@penclipai/server 2026.531.0 → 2026.602.0-canary.0

package/dist/attachment-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-types.d.ts","sourceRoot":"","sources":["../src/attachment-types.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAYlD,CAAC;AAEF,eAAO,MAAM,+BAA+B,6BAA6B,CAAC;AAC1E,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAOpD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAOnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAS1F;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGnF;AAED,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE1E;AAQD,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,eAAO,MAAM,oBAAoB,QACuC,CAAC;AAEzE,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKzF"}
+{"version":3,"file":"attachment-types.d.ts","sourceRoot":"","sources":["../src/attachment-types.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAgBlD,CAAC;AAEF,eAAO,MAAM,+BAA+B,6BAA6B,CAAC;AAC1E,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAUpD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAOnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAS1F;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGnF;AAED,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE1E;AAQD,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,eAAO,MAAM,oBAAoB,QACuC,CAAC;AAEzE,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKzF"}

package/dist/attachment-types.js

@@ -1,7 +1,7 @@
 /**
  * Shared attachment content-type configuration.
  *
- * By default a curated set of image/document/text types are allowed. Set the
+ * By default a curated set of image/document/text/media types are allowed. Set the
  * `PAPERCLIP_ALLOWED_ATTACHMENT_TYPES` environment variable to a
  * comma-separated list of MIME types or wildcard patterns to expand the
  * allowed set for routes that use this allowlist.
@@ -22,11 +22,15 @@ export const DEFAULT_ALLOWED_TYPES = [
     "image/webp",
     "image/gif",
     "application/pdf",
+    "application/zip",
     "text/markdown",
     "text/plain",
     "application/json",
     "text/csv",
     "text/html",
+    "video/mp4",
+    "video/webm",
+    "video/quicktime",
 ];
 export const DEFAULT_ATTACHMENT_CONTENT_TYPE = "application/octet-stream";
 export const SVG_CONTENT_TYPE = "image/svg+xml";
@@ -37,6 +41,9 @@ export const INLINE_ATTACHMENT_TYPES = [
     "text/markdown",
     "application/json",
     "text/csv",
+    "video/mp4",
+    "video/webm",
+    "video/quicktime",
 ];
 /**
  * Parse a comma-separated list of MIME type patterns into a normalised array.

package/dist/attachment-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-types.js","sourceRoot":"","sources":["../src/attachment-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAE3B,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,UAAU;IACV,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CAAC;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,SAAS;IACT,iBAAiB;IACjB,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,UAAU;CACX,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,eAAyB;IAC/E,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACtC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,KAAK,OAAO,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAsC;IACzE,MAAM,UAAU,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,UAAU,IAAI,+BAA+B,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,WAAmB;IAC/D,OAAO,kBAAkB,CAAC,WAAW,EAAE,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,qEAAqE;AAErE,MAAM,eAAe,GAAa,iBAAiB,CACjD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAC/C,CAAC;AAEF,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzE,MAAM,UAAU,gCAAgC,CAAC,KAAgC;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,GAAG,CAAC,oCAAoC,EAAE,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,gCAAgC,EAAE,oBAAoB,CAAC,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"attachment-types.js","sourceRoot":"","sources":["../src/attachment-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAE3B,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,UAAU;IACV,WAAW;IACX,WAAW;IACX,YAAY;IACZ,iBAAiB;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CAAC;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,SAAS;IACT,iBAAiB;IACjB,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,UAAU;IACV,WAAW;IACX,YAAY;IACZ,iBAAiB;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,eAAyB;IAC/E,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACtC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,KAAK,OAAO,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAsC;IACzE,MAAM,UAAU,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,UAAU,IAAI,+BAA+B,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,WAAmB;IAC/D,OAAO,kBAAkB,CAAC,WAAW,EAAE,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,qEAAqE;AAErE,MAAM,eAAe,GAAa,iBAAiB,CACjD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAC/C,CAAC;AAEF,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzE,MAAM,UAAU,gCAAgC,CAAC,KAAgC;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,GAAG,CAAC,oCAAoC,EAAE,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,gCAAgC,EAAE,oBAAoB,CAAC,CAAC;AAC7F,CAAC"}

package/dist/onboarding-assets/default/AGENTS.md

@@ -5,6 +5,7 @@ You are an agent at Paperclip company.
 - Start actionable work in the same heartbeat. Do not stop at a plan unless the issue explicitly asks for planning.
 - Keep the work moving until it is done. If you need QA to review it, ask them. If you need your boss to review it, ask them.
 - Leave durable progress in task comments, documents, or work products, then update the issue to a clear final disposition before you exit.
+- When your work produces a user-inspectable file, follow the Paperclip skill's "Generated Artifacts and Work Products" workflow before final disposition. Use `skills/paperclip/scripts/paperclip-upload-artifact.sh` when working in this repo, create/update an artifact work product when the file is the deliverable, and link the uploaded attachment in the final comment. Do not rely on local filesystem paths as the only access path.
 - Comments, documents, screenshots, work products, and `Remaining` bullets are evidence, not valid liveness paths by themselves.
 - Final disposition checklist: mark `done` when complete and verified; use `in_review` only with a real reviewer, approval, interaction, or monitor path; use `blocked` only with first-class blockers or a named unblock owner/action; create delegated follow-up issues with blockers when another agent owns the next step; keep `in_progress` only when a live continuation path exists.
 - Use child issues for parallel or long delegated work instead of polling agents, sessions, or processes.

package/dist/routes/issues.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issues.d.ts","sourceRoot":"","sources":["../../src/routes/issues.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAUxC,OAAO,EAkCL,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAI3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAiD1D,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,0CAA0C,CAAC;AASlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AA8BhF,KAAK,oBAAoB,GAAG;IAC1B,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtF,CAAC;AA6rBF,wBAAgB,WAAW,CACzB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE;IACJ,qBAAqB,CAAC,EAAE;QACtB,0BAA0B,CAAC,KAAK,CAAC,EAAE;YACjC,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,IAAI,CAAC;SACZ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtB,CAAC;IACF,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACtC,8CAkwKP"}
+{"version":3,"file":"issues.d.ts","sourceRoot":"","sources":["../../src/routes/issues.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAUxC,OAAO,EAmCL,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAI3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAkD1D,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,0CAA0C,CAAC;AASlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AA8BhF,KAAK,oBAAoB,GAAG;IAC1B,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtF,CAAC;AAitBF,wBAAgB,WAAW,CACzB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE;IACJ,qBAAqB,CAAC,EAAE;QACtB,0BAA0B,CAAC,KAAK,CAAC,EAAE;YACjC,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,IAAI,CAAC;SACZ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtB,CAAC;IACF,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACtC,8CAs3KP"}

package/dist/routes/issues.js

@@ -4,7 +4,7 @@ import multer from "multer";
 import { z } from "zod";
 import { and, desc, eq, inArray, notInArray } from "drizzle-orm";
 import { activityLog, executionWorkspaces, heartbeatRuns, issueExecutionDecisions, issueRelations, issues as issueRows, projectWorkspaces, } from "@penclipai/db";
-import { addIssueCommentSchema, acceptIssueThreadInteractionSchema, cancelIssueThreadInteractionSchema, companySearchQuerySchema, createIssueAttachmentMetadataSchema, createIssueThreadInteractionSchema, createIssueWorkProductSchema, createIssueLabelSchema, createAcceptedPlanDecompositionSchema, checkoutIssueSchema, createDocumentAnnotationCommentSchema, createDocumentAnnotationThreadSchema, createChildIssueSchema, createIssueSchema, resolveCreateIssueStatusDefault, resolveIssueRecoveryActionSchema, feedbackTargetTypeSchema, feedbackTraceStatusSchema, feedbackVoteValueSchema, upsertIssueFeedbackVoteSchema, linkIssueApprovalSchema, issueDocumentKeySchema, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, rejectIssueThreadInteractionSchema, restoreIssueDocumentRevisionSchema, respondIssueThreadInteractionSchema, updateIssueWorkProductSchema, updateDocumentAnnotationThreadSchema, upsertIssueDocumentSchema, updateIssueSchema, getClosedIsolatedExecutionWorkspaceMessage, isClosedIsolatedExecutionWorkspace, normalizeIssueIdentifier as normalizeIssueReferenceIdentifier, } from "@penclipai/shared";
+import { addIssueCommentSchema, acceptIssueThreadInteractionSchema, attachmentArtifactWorkProductMetadataSchema, cancelIssueThreadInteractionSchema, companySearchQuerySchema, createIssueAttachmentMetadataSchema, createIssueThreadInteractionSchema, createIssueWorkProductSchema, createIssueLabelSchema, createAcceptedPlanDecompositionSchema, checkoutIssueSchema, createDocumentAnnotationCommentSchema, createDocumentAnnotationThreadSchema, createChildIssueSchema, createIssueSchema, resolveCreateIssueStatusDefault, resolveIssueRecoveryActionSchema, feedbackTargetTypeSchema, feedbackTraceStatusSchema, feedbackVoteValueSchema, upsertIssueFeedbackVoteSchema, linkIssueApprovalSchema, issueDocumentKeySchema, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, rejectIssueThreadInteractionSchema, restoreIssueDocumentRevisionSchema, respondIssueThreadInteractionSchema, updateIssueWorkProductSchema, updateDocumentAnnotationThreadSchema, upsertIssueDocumentSchema, updateIssueSchema, getClosedIsolatedExecutionWorkspaceMessage, isClosedIsolatedExecutionWorkspace, normalizeIssueIdentifier as normalizeIssueReferenceIdentifier, } from "@penclipai/shared";
 import { getTelemetryClient } from "../telemetry.js";
 import { trackAgentTaskCompleted } from "@penclipai/shared/telemetry";
 import { validate } from "../middleware/validate.js";
@@ -15,7 +15,7 @@ import { conflict, forbidden, HttpError, notFound, unprocessable } from "../erro
 import { assertBoard, assertCompanyAccess, getActorInfo } from "./authz.js";
 import { assertNoAgentHostWorkspaceCommandMutation, collectIssueWorkspaceCommandPaths, } from "./workspace-command-authz.js";
 import { shouldWakeAssigneeOnCheckout } from "./issues-checkout-wakeup.js";
-import { isInlineAttachmentContentType, normalizeIssueAttachmentMaxBytes, normalizeContentType, SVG_CONTENT_TYPE, } from "../attachment-types.js";
+import { isInlineAttachmentContentType, isAllowedContentType, normalizeIssueAttachmentMaxBytes, normalizeContentType, SVG_CONTENT_TYPE, } from "../attachment-types.js";
 import { queueIssueAssignmentWakeup } from "../services/issue-assignment-wakeup.js";
 import { resolveExplicitRequestUiLocale } from "../ui-locale.js";
 import { assertEnvironmentSelectionForCompany } from "./environment-selection.js";
@@ -60,6 +60,17 @@ function applyCreateIssueStatusDefault(req, res, next) {
     }
     next();
 }
+function buildAttachmentContentPath(attachmentId) {
+    return `/api/attachments/${attachmentId}/content`;
+}
+function requiresPaperclipAttachmentMetadata(input, fallback) {
+    const type = typeof input.type === "string" ? input.type : fallback?.type ?? null;
+    const provider = typeof input.provider === "string" ? input.provider : fallback?.provider ?? null;
+    return type === "artifact" && provider === "paperclip";
+}
+const attachmentArtifactMetadataInputSchema = z.object({
+    attachmentId: z.string().uuid(),
+}).passthrough();
 function buildCreateIssueActivityStatusDetails(issue, res) {
     const statusDefault = res.locals.createIssueStatusDefault;
     const assignmentWakeSkipped = !issue.assigneeAgentId || issue.status === "backlog";
@@ -737,11 +748,43 @@ export function issueRoutes(db, storage, opts = {}) {
         }
     }
     function withContentPath(attachment) {
+        const contentPath = `/api/attachments/${attachment.id}/content`;
         return {
             ...attachment,
-            contentPath: `/api/attachments/${attachment.id}/content`,
+            contentPath,
+            openPath: contentPath,
+            downloadPath: `${contentPath}?download=1`,
         };
     }
+    function parseAttachmentRangeHeader(raw, contentLength) {
+        if (!raw)
+            return { kind: "none" };
+        if (!Number.isSafeInteger(contentLength) || contentLength <= 0)
+            return { kind: "invalid" };
+        const prefix = "bytes=";
+        if (!raw.toLowerCase().startsWith(prefix))
+            return { kind: "invalid" };
+        const spec = raw.slice(prefix.length).trim();
+        if (!spec || spec.includes(","))
+            return { kind: "invalid" };
+        const [startRaw, endRaw] = spec.split("-", 2);
+        if (endRaw === undefined)
+            return { kind: "invalid" };
+        if (startRaw === "") {
+            const suffixLength = Number.parseInt(endRaw, 10);
+            if (!Number.isSafeInteger(suffixLength) || suffixLength <= 0)
+                return { kind: "invalid" };
+            const start = Math.max(contentLength - suffixLength, 0);
+            return { kind: "range", start, end: contentLength - 1 };
+        }
+        const start = Number.parseInt(startRaw, 10);
+        if (!Number.isSafeInteger(start) || start < 0 || start >= contentLength)
+            return { kind: "invalid" };
+        const end = endRaw === "" ? contentLength - 1 : Number.parseInt(endRaw, 10);
+        if (!Number.isSafeInteger(end) || end < start)
+            return { kind: "invalid" };
+        return { kind: "range", start, end: Math.min(end, contentLength - 1) };
+    }
     function parseBooleanQuery(value) {
         return value === true || value === "true" || value === "1";
     }
@@ -800,6 +843,32 @@ export function issueRoutes(db, storage, opts = {}) {
             annotationCommentId: input.commentId,
         }, "failed to wake assignee on document annotation comment"));
     }
+    async function canonicalizePaperclipArtifactMetadata(input) {
+        const parsed = attachmentArtifactMetadataInputSchema.safeParse(input.metadata);
+        if (!parsed.success) {
+            throw unprocessable("Invalid attachment artifact metadata", {
+                code: "invalid_attachment_artifact_metadata",
+                details: parsed.error.issues,
+            });
+        }
+        const attachment = await svc.getAttachmentById(parsed.data.attachmentId);
+        if (!attachment || attachment.companyId !== input.issue.companyId || attachment.issueId !== input.issue.id) {
+            throw unprocessable("Attachment artifact must reference an attachment on the same issue", {
+                code: "invalid_attachment_artifact_metadata",
+                attachmentId: parsed.data.attachmentId,
+            });
+        }
+        const contentPath = buildAttachmentContentPath(attachment.id);
+        return attachmentArtifactWorkProductMetadataSchema.parse({
+            attachmentId: attachment.id,
+            contentType: normalizeContentType(attachment.contentType),
+            byteSize: attachment.byteSize,
+            contentPath,
+            openPath: contentPath,
+            downloadPath: `${contentPath}?download=1`,
+            originalFilename: attachment.originalFilename ?? null,
+        });
+    }
     async function assertIssueEnvironmentSelection(companyId, environmentId) {
         if (environmentId === undefined || environmentId === null)
             return;
@@ -2531,10 +2600,17 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         if (!(await assertDeliverableMutationAllowedByRunContext(req, res, issue)))
             return;
-        const product = await workProductsSvc.createForIssue(issue.id, issue.companyId, {
+        const createInput = {
             ...req.body,
             projectId: req.body.projectId ?? issue.projectId ?? null,
-        });
+        };
+        if (requiresPaperclipAttachmentMetadata(createInput)) {
+            createInput.metadata = await canonicalizePaperclipArtifactMetadata({
+                issue,
+                metadata: req.body.metadata ?? null,
+            });
+        }
+        const product = await workProductsSvc.createForIssue(issue.id, issue.companyId, createInput);
         if (!product) {
             res.status(422).json({ error: "Invalid work product payload" });
             return;
@@ -2576,7 +2652,20 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         if (!(await assertDeliverableMutationAllowedByRunContext(req, res, issue)))
             return;
-        const product = await workProductsSvc.update(id, req.body);
+        const patch = { ...req.body };
+        if (requiresPaperclipAttachmentMetadata(patch, existing)) {
+            if (patch.metadata !== undefined) {
+                patch.metadata = await canonicalizePaperclipArtifactMetadata({
+                    issue,
+                    metadata: patch.metadata ?? null,
+                });
+            }
+            else if (!requiresPaperclipAttachmentMetadata(existing)) {
+                res.status(422).json({ error: "Attachment-backed artifact metadata is required" });
+                return;
+            }
+        }
+        const product = await workProductsSvc.update(id, patch);
         if (!product) {
             res.status(404).json({ error: "Work product not found" });
             return;
@@ -5161,6 +5250,10 @@ export function issueRoutes(db, storage, opts = {}) {
             res.status(422).json({ error: "Attachment is empty" });
             return;
         }
+        if (!isAllowedContentType(contentType)) {
+            res.status(422).json({ error: `Unsupported attachment content type: ${contentType}` });
+            return;
+        }
         const parsedMeta = createIssueAttachmentMetadataSchema.safeParse(req.body ?? {});
         if (!parsedMeta.success) {
             res.status(400).json({ error: "Invalid attachment metadata", details: parsedMeta.error.issues });
@@ -5212,21 +5305,39 @@ export function issueRoutes(db, storage, opts = {}) {
             return;
         }
         assertCompanyAccess(req, attachment.companyId);
-        const object = await storage.getObject(attachment.companyId, attachment.objectKey);
+        const contentLength = attachment.byteSize;
+        const range = parseAttachmentRangeHeader(typeof req.headers.range === "string" ? req.headers.range : undefined, contentLength);
+        res.setHeader("Accept-Ranges", "bytes");
+        if (range.kind === "invalid") {
+            res.setHeader("Content-Range", `bytes */${contentLength}`);
+            res.status(416).end();
+            return;
+        }
+        const object = await storage.getObject(attachment.companyId, attachment.objectKey, range.kind === "range" ? { range: { start: range.start, end: range.end } } : undefined);
         const responseContentType = normalizeContentType(attachment.contentType || object.contentType);
         res.setHeader("Content-Type", responseContentType);
-        res.setHeader("Content-Length", String(attachment.byteSize || object.contentLength || 0));
         res.setHeader("Cache-Control", "private, max-age=60");
         res.setHeader("X-Content-Type-Options", "nosniff");
         if (responseContentType === SVG_CONTENT_TYPE) {
             res.setHeader("Content-Security-Policy", "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'");
         }
         const filename = attachment.originalFilename ?? "attachment";
-        const disposition = isInlineAttachmentContentType(responseContentType) ? "inline" : "attachment";
+        const disposition = parseBooleanQuery(req.query.download)
+            ? "attachment"
+            : isInlineAttachmentContentType(responseContentType) ? "inline" : "attachment";
         res.setHeader("Content-Disposition", `${disposition}; filename=\"${filename.replaceAll("\"", "")}\"`);
         object.stream.on("error", (err) => {
             next(err);
         });
+        if (range.kind === "range") {
+            const rangeLength = range.end - range.start + 1;
+            res.status(206);
+            res.setHeader("Content-Length", String(rangeLength));
+            res.setHeader("Content-Range", `bytes ${range.start}-${range.end}/${contentLength}`);
+            object.stream.pipe(res);
+            return;
+        }
+        res.setHeader("Content-Length", String(contentLength || object.contentLength || 0));
         object.stream.pipe(res);
     });
     router.delete("/attachments/:attachmentId", async (req, res) => {