@maudecode/kanvil 0.6.1 → 0.8.0

package/apps/server/dist/{src-BaTNDJB7.mjs → src-CC6lPIU_.mjs}

@@ -290,10 +290,15 @@ var en_US_default = {
 			priority: "Priority",
 			kind: "Kind",
 			difficulty: "Difficulty",
+			automation: "Agent readiness",
 			label: "Label",
 			assigneeId: "Assignee",
 			customField: "Field"
 		},
+		automationFilter: {
+			ready: "Ready for agents",
+			manual: "Needs a person"
+		},
 		sort: {
 			priority: "Priority",
 			updated: "Recently updated",
@@ -436,6 +441,10 @@ var en_US_default = {
 				updated: "Time entry updated",
 				deleted: "Time entry deleted"
 			},
+			epic: {
+				created: "Epic created",
+				updated: "Epic updated"
+			},
 			label: {
 				created: "Label created",
 				updated: "Label updated",
@@ -489,6 +498,7 @@ var en_US_default = {
 				created: "Calendar feed created",
 				revoked: "Calendar feed revoked"
 			},
+			public_board: { updated: "Public board updated" },
 			project: {
 				created: "Project created",
 				updated: "Project updated",
@@ -535,6 +545,7 @@ var en_US_default = {
 				time_entry_conflict: "This actor already has a running entry on the ticket.",
 				claim_conflict: "Another worker holds this ticket.",
 				idempotency_conflict: "This request was already used for another change.",
+				duplicate_repository: "Another project in this workspace links this repository.",
 				project_archived: "Restore the archived project before changing it.",
 				rate_limited: "Too many changes in a short time. Wait and retry.",
 				snapshot_required: "The live feed fell behind. Reload to continue.",
@@ -1073,6 +1084,8 @@ var en_US_default = {
 			kind: "Kind",
 			difficulty: "Difficulty",
 			assignee: "Assignee",
+			epic: "Epic",
+			noEpic: "No epic",
 			you: "{{name}} (you)",
 			assignTo: "Assign to…",
 			set: "Set {{label, lowercase}}…",
@@ -1162,6 +1175,7 @@ var en_US_default = {
 				priority: "All priorities",
 				kind: "All kinds",
 				difficulty: "All difficulties",
+				automation: "Any readiness",
 				label: "All labels",
 				assigneeId: "Anyone",
 				customField: "Any field value"
@@ -1171,6 +1185,7 @@ var en_US_default = {
 				priority: "Search priorities",
 				kind: "Search kinds",
 				difficulty: "Search difficulties",
+				automation: "Search readiness",
 				label: "Search labels",
 				assigneeId: "Search people",
 				customField: "Search fields"
@@ -1703,6 +1718,9 @@ var en_US_default = {
 			changePrefixDescription: "Every ticket in {{name}} takes the new prefix and keeps its number.",
 			changing: "Changing…",
 			prefixChanged: "Tickets now use {{key}}",
+			repositories: "Repositories",
+			repositoriesDescription: "Agents can pass one of these git remotes as the project ID.",
+			repositoriesInvalid: "Enter up to 20 git remotes, such as git@github.com:owner/repo.git.",
 			publicLink: "Public link",
 			publicDisclosure: "Anyone with the link can read every unarchived ticket's title, description, acceptance criteria, status, priority, kind, difficulty, labels, scopes, dates, and links to other tickets in this project. People, comments, activity, attachments, evidence, and claims stay private.",
 			publicOn: "Public link on",
@@ -1823,6 +1841,8 @@ var en_US_default = {
 				kept: "Kept",
 				projects: "Projects",
 				members: "Members",
+				epics: "Epics",
+				epicTickets: "Tickets leaving an epic",
 				sharedLabels: "Shared labels",
 				signIn: "Sign-in",
 				sessions: "Sessions",
@@ -2937,6 +2957,7 @@ const scopes = [
 ];
 const attachmentLimit = 1e7;
 const stagedUploadLifetime = 864e5;
+const uploadUrlLifetime = 9e5;
 const stateLabels = labelTable(states, (value) => t(`common.status.${value}`));
 const priorityLabels = labelTable(priorities, (value) => t(`common.priority.${value}`));
 ticketSymbols.status.backlog.tone, ticketSymbols.status.todo.tone, ticketSymbols.status.in_progress.tone, ticketSymbols.status.in_review.tone, ticketSymbols.status.done.tone, ticketSymbols.status.cancelled.tone;
@@ -3053,9 +3074,30 @@ const placement = {
 	after: id.optional()
 };
 const oneNeighbor = (input) => input.before === void 0 || input.after === void 0;
-const projectInput = z.object({ projectId: id });
+const projectInput = z.object({ projectId: z.string().min(1).max(300) });
 const ticketInput = projectInput.extend({ ticketId: id });
 const projectKey = z.string().trim().regex(/^[A-Z][A-Z0-9]{1,9}$/);
+const remoteHost = "(?<host>[a-z0-9][a-z0-9.-]*)";
+const remotePath = "(?<path>[^?#]+)";
+const remoteForms = [
+	new RegExp(`^(?<scheme>https|ssh)://(?:[^/]*@)?${remoteHost}(?::(?<port>\\d+))?/${remotePath}$`),
+	new RegExp(`^[^/:@]+@${remoteHost}:${remotePath}$`),
+	new RegExp(`^${remoteHost}(?::(?<port>\\d+))?/${remotePath}$`)
+];
+const defaultRemotePorts = {
+	https: "443",
+	ssh: "22"
+};
+function normalizeRemote(value) {
+	const remote = value.trim().toLowerCase();
+	if (/\s/.test(remote)) return null;
+	const { scheme, host, port, path } = remoteForms.map((form) => form.exec(remote)).find(Boolean)?.groups ?? {};
+	const segments = path?.replace(/\/+$/, "").replace(/\.git$/, "").split("/").filter(Boolean);
+	if (!host || !segments?.length) return null;
+	return `${host}${port && port !== defaultRemotePorts[scheme ?? ""] ? `:${port}` : ""}/${segments.join("/")}`;
+}
+const repositoryRemote = z.string().max(300).refine((value) => normalizeRemote(value) !== null, "Enter a git remote URL").overwrite((value) => normalizeRemote(value) ?? value);
+const projectRepositories = z.array(repositoryRemote).max(20).overwrite((remotes) => [...new Set(remotes)]);
 const reason = z.object({
 	code: z.string(),
 	message: z.string(),
@@ -3072,15 +3114,19 @@ const filterFieldNames = [
 	"priority",
 	"kind",
 	"difficulty",
+	"automation",
 	"label",
 	"assigneeId",
 	"customField"
 ];
+const automationFilters = ["ready", "manual"];
+labelTable(automationFilters, (value) => t(`common.automationFilter.${value}`));
 const filterFields = {
 	status: z.enum(states),
 	priority: z.enum(priorities),
 	kind: z.enum(kinds),
 	difficulty: z.enum(difficulties),
+	automation: z.enum(automationFilters),
 	label: z.string().max(40),
 	assigneeId: z.union([id, z.literal("none")]),
 	customField: z.string().regex(/^[0-9a-f-]{36}:(?:none|true|[0-9a-f-]{36})$/)
@@ -3098,6 +3144,8 @@ const filterShape = {
 	kindNot: filterValues(filterFields.kind),
 	difficulty: filterValues(filterFields.difficulty),
 	difficultyNot: filterValues(filterFields.difficulty),
+	automation: filterValues(filterFields.automation),
+	automationNot: filterValues(filterFields.automation),
 	label: filterValues(filterFields.label),
 	labelNot: filterValues(filterFields.label),
 	assigneeId: filterValues(filterFields.assigneeId),
@@ -3167,6 +3215,7 @@ const ticketFilter = z.object({
 	]).default("priority"),
 	order: z.enum(["asc", "desc"]).optional()
 }).strict().superRefine(rejectConflicts);
+const listSort = ticketFilter.shape.sort.unwrap().optional();
 labelTable(ticketFilter.shape.sort.unwrap().options, (sort) => t(`common.sort.${sort}`));
 const defaultOrder = {
 	priority: "asc",
@@ -3197,6 +3246,7 @@ const ticketFields = z.object({
 	scopes: tags,
 	assigneeId: z.string().nullable(),
 	parentId: z.uuid().nullable(),
+	epicId: z.uuid().nullable(),
 	automationReady: z.boolean(),
 	holdReason: z.string().trim().max(2e3).nullable(),
 	startAt: dueDate.nullable(),
@@ -3275,6 +3325,7 @@ const projectSchema = z.object({
 	key: z.string(),
 	name: z.string(),
 	description: z.string(),
+	repositories: z.array(z.string()).default([]),
 	version,
 	archivedAt: timestamp.nullable().default(null),
 	createdAt: timestamp,
@@ -3304,7 +3355,8 @@ const projectImpactSchema = z.object({
 		copiedLabels: z.array(z.string()),
 		mergedLabels: z.array(z.string()),
 		subscriptions: count,
-		invitations: count
+		invitations: count,
+		epicTickets: count.default(0)
 	}).nullable()
 });
 const workspaceImpactSchema = projectImpactSchema.omit({ transfer: true }).extend({
@@ -3315,7 +3367,8 @@ const workspaceImpactSchema = projectImpactSchema.omit({ transfer: true }).exten
 	})),
 	members: count,
 	invitations: count,
-	labels: count
+	labels: count,
+	epics: count.default(0)
 });
 const deletedAccountName = "Deleted account";
 const accountImpactSchema = z.object({
@@ -3337,6 +3390,7 @@ const accountImpactSchema = z.object({
 });
 const ticketSchema = z.object({
 	...ticketFields.shape,
+	epicId: z.uuid().nullable().default(null),
 	startAt: dueDate.nullable().default(null),
 	stateId: z.uuid().nullable().default(null),
 	customFields: z.record(z.string(), customFieldValue).default({}),
@@ -3365,11 +3419,27 @@ const ticketSummarySchema = ticketSchema.pick({
 	scopes: true,
 	archived: true,
 	automationReady: true,
+	epicId: true,
 	updatedAt: true,
 	version: true
 });
 const ticketView = { view: z.enum(["summary", "full"]).default("full") };
 const ticketRow = z.union([ticketSchema, ticketSummarySchema]);
+const epicSchema = z.object({
+	id: z.uuid(),
+	workspaceId: z.uuid(),
+	title: text.max(200),
+	description: z.string(),
+	archived: z.boolean(),
+	version,
+	createdBy: z.string(),
+	createdAt: timestamp,
+	updatedAt: timestamp
+});
+const epicRollupSchema = epicSchema.extend({
+	openTickets: count,
+	closedTickets: count
+});
 const snapshotSchema = z.object({
 	project: projectSchema,
 	tickets: z.array(ticketSchema),
@@ -3445,6 +3515,11 @@ const attachmentSchema = z.object({
 	createdAt: timestamp
 });
 const stagedUploadSchema = attachmentSchema.omit({ ticketId: true }).extend({ expiresAt: timestamp });
+const uploadUrlSchema = z.object({
+	uploadId: z.uuid(),
+	url: z.url(),
+	expiresAt: timestamp
+});
 const httpUrl = z.url().regex(/^https?:\/\//i, "Use an HTTP or HTTPS URL");
 const evidenceFields = z.object({
 	kind: z.enum([
@@ -3539,6 +3614,25 @@ const calendarFeedSchema = z.object({
 	createdAt: timestamp,
 	active: z.boolean()
 });
+const publicBoardSchema = z.object({
+	projectId: z.uuid(),
+	enabled: z.boolean(),
+	title: text.max(80),
+	labels: tags,
+	excludedLabels: tags,
+	version,
+	createdAt: timestamp,
+	updatedAt: timestamp
+});
+const publicBoardTicketSchema = z.object({
+	projectId: z.uuid(),
+	key: z.string(),
+	title: z.string(),
+	kind: z.enum(kinds),
+	status: z.enum(states),
+	createdAt: timestamp,
+	updatedAt: timestamp
+});
 const eventSchema = z.object({
 	id: z.string().regex(/^\d+$/),
 	projectId: z.uuid(),
@@ -3922,6 +4016,8 @@ const eventLabels = labelTable([
 	"label.created",
 	"label.updated",
 	"label.deleted",
+	"epic.created",
+	"epic.updated",
 	"workflow.created",
 	"workflow.updated",
 	"workflow.deleted",
@@ -3955,6 +4051,7 @@ const eventLabels = labelTable([
 	"resource.removed",
 	"calendar_feed.created",
 	"calendar_feed.revoked",
+	"public_board.updated",
 	"project.created",
 	"project.updated",
 	"project.archived",
@@ -4210,21 +4307,25 @@ const page = (item) => z.object({
 	items: z.array(item),
 	total: z.number().int().nonnegative()
 });
-const fileFields = {
+const fileMetadata = {
 	name: text.max(255).refine((value) => {
 		for (const character of value) if (character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) return false;
 		return true;
 	}, "Use a filename without control characters"),
-	contentType: z.string().max(120).regex(/^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/i).default("application/octet-stream"),
+	contentType: z.string().max(120).regex(/^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/i).default("application/octet-stream")
+};
+const fileFields = {
+	...fileMetadata,
 	data: z.string().max(Math.ceil(attachmentLimit / 3) * 4)
 };
-const op = (input, output, method, path, scope, description) => ({
+const op = (input, output, method, path, scope, description, options = {}) => ({
 	input,
 	output,
 	method,
 	path,
 	scope,
-	description
+	description,
+	...options
 });
 const operations = {
 	list_workspaces: op(z.object({}), z.array(workspaceSchema), "GET", "/workspaces", "read", "List accessible workspaces and the current membership role."),
@@ -4290,6 +4391,37 @@ const operations = {
 		userId: z.string().min(1),
 		confirmEmail: z.string().trim().max(320)
 	}).strict(), okSchema, "DELETE", "/accounts/{userId}", "write", "Delete an account: remove its sign-in methods, sessions, API keys, OAuth grants, devices, notification settings, memberships, and photo, release its claims, cancel its imports, and replace its name and email with a `Deleted account` tombstone. Tickets, comments, evidence, and activity keep the account ID. Only the account itself or an instance administrator, signed in within the last 15 minutes, can delete; `confirmEmail` must repeat the account's email. Fails with `workspace_owner` while it owns a workspace and `last_administrator` for the last active instance or workspace administrator."),
+	list_epics: op(z.object({
+		workspaceId: z.uuid(),
+		archived: ticketFilter.shape.archived,
+		...pagination
+	}), page(epicRollupSchema), "GET", "/workspaces/{workspaceId}/epics", "read", "List the workspace's Epics by title, each with open and closed ticket counts from the projects you can read, leaving out archived tickets. Archived Epics are left out unless `archived` is `include` or `only`."),
+	get_epic: op(z.object({
+		workspaceId: z.uuid(),
+		epicId: z.uuid()
+	}), epicRollupSchema, "GET", "/workspaces/{workspaceId}/epics/{epicId}", "read", "Read one Epic with the same ticket counts as list_epics."),
+	create_epic: op(z.object({
+		...mutation,
+		workspaceId: z.uuid(),
+		title: epicSchema.shape.title,
+		description: z.string().max(1e5).default("")
+	}).strict(), epicSchema, "POST", "/workspaces/{workspaceId}/epics", "write", "Create an Epic that groups tickets from any project in the workspace. Add a ticket by setting `epicId` through create_ticket, update_ticket, or bulk_update_tickets. Membership has no effect on readiness, eligibility, or claims. Reuse requestId when retrying this write."),
+	update_epic: op(z.object({
+		...mutation,
+		workspaceId: z.uuid(),
+		epicId: z.uuid(),
+		expectedVersion: version,
+		title: epicSchema.shape.title.optional(),
+		description: z.string().max(1e5).optional(),
+		archived: z.boolean().optional()
+	}).strict().refine(({ title, description, archived }) => title !== void 0 || description !== void 0 || archived !== void 0, "Provide at least one change"), epicSchema, "PATCH", "/workspaces/{workspaceId}/epics/{epicId}", "write", "Change an Epic's title or description, archive it, or restore it with `archived: false`. An archived Epic keeps its members and refuses new ones. There is no deletion. Reuse requestId when retrying this write."),
+	list_epic_tickets: op(z.object({
+		workspaceId: z.uuid(),
+		epicId: z.uuid(),
+		archived: ticketFilter.shape.archived,
+		...pagination,
+		...ticketView
+	}), page(ticketRow).extend({ restrictedCount: count }), "GET", "/workspaces/{workspaceId}/epics/{epicId}/tickets", "read", "List an Epic's tickets across projects, oldest first. Only tickets of projects you can read appear; `restrictedCount` counts the rest without naming them. With `view: \"summary\"`, rows omit the description and acceptance criteria."),
 	list_workspace_labels: op(z.object({ workspaceId: z.uuid() }), z.array(workspaceCatalogLabel), "GET", "/workspaces/{workspaceId}/labels", "read", "List the workspace's shared labels with ticket counts from the projects you can read, including archived tickets."),
 	create_workspace_label: op(z.object({
 		...mutation,
@@ -4312,7 +4444,7 @@ const operations = {
 		workspaceId: z.uuid(),
 		labelId: z.uuid(),
 		expectedVersion: version
-	}).strict(), okSchema, "DELETE", "/workspaces/{workspaceId}/labels/{labelId}", "admin", "Delete a workspace label and remove it from tickets and saved-view filters in every project of the workspace atomically."),
+	}).strict(), okSchema, "DELETE", "/workspaces/{workspaceId}/labels/{labelId}", "admin", "Delete a workspace label and remove it from tickets and saved-view filters in every project of the workspace atomically. Fails with `label_in_use` while an enabled public board in the workspace excludes it."),
 	list_invitations: op(z.object({ workspaceId: z.uuid() }), z.array(invitationSchema), "GET", "/workspaces/{workspaceId}/invitations", "admin", "List the workspace's pending and expired invitations."),
 	create_invitation: op(z.object({
 		workspaceId: z.uuid(),
@@ -4414,8 +4546,9 @@ const operations = {
 		publicReadEnabled: z.boolean().optional(),
 		name: text.max(120),
 		description: z.string().max(5e3),
-		key: projectKey.optional()
-	}).strict(), projectSchema, "PATCH", "/projects/{projectId}", "admin", "Update project details. A new `key` re-keys every ticket of the project; the previous prefix stays reserved for the project, and the project and every key issued under it keep resolving. `publicReadEnabled` shares or stops sharing the project's read-only public view (see the public operations)."),
+		key: projectKey.optional(),
+		repositories: projectRepositories.optional()
+	}).strict(), projectSchema, "PATCH", "/projects/{projectId}", "admin", "Update project details. A new `key` re-keys every ticket of the project; the previous prefix stays reserved for the project, and the project and every key issued under it keep resolving. `publicReadEnabled` shares or stops sharing the project's read-only public view (see the public operations). `repositories` replaces the project's linked git remotes (at most 20), and any `projectId` then accepts one of them; within a workspace only one unarchived project can hold a remote."),
 	move_project: op(projectInput.extend({
 		...mutation,
 		expectedVersion: version,
@@ -4426,18 +4559,18 @@ const operations = {
 		expectedVersion: version,
 		archived: z.boolean()
 	}).strict(), projectSchema, "POST", "/projects/{projectId}/archive", "admin", "Archive a project, or restore it with `archived: false`. An archived project keeps its tickets and history but leaves default project lists, search, My work, calendar feeds, public links, reminders, and agent queues, and its tickets and settings are read only. Fails with `claim_conflict` while any ticket is claimed."),
-	get_project_impact: op(projectInput.extend({ workspaceId: z.uuid().optional() }), projectImpactSchema, "GET", "/projects/{projectId}/impact", "admin", "Preview what deleting the project removes, or with `workspaceId`, what moving it to that workspace changes: who loses or gains access, labels copied or merged, follows and invitations dropped, and blockers such as claimed tickets."),
+	get_project_impact: op(projectInput.extend({ workspaceId: z.uuid().optional() }), projectImpactSchema, "GET", "/projects/{projectId}/impact", "admin", "Preview what deleting the project removes, or with `workspaceId`, what moving it to that workspace changes: who loses or gains access, labels copied or merged, follows and invitations dropped, tickets leaving their Epic, and blockers such as claimed tickets."),
 	transfer_project: op(projectInput.extend({
 		...mutation,
 		expectedVersion: version,
 		workspaceId: z.uuid()
-	}).strict(), projectSchema, "POST", "/projects/{projectId}/transfer", "admin", "Move a project with its tickets, keys, and links to another workspace. Requires administration of both workspaces and applies the reconciliation `get_project_impact` previews in one transaction; blockers fail with their code."),
+	}).strict(), projectSchema, "POST", "/projects/{projectId}/transfer", "admin", "Move a project with its tickets, keys, and links to another workspace. Requires administration of both workspaces and applies the reconciliation `get_project_impact` previews in one transaction, including clearing each ticket's `epicId`; blockers fail with their code."),
 	delete_project: op(projectInput.extend({
 		...mutation,
 		expectedVersion: version,
 		confirmKey: z.string().max(20)
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}", "admin", "Permanently delete a project's tickets, comments, attachments, labels, feeds, and destinations. `confirmKey` must repeat the project prefix. Fails with `claim_conflict` while any ticket is claimed. The prefix stays reserved and the activity history and deletion events are kept."),
-	export_project: op(projectInput, ticketExportSchema, "GET", "/projects/{projectId}/export", "read", "Export the project's tickets, archived ones included, as a versioned `kanvil.tickets` bundle: workflow states, custom fields, labels, relationships, comments, evidence, and links, with the people they name. Records reference each other by source ID. `completeness.omitted` counts what the bundle leaves out, such as attachments and activity history."),
+	}).strict(), okSchema, "DELETE", "/projects/{projectId}", "admin", "Permanently delete a project's tickets, comments, attachments, labels, feeds, public board, and destinations. `confirmKey` must repeat the project prefix. Fails with `claim_conflict` while any ticket is claimed. The prefix stays reserved and the activity history and deletion events are kept."),
+	export_project: op(projectInput, ticketExportSchema, "GET", "/projects/{projectId}/export", "read", "Export the project's tickets, archived ones included, as a versioned `kanvil.tickets` bundle: workflow states, custom fields, labels, relationships, comments, evidence, and links, with the people they name. Records reference each other by source ID. `completeness.omitted` counts what the bundle leaves out, such as attachments, Epics, and activity history."),
 	preview_import: op(z.object({
 		...mutation,
 		workspaceId: z.uuid(),
@@ -4479,13 +4612,15 @@ const operations = {
 	}).strict(), okSchema, "POST", "/projects/{projectId}/members", "admin", "Add or update an existing user's membership with a seeded role or a custom role of the project's workspace, or remove it with a null role. Needs `member.manage`; the role, and any role the person holds now, must grant nothing the caller lacks."),
 	list_tickets: op(projectInput.extend({
 		...ticketFilter.shape,
+		sort: listSort,
 		...pagination,
 		relatedTo: id.optional(),
 		stateId: z.uuid().optional(),
+		epicId: z.uuid().optional(),
 		scheduledFrom: timestamp.optional(),
 		scheduledTo: timestamp.optional(),
 		...ticketView
-	}).superRefine(rejectConflicts), page(ticketRow), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination. Each property filter takes one value or a repeated list (any of them); its `Not` twin excludes values. Double-quoted segments of `q` match as exact phrases. Pass `view: \"summary\"` when scanning results: rows then omit the description and acceptance criteria."),
+	}).superRefine(rejectConflicts), page(ticketRow), "GET", "/projects/{projectId}/tickets", "read", "Search tickets with server-side filters, stable ordering, and pagination. Each property filter takes one value or a repeated list (any of them); its `Not` twin excludes values. `q` keeps only tickets whose key, title, description, acceptance criteria, labels, or scopes contain its text as written, or whose key or ID it names exactly; double-quoted segments are exact phrases that must each appear on word boundaries, so `\"IME\"` does not match `time` while unquoted `IME` does. With `q` and no `sort`, results order by relevance as in search_tickets; otherwise by `sort` (default `priority`). With `view: \"summary\"`, rows omit the description and acceptance criteria."),
 	list_ticket_labels: op(projectInput.extend({ archived: ticketFilter.shape.archived }), z.array(z.object({
 		name: z.string(),
 		count: z.number().int().nonnegative()
@@ -4507,7 +4642,7 @@ const operations = {
 		...mutation,
 		labelId: z.uuid(),
 		expectedVersion: version
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/labels/{labelId}", "admin", "Delete a project label and remove it from tickets and saved-view filters atomically."),
+	}).strict(), okSchema, "DELETE", "/projects/{projectId}/labels/{labelId}", "admin", "Delete a project label and remove it from tickets and saved-view filters atomically. Fails with `label_in_use` while the project's enabled public board excludes it."),
 	list_label_colors: op(z.object({}), z.array(z.object({
 		value: hexColor,
 		createdAt: timestamp
@@ -4579,7 +4714,7 @@ const operations = {
 		claim: claimSchema.nullable(),
 		subscribed: z.boolean(),
 		canReleaseClaim: z.boolean()
-	}), "GET", "/projects/{projectId}/tickets/{ticketId}", "read", "Read a ticket by ID or key, with readiness and ownership."),
+	}), "GET", "/projects/{projectId}/tickets/{ticketId}", "read", "Read a ticket by ID or key, with readiness and ownership.", { mcp: "core" }),
 	create_ticket: op(projectInput.extend({
 		...mutation,
 		title: ticketFields.shape.title,
@@ -4596,19 +4731,20 @@ const operations = {
 		scopes: tags.default([]),
 		assigneeId: z.string().nullable().default(null),
 		parentId: z.uuid().nullable().default(null),
+		epicId: z.uuid().nullable().default(null),
 		automationReady: z.boolean().default(false),
 		holdReason: z.string().trim().max(2e3).nullable().default(null),
 		archived: z.boolean().default(false),
 		uploads: z.array(z.uuid()).max(50).default([]),
 		customFields: customFieldValues.default({})
-	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets", "write", "Create a ticket. `customFields` maps field IDs from list_custom_fields to values; omitted fields take their default, and a required field must end with a value. `uploads` lists your staged inline uploads in this project; they become its attachments in the same write, or nothing is created. Reuse requestId when retrying this write."),
-	duplicate_ticket: op(ticketInput.extend(mutation).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/duplicate", "write", "Copy a ticket into a new To do ticket in the same project, linked to the original by a clones relationship. Copies requirements, properties, labels, scopes, and parent; resets agent readiness and never copies claims, comments, evidence, attachments, or children. Reuse requestId when retrying this write."),
+	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets", "write", "Create a ticket. `customFields` maps field IDs from list_custom_fields to values; omitted fields take their default, and a required field must end with a value. `uploads` lists your staged inline uploads in this project; they become its attachments in the same write, or nothing is created. Reuse requestId when retrying this write.", { mcp: "core" }),
+	duplicate_ticket: op(ticketInput.extend(mutation).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/duplicate", "write", "Copy a ticket into a new To do ticket in the same project, linked to the original by a clones relationship. Copies requirements, properties, labels, scopes, parent, and an Epic the caller can still add to; resets agent readiness and never copies claims, comments, evidence, attachments, or children. Reuse requestId when retrying this write."),
 	update_ticket: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version,
 		changes: ticketChanges,
 		claimId: z.uuid().optional()
-	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}", "write", "Update a ticket with optimistic concurrency. Worker completion requires its active claim. `changes.customFields` sets only the named fields; null clears one."),
+	}).strict(), ticketSchema, "PATCH", "/projects/{projectId}/tickets/{ticketId}", "write", "Update a ticket with optimistic concurrency. Worker completion requires its active claim. `changes.customFields` sets only the named fields; null clears one.", { mcp: "core" }),
 	update_ticket_labels: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version,
@@ -4638,7 +4774,7 @@ const operations = {
 	resolve_ticket: op(z.object({ ticketId: id }).strict(), z.object({
 		ticket: ticketSchema,
 		project: projectRef
-	}), "GET", "/tickets/resolve", "read", "Find a ticket by ID, current key, or any earlier key from a prefix change or a move, across every accessible project. An unknown or inaccessible ticket reads as not found."),
+	}), "GET", "/tickets/resolve", "read", "Find a ticket by ID, current key, or any earlier key from a prefix change or a move, across every accessible project. An unknown or inaccessible ticket reads as not found.", { mcp: "core" }),
 	bulk_update_tickets: op(projectInput.extend({
 		...mutation,
 		tickets: claimedTicketSelection,
@@ -4661,7 +4797,7 @@ const operations = {
 		ticket: ticketRow,
 		project: projectRef,
 		snippet: z.string().optional()
-	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace. Results order by exact key match, then relevance, then recency. Double-quoted segments of `q` match as exact phrases. Pass `view: \"summary\"` when scanning results: each ticket is then a compact row and the result carries a `snippet` of the matching text."),
+	})) }), "GET", "/tickets/search", "read", "Search unarchived tickets by key or text across every accessible project, optionally within one workspace. Results order by exact key match, then relevance, then recency. Double-quoted segments of `q` match as exact phrases on word boundaries, so `\"IME\"` does not match `time`. With `view: \"summary\"`, each ticket is a compact row and the result carries a `snippet` of the matching text.", { mcp: "core" }),
 	search_workspace: op(z.object({
 		q: z.string().trim().min(1).max(200),
 		workspaceId: z.uuid().optional(),
@@ -4676,19 +4812,19 @@ const operations = {
 		counts: z.record(z.enum(searchResultTypes), z.number().int().nonnegative()),
 		engine: z.enum(["postgres", "index"]),
 		indexing: z.boolean()
-	}), "GET", "/search", "read", "Search accessible tickets, projects, comments, and activity by text or ticket key, optionally within one workspace or one result type. Property filters restrict results to matching tickets. Results order by exact key match, then type, then ticket relevance, then recency. Double-quoted segments of `q` match ticket text as exact phrases. Pass `view: \"summary\"` when scanning results: ticket results then carry their summary row and each result a `snippet` of the matching text."),
+	}), "GET", "/search", "read", "Search accessible tickets, projects, comments, and activity by text or ticket key, optionally within one workspace or one result type. Property filters restrict results to matching tickets. Results order by exact key match, then type, then ticket relevance, then recency. Double-quoted segments of `q` match ticket text as exact phrases on word boundaries. With `view: \"summary\"`, ticket results carry their summary row and each result a `snippet` of the matching text."),
 	list_my_work: op(z.object({
 		workspaceId: z.uuid().optional(),
 		q: ticketFilter.shape.q,
-		sort: ticketFilter.shape.sort,
+		sort: listSort,
 		order: ticketFilter.shape.order,
 		activity: z.coerce.number().int().min(0).max(50).default(0),
 		...pagination
-	}).strict(), page(ticketSchema).extend({ activity: z.array(eventSchema).default([]) }), "GET", "/my-work", "read", "List open, unarchived tickets assigned to the current identity across every accessible project, optionally within one workspace, with the most recent accessible activity when `activity` is set."),
+	}).strict(), page(ticketSchema).extend({ activity: z.array(eventSchema).default([]) }), "GET", "/my-work", "read", "List open, unarchived tickets assigned to the current identity across every accessible project, optionally within one workspace, with the most recent accessible activity when `activity` is set. `q` and `sort` work as in list_tickets.", { mcp: "core" }),
 	list_eligible_tickets: op(projectInput.extend(pagination), page(z.object({
 		ticket: ticketSchema,
 		readiness: readinessSchema
-	})), "GET", "/projects/{projectId}/eligibility", "read", "Inspect eligibility and explicit blocking reasons for open tickets."),
+	})), "GET", "/projects/{projectId}/eligibility", "read", "Inspect eligibility and explicit blocking reasons for open tickets.", { mcp: "core" }),
 	list_relations: op(ticketInput, z.array(relationSchema), "GET", "/projects/{projectId}/tickets/{ticketId}/relations", "read", "List incoming and outgoing ticket relationships with each side's key, title, and project. A ticket in a project the caller cannot read appears by ID and key alone, with `restricted: true`."),
 	add_relation: op(ticketInput.extend({
 		...mutation,
@@ -4704,7 +4840,7 @@ const operations = {
 	add_comment: op(ticketInput.extend({
 		...mutation,
 		body: text.max(5e4)
-	}).strict(), commentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/comments", "write", "Add a comment with authenticated attribution. Mention a project member with `[@Name](mention:<user id>)` from list_members; members who can read the project are notified."),
+	}).strict(), commentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/comments", "write", "Add a comment with authenticated attribution. Mention a project member with `[@Name](mention:<user id>)` from list_members; members who can read the project are notified.", { mcp: "core" }),
 	update_comment: op(projectInput.extend({
 		...mutation,
 		commentId: z.uuid(),
@@ -4720,11 +4856,16 @@ const operations = {
 	upload_attachment: op(ticketInput.extend({
 		...mutation,
 		...fileFields
-	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path. An intake credential can attach up to 10 files to a quarantined ticket it created, within 1 GB across its quarantined tickets."),
+	}).strict(), attachmentSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/attachments", "write", "Upload up to 10 MB of base64-encoded bytes. The original filename is metadata, never a filesystem path. An intake credential can attach up to 10 files to a quarantined ticket it created, within 1 GB across its quarantined tickets. For a file on disk, use create_upload_url instead of inlining it."),
 	stage_upload: op(projectInput.extend({
 		...mutation,
 		...fileFields
-	}).strict(), stagedUploadSchema, "POST", "/projects/{projectId}/uploads", "write", "Stage up to 10 MB of base64-encoded bytes for a ticket that does not exist yet. Only you can read it, at its attachment content address, until create_ticket claims it; unclaimed uploads expire after 24 hours."),
+	}).strict(), stagedUploadSchema, "POST", "/projects/{projectId}/uploads", "write", "Stage up to 10 MB of base64-encoded bytes for a ticket that does not exist yet. Only you can read it, at its attachment content address, until create_ticket claims it; unclaimed uploads expire after 24 hours. For a file on disk, use create_upload_url instead of inlining it."),
+	create_upload_url: op(projectInput.extend({
+		...fileMetadata,
+		ticketId: id.optional(),
+		size: z.number().int().nonnegative().max(attachmentLimit)
+	}).strict(), uploadUrlSchema, "POST", "/projects/{projectId}/upload-urls", "write", "Get a single-use URL for one file of up to 10 MB, so its bytes never pass through the tool call. PUT exactly `size` bytes to `url` within 15 minutes, for example `curl --upload-file <path> <url>`; the URL needs no other credential and reads nothing. With `ticketId` the file becomes that ticket's attachment; without it, it is a staged upload that create_ticket `uploads` claims by `uploadId`."),
 	discard_upload: op(projectInput.extend({
 		...mutation,
 		uploadId: z.uuid()
@@ -4739,7 +4880,7 @@ const operations = {
 		...mutation,
 		...evidenceFields.shape,
 		claimId: z.uuid().optional()
-	}).strict(), evidenceSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/evidence", "write", "Attach evidence with its commit and provenance."),
+	}).strict(), evidenceSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/evidence", "write", "Attach evidence with its commit and provenance.", { mcp: "core" }),
 	list_time_entries: op(ticketInput.extend(pagination), page(timeEntrySchema), "GET", "/projects/{projectId}/tickets/{ticketId}/time-entries", "read", "List observed time entries, newest first. Running entries have null endAt and durationMs."),
 	get_time_entry: op(ticketInput.extend({ timeEntryId: z.uuid() }), timeEntrySchema, "GET", "/projects/{projectId}/tickets/{ticketId}/time-entries/{timeEntryId}", "read", "Read one attributed time entry within its current ticket and project."),
 	create_time_entry: op(ticketInput.extend({
@@ -4785,18 +4926,18 @@ const operations = {
 	claim_ticket: op(ticketInput.extend({
 		...mutation,
 		workerId: text.max(200),
-		expectedVersion: version,
+		expectedVersion: version.optional(),
 		leaseSeconds: claimLeaseSecondsSchema.optional()
-	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim", "claim", "Atomically claim ready work. Expired claims require explicit recovery."),
+	}).strict(), claimSchema.extend({ ticket: ticketSchema }), "POST", "/projects/{projectId}/tickets/{ticketId}/claim", "claim", "Atomically claim ready work and return the claim with the claimed ticket. expectedVersion is optional; readiness always applies. Expired claims require explicit recovery.", { mcp: "core" }),
 	renew_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid(),
 		leaseSeconds: claimLeaseSecondsSchema.optional()
-	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/renew", "claim", "Renew the caller's unexpired claim."),
+	}).strict(), claimSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/renew", "claim", "Renew the caller's unexpired claim.", { mcp: "core" }),
 	release_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid()
-	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/release", "claim", "Release the caller's claim."),
+	}).strict(), okSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/claim/release", "claim", "Release the caller's claim.", { mcp: "core" }),
 	recover_claim: op(ticketInput.extend({
 		...mutation,
 		claimId: z.uuid().optional(),
@@ -4829,6 +4970,18 @@ const operations = {
 		...mutation,
 		feedId: z.uuid()
 	}).strict(), okSchema, "DELETE", "/projects/{projectId}/calendar-feeds/{feedId}", "admin", "Revoke a calendar feed. Its link stops working immediately."),
+	get_project_board: op(projectInput, z.object({
+		board: publicBoardSchema.nullable(),
+		tickets: z.array(publicBoardTicketSchema)
+	}), "GET", "/projects/{projectId}/public-board", "admin", "Read the project's public board, or null, and the tickets it selects exactly as it publishes them, even while it is disabled."),
+	update_project_board: op(projectInput.extend({
+		...mutation,
+		expectedVersion: version.nullable(),
+		enabled: z.boolean(),
+		title: text.max(80),
+		labels: tags,
+		excludedLabels: tags
+	}).strict(), publicBoardSchema, "PATCH", "/projects/{projectId}/public-board", "admin", "Create or replace the project's public board. It publishes the key, title, kind, status, and dates of unarchived, unheld tickets that carry any of `labels` and none of `excludedLabels`. Enabling requires at least one label."),
 	list_views: op(projectInput, z.array(z.object({
 		id: z.uuid(),
 		name: z.string(),
@@ -5044,6 +5197,8 @@ const permissionOverrides = {
 	list_calendar_feeds: "sharing.manage",
 	create_calendar_feed: "sharing.manage",
 	revoke_calendar_feed: "sharing.manage",
+	get_project_board: "sharing.manage",
+	update_project_board: "sharing.manage",
 	update_project: null
 };
 function operationPermission(name) {
@@ -5084,4 +5239,4 @@ function parseOutput(name, value) {
 	return operations[name].output.parse(value);
 }
 //#endregion
-export { permissionLabels as $, hasAdminRole as A, workflowOrder as At, memberSchema as B, searchSettingsSchema as Bt, errorSchema as C, streamErrorSchema as Ct, filterKey as D, ticketPredicates as Dt, eventSchema as E, ticketImportSchema as Et, isHexColor as F, instanceUpdateSchema as Ft, notificationReadInput as G, notificationIdsInput as H, isOperation as I, photoInputSchema as It, operationPermission as J, notificationsSchema as K, isPresetColor as L, photoResultSchema as Lt, importProviderDefinitions as M, adminInstanceSchema as Mt, importSecretFields as N, authenticationPolicySchema as Nt, filterList as O, ticketSchema as Ot, invitationStatuses as P, brokerSettingsSchema as Pt, parsePublicOutput as Q, isPublicOperation as R, s3SettingsSchema as Rt, difficulties as S, states as St, eventLabels as T, ticketFilter as Tt, notificationPreferencesInput as U, mentionScheme as V, notificationPreferencesSchema as W, parseCustomFieldFilter as X, operations as Y, parseOutput as Z, deletedAccountName as _, seededPermissions as _t, checkpointSchema as a, publicOperations as at, destinationEventKeys as b, stagedUploadLifetime as bt, credentialInput as c, repositoryProviderDefinitions as ct, customFieldSchema as d, resourceProvider as dt, permissionScope as et, customFieldValue as f, roleCategory as ft, defaultWorkflow as g, searchResultTypes as gt, defaultOrder as h, scopes as ht, channelRouteAllows as i, projectSchema as it, importLimits as j, workspaceSchema as jt, formatEvent as k, ticketSummarySchema as kt, credentialProjectsSchema as l, repositoryProviders as lt, defaultClaimMaxLeaseSeconds as m, roles as mt, attachmentLimit as n, priorities as nt, claimLeaseSecondsSchema as o, pushDeviceInput as ot, customFieldValueSchema as p, roleLabels as pt, okSchema as q, channelKinds as r, priorityLabels as rt, closedStates as s, remoteKinds as st, ApiError as t, permissions as tt, customFieldFilterTokens as u, repositorySecretFields as ut, deliverySecretFields as v, signInMethodLabels as vt, eventCategories as w, ticketExportFormat as wt, destinationKinds as x, stateLabels as xt, deliverySettingsSchema as y, snapshotSchema as yt, isSeededRole as z, searchAuthentication as zt };
+export { parseCustomFieldFilter as $, filterList as A, ticketImportSchema as At, isPublicOperation as B, instanceUpdateSchema as Bt, destinationKinds as C, stagedUploadLifetime as Ct, eventLabels as D, streamErrorSchema as Dt, eventCategories as E, states as Et, importSecretFields as F, workflowOrder as Ft, notificationIdsInput as G, searchSettingsSchema as Gt, memberSchema as H, photoResultSchema as Ht, invitationStatuses as I, workspaceSchema as It, notificationReadInput as J, notificationPreferencesInput as K, isHexColor as L, adminInstanceSchema as Lt, hasAdminRole as M, ticketSchema as Mt, importLimits as N, ticketSummarySchema as Nt, eventSchema as O, ticketExportFormat as Ot, importProviderDefinitions as P, uploadUrlLifetime as Pt, operations as Q, isOperation as R, authenticationPolicySchema as Rt, destinationEventKeys as S, snapshotSchema as St, errorSchema as T, stateLabels as Tt, mentionScheme as U, s3SettingsSchema as Ut, isSeededRole as V, photoInputSchema as Vt, normalizeRemote as W, searchAuthentication as Wt, okSchema as X, notificationsSchema as Y, operationPermission as Z, defaultOrder as _, roles as _t, channelRouteAllows as a, priorities as at, deliverySecretFields as b, seededPermissions as bt, claimSchema as c, publicOperations as ct, credentialProjectsSchema as d, repositoryProviderDefinitions as dt, parseOutput as et, customFieldFilterTokens as f, repositoryProviders as ft, defaultClaimMaxLeaseSeconds as g, roleLabels as gt, customFieldValueSchema as h, roleCategory as ht, channelKinds as i, permissions as it, formatEvent as j, ticketPredicates as jt, filterKey as k, ticketFilter as kt, closedStates as l, pushDeviceInput as lt, customFieldValue as m, resourceProvider as mt, attachmentLimit as n, permissionLabels as nt, checkpointSchema as o, priorityLabels as ot, customFieldSchema as p, repositorySecretFields as pt, notificationPreferencesSchema as q, attachmentSchema as r, permissionScope as rt, claimLeaseSecondsSchema as s, projectSchema as st, ApiError as t, parsePublicOutput as tt, credentialInput as u, remoteKinds as ut, defaultWorkflow as v, scopes as vt, difficulties as w, stagedUploadSchema as wt, deliverySettingsSchema as x, signInMethodLabels as xt, deletedAccountName as y, searchResultTypes as yt, isPresetColor as z, brokerSettingsSchema as zt };

package/apps/server/drizzle/0040_upload_urls.sql

@@ -0,0 +1,20 @@
+CREATE TABLE "upload_urls" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"project_id" uuid NOT NULL,
+	"ticket_id" uuid,
+	"actor_id" text NOT NULL,
+	"credential" jsonb,
+	"name" text NOT NULL,
+	"content_type" text NOT NULL,
+	"size" integer NOT NULL,
+	"token_hash" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"used_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "upload_urls_token_hash_unique" UNIQUE("token_hash")
+);
+--> statement-breakpoint
+ALTER TABLE "upload_urls" ADD CONSTRAINT "upload_urls_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "upload_urls" ADD CONSTRAINT "upload_urls_ticket_id_tickets_id_fk" FOREIGN KEY ("ticket_id") REFERENCES "public"."tickets"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "upload_urls" ADD CONSTRAINT "upload_urls_actor_id_user_id_fk" FOREIGN KEY ("actor_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "upload_urls_expires" ON "upload_urls" USING btree ("expires_at");

package/apps/server/drizzle/0041_project_repositories.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "projects" ADD COLUMN "repositories" text[] DEFAULT '{}' NOT NULL;--> statement-breakpoint
+ALTER TABLE "mutation_receipts" ADD COLUMN "project_id" uuid;