@myna-sh/cli 0.13.0 → 0.14.0

package/dist/main.js

@@ -673,6 +673,147 @@ var ManagementClient = class {
       body
     )
   };
+  // --- Feedback: boards -----------------------------------------------------
+  /**
+   * Boards collect reports. A board's `formFields` is its intake form, declared
+   * with the same field DSL as a collection schema — so a QA board that needs a
+   * build number says so there, and gets the same validation as anything else
+   * in Myna.
+   */
+  boards = {
+    list: (project, signal) => this.get(`/projects/${enc(project)}/boards`, void 0, signal),
+    get: (project, board, signal) => this.get(`/projects/${enc(project)}/boards/${enc(board)}`, void 0, signal),
+    create: (project, body) => this.mutate("POST", `/projects/${enc(project)}/boards`, body),
+    update: (project, board, body) => this.mutate("PATCH", `/projects/${enc(project)}/boards/${enc(board)}`, body),
+    delete: (project, board) => this.mutate("DELETE", `/projects/${enc(project)}/boards/${enc(board)}`)
+  };
+  // --- Feedback: reports ----------------------------------------------------
+  /**
+   * Bug reports, QA findings, feedback, and feature requests.
+   *
+   * `get` deliberately returns everything at once — body, board guidance,
+   * custom fields, developer-supplied context, the full timeline with resolved
+   * actors, the attachment manifest with short-lived URLs, and the links.
+   * Assembling a bug report from six calls is the problem this product exists
+   * to remove, so its own client does not make you do it.
+   *
+   * A report reference may be an id (`rep_…`), a number, or `#number`.
+   */
+  reports = {
+    list: (project, opts = {}) => {
+      const { board, status, type, priority, assignee, labels, q, since, ...rest } = opts;
+      return this.page(`/projects/${enc(project)}/reports`, rest, {
+        board,
+        status: Array.isArray(status) ? status.join(",") : status,
+        type,
+        priority,
+        assignee,
+        labels: labels?.join(","),
+        q,
+        since
+      });
+    },
+    get: (project, report, signal) => this.get(
+      `/projects/${enc(project)}/reports/${enc(String(report))}`,
+      void 0,
+      signal
+    ),
+    create: (project, body) => this.mutate("POST", `/projects/${enc(project)}/reports`, body),
+    update: (project, report, body) => this.mutate(
+      "PATCH",
+      `/projects/${enc(project)}/reports/${enc(String(report))}`,
+      body
+    ),
+    comment: (project, report, body) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/${enc(String(report))}/comments`,
+      body
+    ),
+    resolve: (project, report, body = {}) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/${enc(String(report))}/resolve`,
+      body
+    ),
+    reopen: (project, report, body = {}) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/${enc(String(report))}/reopen`,
+      body
+    ),
+    /** Ask whoever reported it to confirm a fix. The human half of the loop. */
+    requestRetest: (project, report, body = {}) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/${enc(String(report))}/retest`,
+      body
+    ),
+    merge: (project, report, body) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/${enc(String(report))}/merge`,
+      body
+    ),
+    /**
+     * What has come in since a time or a release.
+     *
+     * The call to make before deciding what to work on: counts, groupings, and
+     * the reports themselves already ordered by priority then recency.
+     */
+    digest: (project, opts = {}, signal) => this.get(
+      `/projects/${enc(project)}/reports/digest`,
+      { since: opts.since, release: opts.release, limit: opts.limit },
+      signal
+    ),
+    similar: (project, report, signal) => this.get(
+      `/projects/${enc(project)}/reports/${enc(String(report))}/similar`,
+      void 0,
+      signal
+    ),
+    /** What publishing this report to a board would expose. Read before moving. */
+    exposure: (project, report, board, signal) => this.get(
+      `/projects/${enc(project)}/reports/${enc(String(report))}/exposure`,
+      { board },
+      signal
+    ),
+    /** Move between boards. A public destination needs `confirm: true`. */
+    move: (project, report, body) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/${enc(String(report))}/move`,
+      body
+    ),
+    link: (project, report, body) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/${enc(String(report))}/links`,
+      body
+    ),
+    /** One attachment, with a fresh short-lived URL. */
+    attachment: (project, report, attachment, signal) => this.get(
+      `/projects/${enc(project)}/reports/${enc(String(report))}/attachments/${enc(attachment)}`,
+      void 0,
+      signal
+    ),
+    createUpload: (project, body) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/attachments/uploads`,
+      body
+    ),
+    attach: (project, report, uploadIds) => this.mutate(
+      "POST",
+      `/projects/${enc(project)}/reports/${enc(String(report))}/attachments`,
+      { uploadIds }
+    )
+  };
+  // --- Feedback: ingest keys ------------------------------------------------
+  /**
+   * Publishable keys that let a website submit reports.
+   *
+   * Unlike every other credential here, one of these is *meant* to be readable
+   * by every visitor to a customer's page. What makes that safe lives on the
+   * server: the key may only file on one board, only from an origin the project
+   * registered, and only within its own rate and quota budget.
+   */
+  ingestKeys = {
+    list: (project, signal) => this.get(`/projects/${enc(project)}/ingest-keys`, void 0, signal),
+    create: (project, body) => this.mutate("POST", `/projects/${enc(project)}/ingest-keys`, body),
+    revoke: (project, key) => this.mutate("DELETE", `/projects/${enc(project)}/ingest-keys/${enc(key)}`)
+  };
   // --- Declared external checks ---------------------------------------------
   checks = {
     list: (project, signal) => this.get(`/projects/${enc(project)}/checks`, void 0, signal),
@@ -2978,6 +3119,452 @@ function registerReleases(program) {
   );
 }
 
+// src/commands/feedback.ts
+import { writeFile } from "fs/promises";
+import { basename as basename3 } from "path";
+function registerFeedback(program) {
+  const feedback = program.command("feedback").description("Bug reports, QA findings, and feature requests");
+  const boards = feedback.command("boards").description("Boards that collect reports");
+  boards.command("list").description("List boards").action(
+    handle(async (ctx) => {
+      const project = ctx.requireProject();
+      const rows = await ctx.management().boards.list(project);
+      emit(
+        rows,
+        () => table(rows, [
+          { header: "KEY", value: (b) => b.key },
+          { header: "NAME", value: (b) => b.name },
+          { header: "TYPE", value: (b) => b.type },
+          { header: "REPORTS", value: (b) => String(b.reportCount ?? 0) },
+          { header: "FORM", value: (b) => b.formFields?.length ? `${b.formFields.length} field(s)` : "\u2014" }
+        ])
+      );
+    })
+  );
+  boards.command("create").description("Create a board").requiredOption("--key <key>", "lowercase key, e.g. qa").requiredOption("--name <name>", "display name").option("--type <type>", "bug | qa | feedback | feature_request", "bug").option("--description <text>", "what this board is for").option("--guidance <text>", "how reports here should be triaged and answered").action(
+    handle(async (ctx, _args, opts) => {
+      const project = ctx.requireProject();
+      const board = await ctx.management().boards.create(project, {
+        key: opts.key,
+        name: opts.name,
+        type: opts.type,
+        description: opts.description,
+        guidance: opts.guidance
+      });
+      emit(board, () => diag(`Created board ${board.key} (${board.id}).`));
+    })
+  );
+  boards.command("update").description("Change a board's name, visibility, or voting").argument("<board>", "board key or id").option("--name <name>", "display name").option("--description <text>", "what this board is for").option("--guidance <text>", "how reports here should be triaged and answered").option("--visibility <visibility>", "private | public").option("--voting", "let readers of a public board vote").option("--no-voting", "turn voting off").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const visibility = opts.visibility;
+      if (visibility && visibility !== "private" && visibility !== "public") {
+        throw new Error(`--visibility must be private or public (got "${visibility}").`);
+      }
+      const board = await ctx.management().boards.update(project, args[0], {
+        name: opts.name,
+        description: opts.description,
+        guidance: opts.guidance,
+        visibility,
+        votingEnabled: opts.voting
+      });
+      emit(board, () => {
+        diag(`Updated board ${board.key}.`);
+        if (visibility === "public") {
+          diag(
+            `It is now public: every report on it is readable by anyone, and that cannot be undone for reports people have already seen.`
+          );
+        }
+      });
+    })
+  );
+  boards.command("delete").description("Retire an empty board").argument("<board>", "board key or id").action(
+    handle(async (ctx, args) => {
+      const project = ctx.requireProject();
+      const result = await ctx.management().boards.delete(project, args[0]);
+      emit(result, () => diag(`Deleted board ${args[0]}.`));
+    })
+  );
+  const reports = feedback.command("reports").description("Read and act on reports");
+  reports.command("list").description("List reports, most recently active first").option("--board <key>", "only this board").option("--status <list>", "comma-separated statuses").option("--type <type>", "bug | qa | feedback | feature_request").option("--priority <priority>", "low | normal | high | urgent").option("--assignee <userId>", "only reports assigned to this user").option("--labels <list>", "comma-separated labels; matches any").option("-q, --query <text>", "full-text search over title and body").option("--since <iso>", "only reports active at or after this time").option("--limit <n>", "page size", "25").action(
+    handle(async (ctx, _args, opts) => {
+      const project = ctx.requireProject();
+      const page = await ctx.management().reports.list(project, {
+        board: opts.board,
+        status: opts.status,
+        type: opts.type,
+        priority: opts.priority,
+        assignee: opts.assignee,
+        labels: opts.labels?.split(","),
+        q: opts.query,
+        since: opts.since,
+        limit: Number(opts.limit)
+      });
+      emit(
+        { data: page.data, nextCursor: page.nextCursor },
+        () => table(page.data, [
+          { header: "#", value: (r) => String(r.number) },
+          { header: "TITLE", value: (r) => r.title },
+          { header: "BOARD", value: (r) => r.boardKey },
+          { header: "STATUS", value: (r) => r.status },
+          { header: "PRIORITY", value: (r) => r.priority },
+          { header: "ATTACH", value: (r) => String(r.attachmentCount) },
+          { header: "ACTIVITY", value: (r) => r.lastActivityAt }
+        ])
+      );
+    })
+  );
+  reports.command("open").description("Print everything known about a report").argument("<report>", "report id, number, or #number").action(
+    handle(async (ctx, args) => {
+      const project = ctx.requireProject();
+      const r = await ctx.management().reports.get(project, args[0]);
+      emit(r, () => {
+        diag(`#${r.number} ${r.title}`);
+        diag(`${r.status} \xB7 ${r.priority} \xB7 ${r.type} \xB7 board ${r.boardKey}`);
+        if (r.reporter) diag(`reported by ${r.reporter.name ?? r.reporter.id ?? "someone"}`);
+        if (r.assignee) diag(`assigned to ${r.assignee.name ?? r.assignee.id}`);
+        if (r.duplicateOfId) diag(`duplicate of ${r.duplicateOfId}`);
+        if (r.body) diag(`
+${r.body}`);
+        if (r.fields && Object.keys(r.fields).length > 0) {
+          diag(`
+Fields:`);
+          for (const [k, v] of Object.entries(r.fields)) diag(`  ${k}: ${JSON.stringify(v)}`);
+        }
+        if (r.context && Object.keys(r.context).length > 0) {
+          diag(`
+Context (supplied by the application):`);
+          for (const [k, v] of Object.entries(r.context)) diag(`  ${k}: ${JSON.stringify(v)}`);
+        }
+        if (r.board.guidance) diag(`
+Board guidance:
+${r.board.guidance}`);
+        if (r.attachments.length > 0) {
+          diag(`
+Attachments:`);
+          for (const a of r.attachments) {
+            diag(`  ${a.id}  ${a.kind.padEnd(6)} ${a.filename} (${a.byteSize} bytes)`);
+          }
+          diag(`  Fetch one with: myna feedback attachments get ${r.number} <id> --out <path>`);
+        }
+        if (r.links.length > 0) {
+          diag(`
+Links:`);
+          for (const l of r.links) diag(`  ${l.kind}: ${l.value}`);
+        }
+        if (r.timeline.length > 0) {
+          diag(`
+Timeline:`);
+          for (const e of r.timeline) {
+            const who = e.actor.name ?? e.actor.type;
+            const mark = e.visibility === "internal" ? " (internal)" : "";
+            diag(`  ${e.createdAt}  ${who}${mark}  ${e.kind}${e.body ? `: ${e.body}` : ""}`);
+          }
+        }
+      });
+    })
+  );
+  reports.command("create").description("File a report").requiredOption("--board <key>", "board to file it on").requiredOption("--title <title>", "one-line summary").option("--body <text>", "what happened, and how to reproduce it").option("--priority <priority>", "low | normal | high | urgent").option("--labels <list>", "comma-separated labels").option("--context <json>", "environment supplied by the application, as JSON").action(
+    handle(async (ctx, _args, opts) => {
+      const project = ctx.requireProject();
+      const report = await ctx.management().reports.create(project, {
+        board: opts.board,
+        title: opts.title,
+        body: opts.body,
+        priority: opts.priority,
+        labels: opts.labels?.split(","),
+        context: opts.context ? JSON.parse(opts.context) : void 0
+      });
+      emit(report, () => diag(`Filed #${report.number} (${report.id}).`));
+    })
+  );
+  reports.command("triage").description("Set status, priority, assignee, or labels").argument("<report>", "report id, number, or #number").option("--status <status>", "triage | open | in_progress | needs_retest | resolved | closed | duplicate | wont_fix | spam").option("--priority <priority>", "low | normal | high | urgent").option("--assignee <userId>", "user id, or 'none' to unassign").option("--labels <list>", "comma-separated labels; replaces the set").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const report = await ctx.management().reports.update(project, args[0], {
+        status: opts.status,
+        priority: opts.priority,
+        assigneeId: opts.assignee === "none" ? null : opts.assignee,
+        labels: opts.labels?.split(",")
+      });
+      emit(report, () => diag(`#${report.number} is now ${report.status} (${report.priority}).`));
+    })
+  );
+  reports.command("reply").description("Post a reply or an internal note").argument("<report>", "report id, number, or #number").argument("<message>", "what to say").option("--public", "the reporter sees this; without it the note stays internal").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const report = await ctx.management().reports.comment(project, args[0], {
+        body: args[1],
+        visibility: opts.public ? "public" : "internal"
+      });
+      emit(
+        report,
+        () => diag(`Posted ${opts.public ? "a public reply" : "an internal note"} on #${report.number}.`)
+      );
+    })
+  );
+  reports.command("resolve").description("Mark a report resolved, optionally linking the fix").argument("<report>", "report id, number, or #number").option("--reply <text>", "public reply explaining what changed").option("--commit <sha>", "commit that fixed it").option("--pr <url>", "pull request that fixed it").option("--retest", "ask the reporter to confirm instead of closing it").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const report = await ctx.management().reports.resolve(project, args[0], {
+        reply: opts.reply,
+        commit: opts.commit,
+        pullRequest: opts.pr,
+        requestRetest: Boolean(opts.retest)
+      });
+      emit(
+        report,
+        () => diag(
+          opts.retest ? `#${report.number} is awaiting the reporter's confirmation.` : `#${report.number} resolved.`
+        )
+      );
+    })
+  );
+  reports.command("reopen").description("Put a resolved report back").argument("<report>", "report id, number, or #number").option("--reason <text>", "why it is not fixed").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const report = await ctx.management().reports.reopen(project, args[0], { reason: opts.reason });
+      emit(report, () => diag(`#${report.number} reopened.`));
+    })
+  );
+  reports.command("retest").description("Ask whoever reported it to confirm a fix").argument("<report>", "report id, number, or #number").option("--note <text>", "what to check").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const report = await ctx.management().reports.requestRetest(project, args[0], { note: opts.note });
+      emit(report, () => diag(`Asked the reporter to retest #${report.number}.`));
+    })
+  );
+  reports.command("merge").description("Mark a report as a duplicate of another").argument("<report>", "the duplicate").requiredOption("--into <report>", "the canonical report").option("--note <text>", "explain the merge on both timelines").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const report = await ctx.management().reports.merge(project, args[0], {
+        into: opts.into,
+        note: opts.note
+      });
+      emit(report, () => diag(`#${report.number} marked as a duplicate.`));
+    })
+  );
+  reports.command("similar").description("Find reports that might be the same problem").argument("<report>", "report id, number, or #number").action(
+    handle(async (ctx, args) => {
+      const project = ctx.requireProject();
+      const result = await ctx.management().reports.similar(project, args[0]);
+      emit(
+        result,
+        () => table(result.reports, [
+          { header: "#", value: (r) => String(r.number) },
+          { header: "TITLE", value: (r) => r.title },
+          { header: "STATUS", value: (r) => r.status },
+          { header: "WHY", value: (r) => r.reason }
+        ])
+      );
+    })
+  );
+  reports.command("exposure").description("Show exactly what publishing a report to a board would expose").argument("<report>", "report id, number, or #number").requiredOption("--board <key>", "destination board").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const e = await ctx.management().reports.exposure(project, args[0], opts.board);
+      emit(e, () => {
+        diag(`Moving to "${e.board.key}" (${e.board.visibility}) would make this readable by anyone:`);
+        diag(`
+  ${e.willBePublic.title}`);
+        if (e.willBePublic.body) diag(`
+${e.willBePublic.body}`);
+        if (e.willBePublic.comments.length > 0) {
+          diag(`
+Public replies (${e.willBePublic.comments.length}):`);
+          for (const c of e.willBePublic.comments) diag(`  ${c.author}: ${c.body}`);
+        }
+        if (e.willBePublic.attachments.length > 0) {
+          diag(`
+Attachments:`);
+          for (const a of e.willBePublic.attachments) diag(`  ${a.filename} (${a.kind}, ${a.byteSize} bytes)`);
+        }
+        if (e.willBePublic.context) diag(`
+Environment: ${JSON.stringify(e.willBePublic.context)}`);
+        diag(`
+Stays private: ${e.willStayPrivate.internalComments} internal note(s)` + (e.willStayPrivate.reporterEmail ? `, the reporter's email` : ""));
+        for (const w of e.warnings) diag(`
+  ! ${w}`);
+        diag(`
+Publish with: myna feedback reports move ${args[0]} --board ${opts.board} --confirm`);
+      });
+    })
+  );
+  reports.command("move").description("Move a report to another board").argument("<report>", "report id, number, or #number").requiredOption("--board <key>", "destination board").option("--confirm", "required when the destination is public; run `exposure` first").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const result = await ctx.management().reports.move(project, args[0], {
+        board: opts.board,
+        confirm: Boolean(opts.confirm)
+      });
+      emit(
+        result,
+        () => diag(
+          result.isPublic ? `#${result.number} is now public on ${result.board}.` : `#${result.number} moved to ${result.board}.`
+        )
+      );
+    })
+  );
+  reports.command("link").description("Point a report at a commit, pull request, entry, or release").argument("<report>", "report id, number, or #number").requiredOption("--kind <kind>", "commit | pull_request | entry | release | url").requiredOption("--value <value>", "the sha, URL, id, or release number").option("--title <text>", "label for the link").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const report = await ctx.management().reports.link(project, args[0], {
+        kind: opts.kind,
+        value: opts.value,
+        title: opts.title
+      });
+      emit(report, () => diag(`Linked ${opts.kind} to #${report.number}.`));
+    })
+  );
+  feedback.command("digest").description("What has been reported since a time or a release").option("--since <iso>", "ISO timestamp; defaults to the last 24 hours").option("--release <n>", "since a release shipped").option("--limit <n>", "how many reports to include", "25").action(
+    handle(async (ctx, _args, opts) => {
+      const project = ctx.requireProject();
+      const d = await ctx.management().reports.digest(project, {
+        since: opts.since,
+        release: opts.release ? Number(opts.release) : void 0,
+        limit: Number(opts.limit)
+      });
+      emit(d, () => {
+        diag(`${d.total} report(s) since ${d.sinceLabel}; ${d.stillOpen} still open.`);
+        const counts = (label, tally) => {
+          const parts = Object.entries(tally).map(([k, n]) => `${k} ${n}`);
+          if (parts.length > 0) diag(`${label}: ${parts.join(", ")}`);
+        };
+        counts("By status", d.byStatus);
+        counts("By board", d.byBoard);
+        counts("By type", d.byType);
+        if (d.reports.length > 0) {
+          diag("");
+          table(d.reports, [
+            { header: "#", value: (r) => String(r.number) },
+            { header: "PRIORITY", value: (r) => r.priority },
+            { header: "STATUS", value: (r) => r.status },
+            { header: "TITLE", value: (r) => r.title }
+          ]);
+        }
+        if (d.truncated) diag(`
+(showing ${d.reports.length} of ${d.total} \u2014 raise --limit for more)`);
+      });
+    })
+  );
+  const keys = feedback.command("keys").description("Publishable keys that let a website submit reports");
+  keys.command("list").description("List ingest keys").action(
+    handle(async (ctx) => {
+      const project = ctx.requireProject();
+      const rows = await ctx.management().ingestKeys.list(project);
+      emit(
+        rows,
+        () => table(rows, [
+          { header: "ID", value: (k) => k.id },
+          { header: "NAME", value: (k) => k.name },
+          { header: "BOARD", value: (k) => k.boardKey },
+          { header: "SIGNED ID", value: (k) => k.hasIdentitySecret ? "yes" : "no" },
+          { header: "LAST USED", value: (k) => k.lastUsedAt ?? "never" },
+          { header: "STATE", value: (k) => k.revokedAt ? "revoked" : "live" }
+        ])
+      );
+    })
+  );
+  keys.command("create").description("Create a publishable ingest key").requiredOption("--name <name>", "what this key is for").requiredOption("--board <key>", "board it may file on").option("--signed-identity", "also mint a server-side secret for signed identify").action(
+    handle(async (ctx, _args, opts) => {
+      const project = ctx.requireProject();
+      const created = await ctx.management().ingestKeys.create(project, {
+        name: opts.name,
+        board: opts.board,
+        withIdentitySecret: Boolean(opts.signedIdentity)
+      });
+      emit(created, () => {
+        diag(`Created ingest key ${created.id} for board ${created.boardKey}.`);
+        diag(``);
+        diag(`  ${created.key}`);
+        diag(``);
+        diag(`This key is publishable \u2014 it is designed to sit in your browser bundle.`);
+        diag(`It can only file a report on ${created.boardKey}, and only from an origin`);
+        diag(`registered on this project. Add yours with: myna projects update --origins`);
+        if (created.identitySecret) {
+          diag(``);
+          diag(`Identity signing secret (shown once \u2014 keep it on your server):`);
+          diag(``);
+          diag(`  ${created.identitySecret}`);
+          diag(``);
+          diag(`Sign a user id with HMAC-SHA256 and pass it as identify.signature.`);
+        }
+      });
+    })
+  );
+  keys.command("revoke").description("Revoke an ingest key").argument("<key>", "ingest key id").action(
+    handle(async (ctx, args) => {
+      const project = ctx.requireProject();
+      const result = await ctx.management().ingestKeys.revoke(project, args[0]);
+      emit(result, () => diag(`Revoked ${args[0]}. Sites using it can no longer submit.`));
+    })
+  );
+  const attachments = feedback.command("attachments").description("Evidence attached to a report");
+  attachments.command("get").description("Download one attachment").argument("<report>", "report id, number, or #number").argument("<attachment>", "attachment id").option("--out <path>", "where to write it; defaults to the original filename").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const attachment = await ctx.management().reports.attachment(project, args[0], args[1]);
+      if (!attachment.url) {
+        throw new Error(`Attachment ${attachment.id} has no readable URL; it may have expired.`);
+      }
+      const path = opts.out ?? basename3(attachment.filename);
+      const response = await fetch(attachment.url);
+      if (!response.ok) throw new Error(`Could not download attachment: ${response.status}.`);
+      await writeFile(path, Buffer.from(await response.arrayBuffer()));
+      emit(
+        { ...attachment, path },
+        () => diag(`Wrote ${attachment.filename} (${attachment.byteSize} bytes) to ${path}.`)
+      );
+    })
+  );
+  attachments.command("add").description("Attach a file to a report").argument("<report>", "report id, number, or #number").argument("<file>", "path to the file").action(
+    handle(async (ctx, args) => {
+      const project = ctx.requireProject();
+      const { readFile: readFile3 } = await import("fs/promises");
+      const path = args[1];
+      const bytes = await readFile3(path);
+      const contentType = contentTypeFor(path);
+      const upload = await ctx.management().reports.createUpload(project, {
+        filename: basename3(path),
+        contentType,
+        byteSize: bytes.byteLength
+      });
+      const put = await fetch(upload.url, {
+        method: "PUT",
+        headers: upload.headers,
+        body: new Uint8Array(bytes)
+      });
+      if (!put.ok) throw new Error(`Upload failed: ${put.status}.`);
+      const report = await ctx.management().reports.attach(project, args[0], [upload.uploadId]);
+      emit(report, () => diag(`Attached ${basename3(path)} to #${report.number}.`));
+    })
+  );
+}
+function contentTypeFor(path) {
+  const ext = path.toLowerCase().split(".").pop() ?? "";
+  const types = {
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    webp: "image/webp",
+    gif: "image/gif",
+    webm: "video/webm",
+    mp4: "video/mp4",
+    mov: "video/quicktime",
+    txt: "text/plain",
+    log: "text/plain",
+    json: "application/json",
+    pdf: "application/pdf"
+  };
+  const type = types[ext];
+  if (!type) {
+    throw new Error(
+      `Myna does not accept .${ext} attachments. Allowed: ${[...new Set(Object.values(types))].join(", ")}.`
+    );
+  }
+  return type;
+}
+
 // src/commands/pull.ts
 import { execSync } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
@@ -3087,7 +3674,18 @@ var ID_PREFIXES = {
   webauthnCredential: "pky",
   webauthnChallenge: "wac",
   githubInstallation: "ghi",
-  projectRepository: "prp"
+  projectRepository: "prp",
+  /** A person who files reports. Not a user; see `ActorType` "reporter". */
+  reporter: "rpr",
+  board: "brd",
+  report: "rep",
+  reportEvent: "rpe",
+  reportAttachment: "rat",
+  reportAttachmentUpload: "rau",
+  reportLink: "rlk",
+  ingestKey: "ing",
+  reporterToken: "rtk",
+  reportVote: "rvt"
 };
 var PREFIX_SET = new Set(Object.values(ID_PREFIXES));
 
@@ -3123,7 +3721,12 @@ var PLANS = {
     monthlyPublicApiRequests: 1e4,
     maxWebhookEndpoints: 1,
     revisionRetentionDays: 30,
-    maxUploadBytes: 50 * MB
+    maxUploadBytes: 50 * MB,
+    monthlyFeedbackReports: 500,
+    feedbackAttachmentBytes: 1 * GB,
+    feedbackRetentionDays: 90,
+    maxBoards: 3,
+    maxAttachmentBytes: 100 * MB
   },
   pro: {
     key: "pro",
@@ -3136,7 +3739,12 @@ var PLANS = {
     monthlyPublicApiRequests: 5e5,
     maxWebhookEndpoints: 10,
     revisionRetentionDays: null,
-    maxUploadBytes: 250 * MB
+    maxUploadBytes: 250 * MB,
+    monthlyFeedbackReports: 25e3,
+    feedbackAttachmentBytes: 25 * GB,
+    feedbackRetentionDays: null,
+    maxBoards: 25,
+    maxAttachmentBytes: 500 * MB
   },
   /**
    * Myna's own organizations — the changelog, and anything else we run on the
@@ -3155,10 +3763,28 @@ var PLANS = {
     monthlyPublicApiRequests: UNLIMITED,
     maxWebhookEndpoints: UNLIMITED,
     revisionRetentionDays: null,
-    maxUploadBytes: UNLIMITED
+    maxUploadBytes: UNLIMITED,
+    monthlyFeedbackReports: UNLIMITED,
+    feedbackAttachmentBytes: UNLIMITED,
+    feedbackRetentionDays: null,
+    maxBoards: UNLIMITED,
+    maxAttachmentBytes: UNLIMITED
   }
 };
 
+// ../shared/dist/reports.js
+var REPORT_LIMITS = {
+  titleChars: 200,
+  bodyChars: 2e4,
+  commentChars: 2e4,
+  attachmentsPerReport: 20,
+  linksPerReport: 50,
+  labelsPerReport: 20,
+  labelChars: 40,
+  /** Serialized `context`, which a developer supplies and we do not police. */
+  contextBytes: 16 * 1024
+};
+
 // ../shared/dist/rank.js
 var DIGITS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 var MIN_DIGIT = DIGITS[0];
@@ -4826,7 +5452,7 @@ function installCommand(manager, version) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.13.0" : "0.0.0-dev";
+var VERSION = true ? "0.14.0" : "0.0.0-dev";
 var IS_RELEASE_BUILD = true;
 
 // src/commands/doctor.ts
@@ -5391,6 +6017,7 @@ function buildProgram() {
   registerSync(program);
   registerChanges(program);
   registerReleases(program);
+  registerFeedback(program);
   registerPull(program);
   registerPreviews(program);
   registerAssets(program);