@maudecode/kanvil 0.7.0 → 0.8.0

package/apps/server/dist/client.mjs

@@ -1,4 +1,4 @@
-import { Dt as streamErrorSchema, G as notificationIdsInput, J as notificationReadInput, K as notificationPreferencesInput, O as eventSchema, Q as operations, St as snapshotSchema, T as errorSchema, X as okSchema, Y as notificationsSchema, ct as publicOperations, et as parseOutput, o as checkpointSchema, q as notificationPreferencesSchema, t as ApiError, tt as parsePublicOutput } from "./src-D70GmZ5R.mjs";
+import { Dt as streamErrorSchema, G as notificationIdsInput, J as notificationReadInput, K as notificationPreferencesInput, O as eventSchema, Q as operations, St as snapshotSchema, T as errorSchema, X as okSchema, Y as notificationsSchema, ct as publicOperations, et as parseOutput, o as checkpointSchema, q as notificationPreferencesSchema, t as ApiError, tt as parsePublicOutput } from "./src-CC6lPIU_.mjs";
 import { z } from "zod";
 import { parseArgs } from "node:util";
 import { constants } from "node:fs";

package/apps/server/dist/{config-CQVdVhXv.mjs → config-DUIdB3c2.mjs}

@@ -1,4 +1,4 @@
-import { Gt as searchSettingsSchema, Ut as s3SettingsSchema, g as defaultClaimMaxLeaseSeconds, s as claimLeaseSecondsSchema, zt as brokerSettingsSchema } from "./src-D70GmZ5R.mjs";
+import { Gt as searchSettingsSchema, Ut as s3SettingsSchema, g as defaultClaimMaxLeaseSeconds, s as claimLeaseSecondsSchema, zt as brokerSettingsSchema } from "./src-CC6lPIU_.mjs";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { relations } from "drizzle-orm";

package/apps/server/dist/index.mjs

@@ -1,7 +1,7 @@
-import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CQVdVhXv.mjs";
-import { B as isPublicOperation, Bt as instanceUpdateSchema, G as notificationIdsInput, Gt as searchSettingsSchema, H as memberSchema, Ht as photoResultSchema, J as notificationReadInput, K as notificationPreferencesInput, Lt as adminInstanceSchema, M as hasAdminRole, N as importLimits, Ot as ticketExportFormat, P as importProviderDefinitions, Q as operations, R as isOperation, T as errorSchema, Tt as stateLabels, Ut as s3SettingsSchema, Vt as photoInputSchema, X as okSchema, _t as roles, ct as publicOperations, l as closedStates, lt as pushDeviceInput, q as notificationPreferencesSchema, t as ApiError, u as credentialInput, v as defaultWorkflow, vt as scopes, z as isPresetColor, zt as brokerSettingsSchema } from "./src-D70GmZ5R.mjs";
+import { a as auth_schema_exports, d as user$1, i as apikey, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DUIdB3c2.mjs";
+import { B as isPublicOperation, Bt as instanceUpdateSchema, G as notificationIdsInput, Gt as searchSettingsSchema, H as memberSchema, Ht as photoResultSchema, J as notificationReadInput, K as notificationPreferencesInput, Lt as adminInstanceSchema, M as hasAdminRole, N as importLimits, Ot as ticketExportFormat, P as importProviderDefinitions, Q as operations, R as isOperation, T as errorSchema, Tt as stateLabels, Ut as s3SettingsSchema, Vt as photoInputSchema, X as okSchema, _t as roles, ct as publicOperations, l as closedStates, lt as pushDeviceInput, q as notificationPreferencesSchema, t as ApiError, u as credentialInput, v as defaultWorkflow, vt as scopes, z as isPresetColor, zt as brokerSettingsSchema } from "./src-CC6lPIU_.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { $ as pushDevices, A as requireInstanceAdmin, B as createPollingJob, C as defaultSenders, D as receiveUpload, E as createHttpSender, F as createBlobStorage, G as eventClock, H as attachments, I as decodeImage, J as members, K as events, L as imageResponse, M as readCalendarFeed, N as createTicketSearch, O as createAccess, P as createTicketIndex, Q as projects, R as stagedUploadCutoff, S as receiveRepositoryWebhook, T as DeliveryError, U as blobObjects, V as attachmentContent, W as deliveryCheckpoints, X as notifications, Y as notificationPreferences, Z as profilePhotos, _ as one, a as deliverySecrets, at as workspaces, b as requireRow, c as ownerBlocker, d as createDomain, et as stagedUploads, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaceMembers, j as requireSession, k as createWriteLimiter, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as subscriptions, o as otherActiveAdministrator, ot as matchesOIDCBinding, p as fail, r as signInProviders, rt as tickets, s as ownedWorkspaces, t as createAuth, tt as storageBackends, u as assertVersion, v as reachable, w as deliverBatch, x as processImports, y as recipientColumns, z as createObjectStore } from "./auth-D43XyHdK.mjs";
+import { $ as pushDevices, A as createWriteLimiter, B as createPollingJob, C as receiveRepositoryWebhook, D as createHttpSender, E as DeliveryError, F as createBlobStorage, G as eventClock, H as attachments, I as decodeImage, J as members, K as events, L as imageResponse, M as requireSession, N as createTicketSearch, O as receiveUpload, P as createTicketIndex, Q as projects, R as stagedUploadCutoff, S as readCalendarFeed, T as deliverBatch, U as blobObjects, V as attachmentContent, W as deliveryCheckpoints, X as notifications, Y as notificationPreferences, Z as profilePhotos, _ as one, a as deliverySecrets, at as workspaces, b as requireRow, c as ownerBlocker, d as createDomain, et as stagedUploads, f as errorEnvelope, g as notify, h as json, i as createInstance, it as workspaceMembers, j as requireInstanceAdmin, k as createAccess, l as appendEvents, m as intakeOnly, n as emailCodesAvailable, nt as subscriptions, o as otherActiveAdministrator, ot as matchesOIDCBinding, p as fail, r as signInProviders, rt as tickets, s as ownedWorkspaces, t as createAuth, tt as storageBackends, u as assertVersion, v as reachable, w as defaultSenders, x as processImports, y as recipientColumns, z as createObjectStore } from "./auth-CVnX2XIg.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
@@ -9,8 +9,8 @@ import { and, asc, count, desc, eq, gt, ilike, inArray, isNotNull, isNull, notIn
 import { z } from "zod";
 import { fileURLToPath } from "node:url";
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
-import { isDeepStrictEqual } from "node:util";
 import { Expo } from "expo-server-sdk";
+import { isDeepStrictEqual } from "node:util";
 import { EventEmitter } from "node:events";
 import { connect } from "amqplib";
 import { OpenAPIHono, createRoute, z as z$1 } from "@hono/zod-openapi";
@@ -359,7 +359,7 @@ function createCleanup() {
 }
 //#endregion
 //#region src/version.ts
-const applicationVersion = "0.7.0";
+const applicationVersion = "0.8.0";
 //#endregion
 //#region src/realtime.ts
 async function createRealtime(config) {
@@ -3145,6 +3145,11 @@ const known = (name) => {
 	if (!isOperation(name)) throw new ApiError(404, "not_found", `No operation is named ${name}`);
 	return name;
 };
+const refuseUnknownKeys = (name, input) => {
+	const { shape } = toolInput(name);
+	const unknown = Object.keys(input).filter((key) => !Object.hasOwn(shape, key));
+	if (unknown.length > 0) throw new ApiError(400, "invalid_request", `${name} does not take ${unknown.join(", ")}. Valid keys: ${Object.keys(shape).join(", ") || "none"}.`);
+};
 const summary = (name) => ({
 	name,
 	description: operations[name].description,
@@ -3189,6 +3194,7 @@ const runnerInput = {
 function createMcp(auth, domain, access, config, limitWrite) {
 	const serve = (request, identity, limited = false) => {
 		const execute = async (name, input) => {
+			refuseUnknownKeys(name, input);
 			if (limited && operations[name].method !== "GET") limitWrite(identity.ownerId);
 			const value = "view" in operations[name].input.shape ? {
 				view: defaultView,
@@ -3208,10 +3214,9 @@ function createMcp(auth, domain, access, config, limitWrite) {
 			}, { instructions });
 			for (const name of coreNames) {
 				const spec = operations[name];
-				const inputSchema = toolInput(name).shape;
 				server.registerTool(name, {
 					description: spec.description,
-					inputSchema,
+					inputSchema: toolInput(name).loose(),
 					annotations: {
 						readOnlyHint: spec.method === "GET",
 						destructiveHint: false,

package/apps/server/dist/migrate.mjs

@@ -1,4 +1,4 @@
-import { n as createDatabase, t as readConfig } from "./config-CQVdVhXv.mjs";
+import { n as createDatabase, t as readConfig } from "./config-DUIdB3c2.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
 const database = createDatabase(readConfig());

package/apps/server/dist/recover.mjs

@@ -1,6 +1,6 @@
-import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-CQVdVhXv.mjs";
-import { M as hasAdminRole } from "./src-D70GmZ5R.mjs";
-import { p as fail, q as instanceSettings, t as createAuth } from "./auth-D43XyHdK.mjs";
+import { d as user, n as createDatabase, r as account, t as readConfig, u as session } from "./config-DUIdB3c2.mjs";
+import { M as hasAdminRole } from "./src-CC6lPIU_.mjs";
+import { p as fail, q as instanceSettings, t as createAuth } from "./auth-CVnX2XIg.mjs";
 import { and, eq, isNull, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";

package/apps/server/dist/{src-D70GmZ5R.mjs → src-CC6lPIU_.mjs}

@@ -441,6 +441,10 @@ var en_US_default = {
 				updated: "Time entry updated",
 				deleted: "Time entry deleted"
 			},
+			epic: {
+				created: "Epic created",
+				updated: "Epic updated"
+			},
 			label: {
 				created: "Label created",
 				updated: "Label updated",
@@ -494,6 +498,7 @@ var en_US_default = {
 				created: "Calendar feed created",
 				revoked: "Calendar feed revoked"
 			},
+			public_board: { updated: "Public board updated" },
 			project: {
 				created: "Project created",
 				updated: "Project updated",
@@ -1079,6 +1084,8 @@ var en_US_default = {
 			kind: "Kind",
 			difficulty: "Difficulty",
 			assignee: "Assignee",
+			epic: "Epic",
+			noEpic: "No epic",
 			you: "{{name}} (you)",
 			assignTo: "Assign to…",
 			set: "Set {{label, lowercase}}…",
@@ -1834,6 +1841,8 @@ var en_US_default = {
 				kept: "Kept",
 				projects: "Projects",
 				members: "Members",
+				epics: "Epics",
+				epicTickets: "Tickets leaving an epic",
 				sharedLabels: "Shared labels",
 				signIn: "Sign-in",
 				sessions: "Sessions",
@@ -3237,6 +3246,7 @@ const ticketFields = z.object({
 	scopes: tags,
 	assigneeId: z.string().nullable(),
 	parentId: z.uuid().nullable(),
+	epicId: z.uuid().nullable(),
 	automationReady: z.boolean(),
 	holdReason: z.string().trim().max(2e3).nullable(),
 	startAt: dueDate.nullable(),
@@ -3345,7 +3355,8 @@ const projectImpactSchema = z.object({
 		copiedLabels: z.array(z.string()),
 		mergedLabels: z.array(z.string()),
 		subscriptions: count,
-		invitations: count
+		invitations: count,
+		epicTickets: count.default(0)
 	}).nullable()
 });
 const workspaceImpactSchema = projectImpactSchema.omit({ transfer: true }).extend({
@@ -3356,7 +3367,8 @@ const workspaceImpactSchema = projectImpactSchema.omit({ transfer: true }).exten
 	})),
 	members: count,
 	invitations: count,
-	labels: count
+	labels: count,
+	epics: count.default(0)
 });
 const deletedAccountName = "Deleted account";
 const accountImpactSchema = z.object({
@@ -3378,6 +3390,7 @@ const accountImpactSchema = z.object({
 });
 const ticketSchema = z.object({
 	...ticketFields.shape,
+	epicId: z.uuid().nullable().default(null),
 	startAt: dueDate.nullable().default(null),
 	stateId: z.uuid().nullable().default(null),
 	customFields: z.record(z.string(), customFieldValue).default({}),
@@ -3406,11 +3419,27 @@ const ticketSummarySchema = ticketSchema.pick({
 	scopes: true,
 	archived: true,
 	automationReady: true,
+	epicId: true,
 	updatedAt: true,
 	version: true
 });
 const ticketView = { view: z.enum(["summary", "full"]).default("full") };
 const ticketRow = z.union([ticketSchema, ticketSummarySchema]);
+const epicSchema = z.object({
+	id: z.uuid(),
+	workspaceId: z.uuid(),
+	title: text.max(200),
+	description: z.string(),
+	archived: z.boolean(),
+	version,
+	createdBy: z.string(),
+	createdAt: timestamp,
+	updatedAt: timestamp
+});
+const epicRollupSchema = epicSchema.extend({
+	openTickets: count,
+	closedTickets: count
+});
 const snapshotSchema = z.object({
 	project: projectSchema,
 	tickets: z.array(ticketSchema),
@@ -3585,6 +3614,25 @@ const calendarFeedSchema = z.object({
 	createdAt: timestamp,
 	active: z.boolean()
 });
+const publicBoardSchema = z.object({
+	projectId: z.uuid(),
+	enabled: z.boolean(),
+	title: text.max(80),
+	labels: tags,
+	excludedLabels: tags,
+	version,
+	createdAt: timestamp,
+	updatedAt: timestamp
+});
+const publicBoardTicketSchema = z.object({
+	projectId: z.uuid(),
+	key: z.string(),
+	title: z.string(),
+	kind: z.enum(kinds),
+	status: z.enum(states),
+	createdAt: timestamp,
+	updatedAt: timestamp
+});
 const eventSchema = z.object({
 	id: z.string().regex(/^\d+$/),
 	projectId: z.uuid(),
@@ -3968,6 +4016,8 @@ const eventLabels = labelTable([
 	"label.created",
 	"label.updated",
 	"label.deleted",
+	"epic.created",
+	"epic.updated",
 	"workflow.created",
 	"workflow.updated",
 	"workflow.deleted",
@@ -4001,6 +4051,7 @@ const eventLabels = labelTable([
 	"resource.removed",
 	"calendar_feed.created",
 	"calendar_feed.revoked",
+	"public_board.updated",
 	"project.created",
 	"project.updated",
 	"project.archived",
@@ -4340,6 +4391,37 @@ const operations = {
 		userId: z.string().min(1),
 		confirmEmail: z.string().trim().max(320)
 	}).strict(), okSchema, "DELETE", "/accounts/{userId}", "write", "Delete an account: remove its sign-in methods, sessions, API keys, OAuth grants, devices, notification settings, memberships, and photo, release its claims, cancel its imports, and replace its name and email with a `Deleted account` tombstone. Tickets, comments, evidence, and activity keep the account ID. Only the account itself or an instance administrator, signed in within the last 15 minutes, can delete; `confirmEmail` must repeat the account's email. Fails with `workspace_owner` while it owns a workspace and `last_administrator` for the last active instance or workspace administrator."),
+	list_epics: op(z.object({
+		workspaceId: z.uuid(),
+		archived: ticketFilter.shape.archived,
+		...pagination
+	}), page(epicRollupSchema), "GET", "/workspaces/{workspaceId}/epics", "read", "List the workspace's Epics by title, each with open and closed ticket counts from the projects you can read, leaving out archived tickets. Archived Epics are left out unless `archived` is `include` or `only`."),
+	get_epic: op(z.object({
+		workspaceId: z.uuid(),
+		epicId: z.uuid()
+	}), epicRollupSchema, "GET", "/workspaces/{workspaceId}/epics/{epicId}", "read", "Read one Epic with the same ticket counts as list_epics."),
+	create_epic: op(z.object({
+		...mutation,
+		workspaceId: z.uuid(),
+		title: epicSchema.shape.title,
+		description: z.string().max(1e5).default("")
+	}).strict(), epicSchema, "POST", "/workspaces/{workspaceId}/epics", "write", "Create an Epic that groups tickets from any project in the workspace. Add a ticket by setting `epicId` through create_ticket, update_ticket, or bulk_update_tickets. Membership has no effect on readiness, eligibility, or claims. Reuse requestId when retrying this write."),
+	update_epic: op(z.object({
+		...mutation,
+		workspaceId: z.uuid(),
+		epicId: z.uuid(),
+		expectedVersion: version,
+		title: epicSchema.shape.title.optional(),
+		description: z.string().max(1e5).optional(),
+		archived: z.boolean().optional()
+	}).strict().refine(({ title, description, archived }) => title !== void 0 || description !== void 0 || archived !== void 0, "Provide at least one change"), epicSchema, "PATCH", "/workspaces/{workspaceId}/epics/{epicId}", "write", "Change an Epic's title or description, archive it, or restore it with `archived: false`. An archived Epic keeps its members and refuses new ones. There is no deletion. Reuse requestId when retrying this write."),
+	list_epic_tickets: op(z.object({
+		workspaceId: z.uuid(),
+		epicId: z.uuid(),
+		archived: ticketFilter.shape.archived,
+		...pagination,
+		...ticketView
+	}), page(ticketRow).extend({ restrictedCount: count }), "GET", "/workspaces/{workspaceId}/epics/{epicId}/tickets", "read", "List an Epic's tickets across projects, oldest first. Only tickets of projects you can read appear; `restrictedCount` counts the rest without naming them. With `view: \"summary\"`, rows omit the description and acceptance criteria."),
 	list_workspace_labels: op(z.object({ workspaceId: z.uuid() }), z.array(workspaceCatalogLabel), "GET", "/workspaces/{workspaceId}/labels", "read", "List the workspace's shared labels with ticket counts from the projects you can read, including archived tickets."),
 	create_workspace_label: op(z.object({
 		...mutation,
@@ -4362,7 +4444,7 @@ const operations = {
 		workspaceId: z.uuid(),
 		labelId: z.uuid(),
 		expectedVersion: version
-	}).strict(), okSchema, "DELETE", "/workspaces/{workspaceId}/labels/{labelId}", "admin", "Delete a workspace label and remove it from tickets and saved-view filters in every project of the workspace atomically."),
+	}).strict(), okSchema, "DELETE", "/workspaces/{workspaceId}/labels/{labelId}", "admin", "Delete a workspace label and remove it from tickets and saved-view filters in every project of the workspace atomically. Fails with `label_in_use` while an enabled public board in the workspace excludes it."),
 	list_invitations: op(z.object({ workspaceId: z.uuid() }), z.array(invitationSchema), "GET", "/workspaces/{workspaceId}/invitations", "admin", "List the workspace's pending and expired invitations."),
 	create_invitation: op(z.object({
 		workspaceId: z.uuid(),
@@ -4477,18 +4559,18 @@ const operations = {
 		expectedVersion: version,
 		archived: z.boolean()
 	}).strict(), projectSchema, "POST", "/projects/{projectId}/archive", "admin", "Archive a project, or restore it with `archived: false`. An archived project keeps its tickets and history but leaves default project lists, search, My work, calendar feeds, public links, reminders, and agent queues, and its tickets and settings are read only. Fails with `claim_conflict` while any ticket is claimed."),
-	get_project_impact: op(projectInput.extend({ workspaceId: z.uuid().optional() }), projectImpactSchema, "GET", "/projects/{projectId}/impact", "admin", "Preview what deleting the project removes, or with `workspaceId`, what moving it to that workspace changes: who loses or gains access, labels copied or merged, follows and invitations dropped, and blockers such as claimed tickets."),
+	get_project_impact: op(projectInput.extend({ workspaceId: z.uuid().optional() }), projectImpactSchema, "GET", "/projects/{projectId}/impact", "admin", "Preview what deleting the project removes, or with `workspaceId`, what moving it to that workspace changes: who loses or gains access, labels copied or merged, follows and invitations dropped, tickets leaving their Epic, and blockers such as claimed tickets."),
 	transfer_project: op(projectInput.extend({
 		...mutation,
 		expectedVersion: version,
 		workspaceId: z.uuid()
-	}).strict(), projectSchema, "POST", "/projects/{projectId}/transfer", "admin", "Move a project with its tickets, keys, and links to another workspace. Requires administration of both workspaces and applies the reconciliation `get_project_impact` previews in one transaction; blockers fail with their code."),
+	}).strict(), projectSchema, "POST", "/projects/{projectId}/transfer", "admin", "Move a project with its tickets, keys, and links to another workspace. Requires administration of both workspaces and applies the reconciliation `get_project_impact` previews in one transaction, including clearing each ticket's `epicId`; blockers fail with their code."),
 	delete_project: op(projectInput.extend({
 		...mutation,
 		expectedVersion: version,
 		confirmKey: z.string().max(20)
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}", "admin", "Permanently delete a project's tickets, comments, attachments, labels, feeds, and destinations. `confirmKey` must repeat the project prefix. Fails with `claim_conflict` while any ticket is claimed. The prefix stays reserved and the activity history and deletion events are kept."),
-	export_project: op(projectInput, ticketExportSchema, "GET", "/projects/{projectId}/export", "read", "Export the project's tickets, archived ones included, as a versioned `kanvil.tickets` bundle: workflow states, custom fields, labels, relationships, comments, evidence, and links, with the people they name. Records reference each other by source ID. `completeness.omitted` counts what the bundle leaves out, such as attachments and activity history."),
+	}).strict(), okSchema, "DELETE", "/projects/{projectId}", "admin", "Permanently delete a project's tickets, comments, attachments, labels, feeds, public board, and destinations. `confirmKey` must repeat the project prefix. Fails with `claim_conflict` while any ticket is claimed. The prefix stays reserved and the activity history and deletion events are kept."),
+	export_project: op(projectInput, ticketExportSchema, "GET", "/projects/{projectId}/export", "read", "Export the project's tickets, archived ones included, as a versioned `kanvil.tickets` bundle: workflow states, custom fields, labels, relationships, comments, evidence, and links, with the people they name. Records reference each other by source ID. `completeness.omitted` counts what the bundle leaves out, such as attachments, Epics, and activity history."),
 	preview_import: op(z.object({
 		...mutation,
 		workspaceId: z.uuid(),
@@ -4534,6 +4616,7 @@ const operations = {
 		...pagination,
 		relatedTo: id.optional(),
 		stateId: z.uuid().optional(),
+		epicId: z.uuid().optional(),
 		scheduledFrom: timestamp.optional(),
 		scheduledTo: timestamp.optional(),
 		...ticketView
@@ -4559,7 +4642,7 @@ const operations = {
 		...mutation,
 		labelId: z.uuid(),
 		expectedVersion: version
-	}).strict(), okSchema, "DELETE", "/projects/{projectId}/labels/{labelId}", "admin", "Delete a project label and remove it from tickets and saved-view filters atomically."),
+	}).strict(), okSchema, "DELETE", "/projects/{projectId}/labels/{labelId}", "admin", "Delete a project label and remove it from tickets and saved-view filters atomically. Fails with `label_in_use` while the project's enabled public board excludes it."),
 	list_label_colors: op(z.object({}), z.array(z.object({
 		value: hexColor,
 		createdAt: timestamp
@@ -4648,13 +4731,14 @@ const operations = {
 		scopes: tags.default([]),
 		assigneeId: z.string().nullable().default(null),
 		parentId: z.uuid().nullable().default(null),
+		epicId: z.uuid().nullable().default(null),
 		automationReady: z.boolean().default(false),
 		holdReason: z.string().trim().max(2e3).nullable().default(null),
 		archived: z.boolean().default(false),
 		uploads: z.array(z.uuid()).max(50).default([]),
 		customFields: customFieldValues.default({})
 	}).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets", "write", "Create a ticket. `customFields` maps field IDs from list_custom_fields to values; omitted fields take their default, and a required field must end with a value. `uploads` lists your staged inline uploads in this project; they become its attachments in the same write, or nothing is created. Reuse requestId when retrying this write.", { mcp: "core" }),
-	duplicate_ticket: op(ticketInput.extend(mutation).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/duplicate", "write", "Copy a ticket into a new To do ticket in the same project, linked to the original by a clones relationship. Copies requirements, properties, labels, scopes, and parent; resets agent readiness and never copies claims, comments, evidence, attachments, or children. Reuse requestId when retrying this write."),
+	duplicate_ticket: op(ticketInput.extend(mutation).strict(), ticketSchema, "POST", "/projects/{projectId}/tickets/{ticketId}/duplicate", "write", "Copy a ticket into a new To do ticket in the same project, linked to the original by a clones relationship. Copies requirements, properties, labels, scopes, parent, and an Epic the caller can still add to; resets agent readiness and never copies claims, comments, evidence, attachments, or children. Reuse requestId when retrying this write."),
 	update_ticket: op(ticketInput.extend({
 		...mutation,
 		expectedVersion: version,
@@ -4886,6 +4970,18 @@ const operations = {
 		...mutation,
 		feedId: z.uuid()
 	}).strict(), okSchema, "DELETE", "/projects/{projectId}/calendar-feeds/{feedId}", "admin", "Revoke a calendar feed. Its link stops working immediately."),
+	get_project_board: op(projectInput, z.object({
+		board: publicBoardSchema.nullable(),
+		tickets: z.array(publicBoardTicketSchema)
+	}), "GET", "/projects/{projectId}/public-board", "admin", "Read the project's public board, or null, and the tickets it selects exactly as it publishes them, even while it is disabled."),
+	update_project_board: op(projectInput.extend({
+		...mutation,
+		expectedVersion: version.nullable(),
+		enabled: z.boolean(),
+		title: text.max(80),
+		labels: tags,
+		excludedLabels: tags
+	}).strict(), publicBoardSchema, "PATCH", "/projects/{projectId}/public-board", "admin", "Create or replace the project's public board. It publishes the key, title, kind, status, and dates of unarchived, unheld tickets that carry any of `labels` and none of `excludedLabels`. Enabling requires at least one label."),
 	list_views: op(projectInput, z.array(z.object({
 		id: z.uuid(),
 		name: z.string(),
@@ -5101,6 +5197,8 @@ const permissionOverrides = {
 	list_calendar_feeds: "sharing.manage",
 	create_calendar_feed: "sharing.manage",
 	revoke_calendar_feed: "sharing.manage",
+	get_project_board: "sharing.manage",
+	update_project_board: "sharing.manage",
 	update_project: null
 };
 function operationPermission(name) {

package/apps/server/drizzle/0042_public_boards.sql

@@ -0,0 +1,37 @@
+CREATE TABLE "public_boards" (
+	"project_id" uuid PRIMARY KEY NOT NULL,
+	"enabled" boolean DEFAULT false NOT NULL,
+	"title" text NOT NULL,
+	"labels" text[] DEFAULT '{}' NOT NULL,
+	"excluded_labels" text[] DEFAULT '{}' NOT NULL,
+	"version" integer DEFAULT 1 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "public_boards" ADD CONSTRAINT "public_boards_project_id_projects_id_fk" FOREIGN KEY ("project_id") REFERENCES "public"."projects"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE VIEW "public_board_candidates" WITH (security_barrier) AS
+  SELECT t."project_id", t."key", t."title", t."kind", t."status", t."created_at", t."updated_at"
+  FROM "tickets" t
+  JOIN "public_boards" b ON b."project_id" = t."project_id"
+  JOIN "projects" p ON p."id" = b."project_id"
+  WHERE NOT t."archived"
+    AND t."hold_reason" IS NULL
+    AND t."labels" && b."labels"
+    AND NOT t."labels" && b."excluded_labels"
+    AND p."archived_at" IS NULL
+    AND p."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE VIEW "public_board_tickets" WITH (security_barrier) AS
+  SELECT c."project_id", c."key", c."title", c."kind", c."status", c."created_at", c."updated_at"
+  FROM "public_board_candidates" c
+  JOIN "public_boards" b ON b."project_id" = c."project_id"
+  WHERE b."enabled";
+--> statement-breakpoint
+CREATE VIEW "public_board_summaries" WITH (security_barrier) AS
+  SELECT b."project_id", b."title"
+  FROM "public_boards" b
+  JOIN "projects" p ON p."id" = b."project_id"
+  WHERE b."enabled"
+    AND p."archived_at" IS NULL
+    AND p."deleted_at" IS NULL;

package/apps/server/drizzle/0043_epics.sql

@@ -0,0 +1,18 @@
+CREATE TABLE "epics" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"title" text NOT NULL,
+	"description" text DEFAULT '' NOT NULL,
+	"archived" boolean DEFAULT false NOT NULL,
+	"created_by" text NOT NULL,
+	"version" integer DEFAULT 1 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "tickets" ADD COLUMN "epic_id" uuid;--> statement-breakpoint
+ALTER TABLE "epics" ADD CONSTRAINT "epics_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "epics" ADD CONSTRAINT "epics_created_by_user_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."user"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "epic_workspace" ON "epics" USING btree ("workspace_id");--> statement-breakpoint
+ALTER TABLE "tickets" ADD CONSTRAINT "tickets_epic_id_epics_id_fk" FOREIGN KEY ("epic_id") REFERENCES "public"."epics"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "ticket_epic" ON "tickets" USING btree ("epic_id") WHERE "tickets"."epic_id" IS NOT NULL;