRole as V, photoInputSchema as Vt, normalizeRemote as W, searchAuthentication as Wt, okSchema as X, notificationsSchema as Y, operationPermission as Z, defaultOrder as _, roles as _t, channelRouteAllows as a, priorities as at, deliverySecretFields as b, seededPermissions as bt, claimSchema as c, publicOperations as ct, credentialProjectsSchema as d, repositoryProviderDefinitions as dt, parseOutput as et, customFieldFilterTokens as f, repositoryProviders as ft, defaultClaimMaxLeaseSeconds as g, roleLabels as gt, customFieldValueSchema as h, roleCategory as ht, channelKinds as i, permissions as it, formatEvent as j, ticketPredicates as jt, filterKey as k, ticketFilter as kt, closedStates as l, pushDeviceInput as lt, customFieldValue as m, resourceProvider as mt, attachmentLimit as n, permissionLabels as nt, checkpointSchema as o, priorityLabels as ot, customFieldSchema as p, repositorySecretFields as pt, notificationPreferencesSchema as q, attachmentSchema as r, permissionScope as rt, claimLeaseSecondsSchema as s, projectSchema as st, ApiError as t, parsePublicOutput as tt, credentialInput as u, remoteKinds as ut, defaultWorkflow as v, scopes as vt, difficulties as w, stagedUploadSchema as wt, deliverySettingsSchema as x, signInMethodLabels as xt, deletedAccountName as y, searchResultTypes as yt, isPresetColor as z, brokerSettingsSchema as zt };