@maudecode/kanvil 0.6.1 → 0.8.0

package/apps/server/dist/client.mjs

@@ -1,4 +1,4 @@
-import { C as errorSchema, Ct as streamErrorSchema, E as eventSchema, G as notificationReadInput, H as notificationIdsInput, K as notificationsSchema, Q as parsePublicOutput, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, Z as parseOutput, a as checkpointSchema, at as publicOperations, q as okSchema, t as ApiError, yt as snapshotSchema } from "./src-BaTNDJB7.mjs";
+import { Dt as streamErrorSchema, G as notificationIdsInput, J as notificationReadInput, K as notificationPreferencesInput, O as eventSchema, Q as operations, St as snapshotSchema, T as errorSchema, X as okSchema, Y as notificationsSchema, ct as publicOperations, et as parseOutput, o as checkpointSchema, q as notificationPreferencesSchema, t as ApiError, tt as parsePublicOutput } from "./src-CC6lPIU_.mjs";
 import { z } from "zod";
 import { parseArgs } from "node:util";
 import { constants } from "node:fs";
@@ -653,7 +653,7 @@ profile list | profile remove <name> --yes
 --input <json|->       Operation input as a JSON object; - reads stdin
 --title <text>         Ticket title
 --body <markdown>      Comment body
---expected-version <n> Required version for update, delete, acquire and rescheduling recovery
+--expected-version <n> Required version for update, delete and rescheduling recovery; optional for acquire
 --changes <json>       Ticket update changes as a JSON object
 --request-id <uuid>    Reuse for a deliberate retry across invocations
 --json                Compact JSON output (default: indented JSON)

package/apps/server/dist/{config-BQw6mPzE.mjs → config-DUIdB3c2.mjs}

@@ -1,4 +1,4 @@
-import { Bt as searchSettingsSchema, Pt as brokerSettingsSchema, Rt as s3SettingsSchema, m as defaultClaimMaxLeaseSeconds, o as claimLeaseSecondsSchema } from "./src-BaTNDJB7.mjs";
+import { Gt as searchSettingsSchema, Ut as s3SettingsSchema, g as defaultClaimMaxLeaseSeconds, s as claimLeaseSecondsSchema, zt as brokerSettingsSchema } from "./src-CC6lPIU_.mjs";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { relations } from "drizzle-orm";

package/apps/server/dist/index.mjs

@@ -1,7 +1,7 @@
-import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-BQw6mPzE.mjs";
-import { A as hasAdminRole, B as memberSchema, Bt as searchSettingsSchema, C as errorSchema, Ft as instanceUpdateSchema, G as notificationReadInput, H as notificationIdsInput, I as isOperation, It as photoInputSchema, L as isPresetColor, Lt as photoResultSchema, M as importProviderDefinitions, Mt as adminInstanceSchema, Pt as brokerSettingsSchema, R as isPublicOperation, Rt as s3SettingsSchema, U as notificationPreferencesInput, W as notificationPreferencesSchema, Y as operations, at as publicOperations, c as credentialInput, g as defaultWorkflow, ht as scopes, j as importLimits, mt as roles, ot as pushDeviceInput, q as okSchema, s as closedStates, t as ApiError, wt as ticketExportFormat, xt as stateLabels } from "./src-BaTNDJB7.mjs";
+import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DUIdB3c2.mjs";
+import { B as isPublicOperation, Bt as instanceUpdateSchema, G as notificationIdsInput, Gt as searchSettingsSchema, H as memberSchema, Ht as photoResultSchema, J as notificationReadInput, K as notificationPreferencesInput, Lt as adminInstanceSchema, M as hasAdminRole, N as importLimits, Ot as ticketExportFormat, P as importProviderDefinitions, Q as operations, R as isOperation, T as errorSchema, Tt as stateLabels, Ut as s3SettingsSchema, Vt as photoInputSchema, X as okSchema, _t as roles, ct as publicOperations, l as closedStates, lt as pushDeviceInput, q as notificationPreferencesSchema, t as ApiError, u as credentialInput, v as defaultWorkflow, vt as scopes, z as isPresetColor, zt as brokerSettingsSchema } from "./src-CC6lPIU_.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { $ as stagedUploads, A as requireSession, B as attachmentContent, C as defaultSenders, D as createAccess, E as createHttpSender, F as decodeImage, G as events, H as blobObjects, I as imageResponse, J as notificationPreferences, L as stagedUploadCutoff, M as createTicketSearch, N as createTicketIndex, O as createWriteLimiter, P as createBlobStorage, Q as pushDevices, R as createObjectStore, S as receiveRepositoryWebhook, T as DeliveryError, U as deliveryCheckpoints, V as attachments, W as eventClock, X as profilePhotos, Y as notifications, Z as projects, _ as one, a as deliverySecrets, at as matchesOIDCBinding, b as requireRow, c as ownerBlocker, d as createDomain, et as storageBackends, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaces, j as readCalendarFeed, k as requireInstanceAdmin, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as tickets, o as otherActiveAdministrator, p as fail, q as members, r as signInProviders, rt as workspaceMembers, s as ownedWorkspaces, t as createAuth, tt as subscriptions, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createPollingJob } from "./auth-CFjetlB4.mjs";
+import { $ as pushDevices, A as createWriteLimiter, B as createPollingJob, C as receiveRepositoryWebhook, D as createHttpSender, E as DeliveryError, F as createBlobStorage, G as eventClock, H as attachments, I as decodeImage, J as members, K as events, L as imageResponse, M as requireSession, N as createTicketSearch, O as receiveUpload, P as createTicketIndex, Q as projects, R as stagedUploadCutoff, S as readCalendarFeed, T as deliverBatch, U as blobObjects, V as attachmentContent, W as deliveryCheckpoints, X as notifications, Y as notificationPreferences, Z as profilePhotos, _ as one, a as deliverySecrets, at as workspaces, b as requireRow, c as ownerBlocker, d as createDomain, et as stagedUploads, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaceMembers, j as requireInstanceAdmin, k as createAccess, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as subscriptions, o as otherActiveAdministrator, ot as matchesOIDCBinding, p as fail, r as signInProviders, rt as tickets, s as ownedWorkspaces, t as createAuth, tt as storageBackends, u as assertVersion, v as reachable, w as defaultSenders, x as processImports, y as recipientColumns, z as createObjectStore } from "./auth-CVnX2XIg.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
@@ -359,7 +359,7 @@ function createCleanup() {
 }
 //#endregion
 //#region src/version.ts
-const applicationVersion = "0.6.1";
+const applicationVersion = "0.8.0";
 //#endregion
 //#region src/realtime.ts
 async function createRealtime(config) {
@@ -3121,49 +3121,143 @@ const defaultAdapters = {
 };
 //#endregion
 //#region src/mcp.ts
+const operationNames = Object.keys(operations).filter(isOperation);
+const coreNames = operationNames.filter((name) => operations[name].mcp === "core");
+const instructions = "Ticket keys look like KAN-12, and a key's prefix or the project's linked git remote works as projectId. To work a ticket: claim_ticket, keep its status current with update_ticket, add_comment on what you did, add_evidence, then set status done and release_claim. Leave tickets with automationReady false to people. The core tools are listed. Reach every other operation with find_operation, then read_operation for reads or run_operation for writes. In replies, a missing key means null or empty; lists return summary rows unless view is full.";
+const defaultView = "summary";
+const toolInput = (name) => {
+	const input = operations[name].input;
+	return "view" in input.shape ? input.safeExtend({ view: z.enum([defaultView, "full"]).default(defaultView) }) : input;
+};
+const echoedFields = (name) => {
+	const { shape } = toolInput(name);
+	const { changes } = shape;
+	return ["description", "acceptanceCriteria"].filter((field) => field in shape || changes instanceof z.ZodObject && field in changes.shape);
+};
+const isEmpty = (value) => value === null || typeof value === "object" && Object.keys(value).length === 0;
+const compact = (value, echoed) => {
+	if (Array.isArray(value)) return value.map((item) => compact(item, echoed));
+	if (typeof value !== "object" || value === null) return value;
+	const dropped = "acceptanceCriteria" in value ? echoed : [];
+	return Object.fromEntries(Object.entries(value).filter(([key]) => !dropped.includes(key)).map(([key, field]) => [key, compact(field, echoed)]).filter(([, field]) => !isEmpty(field)));
+};
+const known = (name) => {
+	if (!isOperation(name)) throw new ApiError(404, "not_found", `No operation is named ${name}`);
+	return name;
+};
+const refuseUnknownKeys = (name, input) => {
+	const { shape } = toolInput(name);
+	const unknown = Object.keys(input).filter((key) => !Object.hasOwn(shape, key));
+	if (unknown.length > 0) throw new ApiError(400, "invalid_request", `${name} does not take ${unknown.join(", ")}. Valid keys: ${Object.keys(shape).join(", ") || "none"}.`);
+};
+const summary = (name) => ({
+	name,
+	description: operations[name].description,
+	access: operations[name].method === "GET" ? "read" : "write"
+});
+function findOperation({ query = "", name }) {
+	if (name !== void 0) {
+		const operation = known(name), spec = operations[operation];
+		return {
+			...summary(operation),
+			method: spec.method,
+			scope: spec.scope,
+			inputSchema: z.toJSONSchema(toolInput(operation), { io: "input" })
+		};
+	}
+	const terms = query.toLowerCase().split(/\s+/);
+	return { operations: operationNames.map(summary).filter((row) => terms.every((term) => `${row.name} ${row.description}`.toLowerCase().includes(term))) };
+}
+const reply = async (name, work) => {
+	try {
+		return {
+			content: [{
+				type: "text",
+				text: `${name} completed.`
+			}],
+			structuredContent: { result: await work() }
+		};
+	} catch (error) {
+		return {
+			isError: true,
+			content: [{
+				type: "text",
+				text: JSON.stringify(errorEnvelope(error).body)
+			}]
+		};
+	}
+};
+const runnerInput = {
+	name: z.string().max(80).describe("Operation name from find_operation."),
+	input: z.record(z.string(), z.unknown()).default({}).describe("The operation's input.")
+};
 function createMcp(auth, domain, access, config, limitWrite) {
-	const serve = (request, identity, limited = false) => createMcpHandler(() => {
-		const server = new McpServer({
-			name: "Kanvil",
-			version: applicationVersion
+	const serve = (request, identity, limited = false) => {
+		const execute = async (name, input) => {
+			refuseUnknownKeys(name, input);
+			if (limited && operations[name].method !== "GET") limitWrite(identity.ownerId);
+			const value = "view" in operations[name].input.shape ? {
+				view: defaultView,
+				...input
+			} : input;
+			return compact(await domain.execute(name, value, identity), echoedFields(name));
+		};
+		const runner = (write) => (args) => reply(args.name, () => {
+			const name = known(args.name);
+			if (operations[name].method !== "GET" !== write) throw new ApiError(400, "invalid_request", `${name} ${write ? "only reads; use read_operation" : "writes; use run_operation"}`);
+			return execute(name, args.input);
 		});
-		for (const name of Object.keys(operations).filter(isOperation)) {
-			const spec = operations[name];
-			const inputSchema = spec.input.shape;
-			server.registerTool(name, {
-				description: spec.description,
-				inputSchema,
-				outputSchema: { result: spec.output },
+		return createMcpHandler(() => {
+			const server = new McpServer({
+				name: "Kanvil",
+				version: applicationVersion
+			}, { instructions });
+			for (const name of coreNames) {
+				const spec = operations[name];
+				server.registerTool(name, {
+					description: spec.description,
+					inputSchema: toolInput(name).loose(),
+					annotations: {
+						readOnlyHint: spec.method === "GET",
+						destructiveHint: false,
+						idempotentHint: spec.method === "GET",
+						openWorldHint: false
+					}
+				}, (input) => reply(name, () => execute(name, input)));
+			}
+			server.registerTool("find_operation", {
+				description: "Find an operation that is not a listed tool. `query` matches names and descriptions and marks each match as read or write; `name` returns one operation with its input JSON Schema, method, and scope.",
+				inputSchema: {
+					query: z.string().max(200).optional(),
+					name: z.string().max(80).optional()
+				},
 				annotations: {
-					readOnlyHint: spec.method === "GET",
-					destructiveHint: /^(delete|remove|recover)_/.test(name),
-					idempotentHint: spec.method === "GET",
+					readOnlyHint: true,
+					idempotentHint: true,
 					openWorldHint: false
 				}
-			}, async (input) => {
-				try {
-					if (limited && spec.method !== "GET") limitWrite(identity.ownerId);
-					const result = await domain.execute(name, input, identity);
-					return {
-						content: [{
-							type: "text",
-							text: `${name} completed.`
-						}],
-						structuredContent: { result }
-					};
-				} catch (error) {
-					return {
-						isError: true,
-						content: [{
-							type: "text",
-							text: JSON.stringify(errorEnvelope(error).body)
-						}]
-					};
+			}, (input) => reply("find_operation", () => findOperation(input)));
+			server.registerTool("read_operation", {
+				description: "Run a read operation found with find_operation.",
+				inputSchema: runnerInput,
+				annotations: {
+					readOnlyHint: true,
+					idempotentHint: true,
+					openWorldHint: false
 				}
-			});
-		}
-		return server;
-	}, { legacy: "stateless" }).fetch(request);
+			}, runner(false));
+			server.registerTool("run_operation", {
+				description: "Run a write operation found with find_operation.",
+				inputSchema: runnerInput,
+				annotations: {
+					readOnlyHint: false,
+					destructiveHint: true,
+					openWorldHint: false
+				}
+			}, runner(true));
+			return server;
+		}, { legacy: "stateless" }).fetch(request);
+	};
 	const oauth = requireMcpAuth(auth, async (request, claims) => {
 		if (typeof claims.sub !== "string") throw new ApiError(401, "unauthorized", "A user subject is required");
 		const granted = typeof claims.scope === "string" ? claims.scope.split(" ") : [];
@@ -3319,13 +3413,14 @@ async function initializeApplication(database, config, adapters, cleanup) {
 		} }, { status: 400 });
 	} });
 	app.use("*", secureHeaders());
-	app.use("*", bodyLimit({
+	const limitBody = bodyLimit({
 		maxSize: 15e6,
 		onError: () => Response.json({ error: {
 			code: "payload_too_large",
 			message: "The request exceeds the upload limit"
 		} }, { status: 413 })
-	}));
+	});
+	app.use("*", (c, next) => c.req.path.startsWith("/api/uploads/") ? next() : limitBody(c, next));
 	app.onError((error) => {
 		if (error instanceof APIError && error.statusCode >= 400 && error.statusCode < 500) return Response.json({ error: {
 			code: typeof error.body?.code === "string" ? error.body.code : "authentication_error",
@@ -3421,6 +3516,33 @@ async function initializeApplication(database, config, adapters, cleanup) {
 			"Referrer-Policy": "no-referrer"
 		} });
 	});
+	app.openAPIRegistry.registerPath({
+		method: "put",
+		path: "/api/uploads/{token}",
+		request: {
+			params: z$1.object({ token: z$1.string() }),
+			body: { content: { "application/octet-stream": { schema: z$1.string() } } }
+		},
+		responses: {
+			200: { description: "The staged upload, or the attachment when the URL names a ticket" },
+			400: { description: "The body or its Content-Length is not the declared size" },
+			404: { description: "Unknown upload URL" },
+			410: { description: "The upload URL was already used or expired" }
+		}
+	});
+	app.put("/api/uploads/:token", async (c) => Response.json(await receiveUpload(domain, c.req.param("token"), c.req.header("content-length"), async (limit) => {
+		const chunks = [], reader = c.req.raw.body?.getReader();
+		if (!reader) return Buffer.alloc(0);
+		let total = 0;
+		while (total <= limit) {
+			const { done, value } = await reader.read();
+			if (done) return Buffer.concat(chunks);
+			chunks.push(value);
+			total += value.length;
+		}
+		await reader.cancel();
+		return Buffer.concat(chunks);
+	})));
 	app.openAPIRegistry.registerPath({
 		method: "post",
 		path: "/api/repository-hooks/{connectionId}",

package/apps/server/dist/migrate.mjs

@@ -1,4 +1,4 @@
-import { n as createDatabase, t as readConfig } from "./config-BQw6mPzE.mjs";
+import { n as createDatabase, t as readConfig } from "./config-DUIdB3c2.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
 const database = createDatabase(readConfig());

package/apps/server/dist/recover.mjs

@@ -1,6 +1,6 @@
-import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-BQw6mPzE.mjs";
-import { A as hasAdminRole } from "./src-BaTNDJB7.mjs";
-import { K as instanceSettings, p as fail, t as createAuth } from "./auth-CFjetlB4.mjs";
+import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DUIdB3c2.mjs";
+import { M as hasAdminRole } from "./src-CC6lPIU_.mjs";
+import { p as fail, q as instanceSettings, t as createAuth } from "./auth-CVnX2XIg.mjs";
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";