@rallycry/conveyor-mcp 4.3.30 → 5.0.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   ConveyorConnection
-} from "./chunk-X3EHPZNH.js";
+} from "./chunk-2TVN7F5E.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -67,54 +67,142 @@ function registerProjectTools(server2, conn2) {
 }
 
 // src/tools/connection.ts
-import { z as z2 } from "zod";
-var CAPABILITY_ENUM = ["read", "create", "update", "chat", "files", "build"];
-function registerConnectionTools(server2, conn2) {
-  server2.tool(
-    "get_connection_context",
-    "Resolve WHO this connection is and WHAT project/board it points at \u2014 call this FIRST, before inferring anything from names. Returns the effective account, project, and board (sub-project) each with BOTH its immutable ID and its human-readable name/slug, the granted capabilities (read/create/update/chat/files/build), management URLs, and a one-line summary. Removes the ambiguity between a project's canonical name and a board label. Pass projectId to target a specific project; otherwise the configured default project is used.",
-    {
-      projectId: z2.string().optional().describe("Target Conveyor project ID")
-    },
-    async (params) => {
-      const ctx = await conn2.getConnectionContext(params.projectId);
-      return { content: [{ type: "text", text: JSON.stringify(ctx, null, 2) }] };
-    }
-  );
-  server2.tool(
-    "verify_connection",
-    "Prove the connection is correct AND that you can actually write to the intended board \u2014 not just that auth works. Runs layered checks (auth \u2192 account \u2192 project \u2192 target board \u2192 capabilities \u2192 read) and returns a plain pass/fail with, on failure, the exact failing layer and ONE next action. Use this instead of get_project_summary to confirm setup: a summary that returns data proves auth, not scope. Pass intendedActions to verify specific capabilities (defaults to read+create+update). Pass projectId to target a specific project; otherwise the configured default project is used. The board scope comes from CONVEYOR_SUBPROJECT_ID.",
-    {
-      projectId: z2.string().optional().describe("Target Conveyor project ID"),
-      intendedActions: z2.array(z2.enum(CAPABILITY_ENUM)).optional().describe(
-        "Capabilities to verify the connection can perform (default: read, create, update)."
-      )
-    },
-    async (params) => {
-      const result = await conn2.verifyConnection(params);
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-    }
-  );
-  server2.tool(
-    "list_accessible_subprojects",
-    "List the boards (sub-projects) under the connected project \u2014 each with its ID, name, slug, board URL, owned root path, and the role/capabilities this token has on it. Use this to discover which board to create or list cards on (pass a returned id as subProjectId, or set CONVEYOR_SUBPROJECT_ID) instead of asking the human for one. Pass projectId to target a specific project; otherwise the configured default project is used.",
-    {
-      projectId: z2.string().optional().describe("Target Conveyor project ID")
-    },
-    async (params) => {
-      const subprojects = await conn2.listAccessibleSubprojects(params.projectId);
-      return { content: [{ type: "text", text: JSON.stringify(subprojects, null, 2) }] };
-    }
-  );
-}
-
-// src/tools/project-config.ts
-import { z as z4 } from "zod";
+import { z as z3 } from "zod";
 
-// ../shared/dist/chunk-6RHVH33O.js
+// ../shared/dist/chunk-OKJPFFQI.js
 var CARD_DESCRIPTION_MAX = 255;
 var CARD_DESCRIPTION_LIMIT_MESSAGE = `Card descriptions are capped at ${CARD_DESCRIPTION_MAX} characters \u2014 write 1-2 plain sentences a non-engineer can read; put technical detail in the plan or card chat.`;
 var CARD_DESCRIPTION_FIELD_HINT = `max ${CARD_DESCRIPTION_MAX} chars, 1-2 plain sentences a non-engineer can read \u2014 put technical detail in the plan`;
+var SEVERITY_ENUM = [
+  "DEBUG",
+  "INFO",
+  "NOTICE",
+  "WARNING",
+  "ERROR",
+  "CRITICAL",
+  "ALERT",
+  "EMERGENCY"
+];
+var MAX_LINE_CHARS = 400;
+var DEFAULT_SINCE_MINUTES = 60;
+function truncateLine(text) {
+  const oneLine = text.replace(/\s*\n\s*/g, " \u23CE ");
+  if (oneLine.length <= MAX_LINE_CHARS) return oneLine;
+  const overflow = oneLine.length - MAX_LINE_CHARS;
+  return `${oneLine.slice(0, MAX_LINE_CHARS)}\u2026[+${overflow}c]`;
+}
+function entrySource(entry) {
+  return entry.resource.service_name ?? entry.resource.pod_name ?? entry.resource.database_id ?? entry.resourceType ?? "-";
+}
+var PAYLOAD_SKIP_KEYS = /* @__PURE__ */ new Set(["message", "severity", "timestamp", "level", "stack"]);
+var PAYLOAD_PRIORITY = [
+  "error",
+  "outcome",
+  "serviceName",
+  "methodName",
+  "userId",
+  "taskId",
+  "sessionId",
+  "workspaceId",
+  "projectId",
+  "durationMs"
+];
+var PAYLOAD_VALUE_MAX_CHARS = 160;
+function compactPayloadValue(value) {
+  const raw = typeof value === "string" ? value : JSON.stringify(value);
+  const flat = (raw ?? "undefined").replace(/\s+/g, " ");
+  const quoted = typeof value === "string" && /[\s"]/.test(flat) ? JSON.stringify(flat) : flat;
+  return quoted.length > PAYLOAD_VALUE_MAX_CHARS ? `${quoted.slice(0, PAYLOAD_VALUE_MAX_CHARS)}\u2026` : quoted;
+}
+function formatPayloadSuffix(payloadJson) {
+  if (!payloadJson) return "";
+  let parsed;
+  try {
+    parsed = JSON.parse(payloadJson);
+  } catch {
+    return "";
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "";
+  const obj = parsed;
+  const rank = (key) => {
+    const i = PAYLOAD_PRIORITY.indexOf(key);
+    return i === -1 ? PAYLOAD_PRIORITY.length : i;
+  };
+  const parts = Object.keys(obj).filter((k) => !PAYLOAD_SKIP_KEYS.has(k) && obj[k] !== void 0 && obj[k] !== null).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b)).map((k) => `${k}=${compactPayloadValue(obj[k])}`);
+  return parts.length > 0 ? ` | ${parts.join(" ")}` : "";
+}
+function formatLogEntryLine(entry) {
+  const httpPrefix = entry.httpRequest?.status ? `http ${entry.httpRequest.status} ${entry.httpRequest.method ?? ""} ${entry.httpRequest.url ?? ""}`.trim() + " \u2014 " : "";
+  return `${entry.timestamp} ${entry.severity.padEnd(7)} [${entrySource(entry)}] ${truncateLine(
+    `${httpPrefix}${entry.message}${formatPayloadSuffix(entry.payload)}`
+  )}`;
+}
+async function runQueryGcpLogs(port, params, now = Date.now) {
+  const startTime = params.startTime ?? new Date(now() - (params.sinceMinutes ?? DEFAULT_SINCE_MINUTES) * 6e4).toISOString();
+  const result = await port.queryGcpLogs({
+    projectId: params.projectId,
+    env: params.env,
+    severity: params.severity,
+    services: params.services,
+    sqlInstances: params.sqlInstances,
+    allServices: params.allServices,
+    search: params.search,
+    filter: params.filter,
+    startTime,
+    endTime: params.endTime,
+    limit: params.limit,
+    pageToken: params.pageToken
+  });
+  if (result.error) return result.error;
+  const header = [
+    `env=${params.env ?? "prod"}`,
+    `window=${startTime}\u2192${params.endTime ?? "now"}`,
+    ...params.severity ? [`minSeverity=${params.severity}`] : [],
+    `scope=${result.scopedServices ? `[${result.scopedServices.join(", ")}]` : "all"}`,
+    `entries=${result.entries.length}`
+  ].join(" ");
+  const lines = result.entries.map(formatLogEntryLine);
+  const footer = result.nextPageToken ? [`-- more available: pass pageToken="${result.nextPageToken}" to continue`] : [];
+  if (lines.length === 0) {
+    return [
+      header,
+      "(no matching log entries \u2014 widen the window, lower minSeverity, or drop filters)"
+    ].join("\n");
+  }
+  return [header, ...lines, ...footer].join("\n");
+}
+async function runQueryGrafanaLogs(port, params, now = Date.now) {
+  const startTime = params.startTime ?? new Date(now() - (params.sinceMinutes ?? DEFAULT_SINCE_MINUTES) * 6e4).toISOString();
+  const result = await port.queryGrafanaLogs({
+    projectId: params.projectId,
+    env: params.env,
+    level: params.level,
+    services: params.services,
+    search: params.search,
+    logql: params.logql,
+    startTime,
+    endTime: params.endTime,
+    limit: params.limit
+  });
+  if (result.error) return result.error;
+  const header = [
+    `env=${params.env ?? "prod"}`,
+    `window=${startTime}\u2192${params.endTime ?? "now"}`,
+    ...params.level ? [`minLevel=${params.level}`] : [],
+    ...result.logql ? [`logql=${truncateLine(result.logql)}`] : [],
+    `entries=${result.entries.length}`
+  ].join(" ");
+  const lines = result.entries.map(formatLogEntryLine);
+  const oldest = result.entries.map((e) => e.timestamp).sort()[0];
+  const footer = result.hasMore ? [`-- hit the limit: older lines exist \u2014 pass endTime="${oldest}" to page further back`] : [];
+  if (lines.length === 0) {
+    return [
+      header,
+      "(no matching log entries \u2014 widen the window, lower minLevel, or drop filters)"
+    ].join("\n");
+  }
+  return [header, ...lines, ...footer].join("\n");
+}
 
 // ../shared/dist/tool-contracts/index.js
 var f = {
@@ -179,15 +267,23 @@ function compileBase(z10, spec) {
       return z10.object(compileShape(z10, spec.fields));
   }
 }
-function compileField(z10, spec) {
+function descriptionOf(spec) {
+  if (spec.kind === "optional" || spec.kind === "nullable") return descriptionOf(spec.inner);
+  return spec.desc;
+}
+function compileUndescribed(z10, spec) {
   if (spec.kind === "optional") {
-    return compileField(z10, spec.inner).optional();
+    return compileUndescribed(z10, spec.inner).optional();
   }
   if (spec.kind === "nullable") {
-    return compileField(z10, spec.inner).nullable();
+    return compileUndescribed(z10, spec.inner).nullable();
   }
-  const schema = compileBase(z10, spec);
-  return spec.desc === void 0 ? schema : schema.describe(spec.desc);
+  return compileBase(z10, spec);
+}
+function compileField(z10, spec) {
+  const schema = compileUndescribed(z10, spec);
+  const desc = descriptionOf(spec);
+  return desc === void 0 ? schema : schema.describe(desc);
 }
 function compileShape(z10, fields) {
   const shape = {};
@@ -380,14 +476,118 @@ var approveAndMergePrContract = defineToolContract({
     }
   }
 });
+var getConnectionContextContract = defineToolContract({
+  name: "get_connection_context",
+  agent: {
+    description: "Resolve WHAT this session is bound to \u2014 call this FIRST, before inferring anything from names or branch strings. Returns the current task (id, title, status, branch, baseBranch, whether it is a pack parent, and its parentTaskId when it is itself a child), its project (id, name), and the acting agent (id, model, mode, isAuto). This is the pod-side half of the same tool the external MCP surface exposes, so a shared skill can open with one call in both places; it reports no user account, because a pod is bound to a card rather than to a person's session.",
+    fields: {}
+  },
+  mcp: {
+    description: "Resolve WHO this connection is and WHAT project/board it points at \u2014 call this FIRST, before inferring anything from names. Returns the effective account, project, and board (sub-project) each with BOTH its immutable ID and its human-readable name/slug, the granted capabilities (read/create/update/chat/files/build), management URLs, and a one-line summary. Removes the ambiguity between a project's canonical name and a board label. Pass projectId to target a specific project; otherwise the configured default project is used.",
+    fields: {
+      projectId: mcpProjectId
+    }
+  }
+});
 var tasksContracts = [
   getTaskContract,
   postToChatContract,
   readTaskChatContract,
   listTagsContract,
   searchTasksContract,
-  approveAndMergePrContract
+  approveAndMergePrContract,
+  getConnectionContextContract
+];
+var STATUS_ENUM = [
+  "Planning",
+  "Open",
+  "InProgress",
+  "ReviewPR",
+  "ReviewDev",
+  "ReviewLive",
+  "Complete",
+  "Cancelled"
 ];
+var RISK_ENUM = ["critical", "high", "medium", "low"];
+var GITHUB_BRANCH_MEANING = "Record the task's ACTUAL working branch (e.g. a locally-driven pack's branch cut at claim time, so identification never mints a competing name and pack-child merges settle against reality).";
+var GITHUB_BRANCH_DESC = "Record the task's ACTUAL working branch (e.g. a locally-driven pack's branch cut at claim time, so identification never mints a competing name and pack-child merges settle against reality), or null to detach. The branch must already exist on origin, and a live workspace bound to a different branch rejects the write.";
+var updateTaskContract = defineToolContract({
+  name: "update_task",
+  agent: {
+    description: "Update the CURRENT task's title, description, plan, githubBranch, or status \u2014 the one tool the shared Conveyor skills use for card writes, so the same skill text works here and in a local MCP session. Pass task_id ONLY with status, to move one of this card's children (claim it InProgress, promote it to Open); every other field always applies to the current task, because the server scopes plan/title writes to this session. Status rides the same path a human or a build uses, so watchdog and board semantics hold \u2014 for an emergency override that skips those, use force_update_task_status.",
+    fields: {
+      title: f.optional(f.string({ desc: "New title" })),
+      description: f.optional(f.string({ desc: cardDescriptionDesc("New description") })),
+      plan: f.optional(f.string({ desc: "New plan (markdown)" })),
+      status: f.optional(f.enum(STATUS_ENUM, { desc: "New status" })),
+      // Not nullable here, unlike the mcp surface: the pod's underlying
+      // `updateTaskProperties` takes `githubBranch?: string` with no null
+      // branch, so a pod can RECORD a branch but cannot detach one. Offering
+      // null would advertise a write the server would silently drop.
+      githubBranch: f.optional(
+        f.string({
+          min: 1,
+          desc: `${GITHUB_BRANCH_MEANING} The pod does NOT validate this: the value is written through with no check that the ref exists on origin, and no guard against repointing the record away from the branch this pod is actually running on (which strands the compute). Push the branch first, and only name a branch this session genuinely owns. Detaching (clearing) a branch is not available from a pod \u2014 use the external MCP surface for that.`
+        })
+      ),
+      task_id: f.optional(
+        f.string({
+          // min:1 is load-bearing: "" is falsy, so an empty task_id would slip
+          // past both the refusal below and the child-routing branch, and
+          // silently update the CURRENT card — the exact mis-targeting this
+          // field's guard exists to prevent.
+          min: 1,
+          desc: "Child task ID to move. Valid ONLY alongside status \u2014 pairing it with title/description/plan/githubBranch is rejected rather than silently applied to the current card. Omit to update the current task."
+        })
+      )
+    }
+  },
+  mcp: {
+    description: "Update task fields: title, description, plan, status, risk, story points, assignment, githubBranch, or tags. Set status to claim a card (InProgress), triage it (Open), or cancel it (Cancelled); for review approvals prefer approve_task / request_changes, which guard against stale-state races. Tags are additive/subtractive \u2014 pass addTags/removeTags with tag names (not a replace-set). Pass projectId to target a specific project; otherwise the configured default project is used. Moving a task beyond Planning auto-fills any missing icon, story points, and agent assignment \u2014 don't spend turns on them; pass storyPointValue only to correct the sizing yourself. For subtasks use update_subtask.",
+    fields: {
+      projectId: mcpProjectId,
+      taskId: f.string({ desc: "The task ID" }),
+      title: f.optional(f.string({ desc: "New title" })),
+      description: f.optional(f.string({ desc: cardDescriptionDesc("New description") })),
+      plan: f.optional(f.string({ desc: "New plan (markdown)" })),
+      status: f.optional(f.enum(STATUS_ENUM, { desc: "New status" })),
+      risk: f.optional(
+        f.nullable(
+          f.enum(RISK_ENUM, {
+            desc: "Risk level \u2014 how much important surface the task touches (critical/high/medium/low). Pass null to clear."
+          })
+        )
+      ),
+      storyPointValue: f.optional(
+        f.nullable(
+          f.number({
+            desc: `${storyPointValueDesc}. The tiers are per-project \u2014 a value the project has not configured is rejected. Pass null to clear it; a card beyond Planning with no story point is re-filled by identification.`
+          })
+        )
+      ),
+      assignedUserId: f.optional(f.nullable(f.string({ desc: "User ID to assign, or null" }))),
+      subProjectId: f.optional(
+        f.nullable(
+          f.string({
+            desc: "Assign the task to a sub-project board; null moves it back to the parent board. Omit to leave unchanged."
+          })
+        )
+      ),
+      githubBranch: f.optional(f.nullable(f.string({ desc: GITHUB_BRANCH_DESC }))),
+      addTags: f.optional(
+        f.array(f.string(), {
+          desc: 'Tag names to add to the card (e.g. ["refactor"]). Additive \u2014 existing tags are kept. Unknown names are rejected; use list_tags to see available tags or manage_tags to create one.'
+        })
+      ),
+      removeTags: f.optional(
+        f.array(f.string(), {
+          desc: "Tag names to remove from the card. Removing a tag the card doesn't have is a no-op."
+        })
+      )
+    }
+  }
+});
+var taskUpdateContracts = [updateTaskContract];
 var tagRef = f.string({
   desc: "Tag id, or the exact tag name (case-insensitive)",
   min: 1,
@@ -678,7 +878,7 @@ var createSubtaskContract = defineToolContract({
 var updateSubtaskContract = defineToolContract({
   name: "update_subtask",
   agent: {
-    description: "Update an existing subtask's fields (title, description, plan, ordinal, storyPointValue, dependsOn) \u2014 and the sanctioned path to make a child buildable: promote it to status Open, assign its agent (agentIdOrName), and set story points. Setting story points does NOT auto-promote; set status explicitly. For the current task use update_task_plan.",
+    description: "Update an existing subtask's fields (title, description, plan, ordinal, storyPointValue, dependsOn) \u2014 and the sanctioned path to make a child buildable: promote it to status Open, assign its agent (agentIdOrName), and set story points. Setting story points does NOT auto-promote; set status explicitly. For the current task use update_task.",
     fields: {
       subtaskId: f.string({ desc: "The subtask ID to update" }),
       title: f.optional(f.string()),
@@ -743,7 +943,7 @@ var deleteSubtaskContract = defineToolContract({
 var listSubtasksContract = defineToolContract({
   name: "list_subtasks",
   agent: {
-    description: "List all subtasks under the current parent task. Default compact view returns per child: status, agent, story points, PR number/state, dependencies, and holdsBuildSlot \u2014 plus packSlots (in-flight environments vs the PACK_CHILD_LIMIT cap, and which children hold the slots). Use to coordinate child work; pass verbose:true only when you need full description/plan text (large). For non-child tasks use get_task.",
+    description: "List all subtasks under the current parent task. Default compact view returns per child: status, agent, story points, PR number/state, and dependencies. On a FAN-OUT pack it also returns holdsBuildSlot per child plus a packSlots summary (in-flight environments vs the PACK_CHILD_LIMIT cap, and which children hold the slots); both are omitted on the default single-pod path, where one pod implements every child and nothing holds a slot. Use to coordinate child work; pass verbose:true only when you need full description/plan text (large). For non-child tasks use get_task.",
     fields: {
       verbose: f.optional(
         f.boolean({
@@ -849,7 +1049,7 @@ var getAttachmentContract = defineToolContract({
 });
 var attachmentTags = f.optional(
   f.array(f.string(), {
-    desc: `Glossary tag names this file is a relevant example of, e.g. a screenshot of the tag page tagged "tag". Use it when the file shows a tagged entity in a particular state: the tag's page lists its recent tagged attachments, so a reader can see what the entity looks like across the app and spot visual changes over time. Names are matched case-insensitively within the project; a name that matches no tag is reported back and never fails the upload. Max 5.`
+    desc: `Glossary tag names this file is a relevant example of. MUST be a JSON array of quoted strings, e.g. ["ops-hub", "platform-support"] \u2014 bare unquoted words are invalid JSON and fail the whole call before it is parsed (21 fleet calls in one week died this way). Use it when the file shows a tagged entity in a particular state: the tag's page lists its recent tagged attachments, so a reader can see what the entity looks like across the app and spot visual changes over time. Names are matched case-insensitively within the project; a name that matches no tag is reported back and never fails the upload. Max 5.`
   })
 );
 var uploadAttachmentContract = defineToolContract({
@@ -964,34 +1164,441 @@ var createPullRequestContract = defineToolContract({
   }
 });
 var pullRequestContracts = [createPullRequestContract];
-var TOOL_CONTRACTS = Object.fromEntries(
-  [
-    ...tasksContracts,
-    ...tagsContracts,
-    ...checklistContracts,
-    ...dependenciesContracts,
-    ...subtasksContracts,
-    ...attachmentsContracts,
-    ...suggestionsContracts,
-    ...pullRequestContracts
-  ].map((contract) => [contract.name, contract])
-);
-
-// src/tools/contract-tool.ts
-import { z as z3 } from "zod";
-function mcpShape(surface) {
-  return compileShape(z3, surface.fields);
-}
-function registerContractTool(server2, contract, handler, options) {
-  if (options?.alwaysLoad) {
-    registerHotTool(
-      server2,
-      contract.name,
-      contract.mcp.description,
-      mcpShape(contract.mcp),
-      handler
-    );
-    return;
+var REGISTRY_RULE = "Only channels an admin registered as work channels in project settings are reachable \u2014 an unregistered channel is invisible here no matter what the bot can see in the workspace, and the card-sync channels are NOT automatically included.";
+var NO_STORAGE = "Messages are fetched live from Slack/Discord on every call and are never stored by Conveyor.";
+var listProjectIntegrationsContract = defineToolContract({
+  name: "list_project_integrations",
+  agent: {
+    description: `Find out what this project is connected to before assuming a capability exists \u2014 repository forge, Slack or Discord, email, GCP, Grafana, Google Analytics, Google Drive, Cloudflare, and whether incident reporting is set up. Also lists the registered work channels you may read or post in, and how many meetings have been ingested \u2014 so you can tell whether reading meetings is worth doing before calling a meeting tool. Credential-free: every value says whether something is configured, never what the secret is. Call this when you are about to reach for an integration and want to know whether it is there, rather than trying and handling a failure.`,
+    fields: {}
+  },
+  mcp: {
+    description: `Report which integrations a project has configured \u2014 repository forge, Slack/Discord, email, GCP, Grafana, Google Analytics, Google Drive, Cloudflare, incident reporting \u2014 plus the work channels registered for agent access and the project's ingested-meeting count. Returns configuration booleans only, never credential material. Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId
+    }
+  }
+});
+var listProjectChannelsContract = defineToolContract({
+  name: "list_project_channels",
+  agent: {
+    description: `List the Slack or Discord channels this project has registered as work channels, each with the admin's description of what happens there and whether you may read it and post into it. Start here before read_channel_messages \u2014 the description is what tells you which channel is worth consulting. ${REGISTRY_RULE}`,
+    fields: {}
+  },
+  mcp: {
+    description: `List a project's registered work channels: provider, channel id and name, the admin's description of what the channel is for, and the allowRead/allowPost grants. ${REGISTRY_RULE} Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId
+    }
+  }
+});
+var CHANNEL_ID_DESC = "Provider channel id, exactly as list_project_channels reports it (Slack `C\u2026`, Discord a numeric id). Not the channel name.";
+var LIMIT_DESC = "How many messages to return, newest first. Defaults to 25, maximum 50. Prefer a small read plus a follow-up over one large one \u2014 channel history spends context fast.";
+var BEFORE_DESC = "Page further back: return messages older than this cursor. Pass the `olderCursor` from a previous call; a null cursor there means you have reached the start of the channel.";
+var AFTER_DESC = "Return only messages newer than this cursor. Use to catch up on a channel.";
+var THREAD_DESC = "Read one thread instead of the channel surface. Pass a `threadTs` seen on a message from a previous read.";
+var readChannelMessagesContract = defineToolContract({
+  name: "read_channel_messages",
+  agent: {
+    description: `Read recent messages from a registered work channel, newest first \u2014 to catch up on a discussion, find the context behind a decision, or check whether something was already raised. Each message reports its author, whether that author is a bot (Conveyor's own card feed posts show up here too, so check this before treating a message as a teammate's), its text, and a cursor for paging further back. ${REGISTRY_RULE} ${NO_STORAGE}`,
+    fields: {
+      channelId: f.string({ desc: CHANNEL_ID_DESC }),
+      limit: f.optional(f.number({ desc: LIMIT_DESC, int: true, min: 1, max: 50 })),
+      before: f.optional(f.string({ desc: BEFORE_DESC })),
+      after: f.optional(f.string({ desc: AFTER_DESC })),
+      threadTs: f.optional(f.string({ desc: THREAD_DESC }))
+    }
+  },
+  mcp: {
+    description: `Read recent messages from a project's registered work channel, newest first. Each message carries author name, a bot flag, text, a provider-native cursor, and a timestamp; the response carries an olderCursor for paging back. ${REGISTRY_RULE} ${NO_STORAGE} Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId,
+      channelId: f.string({ desc: CHANNEL_ID_DESC }),
+      limit: f.optional(f.number({ desc: LIMIT_DESC, int: true, min: 1, max: 50 })),
+      before: f.optional(f.string({ desc: BEFORE_DESC })),
+      after: f.optional(f.string({ desc: AFTER_DESC })),
+      threadTs: f.optional(f.string({ desc: THREAD_DESC }))
+    }
+  }
+});
+var POST_TEXT_DESC = "What to say, in plain text or light markdown. An attribution footer naming you is appended automatically, so do not sign the message yourself. Channel-wide pings (@everyone, @here, <!channel>) are rendered as ordinary text and will not notify anyone.";
+var POST_THREAD_DESC = "Reply inside a thread rather than to the channel. Prefer this when responding to a specific message \u2014 pass the `threadTs` from the message you are answering.";
+var POST_WARNING = "This is visible to everyone in the channel and cannot be edited or deleted afterwards. Posting requires a per-channel grant that is OFF by default, separate from read access, so most registered channels will refuse it.";
+var postChannelMessageContract = defineToolContract({
+  name: "post_channel_message",
+  agent: {
+    description: `Post a message into a registered work channel \u2014 to answer a question aimed at you, report something the team is waiting on, or ask for input you genuinely need. ${POST_WARNING} ${REGISTRY_RULE}`,
+    fields: {
+      channelId: f.string({ desc: CHANNEL_ID_DESC }),
+      text: f.string({ desc: POST_TEXT_DESC, min: 1, max: 1800 }),
+      threadTs: f.optional(f.string({ desc: POST_THREAD_DESC }))
+    }
+  },
+  mcp: {
+    description: `Post a message into a project's registered work channel, attributed to the acting agent or user. ${POST_WARNING} ${REGISTRY_RULE} Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId,
+      channelId: f.string({ desc: CHANNEL_ID_DESC }),
+      text: f.string({ desc: POST_TEXT_DESC, min: 1, max: 1800 }),
+      threadTs: f.optional(f.string({ desc: POST_THREAD_DESC }))
+    }
+  }
+});
+var ANALYTICS_RANGE = "How many days back to summarize, ending today. Defaults to 28; 90 is the maximum, because GA4 retention makes longer windows unreliable.";
+var ANALYTICS_CAMPAIGN = "Restrict to one campaign name. The campaigns breakdown is always unfiltered, so read it first to see what exists.";
+var ANALYTICS_SHAPE = "Returns headline totals (sessions, active users, new users, page views, average session duration, bounce rate) plus the top five pages, traffic sources, landing pages and campaigns. A project that has not set up GA4 answers configured:false with a reason rather than failing \u2014 that is a normal state, not an error.";
+var getAnalyticsSummaryContract = defineToolContract({
+  name: "get_analytics_summary",
+  agent: {
+    description: `Read this project's Google Analytics 4 traffic \u2014 real numbers for questions like "did that launch land" or "which pages actually get read", instead of guessing. ${ANALYTICS_SHAPE}`,
+    fields: {
+      rangeDays: f.optional(f.number({ desc: ANALYTICS_RANGE, int: true, min: 1, max: 90 })),
+      campaign: f.optional(f.string({ desc: ANALYTICS_CAMPAIGN, max: 200 }))
+    }
+  },
+  mcp: {
+    description: `Read a project's Google Analytics 4 traffic summary. ${ANALYTICS_SHAPE} Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId,
+      rangeDays: f.optional(f.number({ desc: ANALYTICS_RANGE, int: true, min: 1, max: 90 })),
+      campaign: f.optional(f.string({ desc: ANALYTICS_CAMPAIGN, max: 200 }))
+    }
+  }
+});
+var integrationsContracts = [
+  listProjectIntegrationsContract,
+  listProjectChannelsContract,
+  readChannelMessagesContract,
+  postChannelMessageContract,
+  getAnalyticsSummaryContract
+];
+var MAX_CONTENT_CHARS = 1e6;
+var FILE_ID = "Drive file id, as returned by drive_list_files";
+var ROOT_DEFAULT = "Defaults to the project's connected root folder.";
+var MCP_PROJECT_TAIL = "Pass projectId to target a specific project; otherwise the configured default project is used.";
+var driveListFilesContract = defineToolContract({
+  name: "drive_list_files",
+  agent: {
+    description: "List files and folders in the project's connected Google Drive folder. Omit folderId to list the project's root folder. Returns id, name, mimeType, size, and modified time for each entry.",
+    fields: {
+      folderId: f.optional(f.string({ desc: `Folder to list. ${ROOT_DEFAULT}` })),
+      search: f.optional(f.string({ desc: "Only return names containing this text", max: 200 })),
+      limit: f.optional(f.number({ desc: "Max entries (default 100)", int: true, min: 1, max: 200 }))
+    }
+  },
+  mcp: {
+    description: `List files and folders in a project's connected Google Drive folder. Omit folderId to list the project's root folder. Returns id, name, mimeType, size, and modified time for each entry. ${MCP_PROJECT_TAIL}`,
+    fields: {
+      projectId: mcpProjectId,
+      folderId: f.optional(f.string({ desc: `Folder to list. ${ROOT_DEFAULT}` })),
+      search: f.optional(f.string({ desc: "Only return names containing this text", max: 200 })),
+      limit: f.optional(f.number({ desc: "Max entries (default 100)", int: true, min: 1, max: 200 }))
+    }
+  }
+});
+var driveReadFileContract = defineToolContract({
+  name: "drive_read_file",
+  agent: {
+    description: "Read a file's text content from the project's connected Google Drive folder. Google Docs, Sheets, and Slides are exported to text automatically. Content over 100 KB is truncated.",
+    fields: { fileId: f.string({ desc: FILE_ID }) }
+  },
+  mcp: {
+    description: `Read a file's text content from a project's connected Google Drive folder. Google Docs, Sheets, and Slides are exported to text automatically. Content over 100 KB is truncated. ${MCP_PROJECT_TAIL}`,
+    fields: { projectId: mcpProjectId, fileId: f.string({ desc: FILE_ID }) }
+  }
+});
+var driveCreateFileContract = defineToolContract({
+  name: "drive_create_file",
+  agent: {
+    description: "Create a new file in the project's connected Google Drive folder. Use drive_update_file to change an existing file instead.",
+    fields: {
+      name: f.string({ desc: "File name, without any path separators", min: 1, max: 255 }),
+      content: f.string({ desc: "File content, UTF-8 text", max: MAX_CONTENT_CHARS }),
+      mimeType: f.optional(f.string({ desc: "MIME type (default text/plain)" })),
+      folderId: f.optional(f.string({ desc: `Destination folder. ${ROOT_DEFAULT}` }))
+    }
+  },
+  mcp: {
+    description: `Create a new file in a project's connected Google Drive folder. Use drive_update_file to change an existing file instead. ${MCP_PROJECT_TAIL}`,
+    fields: {
+      projectId: mcpProjectId,
+      name: f.string({ desc: "File name, without any path separators", min: 1, max: 255 }),
+      content: f.string({ desc: "File content, UTF-8 text", max: MAX_CONTENT_CHARS }),
+      mimeType: f.optional(f.string({ desc: "MIME type (default text/plain)" })),
+      folderId: f.optional(f.string({ desc: `Destination folder. ${ROOT_DEFAULT}` }))
+    }
+  }
+});
+var driveUpdateFileContract = defineToolContract({
+  name: "drive_update_file",
+  agent: {
+    description: "Replace the content of an existing file in the project's connected Google Drive folder. This overwrites the whole file. Google-native documents cannot be overwritten.",
+    fields: {
+      fileId: f.string({ desc: FILE_ID }),
+      content: f.string({ desc: "Replacement content, UTF-8 text", max: MAX_CONTENT_CHARS }),
+      mimeType: f.optional(f.string({ desc: "MIME type (defaults to the file's current type)" }))
+    }
+  },
+  mcp: {
+    description: `Replace the content of an existing file in a project's connected Google Drive folder. This overwrites the whole file \u2014 read it first if you are editing rather than replacing. Google-native documents cannot be overwritten. ${MCP_PROJECT_TAIL}`,
+    fields: {
+      projectId: mcpProjectId,
+      fileId: f.string({ desc: FILE_ID }),
+      content: f.string({ desc: "Replacement content, UTF-8 text", max: MAX_CONTENT_CHARS }),
+      mimeType: f.optional(f.string({ desc: "MIME type (defaults to the file's current type)" }))
+    }
+  }
+});
+var driveDeleteFileContract = defineToolContract({
+  name: "drive_delete_file",
+  agent: {
+    description: "Move a file in the project's connected Google Drive folder to the Drive trash. The file is recoverable from the trash; it is never permanently deleted.",
+    fields: { fileId: f.string({ desc: FILE_ID }) }
+  },
+  mcp: {
+    description: `Move a file in a project's connected Google Drive folder to the Drive trash. The file is recoverable from the trash; it is never permanently deleted. ${MCP_PROJECT_TAIL}`,
+    fields: { projectId: mcpProjectId, fileId: f.string({ desc: FILE_ID }) }
+  }
+});
+var driveCreateFolderContract = defineToolContract({
+  name: "drive_create_folder",
+  agent: {
+    description: "Create a folder inside the project's connected Google Drive folder.",
+    fields: {
+      name: f.string({ desc: "Folder name, without any path separators", min: 1, max: 255 }),
+      folderId: f.optional(f.string({ desc: `Parent folder. ${ROOT_DEFAULT}` }))
+    }
+  },
+  mcp: {
+    description: `Create a folder inside a project's connected Google Drive folder. ${MCP_PROJECT_TAIL}`,
+    fields: {
+      projectId: mcpProjectId,
+      name: f.string({ desc: "Folder name, without any path separators", min: 1, max: 255 }),
+      folderId: f.optional(f.string({ desc: `Parent folder. ${ROOT_DEFAULT}` }))
+    }
+  }
+});
+var driveContracts = [
+  driveListFilesContract,
+  driveReadFileContract,
+  driveCreateFileContract,
+  driveUpdateFileContract,
+  driveDeleteFileContract,
+  driveCreateFolderContract
+];
+var MEETING_ID = "Meeting id, as returned by list_meetings.";
+var MCP_TAIL = "Pass projectId to target a specific project; otherwise the configured default project is used.";
+var SUMMARY_NOTE = 'A meeting whose summary is still being written reports status "processing" and a null summary \u2014 that is normal shortly after ingestion, not an error.';
+var listMeetingsContract = defineToolContract({
+  name: "list_meetings",
+  agent: {
+    description: `List this project's meetings, newest first \u2014 each with its title, date, source, status, participants, and a short summary preview. Start here when you are asked about "the meeting", "what did we decide", or "what came out of that call". ${SUMMARY_NOTE}`,
+    fields: {
+      limit: f.optional(
+        f.number({ desc: "How many to return (default 20, maximum 50).", int: true, min: 1, max: 50 })
+      ),
+      search: f.optional(
+        f.string({ desc: "Case-insensitive match on the meeting title.", max: 200 })
+      )
+    }
+  },
+  mcp: {
+    description: `List a project's meetings, newest first, with title, date, source, status, participants, and a summary preview. ${SUMMARY_NOTE} ${MCP_TAIL}`,
+    fields: {
+      projectId: mcpProjectId,
+      limit: f.optional(
+        f.number({ desc: "How many to return (default 20, maximum 50).", int: true, min: 1, max: 50 })
+      ),
+      search: f.optional(
+        f.string({ desc: "Case-insensitive match on the meeting title.", max: 200 })
+      )
+    }
+  }
+});
+var getMeetingContract = defineToolContract({
+  name: "get_meeting",
+  agent: {
+    description: `Read one meeting's details and its FULL AI summary \u2014 the overview, the decisions, and the proposed next steps. **Read this before reaching for the transcript**: the summary usually answers the question, and a transcript costs far more context. Also returns the participant list, the segment count, and the meeting's web link. ${SUMMARY_NOTE}`,
+    fields: { meetingId: f.string({ desc: MEETING_ID }) }
+  },
+  mcp: {
+    description: `Read one meeting's details and full AI summary (overview, decisions, proposed next steps), plus participants, segment count, and its web link. Prefer this over the transcript \u2014 the summary usually answers the question at a fraction of the context. ${SUMMARY_NOTE} ${MCP_TAIL}`,
+    fields: { projectId: mcpProjectId, meetingId: f.string({ desc: MEETING_ID }) }
+  }
+});
+var OFFSET_DESC = "Segment index to start from (default 0). Pass the nextOffset from the previous page to continue.";
+var LIMIT_DESC2 = "Segments per page (default 200, maximum 500). A long meeting runs to thousands, so page it rather than asking for everything.";
+var readMeetingTranscriptContract = defineToolContract({
+  name: "read_meeting_transcript",
+  agent: {
+    description: `Read a page of a meeting's raw transcript as \`[hh:mm:ss] Speaker: text\` lines. Use this when you need someone's exact words \u2014 a quote, a caveat, or the reasoning behind a decision the summary only states. For "what happened in the meeting", read get_meeting instead. The response carries nextOffset when more segments remain.`,
+    fields: {
+      meetingId: f.string({ desc: MEETING_ID }),
+      offset: f.optional(f.number({ desc: OFFSET_DESC, int: true, min: 0 })),
+      limit: f.optional(f.number({ desc: LIMIT_DESC2, int: true, min: 1, max: 500 }))
+    }
+  },
+  mcp: {
+    description: `Read a page of a meeting's raw transcript as \`[hh:mm:ss] Speaker: text\` lines. Use it for exact wording; prefer get_meeting's summary for what happened. The response carries nextOffset when more segments remain. ${MCP_TAIL}`,
+    fields: {
+      projectId: mcpProjectId,
+      meetingId: f.string({ desc: MEETING_ID }),
+      offset: f.optional(f.number({ desc: OFFSET_DESC, int: true, min: 0 })),
+      limit: f.optional(f.number({ desc: LIMIT_DESC2, int: true, min: 1, max: 500 }))
+    }
+  }
+});
+var meetingsContracts = [
+  listMeetingsContract,
+  getMeetingContract,
+  readMeetingTranscriptContract
+];
+var SINCE_MINUTES = f.optional(
+  f.number({
+    desc: "Relative time window ending now, in minutes (default 60). Ignored if startTime is set.",
+    int: true,
+    min: 1,
+    max: 10080
+  })
+);
+var START_TIME = f.optional(
+  f.string({ desc: "ISO 8601 lower bound (overrides sinceMinutes)" })
+);
+var END_TIME = f.optional(f.string({ desc: "ISO 8601 upper bound (default now)" }));
+var LIMIT = f.optional(
+  f.number({ desc: "Max entries per page (default 50)", int: true, min: 1, max: 200 })
+);
+var RAW_QUERY_MAX = 2e3;
+var gcpFields = {
+  env: f.optional(
+    f.enum(["prod", "dev", "claudespace"], {
+      desc: "GCP environment slot to query (default prod)"
+    })
+  ),
+  sinceMinutes: SINCE_MINUTES,
+  startTime: START_TIME,
+  endTime: END_TIME,
+  severity: f.optional(
+    f.enum(SEVERITY_ENUM, {
+      desc: "Minimum severity, inclusive \u2014 ERROR returns ERROR and above"
+    })
+  ),
+  services: f.optional(
+    f.array(f.string(), {
+      desc: "Restrict to these Cloud Run service names (prod/dev only). Defaults to all services linked in project settings."
+    })
+  ),
+  sqlInstances: f.optional(
+    f.array(f.string(), { desc: "Restrict to these Cloud SQL instance names (prod/dev only)" })
+  ),
+  allServices: f.optional(
+    f.boolean({
+      desc: "Set true to search ALL logs in the GCP project, ignoring the linked-resource scope"
+    })
+  ),
+  search: f.optional(
+    f.string({ desc: "Free-text search across all log fields (exact substring, not regex)", max: 256 })
+  ),
+  filter: f.optional(
+    f.string({
+      desc: "Advanced: raw Cloud Logging filter expression, ANDed with the scope (it cannot widen it)",
+      max: RAW_QUERY_MAX
+    })
+  ),
+  limit: LIMIT,
+  pageToken: f.optional(
+    f.string({ desc: "Opaque token from a previous response to fetch the next page" })
+  )
+};
+var GCP_SHARED_DESC = "Envs: 'prod' and 'dev' are the project's Cloud Run apps + Cloud SQL databases (scoped by default to the resources linked in project settings); 'claudespace' is the project's GKE agent-pod namespace. Start broad (severity=ERROR, sinceMinutes=60), then narrow with services/search. Returns compact lines: '<time> <SEVERITY> [<source>] <message> | key=value \u2026' (the key=value tail is the entry's structured payload \u2014 error details, service/method, actor and entity ids). When the response ends with a pageToken line, pass that token back as pageToken for the next page.";
+var queryGcpLogsContract = defineToolContract({
+  name: "query_gcp_logs",
+  agent: {
+    description: `Query Google Cloud Logging for this project's linked GCP environments \u2014 use this to investigate a production or dev failure directly rather than guessing from the code. ${GCP_SHARED_DESC}`,
+    fields: gcpFields
+  },
+  mcp: {
+    description: `Query Google Cloud Logging for a project's linked GCP environments \u2014 use this to investigate production or dev issues directly ('something broke on prod'). ${GCP_SHARED_DESC} Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: { projectId: mcpProjectId, ...gcpFields }
+  }
+});
+var grafanaFields = {
+  env: f.optional(
+    f.enum(["prod", "dev"], {
+      desc: "Configured Grafana env mapping to scope by (default prod)"
+    })
+  ),
+  sinceMinutes: SINCE_MINUTES,
+  startTime: START_TIME,
+  endTime: END_TIME,
+  level: f.optional(
+    f.enum(["debug", "info", "warn", "error", "fatal"], {
+      desc: "Minimum severity, inclusive \u2014 error returns error and above"
+    })
+  ),
+  services: f.optional(
+    f.array(f.string(), { desc: "Restrict to these service_name label values" })
+  ),
+  search: f.optional(
+    f.string({ desc: "Substring line filter (exact substring, not regex)", max: 256 })
+  ),
+  logql: f.optional(
+    f.string({
+      desc: "Advanced: raw LogQL query \u2014 REPLACES env/services/level/search composition",
+      max: RAW_QUERY_MAX
+    })
+  ),
+  limit: LIMIT
+};
+var GRAFANA_SHARED_DESC = "the APPLICATION logs shipped to Grafana Cloud/Loki, complementing query_gcp_logs (GCP infrastructure logs). Start with structured filters (env, level=error, sinceMinutes=60, services), then narrow with search; pass raw LogQL via logql only when structured filters cannot express the query (it REPLACES them). The response header echoes the composed LogQL \u2014 iterate on it. Returns compact lines: '<time> <SEVERITY> [<service>] <message>'.";
+var queryGrafanaLogsContract = defineToolContract({
+  name: "query_grafana_logs",
+  agent: {
+    description: `Query this project's connected Grafana (Loki) logs \u2014 ${GRAFANA_SHARED_DESC}`,
+    fields: grafanaFields
+  },
+  mcp: {
+    description: `Query the project's connected Grafana (Loki) logs \u2014 ${GRAFANA_SHARED_DESC} Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: { projectId: mcpProjectId, ...grafanaFields }
+  }
+});
+var logsContracts = [
+  queryGcpLogsContract,
+  queryGrafanaLogsContract
+];
+var TOOL_CONTRACTS = Object.fromEntries(
+  [
+    ...tasksContracts,
+    ...taskUpdateContracts,
+    ...tagsContracts,
+    ...checklistContracts,
+    ...dependenciesContracts,
+    ...subtasksContracts,
+    ...attachmentsContracts,
+    ...suggestionsContracts,
+    ...pullRequestContracts,
+    ...integrationsContracts,
+    ...driveContracts,
+    ...meetingsContracts,
+    ...logsContracts
+  ].map((contract) => [contract.name, contract])
+);
+
+// src/tools/contract-tool.ts
+import { z as z2 } from "zod";
+function mcpShape(surface) {
+  return compileShape(z2, surface.fields);
+}
+function registerContractTool(server2, contract, handler, options) {
+  if (options?.alwaysLoad) {
+    registerHotTool(
+      server2,
+      contract.name,
+      contract.mcp.description,
+      mcpShape(contract.mcp),
+      handler
+    );
+    return;
   }
   server2.tool(
     contract.name,
@@ -1012,7 +1619,42 @@ function registerHotTool(server2, name, description, schema, handler) {
   );
 }
 
+// src/tools/connection.ts
+var CAPABILITY_ENUM = ["read", "create", "update", "chat", "files", "build"];
+function registerConnectionTools(server2, conn2) {
+  registerContractTool(server2, getConnectionContextContract, async (params) => {
+    const ctx = await conn2.getConnectionContext(params.projectId);
+    return { content: [{ type: "text", text: JSON.stringify(ctx, null, 2) }] };
+  });
+  server2.tool(
+    "verify_connection",
+    "Prove the connection is correct AND that you can actually write to the intended board \u2014 not just that auth works. Runs layered checks (auth \u2192 account \u2192 project \u2192 target board \u2192 capabilities \u2192 read) and returns a plain pass/fail with, on failure, the exact failing layer and ONE next action. Use this instead of get_project_summary to confirm setup: a summary that returns data proves auth, not scope. Pass intendedActions to verify specific capabilities (defaults to read+create+update). Pass projectId to target a specific project; otherwise the configured default project is used. The board scope comes from CONVEYOR_SUBPROJECT_ID.",
+    {
+      projectId: z3.string().optional().describe("Target Conveyor project ID"),
+      intendedActions: z3.array(z3.enum(CAPABILITY_ENUM)).optional().describe(
+        "Capabilities to verify the connection can perform (default: read, create, update)."
+      )
+    },
+    async (params) => {
+      const result = await conn2.verifyConnection(params);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    }
+  );
+  server2.tool(
+    "list_accessible_subprojects",
+    "List the boards (sub-projects) under the connected project \u2014 each with its ID, name, slug, board URL, owned root path, and the role/capabilities this token has on it. Use this to discover which board to create or list cards on (pass a returned id as subProjectId, or set CONVEYOR_SUBPROJECT_ID) instead of asking the human for one. Pass projectId to target a specific project; otherwise the configured default project is used.",
+    {
+      projectId: z3.string().optional().describe("Target Conveyor project ID")
+    },
+    async (params) => {
+      const subprojects = await conn2.listAccessibleSubprojects(params.projectId);
+      return { content: [{ type: "text", text: JSON.stringify(subprojects, null, 2) }] };
+    }
+  );
+}
+
 // src/tools/project-config.ts
+import { z as z4 } from "zod";
 var CONTEXT_LINK_LOCATOR_MAX = 300;
 function jsonResult(data) {
   return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -1333,7 +1975,7 @@ function summarizeTask(task) {
 }
 
 // src/tools/tasks.ts
-var STATUS_ENUM = [
+var STATUS_ENUM2 = [
   "Planning",
   "Open",
   "InProgress",
@@ -1344,7 +1986,7 @@ var STATUS_ENUM = [
   "Cancelled"
 ];
 var CARD_TYPE_ENUM = ["task", "incident", "suggestion"];
-var RISK_ENUM = ["critical", "high", "medium", "low"];
+var RISK_ENUM2 = ["critical", "high", "medium", "low"];
 var BOARD_FILTER = z5.string().nullable().optional().describe(
   "Filter to a sub-project board. Omit to use the connection's default board (CONVEYOR_SUBPROJECT_ID) when set, else the whole project; pass null to force the whole project. Use list_accessible_subprojects to find board IDs."
 );
@@ -1358,7 +2000,7 @@ function registerListTasks(server2, conn2) {
     "List project cards, optionally filtered by card type, status, or assignment (a specific assignee, or unassigned tasks). Defaults to type=task \u2014 pass typeFilters to list incidents/suggestions. Results are relevance-ordered: highest priority first then newest; suggestions-only queries rank by upvote score. Pass projectId to target a specific project; otherwise the configured default project is used. Returns summaries \u2014 plan omitted, description truncated; use get_task for full details.",
     {
       projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      status: z5.enum(STATUS_ENUM).optional().describe("Filter by task status"),
+      status: z5.enum(STATUS_ENUM2).optional().describe("Filter by task status"),
       typeFilters: z5.array(z5.enum(CARD_TYPE_ENUM)).optional().describe(
         'Card types to include, e.g. ["incident"] or ["task", "incident"]. Omit for tasks only.'
       ),
@@ -1446,51 +2088,20 @@ function registerCreateTask(server2, conn2) {
   );
 }
 function registerUpdateTask(server2, conn2) {
-  server2.tool(
-    "update_task",
-    "Update task fields: title, description, plan, status, risk, story points, assignment, githubBranch, or tags. Set status to claim a card (InProgress), triage it (Open), or cancel it (Cancelled); for review approvals prefer approve_task / request_changes, which guard against stale-state races. Tags are additive/subtractive \u2014 pass addTags/removeTags with tag names (not a replace-set). Pass projectId to target a specific project; otherwise the configured default project is used. Moving a task beyond Planning auto-fills any missing icon, story points, and agent assignment \u2014 don't spend turns on them; pass storyPointValue only to correct the sizing yourself. For subtasks use update_subtask.",
-    {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      taskId: z5.string().describe("The task ID"),
-      title: z5.string().optional().describe("New title"),
-      description: z5.string().optional().describe(cardDescriptionDesc("New description")),
-      plan: z5.string().optional().describe("New plan (markdown)"),
-      status: z5.enum(STATUS_ENUM).optional().describe("New status"),
-      risk: z5.enum(RISK_ENUM).nullable().optional().describe(
-        "Risk level \u2014 how much important surface the task touches (critical/high/medium/low). Pass null to clear."
-      ),
-      storyPointValue: z5.number().nullable().optional().describe(
-        `${storyPointValueDesc}. The tiers are per-project \u2014 a value the project has not configured is rejected. Pass null to clear it; a card beyond Planning with no story point is re-filled by identification.`
-      ),
-      assignedUserId: z5.string().nullable().optional().describe("User ID to assign, or null"),
-      subProjectId: z5.string().nullable().optional().describe(
-        "Assign the task to a sub-project board; null moves it back to the parent board. Omit to leave unchanged."
-      ),
-      githubBranch: z5.string().nullable().optional().describe(
-        "Record the task's ACTUAL working branch (e.g. a locally-driven pack's branch cut at claim time, so identification never mints a competing name and pack-child merges settle against reality), or null to detach. The branch must already exist on origin, and a live workspace bound to a different branch rejects the write."
-      ),
-      addTags: z5.array(z5.string()).optional().describe(
-        'Tag names to add to the card (e.g. ["refactor"]). Additive \u2014 existing tags are kept. Unknown names are rejected; use list_tags to see available tags or manage_tags to create one.'
-      ),
-      removeTags: z5.array(z5.string()).optional().describe(
-        "Tag names to remove from the card. Removing a tag the card doesn't have is a no-op."
-      )
-    },
-    async (params) => {
-      const result = await conn2.updateTask(params);
-      const parts = [`Task ${result.id} updated`];
-      if (result.status) parts.push(`status: ${result.status}`);
-      if (params.storyPointValue !== void 0) {
-        parts.push(`story points: ${result.storyPointValue ?? "cleared"}`);
-      }
-      if ((result.addedTags ?? []).length > 0) parts.push(`+tags: ${result.addedTags.join(", ")}`);
-      if ((result.removedTags ?? []).length > 0)
-        parts.push(`-tags: ${result.removedTags.join(", ")}`);
-      return {
-        content: [{ type: "text", text: parts.join(" \xB7 ") }]
-      };
+  registerContractTool(server2, updateTaskContract, async (params) => {
+    const result = await conn2.updateTask(params);
+    const parts = [`Task ${result.id} updated`];
+    if (result.status) parts.push(`status: ${result.status}`);
+    if (params.storyPointValue !== void 0) {
+      parts.push(`story points: ${result.storyPointValue ?? "cleared"}`);
     }
-  );
+    if ((result.addedTags ?? []).length > 0) parts.push(`+tags: ${result.addedTags.join(", ")}`);
+    if ((result.removedTags ?? []).length > 0)
+      parts.push(`-tags: ${result.removedTags.join(", ")}`);
+    return {
+      content: [{ type: "text", text: parts.join(" \xB7 ") }]
+    };
+  });
 }
 function registerMoveCard(server2, conn2) {
   server2.tool(
@@ -1613,7 +2224,7 @@ function registerReviewTools(server2, conn2) {
     {
       projectId: z5.string().optional().describe("Target Conveyor project ID"),
       taskId: z5.string().describe("The task ID"),
-      risk: z5.enum(RISK_ENUM).optional().describe("Optional risk level to record; defaults to a raise-only 'low' on approval.")
+      risk: z5.enum(RISK_ENUM2).optional().describe("Optional risk level to record; defaults to a raise-only 'low' on approval.")
     },
     async (params) => {
       const result = await conn2.approveTask(params.taskId, params.projectId, params.risk);
@@ -1634,7 +2245,7 @@ function registerReviewTools(server2, conn2) {
       projectId: z5.string().optional().describe("Target Conveyor project ID"),
       taskId: z5.string().describe("The task ID"),
       feedback: z5.string().describe("Feedback message describing requested changes"),
-      risk: z5.enum(RISK_ENUM).optional().describe("Optional risk level to record; defaults to a raise-only 'medium' on changes.")
+      risk: z5.enum(RISK_ENUM2).optional().describe("Optional risk level to record; defaults to a raise-only 'medium' on changes.")
     },
     async (params) => {
       await conn2.requestChanges(params.taskId, params.feedback, params.projectId, params.risk);
@@ -2426,193 +3037,2071 @@ function registerWorkspaceTools(server2, conn2, deps = {}) {
   registerStopTunnelTool(server2);
 }
 
-// src/tools/logs.ts
+// ../shared/dist/index.js
 import { z as z9 } from "zod";
-var SEVERITY_ENUM = [
-  "DEBUG",
-  "INFO",
-  "NOTICE",
-  "WARNING",
-  "ERROR",
-  "CRITICAL",
-  "ALERT",
-  "EMERGENCY"
+import { z as z22 } from "zod";
+import { z as z32 } from "zod";
+import { z as z42 } from "zod";
+import { z as z52 } from "zod";
+import { z as z62 } from "zod";
+import { z as z72 } from "zod";
+import { z as z82 } from "zod";
+import { z as z92 } from "zod";
+var DEFAULT_SONNET_MODEL = "claude-sonnet-5";
+var DEFAULT_OPUS_MODEL = "claude-opus-5";
+var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
+var FABLE_MODEL = "claude-fable-5";
+var PREVIOUS_SONNET_MODEL = "claude-sonnet-4-6";
+var PREVIOUS_OPUS_MODEL = "claude-opus-4-8";
+var PTY_STREAM_PORT_BASE = 7420;
+var PTY_STREAM_PORT_ATTEMPTS = 8;
+var PREVIEW_PORT_DENY_LIST = [
+  5432,
+  6379,
+  9200,
+  ...Array.from({ length: PTY_STREAM_PORT_ATTEMPTS }, (_, i) => PTY_STREAM_PORT_BASE + i)
 ];
-var MAX_LINE_CHARS = 400;
-var DEFAULT_SINCE_MINUTES = 60;
-function truncateLine(text) {
-  const oneLine = text.replace(/\s*\n\s*/g, " \u23CE ");
-  if (oneLine.length <= MAX_LINE_CHARS) return oneLine;
-  const overflow = oneLine.length - MAX_LINE_CHARS;
-  return `${oneLine.slice(0, MAX_LINE_CHARS)}\u2026[+${overflow}c]`;
+function normalizeCheckpointPath(value) {
+  let normalized = value.trim().replace(/\/{2,}/g, "/");
+  normalized = normalized.split("/").filter((segment) => segment !== ".").join("/");
+  while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
+  return normalized;
 }
-function entrySource(entry) {
-  return entry.resource.service_name ?? entry.resource.pod_name ?? entry.resource.database_id ?? entry.resourceType ?? "-";
+var checkpointPathSchema = z9.string().transform(normalizeCheckpointPath).pipe(
+  z9.string().min(1).refine((value) => value !== ".", "Checkpoint paths must name a repository entry").refine((value) => !value.startsWith("/"), "Checkpoint paths must be repository-relative").refine(
+    (value) => !/^[A-Za-z]:[\\/]/.test(value) && !value.includes("\\"),
+    "Checkpoint paths must use repository-relative POSIX syntax"
+  ).refine(
+    (value) => !value.split("/").includes(".."),
+    "Checkpoint paths must not traverse a parent directory"
+  )
+);
+var secretNameSchema = z9.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+var checkpointKeySchema = z9.string().regex(/^[0-9a-f]{64}$/);
+var checkpointDigestRefSchema = z9.string().regex(/^[^\s@]+@sha256:[0-9a-f]{64}$/);
+var ACTIONS_PREBAKE_REGISTRY_PATTERN = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::(?:[1-9][0-9]{0,4}))?(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
+var actionsPrebakeRegistrySchema = z9.string().trim().min(1).regex(
+  ACTIONS_PREBAKE_REGISTRY_PATTERN,
+  "Actions prebake registry must be a lowercase host[:port] with an optional path prefix"
+).refine((value) => {
+  const port = /:([0-9]+)(?:\/|$)/.exec(value)?.[1];
+  return !port || Number(port) <= 65535;
+}, "Actions prebake registry port must be between 1 and 65535");
+function uniqueSortedArray(item, minimum = 0) {
+  return z9.array(item).min(minimum).superRefine((values, ctx) => {
+    if (new Set(values).size !== values.length) {
+      ctx.addIssue({ code: z9.ZodIssueCode.custom, message: "Duplicate values are not allowed" });
+    }
+  }).transform((values) => [...values].sort());
 }
-var PAYLOAD_SKIP_KEYS = /* @__PURE__ */ new Set(["message", "severity", "timestamp", "level", "stack"]);
-var PAYLOAD_PRIORITY = [
-  "error",
-  "outcome",
-  "serviceName",
-  "methodName",
-  "userId",
-  "taskId",
-  "sessionId",
-  "workspaceId",
-  "projectId",
-  "durationMs"
+var projectCheckpointSettingsSchema = z9.object({
+  enabled: z9.literal(true),
+  cacheCommand: z9.string().trim().min(1),
+  cacheInputPaths: uniqueSortedArray(checkpointPathSchema, 1),
+  reusableArtifactPaths: uniqueSortedArray(checkpointPathSchema, 1),
+  finalizeCommand: z9.string().trim().min(1),
+  credentialEpoch: z9.string().trim().min(1),
+  requiredSecretNames: uniqueSortedArray(secretNameSchema).optional(),
+  optionalSecretNames: uniqueSortedArray(secretNameSchema).optional(),
+  bakeWebAppBuild: z9.boolean().optional()
+}).superRefine((checkpoint, ctx) => {
+  const required = new Set(checkpoint.requiredSecretNames ?? []);
+  for (const name of checkpoint.optionalSecretNames ?? []) {
+    if (required.has(name)) {
+      ctx.addIssue({
+        code: z9.ZodIssueCode.custom,
+        path: ["optionalSecretNames"],
+        message: "A secret cannot be both required and optional"
+      });
+    }
+  }
+});
+var ACHIEVEMENT_RARITIES = [
+  {
+    key: "common",
+    name: "Common",
+    color: "#22c55e",
+    iconPath: "/storypoints/square-solid-full.svg"
+  },
+  {
+    key: "magic",
+    name: "Magic",
+    color: "#3b82f6",
+    iconPath: "/storypoints/diamond-solid-full.svg"
+  },
+  { key: "rare", name: "Rare", color: "#eab308", iconPath: "/storypoints/gem-solid-full.svg" },
+  {
+    key: "unique",
+    name: "Unique",
+    color: "#f97316",
+    iconPath: "/storypoints/scroll-sharp-solid-full.svg"
+  },
+  { key: "pack", name: "Pack", color: "#9c27b0", iconPath: "/storypoints/pack.svg" }
 ];
-var PAYLOAD_VALUE_MAX_CHARS = 160;
-function compactPayloadValue(value) {
-  const raw = typeof value === "string" ? value : JSON.stringify(value);
-  const flat = (raw ?? "undefined").replace(/\s+/g, " ");
-  const quoted = typeof value === "string" && /[\s"]/.test(flat) ? JSON.stringify(flat) : flat;
-  return quoted.length > PAYLOAD_VALUE_MAX_CHARS ? `${quoted.slice(0, PAYLOAD_VALUE_MAX_CHARS)}\u2026` : quoted;
+var RISK_LEVELS = ["critical", "high", "medium", "low"];
+var riskLevelSchema = z22.enum(RISK_LEVELS);
+var DEFAULT_RISK_LEVELS = [
+  {
+    level: "critical",
+    value: 4,
+    label: "Critical",
+    description: "Touches critical surface area; give it the closest review.",
+    color: "#dc2626",
+    ordinal: 0
+  },
+  {
+    level: "high",
+    value: 3,
+    label: "Elevated",
+    description: "Touches important surface area; review carefully.",
+    color: "#ea580c",
+    ordinal: 1
+  },
+  {
+    level: "medium",
+    value: 2,
+    label: "Moderate",
+    description: "Moderate surface area; normal review.",
+    color: "#d97706",
+    ordinal: 2
+  },
+  {
+    level: "low",
+    value: 1,
+    label: "Minimal",
+    description: "Small or isolated surface area.",
+    color: "#64748b",
+    ordinal: 3
+  }
+];
+var LEVEL_BY_VALUE = new Map(
+  DEFAULT_RISK_LEVELS.map((m) => [m.value, m.level])
+);
+var ACTIVE_WORK_STATUSES = [
+  "InProgress",
+  "ReviewPR",
+  "ReviewDev",
+  "ReviewLive",
+  "Complete"
+];
+var IDENTIFIED_WORK_STATUSES = ["Open", ...ACTIVE_WORK_STATUSES];
+var DEFAULT_TASK_STATUS_COLOR = "#a8a29e";
+var DEFAULT_TASK_STATUS_COLOR_INT = Number.parseInt(DEFAULT_TASK_STATUS_COLOR.slice(1), 16);
+var MAX_FILE_SIZE_BYTES2 = 25 * 1024 * 1024;
+var MAX_FILE_TAGS2 = 5;
+var MAX_FILE_TAG_LENGTH = 100;
+var EMBED_THRESHOLD_IMAGES = 5 * 1024 * 1024;
+var EMBED_THRESHOLD_TEXT = 2 * 1024 * 1024;
+var IDLE_HEARTBEAT_MS = 90 * 1e3;
+var TurnEndToolCallSchema = z32.object({
+  tool: z32.string(),
+  input: z32.string().optional(),
+  output: z32.string().optional(),
+  timestamp: z32.string().optional()
+}).passthrough();
+var KnownAgentEventSchema = z32.discriminatedUnion("type", [
+  // ── Lifecycle / connection ────────────────────────────────────────────
+  z32.object({
+    type: z32.literal("connected"),
+    sessionId: z32.string(),
+    projectId: z32.string().optional()
+  }).passthrough(),
+  // Open-ended context snapshot spread from buildInitializationContext().
+  z32.object({ type: z32.literal("session_manifest") }).passthrough(),
+  z32.object({
+    type: z32.literal("agent_runner_status"),
+    reason: z32.string(),
+    attempt: z32.number().optional(),
+    attempts: z32.number().optional()
+  }).passthrough(),
+  z32.object({ type: z32.literal("shutdown"), reason: z32.string().optional() }).passthrough(),
+  z32.object({ type: z32.literal("mode_changed"), agentMode: z32.string() }).passthrough(),
+  z32.object({ type: z32.literal("mode_transition"), from: z32.string(), to: z32.string() }).passthrough(),
+  // ── Turn stream ───────────────────────────────────────────────────────
+  z32.object({ type: z32.literal("message"), content: z32.string() }).passthrough(),
+  z32.object({ type: z32.literal("thinking"), message: z32.string() }).passthrough(),
+  z32.object({
+    type: z32.literal("tool_use"),
+    tool: z32.string(),
+    // Producers send JSON.stringify(input); consumers defend against
+    // object inputs from older agents, so the wire stays permissive here.
+    input: z32.unknown().optional()
+  }).passthrough(),
+  z32.object({
+    type: z32.literal("tool_result"),
+    tool: z32.string(),
+    output: z32.unknown().optional(),
+    isError: z32.boolean().optional(),
+    redactedCount: z32.number().optional()
+  }).passthrough(),
+  z32.object({ type: z32.literal("turn_end"), toolCalls: z32.array(TurnEndToolCallSchema) }).passthrough(),
+  z32.object({
+    type: z32.literal("completed"),
+    summary: z32.string().optional(),
+    durationMs: z32.number().optional()
+  }).passthrough(),
+  z32.object({ type: z32.literal("error"), message: z32.string() }).passthrough(),
+  z32.object({ type: z32.literal("agent_typing_start") }).passthrough(),
+  z32.object({ type: z32.literal("agent_typing_stop") }).passthrough(),
+  // ── Telemetry ─────────────────────────────────────────────────────────
+  // heartbeat/typing: legacy telemetry the server still classifies as
+  // transient (TRANSIENT_EVENT_TYPES) — kept in the vocabulary.
+  z32.object({ type: z32.literal("heartbeat") }).passthrough(),
+  z32.object({ type: z32.literal("typing") }).passthrough(),
+  z32.object({
+    type: z32.literal("context_update"),
+    contextTokens: z32.number(),
+    contextWindow: z32.number(),
+    inputTokens: z32.number().optional(),
+    cacheReadInputTokens: z32.number().optional(),
+    cacheCreationInputTokens: z32.number().optional(),
+    totalTokensUsed: z32.number().optional()
+  }).passthrough(),
+  // Four producer shapes share this type: {rateLimitType, utilization, status}
+  // (SDK rate_limit_event), {resetsAt} (agent-connection resume notice), the
+  // usage-sampler ({rateLimitType, utilization, status, resetsAt, gauges}
+  // — resetsAt matches rateLimitType; gauges survives via .passthrough()), and
+  // {unmeasurable, reason} (the sampler reporting it cannot read this key).
+  z32.object({
+    type: z32.literal("rate_limit_update"),
+    rateLimitType: z32.string().optional(),
+    utilization: z32.number().optional(),
+    status: z32.string().optional(),
+    resetsAt: z32.string().optional(),
+    unmeasurable: z32.boolean().optional(),
+    reason: z32.string().optional()
+  }).passthrough(),
+  z32.object({
+    type: z32.literal("context_compacted"),
+    trigger: z32.string().optional(),
+    preTokens: z32.number().optional()
+  }).passthrough(),
+  z32.object({
+    type: z32.literal("tool_progress"),
+    toolName: z32.string().optional(),
+    elapsedSeconds: z32.number().optional()
+  }).passthrough(),
+  z32.object({
+    type: z32.literal("subagent_started"),
+    sdkTaskId: z32.string().optional(),
+    description: z32.string().optional()
+  }).passthrough(),
+  z32.object({
+    type: z32.literal("subagent_progress"),
+    sdkTaskId: z32.string().optional(),
+    description: z32.string().optional(),
+    toolUses: z32.number().optional(),
+    durationMs: z32.number().optional()
+  }).passthrough(),
+  // ── Work products ─────────────────────────────────────────────────────
+  z32.object({ type: z32.literal("pr_created"), url: z32.string(), number: z32.number() }).passthrough(),
+  z32.object({
+    type: z32.literal("code_review_complete"),
+    result: z32.enum(["approved", "changes_requested"]),
+    summary: z32.string().optional(),
+    issues: z32.array(
+      z32.object({
+        file: z32.string(),
+        line: z32.number().optional(),
+        severity: z32.string().optional(),
+        description: z32.string().optional()
+      }).passthrough()
+    ).optional()
+  }).passthrough(),
+  // ── Environment setup / start command ─────────────────────────────────
+  z32.object({ type: z32.literal("setup_output"), stream: z32.string(), data: z32.string() }).passthrough(),
+  z32.object({
+    type: z32.literal("setup_complete"),
+    startCommandRunning: z32.boolean().optional(),
+    startCommandConfigured: z32.boolean().optional(),
+    // Sanitized server-side by sanitizeSessionPreviewPorts — stays unknown.
+    previewPorts: z32.unknown().optional()
+  }).passthrough(),
+  z32.object({ type: z32.literal("setup_error"), message: z32.string() }).passthrough(),
+  z32.object({ type: z32.literal("start_command_started") }).passthrough(),
+  z32.object({ type: z32.literal("start_command_output"), stream: z32.string(), data: z32.string() }).passthrough(),
+  z32.object({
+    type: z32.literal("start_command_exited"),
+    code: z32.number().nullable().optional(),
+    signal: z32.string().nullable().optional(),
+    message: z32.string().optional()
+  }).passthrough(),
+  z32.object({ type: z32.literal("start_command_error"), message: z32.string() }).passthrough()
+]);
+var AgentEventSchema = z32.union([
+  KnownAgentEventSchema,
+  z32.object({ type: z32.string().min(1) }).catchall(z32.unknown())
+]);
+var cardDescription = z42.string().max(CARD_DESCRIPTION_MAX, CARD_DESCRIPTION_LIMIT_MESSAGE).optional();
+var AgentHeartbeatSchema = z42.object({
+  sessionId: z42.string().optional(),
+  timestamp: z42.string(),
+  status: z42.enum(["active", "idle", "building"]),
+  currentAction: z42.string().optional(),
+  /** Sender-observed main event-loop lag (ms) — see AgentHeartbeat.loopLagMs. */
+  loopLagMs: z42.number().nonnegative().optional()
+});
+var CreatePRInputSchema = z42.object({
+  title: z42.string().min(1),
+  body: z42.string(),
+  head: z42.string().optional(),
+  base: z42.string().optional()
+});
+var PostToChatInputSchema = z42.object({
+  message: z42.string().min(1),
+  type: z42.enum(["message", "question", "update"]).optional().default("message"),
+  milestone: z42.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
+});
+var GetTaskContextRequestSchema = z42.object({
+  sessionId: z42.string(),
+  includeHistory: z42.boolean().optional().default(false),
+  /**
+   * Read the plan-revised marker WITHOUT consuming it. Bookkeeping fetches
+   * (the session-identity check, the branch refresh) pass true so they cannot
+   * race the boot fetch and swallow the notice before it reaches the prompt.
+   * Defaults to false — consuming — so a pod running an older agent build still
+   * clears the marker instead of showing the notice on every boot forever.
+   */
+  peekPlanRevision: z42.boolean().optional().default(false)
+});
+var GetChatMessagesRequestSchema = z42.object({
+  sessionId: z42.string(),
+  limit: z42.number().int().positive().optional().default(50),
+  offset: z42.number().int().nonnegative().optional().default(0),
+  /** Task id or slug to read chat from. Omit for the session's own task. Only
+   * the session's own task or one of its children resolves — anything else is
+   * an error, never a silent fallback to the caller's own chat. */
+  taskId: z42.string().optional()
+});
+var GetTaskFilesRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var GetTaskFileRequestSchema = z42.object({
+  sessionId: z42.string(),
+  fileId: z42.string()
+});
+var GetTaskRequestSchema = z42.object({
+  sessionId: z42.string(),
+  taskSlugOrId: z42.string()
+});
+var GetCliHistoryRequestSchema = z42.object({
+  sessionId: z42.string(),
+  limit: z42.number().int().positive().optional().default(100),
+  source: z42.enum(["agent", "application"]).optional(),
+  /** Task id or slug to read logs from. Omit for the session's own task. Only
+   * the session's own task or one of its children resolves — anything else is
+   * an error, never a silent fallback to the caller's own logs. */
+  taskId: z42.string().optional()
+});
+var ListSubtasksRequestSchema = z42.object({
+  sessionId: z42.string(),
+  /** "compact" returns the slim orchestration view (ListSubtasksCompactResponse)
+   * with the pack build-slot picture; "full" (default — wire-compat with older
+   * agents) returns the verbose SubtaskSummaryDTO[] including description/plan. */
+  view: z42.enum(["compact", "full"]).optional()
+});
+var GetDependenciesRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var GetSuggestionsRequestSchema = z42.object({
+  sessionId: z42.string(),
+  status: z42.string().optional(),
+  limit: z42.number().int().min(1).max(100).optional()
+});
+var ListManualTestsRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var QueryManualTestsRequestSchema = z42.object({
+  sessionId: z42.string(),
+  cardStatuses: z42.array(z42.string()).optional(),
+  testStatuses: z42.array(z42.enum(["open", "approved", "rejected"])).optional()
+});
+var CreatePullRequestRequestSchema = CreatePRInputSchema.extend({ sessionId: z42.string() });
+var RequestFileUploadRequestSchema = z42.object({
+  sessionId: z42.string(),
+  fileName: z42.string().min(1).max(255),
+  mimeType: z42.string().min(1).max(128),
+  fileSize: z42.number().int().positive().max(MAX_FILE_SIZE_BYTES2)
+});
+var ConfirmFileUploadRequestSchema = z42.object({
+  sessionId: z42.string(),
+  fileId: z42.string(),
+  title: z42.string().max(500).optional(),
+  /** Glossary tag names (or ids) this file is an example of. */
+  tags: z42.array(z42.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS2).optional()
+});
+var UpdateTaskStatusRequestSchema = z42.object({
+  sessionId: z42.string(),
+  status: z42.string(),
+  force: z42.boolean().optional().default(false)
+});
+var StoreSessionIdRequestSchema = z42.object({
+  sessionId: z42.string(),
+  sdkSessionId: z42.string()
+});
+var SetManualTestsRequestSchema = z42.object({
+  sessionId: z42.string(),
+  items: z42.array(z42.object({ title: z42.string().min(1) })).min(1)
+});
+var EditManualTestRequestSchema = z42.object({
+  sessionId: z42.string(),
+  title: z42.string().min(1),
+  newTitle: z42.string().min(1)
+});
+var RemoveManualTestRequestSchema = z42.object({
+  sessionId: z42.string(),
+  title: z42.string().min(1)
+});
+var ApproveManualTestRequestSchema = z42.object({
+  sessionId: z42.string(),
+  title: z42.string().min(1)
+});
+var RejectManualTestRequestSchema = z42.object({
+  sessionId: z42.string(),
+  title: z42.string().min(1),
+  reason: z42.string().min(1).max(2e3)
+});
+var SessionStartRequestSchema = z42.object({
+  sessionId: z42.string(),
+  agentVersion: z42.string(),
+  capabilities: z42.array(z42.string())
+});
+var SessionStopRequestSchema = z42.object({
+  sessionId: z42.string(),
+  reason: z42.string().optional()
+});
+var EndReviewSessionRequestSchema = z42.object({
+  sessionId: z42.string(),
+  reason: z42.enum(["approved", "changes_requested", "finished"]).optional()
+});
+var ConnectAgentRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var ReportAgentStatusRequestSchema = z42.object({
+  sessionId: z42.string(),
+  status: z42.string(),
+  /** Why the agent reports this status (e.g. "user_question" while an AskUserQuestion questionnaire is pending in the TUI). */
+  reason: z42.string().optional(),
+  /**
+   * The pending question text, sent only alongside `reason: "user_question"`
+   * so the server can surface it in the user-question notification body (and
+   * thus the Attention feed) instead of a generic string. Optional: older
+   * agents omit it and the server falls back to the generic wording.
+   */
+  questionText: z42.string().optional()
+});
+var NotifyAgentVersionRequestSchema = z42.object({
+  sessionId: z42.string(),
+  agentVersion: z42.string()
+});
+var DiscoveredPortSchema = z42.object({
+  port: z42.number().int().min(1).max(65535),
+  label: z42.string().min(1).max(64).optional(),
+  protocol: z42.enum(["http", "tcp"]).optional(),
+  detectedAt: z42.string()
+});
+var ReportDiscoveredPortsRequestSchema = z42.object({
+  sessionId: z42.string(),
+  ports: z42.array(DiscoveredPortSchema).max(64)
+});
+var ReportBootMilestoneRequestSchema = z42.object({
+  sessionId: z42.string(),
+  key: z42.string().max(64)
+});
+var CreateSubtaskRequestSchema = z42.object({
+  sessionId: z42.string(),
+  title: z42.string().min(1),
+  description: cardDescription,
+  plan: z42.string().optional(),
+  storyPointValue: z42.number().int().positive().optional(),
+  ordinal: z42.number().int().nonnegative().optional(),
+  followParentStatus: z42.boolean().optional(),
+  /** Sibling subtask ids or slugs this subtask blocks on (explicit dependency
+   * metadata — preferred over encoding order in plan text / ordinal). */
+  dependsOn: z42.array(z42.string().min(1)).max(32).optional(),
+  /** Glossary tag names to assign to the child. Unmatched names come back in
+   * the response rather than failing the create. */
+  tags: z42.array(z42.string().min(1)).max(10).optional()
+});
+var UpdateSubtaskRequestSchema = z42.object({
+  sessionId: z42.string(),
+  subtaskId: z42.string(),
+  title: z42.string().min(1).optional(),
+  description: cardDescription,
+  plan: z42.string().optional(),
+  /** Orchestration statuses only ("Planning" | "Open") — the pack parent's
+   * sanctioned promotion path. Execution statuses stay with the build
+   * pipeline / force_update_task_status. Enforced server-side. */
+  status: z42.string().optional(),
+  /** Assign a project agent to the child — accepts the agent's id or exact
+   * name; resolved against the parent task's project server-side. */
+  agentIdOrName: z42.string().min(1).optional(),
+  storyPointValue: z42.number().int().positive().optional(),
+  followParentStatus: z42.boolean().optional(),
+  /** Replace this subtask's dependency edges with these sibling ids/slugs.
+   * Empty array clears all. Omit to leave dependencies unchanged. */
+  dependsOn: z42.array(z42.string().min(1)).max(32).optional()
+});
+var DeleteSubtaskRequestSchema = z42.object({
+  sessionId: z42.string(),
+  subtaskId: z42.string()
+});
+var SetSubtaskParentRequestSchema = z42.object({
+  sessionId: z42.string(),
+  taskId: z42.string().min(1),
+  detach: z42.boolean().optional(),
+  ordinal: z42.number().int().nonnegative().optional(),
+  followParentStatus: z42.boolean().optional()
+});
+var GetTaskPropertiesRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var UpdateTaskFieldsRequestSchema = z42.object({
+  sessionId: z42.string(),
+  plan: z42.string().optional(),
+  description: cardDescription
+});
+var UpdateTaskPropertiesRequestSchema = z42.object({
+  sessionId: z42.string(),
+  title: z42.string().optional(),
+  storyPointValue: z42.number().int().positive().optional(),
+  tagIds: z42.array(z42.string()).optional(),
+  tagNames: z42.array(z42.string()).optional(),
+  githubPRUrl: z42.string().url().optional(),
+  githubBranch: z42.string().optional(),
+  // Canonical risk level, or null to clear — same semantics as the headless
+  // update_task boundary (resolved to the project's Risk row in the handler).
+  risk: riskLevelSchema.nullable().optional()
+});
+var ListIconsRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var GenerateTaskIconRequestSchema = z42.object({
+  sessionId: z42.string(),
+  prompt: z42.string().min(1),
+  aspectRatio: z42.string().optional()
+});
+var SearchFaIconsRequestSchema = z42.object({
+  sessionId: z42.string(),
+  query: z42.string().min(1),
+  first: z42.number().int().positive().optional()
+});
+var PickFaIconRequestSchema = z42.object({
+  sessionId: z42.string(),
+  fontAwesomeId: z42.string().min(1),
+  fontAwesomeStyle: z42.string().optional()
+});
+var CreateFollowUpTaskRequestSchema = z42.object({
+  sessionId: z42.string(),
+  title: z42.string().min(1),
+  description: cardDescription,
+  plan: z42.string().optional(),
+  storyPointValue: z42.number().int().positive().optional()
+});
+var AddDependencyRequestSchema = z42.object({
+  sessionId: z42.string(),
+  dependsOnSlugOrId: z42.string()
+});
+var RemoveDependencyRequestSchema = z42.object({
+  sessionId: z42.string(),
+  dependsOnSlugOrId: z42.string()
+});
+var CreateSuggestionRequestSchema = z42.object({
+  sessionId: z42.string(),
+  title: z42.string().min(1),
+  description: cardDescription,
+  tagNames: z42.array(z42.string()).optional()
+});
+var VoteSuggestionRequestSchema = z42.object({
+  sessionId: z42.string(),
+  suggestionId: z42.string(),
+  value: z42.union([z42.literal(1), z42.literal(-1)])
+});
+var TriggerIdentificationRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var HandoffToImplementerRequestSchema = z42.object({
+  sessionId: z42.string(),
+  // Optional difficulty sizing — sets the task's story points before resolving
+  // the matched implementer agent. Omit to hand off using the task's current
+  // story points (or the project's default task agent when unsized).
+  storyPoints: z42.number().int().positive().optional(),
+  // Optional kickoff note posted to the task chat alongside the handoff notice.
+  message: z42.string().optional()
+});
+var SubmitCodeReviewResultRequestSchema = z42.object({
+  sessionId: z42.string(),
+  approved: z42.boolean(),
+  content: z42.string(),
+  // Canonical risk level the reviewer assigned to this change. Required on every
+  // verdict — the reviewer must judge it. Applied authoritatively server-side
+  // (may raise OR lower an already-set value; the reviewer has that authority).
+  risk: riskLevelSchema,
+  // The commit SHA the reviewer actually reviewed. When present, the verdict is
+  // rejected unless the task is still at this SHA (guards against a late
+  // old-SHA verdict overwriting a newer review cycle).
+  reviewedSha: z42.string().optional()
+});
+var CycleCodingAgentKeyRequestSchema = z42.object({
+  sessionId: z42.string(),
+  rateLimitType: z42.string(),
+  resetsAt: z42.string().optional()
+});
+var StartChildCloudBuildRequestSchema = z42.object({
+  sessionId: z42.string(),
+  childTaskId: z42.string()
+});
+var StopChildBuildRequestSchema = z42.object({
+  sessionId: z42.string(),
+  childTaskId: z42.string()
+});
+var ApproveAndMergePRRequestSchema = z42.object({
+  sessionId: z42.string(),
+  childTaskId: z42.string()
+});
+var PostChildChatMessageRequestSchema = z42.object({
+  sessionId: z42.string(),
+  childTaskId: z42.string(),
+  message: z42.string().min(1)
+});
+var UpdateChildStatusRequestSchema = z42.object({
+  sessionId: z42.string(),
+  childTaskId: z42.string(),
+  status: z42.string()
+});
+var GetAgentStatusRequestSchema = z42.object({
+  taskId: z42.string()
+});
+var GetUiCliHistoryRequestSchema = z42.object({
+  taskId: z42.string()
+});
+var GetActivePtySessionRequestSchema = z42.object({
+  taskId: z42.string()
+});
+var ListActivePtySessionsRequestSchema = z42.object({
+  taskId: z42.string()
+});
+var SendSoftStopRequestSchema = z42.object({
+  taskId: z42.string()
+});
+var StopTaskSessionRequestSchema = z42.object({
+  taskId: z42.string(),
+  sessionId: z42.string()
+});
+var FlushTaskQueueRequestSchema = z42.object({
+  taskId: z42.string(),
+  softStop: z42.boolean().optional()
+});
+var CancelTaskQueuedMessageRequestSchema = z42.object({
+  taskId: z42.string(),
+  messageId: z42.string()
+});
+var FlushSingleQueuedMessageRequestSchema = z42.object({
+  taskId: z42.string(),
+  messageId: z42.string(),
+  softStop: z42.boolean().optional()
+});
+var AnswerAgentQuestionRequestSchema = z42.object({
+  taskId: z42.string(),
+  requestId: z42.string(),
+  answers: z42.record(z42.string(), z42.string())
+});
+var ClearAgentTodosRequestSchema = z42.object({
+  taskId: z42.string()
+});
+var AgentQuestionOptionSchema = z42.object({
+  label: z42.string(),
+  description: z42.string(),
+  preview: z42.string().optional()
+});
+var AgentQuestionSchema = z42.object({
+  question: z42.string(),
+  header: z42.string(),
+  options: z42.array(AgentQuestionOptionSchema),
+  multiSelect: z42.boolean().optional()
+});
+var AskUserQuestionRequestSchema = z42.object({
+  sessionId: z42.string(),
+  question: z42.string().min(1),
+  requestId: z42.string().min(1),
+  questions: z42.array(AgentQuestionSchema).min(1)
+});
+var PostAgentMessageRequestSchema = z42.object({
+  sessionId: z42.string().min(1),
+  content: z42.string(),
+  milestone: z42.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
+});
+var EmitAgentEventRequestSchema = z42.object({
+  sessionId: z42.string(),
+  events: z42.array(AgentEventSchema).max(500)
+});
+var RefreshGithubTokenRequestSchema = z42.object({
+  sessionId: z42.string(),
+  forceFresh: z42.boolean().optional()
+});
+var ReportCredentialFailureRequestSchema = z42.object({
+  sessionId: z42.string(),
+  error: z42.string().max(2e3).optional(),
+  tokenShape: z42.string().max(500).optional(),
+  healed: z42.boolean().optional()
+});
+var ReportReviewSpawnFailureRequestSchema = z42.object({
+  sessionId: z42.string(),
+  reviewSessionId: z42.string(),
+  error: z42.string().max(2e3).optional()
+});
+var ReportBuilderSpawnFailureRequestSchema = ReportReviewSpawnFailureRequestSchema.omit({
+  reviewSessionId: true
+}).extend({ buildSessionId: z42.string() });
+var RequestWorkspaceRecycleRequestSchema = z42.object({
+  sessionId: z42.string(),
+  reason: z42.string().max(2e3)
+});
+var SpawnTaskSessionRequestSchema = z42.object({
+  taskId: z42.string(),
+  kind: z42.enum(["tui", "shell"])
+});
+var StartCodeReviewRequestSchema = z42.object({
+  taskId: z42.string(),
+  force: z42.boolean().optional()
+});
+var StopCodeReviewRequestSchema = z42.object({
+  taskId: z42.string()
+});
+var ReportSessionSpawnFailureRequestSchema = z42.object({
+  sessionId: z42.string(),
+  spawnedSessionId: z42.string(),
+  error: z42.string().max(2e3).optional()
+});
+var RefreshGithubTokenResponseSchema = z42.object({
+  token: z42.string()
+});
+var PTY_FRAME_MAX_CHARS = 256 * 1024;
+var PTY_MAX_DIMENSION = 1e3;
+var PtyOutputRequestSchema = z42.object({
+  sessionId: z42.string(),
+  data: z42.string().max(PTY_FRAME_MAX_CHARS),
+  cols: z42.number().int().positive().max(PTY_MAX_DIMENSION).optional(),
+  rows: z42.number().int().positive().max(PTY_MAX_DIMENSION).optional()
+});
+var PtyEndedRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var PtyInputRequestSchema = z42.object({
+  sessionId: z42.string(),
+  data: z42.string().max(PTY_FRAME_MAX_CHARS)
+});
+var PtyResizeRequestSchema = z42.object({
+  sessionId: z42.string(),
+  cols: z42.number().int().positive().max(PTY_MAX_DIMENSION),
+  rows: z42.number().int().positive().max(PTY_MAX_DIMENSION)
+});
+var PtyAttachRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var ReportPtyStreamRequestSchema = z42.object({
+  sessionId: z42.string(),
+  port: z42.number().int().positive().max(65535).nullable()
+});
+var GetPtyStreamEndpointRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var PtyChatEventPayloadSchema = z42.discriminatedUnion("kind", [
+  z42.object({
+    kind: z42.literal("init"),
+    model: z42.string().max(200),
+    claudeSessionId: z42.string().max(100).optional()
+  }),
+  z42.object({
+    kind: z42.literal("user_text"),
+    text: z42.string().max(16384),
+    // Set by the SERVER (never the agent) when this prompt was injected by
+    // Conveyor rather than typed by a human — the routed message's `source`
+    // (`ci_success`, `review_trigger`, `automated_feedback`, …). The agent
+    // pastes automated messages into the TUI exactly like human prompts, so the
+    // CLI records both as plain transcript `user` records; without this the
+    // builder chat renders "All CI checks passed on your PR." as the human's
+    // own bubble. Absent ⇒ a genuine human prompt.
+    source: z42.string().max(60).optional()
+  }),
+  z42.object({ kind: z42.literal("assistant_text"), text: z42.string().max(16384) }),
+  z42.object({
+    kind: z42.literal("tool_use"),
+    name: z42.string().max(200),
+    // Compact preview: JSON.stringify(input) truncated agent-side. The cap
+    // matches the text events because AskUserQuestion payloads ride this field
+    // and the web lifts them into an interactive card — a tight cap forced
+    // option descriptions down to 80 chars, making them unreadable. Every
+    // other tool keeps a far smaller agent-side budget (`TOOL_INPUT_MAX` in
+    // `chat-record-mapper.ts`), so the ring does not grow for normal calls.
+    input: z42.string().max(16384),
+    // Transcript tool_use block id — lets the client pair the tool_result.
+    id: z42.string().max(100).optional()
+  }),
+  z42.object({
+    kind: z42.literal("tool_result"),
+    // tool_use block id this result answers (absent on malformed records).
+    toolUseId: z42.string().max(100).optional(),
+    // Compact output preview, truncated agent-side.
+    output: z42.string().max(2e3),
+    isError: z42.boolean().optional()
+  }),
+  z42.object({ kind: z42.literal("turn_end") })
+]);
+var PtyChatEventRequestSchema = z42.object({
+  sessionId: z42.string(),
+  event: PtyChatEventPayloadSchema
+});
+var PtyChatAttachRequestSchema = z42.object({
+  sessionId: z42.string()
+});
+var CreatePRResponseSchema = z42.object({
+  prNumber: z42.number().int().positive(),
+  prUrl: z42.string().url(),
+  /** Advisory glossary-upkeep note derived from the PR's changed files matched
+   *  against tag contextPaths — rendered into the tool result, never stored. */
+  glossaryNote: z42.string().optional()
+});
+var PostToChatResponseSchema = z42.object({
+  messageId: z42.string()
+});
+var UpdateTaskStatusResponseSchema = z42.object({
+  taskId: z42.string(),
+  status: z42.string()
+});
+var StoreSessionIdResponseSchema = z42.object({
+  success: z42.boolean()
+});
+var HeartbeatResponseSchema = z42.object({
+  acknowledged: z42.boolean()
+});
+var SessionStartResponseSchema = z42.object({
+  sessionId: z42.string(),
+  startedAt: z42.string()
+});
+var SessionStopResponseSchema = z42.object({
+  sessionId: z42.string(),
+  stoppedAt: z42.string()
+});
+var DeleteSubtaskResponseSchema = z42.object({
+  deleted: z42.boolean()
+});
+var GIT_BRANCH_NAME_MAX = 255;
+var GIT_BRANCH_NAME_MESSAGE = "Invalid git branch name \u2014 use only letters, numbers, '.', '_', '/' and '-', starting with a letter or number, with no '..', '@{' or '//', and no trailing '/', '-', '.' or '.lock'";
+var ALLOWED_REF = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+function isValidGitBranchName(name) {
+  if (typeof name !== "string") return false;
+  if (name.length === 0 || name.length > GIT_BRANCH_NAME_MAX) return false;
+  if (!ALLOWED_REF.test(name)) return false;
+  if (name.includes("..") || name.includes("@{") || name.includes("//")) return false;
+  if (name.endsWith("/") || name.endsWith("-")) return false;
+  if (name.endsWith(".") || name.endsWith(".lock")) return false;
+  return true;
 }
-function formatPayloadSuffix(payloadJson) {
-  if (!payloadJson) return "";
-  let parsed;
-  try {
-    parsed = JSON.parse(payloadJson);
-  } catch {
-    return "";
+var cardDescription2 = z52.string().max(CARD_DESCRIPTION_MAX, CARD_DESCRIPTION_LIMIT_MESSAGE).optional();
+var ListAccessibleProjectsRequestSchema = z52.object({
+  pageSize: z52.number().int().positive().max(100).optional().default(100)
+});
+var ListProjectTasksRequestSchema = z52.object({
+  projectId: z52.string(),
+  status: z52.string().optional(),
+  // Card types to include. Omitted/empty → defaults to ["task"] in the handler
+  // (mirrors searchProjectTasks) so listing doesn't surface incidents/suggestions
+  // unless asked. Enum validation lives at the MCP tool layer.
+  typeFilters: z52.array(z52.string()).optional(),
+  assigneeId: z52.string().optional(),
+  unassigned: z52.boolean().optional(),
+  // Scope to a sub-project board when provided. Unlike the board layer's `?? null`
+  // semantics, agents default to seeing the whole project when omitted.
+  subProjectId: z52.string().nullable().optional(),
+  limit: z52.number().int().positive().optional().default(50)
+}).refine((p) => !(p.unassigned && p.assigneeId), {
+  message: "Pass either assigneeId or unassigned, not both"
+});
+var GetProjectTaskRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string()
+});
+var SearchProjectTasksRequestSchema = z52.object({
+  projectId: z52.string(),
+  // Tag names, matched case-insensitively against the project glossary.
+  tagNames: z52.array(z52.string()).optional(),
+  // How to combine tagNames: "any" (default) = carries at least one,
+  // "all" = carries every one.
+  tagMatch: z52.enum(["any", "all"]).optional(),
+  // Expand each named tag to its descendants in the tag DAG before matching,
+  // so a parent tag sweeps its whole area. Default false.
+  includeChildTags: z52.boolean().optional(),
+  searchQuery: z52.string().optional(),
+  statusFilters: z52.array(z52.string()).optional(),
+  // Card types to include. Omitted/empty → defaults to ["task"] in the handler so
+  // search doesn't surface incidents/suggestions unless asked. Enum validation lives
+  // at the MCP tool layer (mirrors statusFilters).
+  typeFilters: z52.array(z52.string()).optional(),
+  assigneeId: z52.string().optional(),
+  unassigned: z52.boolean().optional(),
+  // Scope to a sub-project board when provided. Unlike the board layer's `?? null`
+  // semantics, agents default to seeing the whole project when omitted.
+  subProjectId: z52.string().nullable().optional(),
+  limit: z52.number().int().positive().optional().default(20)
+}).refine((p) => !(p.unassigned && p.assigneeId), {
+  message: "Pass either assigneeId or unassigned, not both"
+});
+var ListProjectTagsRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var GetProjectTagRequestSchema = z52.object({
+  projectId: z52.string(),
+  /** Tag id or exact (case-insensitive) tag name. */
+  tag: z52.string().min(1).max(100)
+});
+var ListProjectTagAttachmentsRequestSchema = z52.object({
+  projectId: z52.string(),
+  /** Tag id or exact (case-insensitive) tag name. */
+  tag: z52.string().min(1).max(100),
+  limit: z52.number().int().min(1).max(60).optional(),
+  offset: z52.number().int().min(0).optional()
+});
+var SetProjectFileTagsRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  fileId: z52.string(),
+  tags: z52.array(z52.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS2),
+  requestingUserId: z52.string().optional()
+});
+var GetProjectSummaryRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var GetProjectOnboardingStatusRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var GetProjectOnboardingStepRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var GetProjectConnectUrlsRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var conveyorCapabilitySchema = z52.enum([
+  "read",
+  "create",
+  "update",
+  "chat",
+  "files",
+  "build"
+]);
+var GetConnectionContextRequestSchema = z52.object({
+  projectId: z52.string(),
+  // Optional board scope (CONVEYOR_SUBPROJECT_ID). Validated to belong to the
+  // project in the handler; an invalid/foreign id is reported, not silently
+  // dropped, so a mis-scoped connection is never presented as board-specific.
+  subProjectId: z52.string().nullable().optional()
+});
+var VerifyConnectionRequestSchema = z52.object({
+  projectId: z52.string(),
+  subProjectId: z52.string().nullable().optional(),
+  intendedActions: z52.array(conveyorCapabilitySchema).optional()
+});
+var ListAccessibleSubprojectsRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var CreateProjectTaskRequestSchema = z52.object({
+  projectId: z52.string(),
+  title: z52.string().min(1),
+  description: cardDescription2,
+  plan: z52.string().optional(),
+  status: z52.string().optional(),
+  // Assign to a sub-project board. Validated to belong to `projectId` in the handler.
+  subProjectId: z52.string().nullable().optional(),
+  requestingUserId: z52.string().optional()
+});
+var SetProjectTaskParentRequestSchema = z52.object({
+  projectId: z52.string(),
+  /** Card to move — id or slug. */
+  taskId: z52.string().min(1),
+  /** New parent (id or slug), or null to detach. */
+  parentTaskId: z52.string().min(1).nullable(),
+  ordinal: z52.number().int().nonnegative().optional(),
+  followParentStatus: z52.boolean().optional(),
+  requestingUserId: z52.string().optional()
+}).strict();
+var UpdateProjectTaskRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  title: z52.string().optional(),
+  description: cardDescription2,
+  plan: z52.string().optional(),
+  // Enum validation lives at the MCP tool layer (mirrors createProjectTask);
+  // the handler routes through the shared updateStatus core (InProgress
+  // dependency check + cleanup/board/Slack side effects), not the stricter
+  // card-type-validating path the Socket.IO updateTaskStatus mutation uses.
+  status: z52.string().optional(),
+  // Canonical risk level, or null to clear. Resolved to the project's
+  // configured Risk row (by rank) in the handler.
+  risk: riskLevelSchema.nullable().optional(),
+  // Story-point value, or null to clear. Resolved to the project's configured
+  // StoryPoint row in the handler, which rejects an unconfigured value.
+  storyPointValue: z52.number().int().positive().nullable().optional(),
+  assignedUserId: z52.string().nullish(),
+  // Move to a different sub-project board, or null to move to the parent board.
+  // Validated to belong to `projectId` in the handler.
+  subProjectId: z52.string().nullable().optional(),
+  // Record the task's ACTUAL working branch (e.g. a locally-driven pack's
+  // branch, so identification never mints a competing name and pack-child
+  // merge handling matches reality), or null to detach. Guarded in the
+  // handler: the ref must exist on origin and no live workspace may be bound
+  // to a different branch.
+  githubBranch: z52.string().min(1).max(GIT_BRANCH_NAME_MAX).refine(isValidGitBranchName, { message: GIT_BRANCH_NAME_MESSAGE }).nullable().optional(),
+  requestingUserId: z52.string().optional()
+}).strict().refine(
+  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0 || v.githubBranch !== void 0,
+  {
+    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, assignedUserId, subProjectId, or githubBranch)"
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "";
-  const obj = parsed;
-  const rank = (key) => {
-    const i = PAYLOAD_PRIORITY.indexOf(key);
-    return i === -1 ? PAYLOAD_PRIORITY.length : i;
-  };
-  const parts = Object.keys(obj).filter((k) => !PAYLOAD_SKIP_KEYS.has(k) && obj[k] !== void 0 && obj[k] !== null).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b)).map((k) => `${k}=${compactPayloadValue(obj[k])}`);
-  return parts.length > 0 ? ` | ${parts.join(" ")}` : "";
+);
+var TransitionProjectTaskStatusRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  toStatus: z52.string(),
+  expectedFromStatus: z52.string().optional(),
+  // Optional raise-only risk to attempt alongside the transition
+  // (approve → low, request_changes → medium by default).
+  risk: riskLevelSchema.optional(),
+  requestingUserId: z52.string().optional()
+});
+var MoveProjectCardRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  destinationProjectId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var PostToProjectTaskChatRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  content: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var GetProjectTaskCliRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  limit: z52.number().int().positive().optional().default(50),
+  source: z52.string().optional()
+});
+var GetProjectTaskSessionsRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string()
+});
+var QueryProjectGcpLogsRequestSchema = z52.object({
+  projectId: z52.string(),
+  env: z52.enum(["prod", "dev", "claudespace"]).optional(),
+  severity: z52.enum(["DEBUG", "INFO", "NOTICE", "WARNING", "ERROR", "CRITICAL", "ALERT", "EMERGENCY"]).optional(),
+  services: z52.array(z52.string().min(1).max(200)).max(25).optional(),
+  sqlInstances: z52.array(z52.string().min(1).max(200)).max(25).optional(),
+  allServices: z52.boolean().optional(),
+  search: z52.string().max(256).optional(),
+  filter: z52.string().max(1e3).optional(),
+  startTime: z52.string().optional(),
+  endTime: z52.string().optional(),
+  limit: z52.number().int().min(1).max(200).optional().default(50),
+  pageToken: z52.string().max(4096).optional()
+});
+var QueryProjectGrafanaLogsRequestSchema = z52.object({
+  projectId: z52.string(),
+  env: z52.enum(["prod", "dev"]).optional(),
+  services: z52.array(z52.string().min(1).max(200)).max(25).optional(),
+  level: z52.enum(["debug", "info", "warn", "error", "fatal"]).optional(),
+  search: z52.string().max(256).optional(),
+  logql: z52.string().max(2e3).optional(),
+  startTime: z52.string().optional(),
+  endTime: z52.string().optional(),
+  limit: z52.number().int().min(1).max(200).optional().default(50)
+});
+var driveFileNameSchema = z52.string().min(1).max(255).regex(/^[^/\\\r\n]+$/, "File names cannot contain slashes or line breaks");
+var DRIVE_MAX_CONTENT_CHARS = 1e6;
+var ListProjectDriveFilesRequestSchema = z52.object({
+  projectId: z52.string(),
+  folderId: z52.string().max(200).optional(),
+  search: z52.string().max(200).optional(),
+  limit: z52.number().int().min(1).max(200).optional()
+});
+var ReadProjectDriveFileRequestSchema = z52.object({
+  projectId: z52.string(),
+  fileId: z52.string().min(1).max(200)
+});
+var CreateProjectDriveFileRequestSchema = z52.object({
+  projectId: z52.string(),
+  name: driveFileNameSchema,
+  content: z52.string().max(DRIVE_MAX_CONTENT_CHARS),
+  mimeType: z52.string().max(200).optional(),
+  folderId: z52.string().max(200).optional()
+});
+var UpdateProjectDriveFileRequestSchema = z52.object({
+  projectId: z52.string(),
+  fileId: z52.string().min(1).max(200),
+  content: z52.string().max(DRIVE_MAX_CONTENT_CHARS),
+  mimeType: z52.string().max(200).optional()
+});
+var DeleteProjectDriveFileRequestSchema = z52.object({
+  projectId: z52.string(),
+  fileId: z52.string().min(1).max(200)
+});
+var CreateProjectDriveFolderRequestSchema = z52.object({
+  projectId: z52.string(),
+  name: driveFileNameSchema,
+  folderId: z52.string().max(200).optional()
+});
+var StartProjectBuildRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var StopProjectBuildRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var StartProjectWorkspaceRequestSchema = z52.object({
+  projectId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var StopProjectWorkspaceRequestSchema = z52.object({
+  projectId: z52.string(),
+  destroy: z52.boolean().optional(),
+  requestingUserId: z52.string().optional()
+});
+var ListMyLiveSessionsRequestSchema = z52.object({
+  projectId: z52.string(),
+  /** Admin-only: list another member's sessions instead of the caller's. */
+  targetUserId: z52.string().optional()
+});
+var ListProjectSessionGroupsRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var ListMyLiveSessionsAcrossProjectsRequestSchema = z52.object({});
+var GetProjectAvailableTuisRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var StartAdhocSessionRequestSchema = z52.object({
+  projectId: z52.string(),
+  label: z52.string().max(200).optional(),
+  /** Coding-agent key to launch under — validated pick-time (ownership + TUI availability) in the handler. */
+  codingAgentKeyId: z52.string().optional(),
+  /** Model override (Claude model id) — overrides the launch key's own model. */
+  model: z52.string().max(200).optional(),
+  /**
+   * Session role. Constrained: other task-less modes fall through to the pm
+   * runner in the pod entrypoint, and "review" would crash without a task.
+   */
+  mode: z52.enum(["adhoc", "pm"]).optional(),
+  /** Base branch to check out (defaults to the project's dev branch). */
+  branch: z52.string().max(300).optional(),
+  /**
+   * Server-assembled instructions the pod's TUI auto-submits once on first boot
+   * (headless kickoff). Used by the onboarding "Set it up for me" flow to seed a
+   * setup-driver prompt; the session stays watchable/interactive in the Sessions
+   * view. `ensureAdhocWorkspace` persists it and clears it after first submit.
+   */
+  initialPrompt: z52.string().max(2e4).optional(),
+  requestingUserId: z52.string().optional()
+});
+var StopAdhocSessionRequestSchema = z52.object({
+  projectId: z52.string(),
+  workspaceId: z52.string(),
+  destroy: z52.boolean().optional(),
+  requestingUserId: z52.string().optional()
+});
+var ResumeAdhocSessionRequestSchema = z52.object({
+  projectId: z52.string(),
+  workspaceId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var RefreshCodingAgentKeyUsageRequestSchema = z52.object({
+  projectId: z52.string(),
+  keyId: z52.string().optional(),
+  requestingUserId: z52.string().optional()
+});
+var ListKeysToProbeRequestSchema = z52.object({
+  sessionId: z52.string()
+});
+var CreateProjectReleaseRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskIds: z52.array(z52.string()).optional(),
+  requestingUserId: z52.string().optional()
+});
+var AddTasksToProjectReleaseRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskIds: z52.array(z52.string()).min(1),
+  requestingUserId: z52.string().optional()
+});
+var ApproveProjectMergePRRequestSchema = z52.object({
+  projectId: z52.string(),
+  childTaskId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var ListProjectSubtasksRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string()
+});
+var CreateProjectSubtaskRequestSchema = z52.object({
+  projectId: z52.string(),
+  parentTaskId: z52.string(),
+  title: z52.string().min(1),
+  description: cardDescription2,
+  plan: z52.string().optional(),
+  ordinal: z52.number().int().nonnegative().optional(),
+  storyPointValue: z52.number().int().positive().optional(),
+  followParentStatus: z52.boolean().optional(),
+  /** Sibling subtask ids or slugs this subtask blocks on (explicit dependency
+   * metadata — preferred over encoding order in plan text / ordinal). */
+  dependsOn: z52.array(z52.string().min(1)).max(32).optional(),
+  requestingUserId: z52.string().optional()
+});
+var UpdateProjectSubtaskRequestSchema = z52.object({
+  projectId: z52.string(),
+  subtaskId: z52.string(),
+  title: z52.string().optional(),
+  description: cardDescription2,
+  plan: z52.string().optional(),
+  status: z52.string().optional(),
+  ordinal: z52.number().int().nonnegative().optional(),
+  storyPointValue: z52.number().int().positive().optional(),
+  followParentStatus: z52.boolean().optional(),
+  /** Replace-set of sibling subtask ids/slugs this subtask blocks on ([] clears).
+   * Mirrors the in-pod updateSubtask semantics. */
+  dependsOn: z52.array(z52.string().min(1)).max(32).optional(),
+  requestingUserId: z52.string().optional()
+});
+var DeleteProjectSubtaskRequestSchema = z52.object({
+  projectId: z52.string(),
+  subtaskId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var GetProjectTaskChatRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  limit: z52.number().int().positive().optional().default(20)
+});
+var AddProjectTaskDependencyRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  dependsOnSlugOrId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var RemoveProjectTaskDependencyRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  dependsOnSlugOrId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var VoteProjectSuggestionRequestSchema = z52.object({
+  projectId: z52.string(),
+  suggestionId: z52.string(),
+  value: z52.union([z52.literal(1), z52.literal(-1)]),
+  requestingUserId: z52.string().optional()
+});
+var GetProjectTaskDependenciesRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string()
+});
+var ListProjectTaskFilesRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string()
+});
+var GetProjectAttachmentRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  fileId: z52.string(),
+  /** Byte offset into text content (paging large logs/JSON). Default 0. */
+  offset: z52.number().int().nonnegative().optional(),
+  /** Max bytes of text content to return from `offset`. Server default applies. */
+  maxBytes: z52.number().int().positive().optional()
+});
+var RequestProjectFileUploadRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  fileName: z52.string().min(1).max(255),
+  mimeType: z52.string().min(1).max(128),
+  fileSize: z52.number().int().positive().max(MAX_FILE_SIZE_BYTES2),
+  requestingUserId: z52.string().optional()
+});
+var ConfirmProjectFileUploadRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  fileId: z52.string(),
+  /** When set, the attachment is also posted to the task chat with this text. */
+  comment: z52.string().max(2e3).optional(),
+  /** Glossary tag names (or ids) this file is an example of. */
+  tags: z52.array(z52.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS2).optional(),
+  requestingUserId: z52.string().optional()
+});
+var CreateProjectPullRequestRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  title: z52.string().min(1),
+  body: z52.string(),
+  head: z52.string().optional(),
+  base: z52.string().optional(),
+  requestingUserId: z52.string().optional()
+});
+var ListProjectMembersRequestSchema = z52.object({
+  projectId: z52.string()
+});
+var AddProjectTaskReviewerRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  userId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var RemoveProjectTaskReviewerRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  userId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
+var ListProjectManualTestsRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string()
+});
+var QueryProjectManualTestsRequestSchema = z52.object({
+  projectId: z52.string(),
+  cardStatuses: z52.array(z52.string()).optional(),
+  testStatuses: z52.array(z52.enum(["open", "approved", "rejected"])).optional()
+});
+var SetProjectManualTestsRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  items: z52.array(z52.object({ title: z52.string().min(1) })).min(1),
+  requestingUserId: z52.string().optional()
+});
+var EditProjectManualTestRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  title: z52.string().min(1),
+  newTitle: z52.string().min(1),
+  requestingUserId: z52.string().optional()
+});
+var RemoveProjectManualTestRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  title: z52.string().min(1),
+  requestingUserId: z52.string().optional()
+});
+var ApproveProjectManualTestRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  title: z52.string().min(1),
+  requestingUserId: z52.string().optional()
+});
+var RejectProjectManualTestRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  title: z52.string().min(1),
+  reason: z52.string().min(1).max(2e3),
+  requestingUserId: z52.string().optional()
+});
+var CreateProjectSuggestionRequestSchema = z52.object({
+  projectId: z52.string(),
+  title: z52.string().min(1),
+  description: cardDescription2,
+  tagNames: z52.array(z52.string()).optional(),
+  requestingUserId: z52.string().optional()
+});
+var ListProjectChannelsRequestSchema = z62.object({
+  projectId: z62.string()
+});
+var READ_CHANNEL_MESSAGES_MAX_LIMIT = 50;
+var ReadChannelMessagesRequestSchema = z62.object({
+  projectId: z62.string(),
+  channelId: z62.string().min(1).max(200),
+  limit: z62.number().int().min(1).max(READ_CHANNEL_MESSAGES_MAX_LIMIT).optional(),
+  /** Provider-native cursor: return messages OLDER than this one. */
+  before: z62.string().max(100).optional(),
+  /** Provider-native cursor: return messages NEWER than this one. */
+  after: z62.string().max(100).optional(),
+  /**
+   * Read one thread instead of the channel surface. Slack calls this a
+   * `thread_ts`; on Discord it is the thread channel's id. One field for both,
+   * because a caller holding a `threadTs` from a previous read should not have
+   * to know which provider produced it.
+   */
+  threadTs: z62.string().max(100).optional()
+});
+var POST_CHANNEL_MESSAGE_MAX_CHARS = 1800;
+var PostChannelMessageRequestSchema = z62.object({
+  projectId: z62.string(),
+  channelId: z62.string().min(1).max(200),
+  text: z62.string().min(1).max(POST_CHANNEL_MESSAGE_MAX_CHARS),
+  /** Reply inside a thread rather than to the channel. */
+  threadTs: z62.string().max(100).optional()
+});
+var GET_ANALYTICS_SUMMARY_MAX_RANGE_DAYS = 90;
+var GetProjectAnalyticsSummaryRequestSchema = z62.object({
+  projectId: z62.string(),
+  rangeDays: z62.number().int().min(1).max(GET_ANALYTICS_SUMMARY_MAX_RANGE_DAYS).optional(),
+  campaign: z62.string().max(200).optional()
+});
+var SHA_PATTERN = /^[0-9a-f]{40}$/i;
+var ReviewGuideFileReferenceSchema = z72.object({
+  path: z72.string().min(1).max(500),
+  startLine: z72.number().int().positive().max(1e6).optional(),
+  endLine: z72.number().int().positive().max(1e6).optional(),
+  hunkHeader: z72.string().min(1).max(300).optional()
+}).strict().superRefine((value, ctx) => {
+  if (value.endLine !== void 0 && value.startLine === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["startLine"],
+      message: "startLine is required when endLine is set"
+    });
+  }
+  if (value.startLine !== void 0 && value.endLine !== void 0 && value.endLine < value.startLine) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["endLine"],
+      message: "endLine must be greater than or equal to startLine"
+    });
+  }
+});
+var ReviewGuideSectionSchema = z72.object({
+  title: z72.string().min(1).max(160),
+  explanation: z72.string().min(1).max(2e3),
+  classification: z72.enum(["core", "supporting"]).optional(),
+  files: z72.array(ReviewGuideFileReferenceSchema).min(1).max(20)
+}).strict();
+var ReviewGuideContentSchema = z72.object({
+  overview: z72.string().min(1).max(3e3),
+  sections: z72.array(ReviewGuideSectionSchema).min(1).max(12)
+}).strict();
+var PublishReviewGuideRequestSchema = ReviewGuideContentSchema.extend({
+  sessionId: z72.string().min(1),
+  reviewedSha: z72.string().regex(SHA_PATTERN, "reviewedSha must be a 40-character commit SHA")
+}).strict();
+var CONTEXT_LINK_LOCATOR_MAX2 = 300;
+var TAG_DESCRIPTION_MAX = CARD_DESCRIPTION_MAX;
+var TAG_OVERVIEW_MAX = 32e3;
+var TAG_REASON_MAX = 500;
+var ProjectTagContextPathSchema = z82.object({
+  type: z82.enum(["rule", "doc", "file", "folder"]),
+  path: z82.string().min(1).max(500),
+  label: z82.string().max(100).optional(),
+  /** Verified-link tether — text that must keep existing in the file. */
+  locator: z82.string().min(1).max(CONTEXT_LINK_LOCATOR_MAX2).regex(/^[^\r\n]*$/, "Locator cannot contain line breaks").optional(),
+  /** test = must appear in a real test/describe title; code = any substring. */
+  locatorType: z82.enum(["test", "code"]).optional()
+}).refine((link) => link.locator === void 0 === (link.locatorType === void 0), {
+  message: "locator and locatorType must be provided together"
+}).refine((link) => link.locator === void 0 || link.type !== "folder", {
+  message: "folder links cannot carry a locator"
+});
+var hexColor = z82.string().regex(/^#[0-9a-fA-F]{6}$/, "Expected #RRGGBB hex color");
+var overviewPathSchema = z82.string().min(1).max(500).regex(/^[^\r\n]*$/, "Overview path cannot contain line breaks");
+var CreateProjectTagRequestSchema = z82.object({
+  projectId: z82.string(),
+  name: z82.string().min(1).max(50),
+  color: hexColor.optional(),
+  description: z82.string().max(TAG_DESCRIPTION_MAX).optional(),
+  overview: z82.string().max(TAG_OVERVIEW_MAX).optional(),
+  /** Source the overview from this repo file (stored overview stays as the pending fallback). */
+  overviewPath: overviewPathSchema.optional(),
+  contextPaths: z82.array(ProjectTagContextPathSchema).max(20).optional(),
+  /** Parents to link at create time (multi-parent DAG). */
+  parentTagIds: z82.array(z82.string()).max(25).optional(),
+  requestingUserId: z82.string().optional()
+});
+var UpdateProjectTagRequestSchema = z82.object({
+  projectId: z82.string(),
+  tagId: z82.string(),
+  name: z82.string().min(1).max(50).optional(),
+  color: hexColor.optional(),
+  description: z82.string().max(TAG_DESCRIPTION_MAX).optional(),
+  /** Full markdown glossary body; null clears it. Rejected while overviewPath is set. */
+  overview: z82.string().max(TAG_OVERVIEW_MAX).nullable().optional(),
+  /** Repo file to source the overview from; null clears back to the stored overview. */
+  overviewPath: overviewPathSchema.nullable().optional(),
+  /** Full replacement of the tag's context links when provided. */
+  contextPaths: z82.array(ProjectTagContextPathSchema).max(20).optional(),
+  /** Full-set replacement of the tag's parent tags (multi-parent DAG). */
+  parentTagIds: z82.array(z82.string()).max(25).optional(),
+  /** One-line revision provenance, recorded in the tag's history. */
+  reason: z82.string().max(TAG_REASON_MAX).optional(),
+  /** Card the caller was working in — stamped into the revision history. */
+  taskId: z82.string().optional(),
+  requestingUserId: z82.string().optional()
+});
+var PostToProjectChatRequestSchema = z82.object({
+  projectId: z82.string(),
+  content: z82.string().min(1).max(2e4),
+  requestingUserId: z82.string().optional(),
+  /** Marks the post so the server can persist it beyond chat (tag-audit summaries land in tag history). */
+  kind: z82.enum(["tag_audit_summary"]).optional()
+});
+var StartTagAuditRequestSchema = z82.object({
+  projectId: z82.string(),
+  requestingUserId: z82.string().optional()
+});
+var StartTaskAuditRequestSchema = z82.object({
+  projectId: z82.string(),
+  taskIds: z82.array(z82.string()).min(1).max(20),
+  requestingUserId: z82.string().optional()
+});
+var GetActiveAuditSessionsRequestSchema = z82.object({
+  projectId: z82.string()
+});
+var ReportTaskAuditResultRequestSchema = z82.object({
+  projectId: z82.string(),
+  taskId: z82.string(),
+  summary: z82.string(),
+  turnGrades: z82.array(
+    z82.object({
+      turnIndex: z82.number(),
+      phase: z82.enum(["planning", "building", "human"]),
+      grade: z82.enum(["correct", "neutral", "blunder"]),
+      reasoning: z82.string(),
+      eventType: z82.string(),
+      eventSummary: z82.string()
+    })
+  ),
+  planningAccuracy: z82.number().nullable(),
+  buildingAccuracy: z82.number().nullable(),
+  humanAccuracy: z82.number().nullable(),
+  planningCorrect: z82.number(),
+  planningNeutral: z82.number(),
+  planningBlunder: z82.number(),
+  buildingCorrect: z82.number(),
+  buildingNeutral: z82.number(),
+  buildingBlunder: z82.number(),
+  humanCorrect: z82.number(),
+  humanNeutral: z82.number(),
+  humanBlunder: z82.number(),
+  humanEvaluations: z82.array(
+    z82.object({
+      messageIndex: z82.number(),
+      rating: z82.union([z82.literal(-1), z82.literal(0), z82.literal(1)]),
+      reasoning: z82.string()
+    })
+  ).optional(),
+  suggestionIds: z82.array(z82.string()),
+  auditCostUsd: z82.number().nullable(),
+  model: z82.string().nullable(),
+  /** When set, the audit is marked failed with this message instead. */
+  error: z82.string().optional()
+});
+var GetTaskAuditsRequestSchema = z82.object({
+  projectId: z82.string(),
+  limit: z82.number().int().positive().max(200).optional().default(50)
+});
+var GetTaskAuditRequestSchema = z82.object({
+  projectId: z82.string(),
+  auditId: z82.string()
+});
+var GetTaskAuditAggregatesRequestSchema = z82.object({
+  projectId: z82.string()
+});
+var DeleteTaskAuditRequestSchema = z82.object({
+  projectId: z82.string(),
+  auditId: z82.string(),
+  requestingUserId: z82.string().optional()
+});
+var MarkInitialPromptSubmittedRequestSchema = z82.object({
+  sessionId: z82.string()
+});
+var MEETING_TRANSCRIPT_MAX_CHARS = 2e6;
+var MEETING_TITLE_MAX = 200;
+var CreateMeetingFromTranscriptRequestSchema = z92.object({
+  projectId: z92.string().cuid(),
+  rawText: z92.string().min(1).max(MEETING_TRANSCRIPT_MAX_CHARS),
+  title: z92.string().min(1).max(MEETING_TITLE_MAX).optional(),
+  /** ISO 8601. Defaults to now when the source carries no date. */
+  occurredAt: z92.string().datetime().optional(),
+  /** Override auto-detection. Rarely needed; detection handles the three formats. */
+  format: z92.enum(["text", "vtt", "srt"]).optional(),
+  source: z92.enum(["manual", "slack"]).optional()
+});
+var GetMeetingRequestSchema = z92.object({
+  projectId: z92.string().cuid(),
+  meetingId: z92.string().cuid()
+});
+var UpdateMeetingRequestSchema = z92.object({
+  projectId: z92.string().cuid(),
+  meetingId: z92.string().cuid(),
+  title: z92.string().min(1).max(MEETING_TITLE_MAX).optional(),
+  occurredAt: z92.string().datetime().optional()
+});
+var RegenerateMeetingSummaryRequestSchema = z92.object({
+  projectId: z92.string().cuid(),
+  meetingId: z92.string().cuid()
+});
+var DeleteMeetingRequestSchema = z92.object({
+  projectId: z92.string().cuid(),
+  meetingId: z92.string().cuid()
+});
+var ListMeetingsRequestSchema = z92.object({
+  projectId: z92.string().cuid(),
+  limit: z92.number().int().min(1).max(50).optional(),
+  search: z92.string().max(200).optional()
+});
+var ReadMeetingTranscriptRequestSchema = z92.object({
+  projectId: z92.string().cuid(),
+  meetingId: z92.string().cuid(),
+  offset: z92.number().int().min(0).optional(),
+  limit: z92.number().int().min(1).max(500).optional()
+});
+var TASK_CHAT_HISTORY_LIMIT = 20;
+var PM_CHAT_HISTORY_LIMIT = 40;
+var AGENT_CHAT_HISTORY_FETCH_LIMIT = Math.max(TASK_CHAT_HISTORY_LIMIT, PM_CHAT_HISTORY_LIMIT) + 10;
+function formatModelId(provider, model) {
+  return `${provider}/${model}`;
 }
-function formatLogEntryLine(entry) {
-  const httpPrefix = entry.httpRequest?.status ? `http ${entry.httpRequest.status} ${entry.httpRequest.method ?? ""} ${entry.httpRequest.url ?? ""}`.trim() + " \u2014 " : "";
-  return `${entry.timestamp} ${entry.severity.padEnd(7)} [${entrySource(entry)}] ${truncateLine(
-    `${httpPrefix}${entry.message}${formatPayloadSuffix(entry.payload)}`
-  )}`;
+function anthropicEntry(model, label, inputPerMillion, outputPerMillion, opts = {}) {
+  return {
+    provider: "anthropic",
+    model,
+    id: formatModelId("anthropic", model),
+    label,
+    format: "anthropic-messages",
+    inputPrice: inputPerMillion / 1e6,
+    outputPrice: outputPerMillion / 1e6,
+    supportsTools: true,
+    supportsEffort: opts.supportsEffort ?? true,
+    ...opts.experimental ? { experimental: true } : {}
+  };
 }
-async function runQueryGcpLogs(conn2, params, now = Date.now) {
-  const startTime = params.startTime ?? new Date(now() - (params.sinceMinutes ?? DEFAULT_SINCE_MINUTES) * 6e4).toISOString();
-  const result = await conn2.queryGcpLogs({
-    projectId: params.projectId,
-    env: params.env,
-    severity: params.severity,
-    services: params.services,
-    sqlInstances: params.sqlInstances,
-    allServices: params.allServices,
-    search: params.search,
-    filter: params.filter,
-    startTime,
-    endTime: params.endTime,
-    limit: params.limit,
-    pageToken: params.pageToken
-  });
-  if (result.error) return result.error;
-  const header = [
-    `env=${params.env ?? "prod"}`,
-    `window=${startTime}\u2192${params.endTime ?? "now"}`,
-    ...params.severity ? [`minSeverity=${params.severity}`] : [],
-    `scope=${result.scopedServices ? `[${result.scopedServices.join(", ")}]` : "all"}`,
-    `entries=${result.entries.length}`
-  ].join(" ");
-  const lines = result.entries.map(formatLogEntryLine);
-  const footer = result.nextPageToken ? [`-- more available: pass pageToken="${result.nextPageToken}" to continue`] : [];
-  if (lines.length === 0) {
-    return [
-      header,
-      "(no matching log entries \u2014 widen the window, lower minSeverity, or drop filters)"
-    ].join("\n");
+var ANTHROPIC_CATALOG = [
+  anthropicEntry(DEFAULT_OPUS_MODEL, "Opus 5 Latest", 5, 25),
+  anthropicEntry(PREVIOUS_OPUS_MODEL, "Opus 4.8", 5, 25),
+  anthropicEntry(DEFAULT_SONNET_MODEL, "Sonnet 5 Latest", 3, 15),
+  anthropicEntry(PREVIOUS_SONNET_MODEL, "Sonnet 4.6", 3, 15),
+  // The Haiku line (4.5 and older) predates the tuning surface and 400s on it.
+  anthropicEntry(DEFAULT_HAIKU_MODEL, "Haiku 4.5", 1, 5, { supportsEffort: false }),
+  anthropicEntry(FABLE_MODEL, "Fable 5 (experimental)", 10, 50, { experimental: true })
+];
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+var POSTGRES_ENV = {
+  POSTGRES_HOST_AUTH_METHOD: "trust",
+  POSTGRES_DB: "conveyor"
+};
+var FIREBASE_EMULATOR_COMMAND = [
+  "sh",
+  "-c",
+  `set -e; mkdir -p /home/node && cd /home/node && cat > firebase.json <<'EOF'
+{"emulators":{"auth":{"host":"0.0.0.0","port":9099},"hub":{"host":"0.0.0.0","port":4400},"ui":{"enabled":false}}}
+EOF
+exec firebase emulators:start --only=auth --project=rally-cry-dev`
+];
+var FIREBASE_EMULATOR_ENV = {
+  METADATA_SERVER_DETECTION: "none",
+  GOOGLE_APPLICATION_CREDENTIALS: "/dev/null"
+};
+var CATALOG = {
+  postgresql: {
+    name: "postgresql",
+    image: "postgres:16-alpine",
+    command: [
+      "sh",
+      "-c",
+      // Start postgres, wait for readiness, then create the test database.
+      // Durability flags: service state is ephemeral by design (overlayfs, no
+      // PVC; a crash re-seeds from pod-data), so commits must never wait on a
+      // WAL flush. fsync=off + synchronous_commit=off + full_page_writes=off
+      // remove all blocking storage I/O — without them, per-commit flushes on
+      // the node's network boot disk dominated int-test wall time (~100ms/commit).
+      "if [ ! -s /var/lib/postgresql/data/PG_VERSION ] && [ -d /var/lib/postgresql/pod-data ]; then cp -a /var/lib/postgresql/pod-data/. /var/lib/postgresql/data/; fi; chown -R postgres:postgres /var/lib/postgresql/data; docker-entrypoint.sh postgres -c fsync=off -c synchronous_commit=off -c full_page_writes=off & PID=$!; for i in $(seq 1 30); do pg_isready -U postgres && break; sleep 1; done; createdb -U postgres conveyor_test 2>/dev/null || true; wait $PID"
+    ],
+    ports: [5432],
+    livenessProbe: {
+      exec: ["pg_isready", "-U", "postgres"],
+      periodSeconds: 30,
+      failureThreshold: 3,
+      timeoutSeconds: 5,
+      initialDelaySeconds: 60
+    },
+    env: { ...POSTGRES_ENV },
+    resources: {
+      // postgres runs from the baked seed at /var/lib/postgresql/pod-data via
+      // overlayfs CoW (no emptyDir — see k8s-pod-spec.ts), so WAL + catalog +
+      // re-seed churn charges the container's ephemeral-storage. It must exceed
+      // the ~1Gi ceiling where pods evicted, but is bounded by TWO Autopilot rules:
+      //   1) limit == request — Autopilot caps the limit DOWN to the request at
+      //      admission, so headroom must live on the REQUEST, not just the limit;
+      //   2) the SUM of all container ephemeral requests in a pod must be ≤ 10Gi
+      //      (an emptyDir doesn't escape this: its usage still evicts against the
+      //      container limit, and raising the limit re-hits rule 1 → the cap).
+      // The agent is trimmed to 4Gi (resource-tiers.ts) to free room: with
+      // agent 4 + gcsfuse 1 + lgtm 1 + es/redis/firebase 0.75, postgres gets 3Gi
+      // and the heaviest (URC) pod sits at 9.75Gi + 10Mi for GCS Fuse metadata
+      // prefetch — under the 10Gi cap — while giving postgres 3x the ~1Gi
+      // ceiling that evicted. Keep request == limit;
+      // see the per-pod ephemeral budget guard test.
+      // CPU: the request is the CFS floor; the old 50m starved postgres to 5ms
+      // of CPU per 100ms period — every query burst hit throttle stalls, which
+      // showed up as ~100ms floors on trivial statements and dominated the API
+      // int suite even after the fsync flags above. 500m is paid for out of the
+      // agent's derived share (resource-tiers.ts). The limit bursts to 2 for
+      // spiky work — the first-boot pod-data seed copy and int-suite query
+      // storms — borrowing idle node CPU without moving the request.
+      requests: { cpuMillicores: 500, memoryMi: 512, ephemeralMi: 3 * 1024 },
+      limits: { cpuMillicores: 2e3, memoryMi: 512, ephemeralMi: 3 * 1024 }
+    },
+    connectionEnv: {
+      DATABASE_URL: "postgresql://postgres@postgresql:5432/conveyor",
+      TEST_DATABASE_URL: "postgresql://postgres@postgresql:5432/conveyor_test"
+    },
+    statefulBake: true,
+    bake: {
+      // Start postgres, wait for readiness, then create the test database so
+      // it's baked into the committed image. No pod-data restore (nothing is
+      // seeded yet) and no durability flags (the bake's writes must land).
+      // NOTE: docker-compose interpolates `$VAR`/`$(...)`, so every `$` that
+      // must reach the shell is doubled.
+      command: [
+        "sh",
+        "-c",
+        "docker-entrypoint.sh postgres & PID=$$!; for i in $$(seq 1 30); do pg_isready -U postgres && break; sleep 1; done; createdb -U postgres conveyor_test 2>/dev/null || true; wait $$PID"
+      ],
+      environment: { ...POSTGRES_ENV },
+      healthcheck: {
+        test: ["CMD-SHELL", "pg_isready -U postgres"],
+        intervalSec: 2,
+        timeoutSec: 5,
+        retries: 15
+      }
+    }
+  },
+  redis: {
+    name: "redis",
+    image: "redis:7-alpine",
+    command: ["redis-server", "--appendonly", "yes", "--dir", "/data"],
+    ports: [6379],
+    env: {},
+    resources: {
+      requests: { cpuMillicores: 25, memoryMi: 32, ephemeralMi: 256 },
+      limits: { cpuMillicores: 50, memoryMi: 64, ephemeralMi: 256 }
+    },
+    connectionEnv: {
+      REDIS_URL: "redis://redis:6379",
+      AUTH_REDIS_URL: "redis://redis:6379"
+    },
+    statefulBake: false,
+    // Redis holds no baked state, so the bake runs the stock image CMD.
+    bake: {},
+    mirror: { src: "redis:7-alpine", dest: "mirror-redis:7-alpine" }
+  },
+  elasticsearch: {
+    name: "elasticsearch",
+    // 9.4.0 matches universal-rally-cry's local compose + its v9 ES client —
+    // the v9 client sends Accept: compatible-with=9, which an 8.x server
+    // rejects (media_type_header_exception), breaking search/audit indexing
+    // in pods. 512m heap matches the project compose sizing.
+    image: "docker.elastic.co/elasticsearch/elasticsearch:9.4.0",
+    ports: [9200],
+    // Baked service images are `docker commit`s of a recently-running ES, so
+    // they carry a stale data-dir node.lock; ES 9 hard-fails on it at boot
+    // ("Underlying file changed by an external force" → AlreadyClosedException).
+    // Clear it before handing off to the stock entrypoint.
+    command: [
+      "sh",
+      "-c",
+      // ALL Lucene lock files, not just node.lock — the baked image also
+      // carries per-index write.lock + snapshot_cache/write.lock, and ES 9
+      // fail-fasts on any of them ("changed by an external force").
+      "find /usr/share/elasticsearch/data -name '*.lock' -type f -delete 2>/dev/null; exec /usr/local/bin/docker-entrypoint.sh eswrapper"
+    ],
+    env: {
+      "discovery.type": "single-node",
+      "xpack.security.enabled": "false",
+      "xpack.ml.enabled": "false",
+      "xpack.watcher.enabled": "false",
+      "xpack.profiling.enabled": "false",
+      "ingest.geoip.downloader.enabled": "false",
+      ES_JAVA_OPTS: "-Xms512m -Xmx512m"
+    },
+    resources: {
+      // CPU limit 4x the request: ES cold-start is a CPU-bound JVM boot
+      // (class loading + JIT + recovery of the docker-commit'ed data dir),
+      // and the 500m hard cap put it at ~135s to yellow — past the sidecar
+      // wait script's original 90s budget. Bursting to 2 cut it to ~40s on
+      // the real cluster (A/B on identical nodes, 2 rounds). The burst only
+      // borrows idle node CPU at boot; under contention CFS still floors ES
+      // at its 500m request.
+      requests: { cpuMillicores: 500, memoryMi: 1024, ephemeralMi: 256 },
+      limits: { cpuMillicores: 2e3, memoryMi: 1024, ephemeralMi: 256 }
+    },
+    connectionEnv: {
+      ELASTICSEARCH_URL: "http://elasticsearch:9200"
+    },
+    statefulBake: true,
+    bake: {
+      // No lock-clearing command at bake time: the bake starts from the stock
+      // image, which has no committed data dir to unlock yet.
+      environment: {
+        "discovery.type": "single-node",
+        "xpack.security.enabled": "false",
+        ES_JAVA_OPTS: "-Xms512m -Xmx512m"
+      }
+    }
+  },
+  // All-in-one image bundling Grafana + Loki + Tempo + Mimir + an OTEL Collector.
+  // Pinned tag (not :latest) so the image-builder content hash stays
+  // deterministic across upstream releases — see image-builder.ts content-hash
+  // dedup keyed on `deps.sorted()`.
+  lgtm: {
+    name: "lgtm",
+    image: "grafana/otel-lgtm:0.11.6",
+    // The otel-lgtm image's own CMD is ["/otel-lgtm/run-all.sh"] (WORKDIR
+    // /otel-lgtm). Declaring it explicitly makes lgtm a command-based service so
+    // the lazy start-file gate wraps it like the others — otherwise it launches
+    // via image CMD at boot and can't be parked (which is why warm-booting it at
+    // a minimal request OOMKilled it). getSidecarSpecs strips this command for a
+    // baked lgtm image, so it only applies to the stock image whose launcher is
+    // exactly this path.
+    command: ["/otel-lgtm/run-all.sh"],
+    ports: [
+      // OTLP gRPC + HTTP — agents and user code emit telemetry here.
+      4317,
+      4318,
+      // Grafana UI — reachable through the existing preview proxy on
+      // https://3000-{sessionId}.preview.<PREVIEW_DOMAIN>/.
+      3e3
+    ],
+    env: {
+      // The pod is per-task; the preview proxy authenticates the session
+      // upstream, so anonymous in-pod admin is acceptable here.
+      GF_AUTH_ANONYMOUS_ENABLED: "true",
+      GF_AUTH_ANONYMOUS_ORG_ROLE: "Admin",
+      GF_SECURITY_ALLOW_EMBEDDING: "true",
+      ENABLE_LOGS_GRAFANA: "true",
+      ENABLE_LOGS_OTELCOL: "true"
+    },
+    resources: {
+      // Autopilot caps the ephemeral-storage limit to the request (see the
+      // postgresql note), so the 1Gi headroom must be on the request too.
+      requests: { cpuMillicores: 250, memoryMi: 1024, ephemeralMi: 1024 },
+      limits: { cpuMillicores: 1e3, memoryMi: 2048, ephemeralMi: 1024 }
+    },
+    statefulBake: false,
+    // No `bake` block: a BAKE produces traces nobody reads, so starting the
+    // (heavy) collector image would only add a pull + boot to every build.
+    // lgtm still runs for live pods, and is never committed regardless.
+    mirror: { src: "grafana/otel-lgtm:0.11.6", dest: "mirror-otel-lgtm:0.11.6" }
+  },
+  "firebase-auth-emulator": {
+    name: "firebase-auth-emulator",
+    image: "andreysenov/firebase-tools:latest",
+    command: FIREBASE_EMULATOR_COMMAND,
+    ports: [9099, 4400],
+    env: {
+      // The emulator container inherits the pod's Workload Identity, so
+      // firebase-tools finds GCP credentials and its `emulators:start` does an
+      // online "auto auth" + project validation that stalls ~47s on the pod's
+      // locked-down egress (the dominant service boot cost — measured live).
+      // The emulator needs NO real credentials, so cut off credential discovery
+      // for this container only: google-auth-library skips metadata detection
+      // and finds no key file, firebase-tools logs "not authenticated" and
+      // starts the emulator immediately. The agent container keeps its WI.
+      ...FIREBASE_EMULATOR_ENV
+    },
+    resources: {
+      requests: { cpuMillicores: 100, memoryMi: 256, ephemeralMi: 256 },
+      limits: { cpuMillicores: 500, memoryMi: 512, ephemeralMi: 256 }
+    },
+    connectionEnv: {
+      // In docker-compose, services reach each other by service name — the
+      // runtime pod equivalents use `localhost` because co-located services
+      // share the pod's network namespace.
+      FIREBASE_AUTH_EMULATOR_HOST: "firebase-auth-emulator:9099",
+      NEXT_PUBLIC_FIREBASE_AUTH_EMULATOR_HOST: "firebase-auth-emulator:9099"
+    },
+    statefulBake: false,
+    mirror: {
+      src: "andreysenov/firebase-tools:latest",
+      dest: "mirror-firebase-tools:latest"
+    },
+    bake: {
+      // The emulator writes its config at startup, so the bake needs the same
+      // inline command the runtime uses.
+      command: FIREBASE_EMULATOR_COMMAND,
+      environment: FIREBASE_EMULATOR_ENV,
+      healthcheck: {
+        // Probe with node, the one runtime this image guarantees. The image
+        // (`andreysenov/firebase-tools`) is a slim Node image that ships
+        // NEITHER `wget` NOR `curl`, so the `wget -qO- …` probe this replaced
+        // exited 127 on every attempt: a healthy emulator burned all 20 retries
+        // and every bake reported it unhealthy. See the catalog invariant in
+        // `service-definitions.test.ts`, which also executes this probe.
+        test: [
+          "CMD-SHELL",
+          `node -e "fetch('http://localhost:9099/').then((response) => process.exit(response.ok ? 0 : 1)).catch(() => process.exit(1))"`
+        ],
+        intervalSec: 3,
+        timeoutSec: 5,
+        retries: 20
+      }
+    }
   }
-  return [header, ...lines, ...footer].join("\n");
-}
-async function runQueryGrafanaLogs(conn2, params, now = Date.now) {
-  const startTime = params.startTime ?? new Date(now() - (params.sinceMinutes ?? DEFAULT_SINCE_MINUTES) * 6e4).toISOString();
-  const result = await conn2.queryGrafanaLogs({
-    projectId: params.projectId,
-    env: params.env,
-    level: params.level,
-    services: params.services,
-    search: params.search,
-    logql: params.logql,
-    startTime,
-    endTime: params.endTime,
-    limit: params.limit
+};
+var SERVICE_DEFINITIONS = CATALOG;
+var SUPPORTED_CLAUDESPACE_DEPS = Object.keys(CATALOG);
+var STATEFUL_BAKE_DEPS = new Set(
+  SUPPORTED_CLAUDESPACE_DEPS.filter((dep) => SERVICE_DEFINITIONS[dep].statefulBake)
+);
+var MIRRORABLE_SIDECARS = Object.fromEntries(
+  SUPPORTED_CLAUDESPACE_DEPS.flatMap((dep) => {
+    const mirror = SERVICE_DEFINITIONS[dep].mirror;
+    return mirror ? [[dep, mirror]] : [];
+  })
+);
+var LEVELS_PER_BAND = 100;
+var PRESTIGE_TIERS = ACHIEVEMENT_RARITIES.map((rarity, index) => ({
+  prestige: index + 1,
+  name: rarity.name,
+  color: rarity.color,
+  iconPath: rarity.iconPath,
+  minLevel: (index + 1) * LEVELS_PER_BAND
+}));
+var TOP_PRESTIGE_BAND = PRESTIGE_TIERS.length;
+var CARD_TYPE_SURFACE = {
+  task: "board",
+  chat: "board",
+  incident: "report",
+  suggestion: "report"
+};
+var surfaceTypes = (surface) => Object.keys(CARD_TYPE_SURFACE).filter(
+  (type) => CARD_TYPE_SURFACE[type] === surface
+);
+var BOARD_CARD_TYPES = surfaceTypes("board");
+var REPORT_CARD_TYPES = surfaceTypes("report");
+
+// src/tools/logs.ts
+function registerLogTools(server2, conn2) {
+  registerContractTool(server2, queryGcpLogsContract, async (params) => {
+    const text = await runQueryGcpLogs(conn2, params);
+    return { content: [{ type: "text", text }] };
+  });
+  registerContractTool(server2, queryGrafanaLogsContract, async (params) => {
+    const text = await runQueryGrafanaLogs(conn2, params);
+    return { content: [{ type: "text", text }] };
   });
-  if (result.error) return result.error;
-  const header = [
-    `env=${params.env ?? "prod"}`,
-    `window=${startTime}\u2192${params.endTime ?? "now"}`,
-    ...params.level ? [`minLevel=${params.level}`] : [],
-    ...result.logql ? [`logql=${truncateLine(result.logql)}`] : [],
-    `entries=${result.entries.length}`
-  ].join(" ");
-  const lines = result.entries.map(formatLogEntryLine);
-  const oldest = result.entries.map((e) => e.timestamp).sort()[0];
-  const footer = result.hasMore ? [`-- hit the limit: older lines exist \u2014 pass endTime="${oldest}" to page further back`] : [];
-  if (lines.length === 0) {
-    return [
-      header,
-      "(no matching log entries \u2014 widen the window, lower minLevel, or drop filters)"
-    ].join("\n");
-  }
-  return [header, ...lines, ...footer].join("\n");
 }
-function registerGrafanaLogTool(server2, conn2) {
-  server2.tool(
-    "query_grafana_logs",
-    "Query the project's connected Grafana (Loki) logs \u2014 the application logs shipped to Grafana Cloud/Loki, complementing query_gcp_logs (GCP infrastructure logs). Start with structured filters (env, level=error, sinceMinutes=60, services), then narrow with search; pass raw LogQL via logql only when structured filters can't express the query (it REPLACES them). The response header echoes the composed LogQL \u2014 iterate on it. Returns compact lines: '<time> <SEVERITY> [<service>] <message>'.",
-    {
-      projectId: z9.string().optional().describe("Target Conveyor project ID"),
-      env: z9.enum(["prod", "dev"]).optional().describe("Configured Grafana env mapping to scope by (default prod)"),
-      sinceMinutes: z9.number().int().min(1).max(10080).optional().describe(
-        "Relative time window ending now, in minutes (default 60). Ignored if startTime is set."
-      ),
-      startTime: z9.string().optional().describe("ISO 8601 lower bound (overrides sinceMinutes)"),
-      endTime: z9.string().optional().describe("ISO 8601 upper bound (default now)"),
-      level: z9.enum(["debug", "info", "warn", "error", "fatal"]).optional().describe("Minimum severity, inclusive \u2014 error returns error and above"),
-      services: z9.array(z9.string()).optional().describe("Restrict to these service_name label values"),
-      search: z9.string().max(256).optional().describe("Substring line filter (exact substring, not regex)"),
-      logql: z9.string().max(2e3).optional().describe("Advanced: raw LogQL query \u2014 REPLACES env/services/level/search composition"),
-      limit: z9.number().int().min(1).max(200).optional().describe("Max entries (default 50)")
-    },
-    async (params) => {
-      const text = await runQueryGrafanaLogs(conn2, params);
-      return { content: [{ type: "text", text }] };
+
+// src/tools/integrations.ts
+function registerIntegrationTools(server2, conn2) {
+  registerContractTool(server2, listProjectIntegrationsContract, async (params) => {
+    const result = await conn2.listProjectIntegrations(params.projectId);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  registerContractTool(server2, listProjectChannelsContract, async (params) => {
+    const channels = await conn2.listProjectChannels(params.projectId);
+    if (channels.length === 0) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "No work channels are registered for this project. An admin registers them in project settings; until then no channel is reachable, whatever the bot can see in the workspace."
+          }
+        ]
+      };
     }
-  );
+    return { content: [{ type: "text", text: JSON.stringify(channels, null, 2) }] };
+  });
+  registerContractTool(server2, readChannelMessagesContract, async (params) => {
+    const result = await conn2.readChannelMessages(params);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  registerContractTool(server2, getAnalyticsSummaryContract, async (params) => {
+    const res = await conn2.getProjectAnalyticsSummary(params);
+    if (!res.configured) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: res.message ?? "Google Analytics is not configured for this project."
+          }
+        ]
+      };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(res, null, 2) }] };
+  });
+  registerContractTool(server2, postChannelMessageContract, async (params) => {
+    const result = await conn2.postChannelMessage(params);
+    return {
+      content: [
+        { type: "text", text: `Posted to ${result.channelId} (message ${result.messageId}).` }
+      ]
+    };
+  });
 }
-function registerLogTools(server2, conn2) {
-  server2.tool(
-    "query_gcp_logs",
-    "Query Google Cloud Logging for a project's linked GCP environments \u2014 use this to investigate production or dev issues directly ('something broke on prod'). Envs: 'prod' and 'dev' are the project's Cloud Run apps + Cloud SQL databases (scoped by default to the resources linked in project settings); 'claudespace' is the project's GKE agent-pod namespace. Start broad (severity=ERROR, sinceMinutes=60), then narrow with services/search. Returns compact lines: '<time> <SEVERITY> [<source>] <message> | key=value \u2026' (the key=value tail is the entry's structured payload \u2014 error details, service/method, actor and entity ids). When the response ends with a pageToken line, pass that token back as pageToken for the next page. Pass projectId to target a specific project; otherwise the configured default project is used.",
-    {
-      projectId: z9.string().optional().describe("Target Conveyor project ID"),
-      env: z9.enum(["prod", "dev", "claudespace"]).optional().describe("GCP environment slot to query (default prod)"),
-      sinceMinutes: z9.number().int().min(1).max(10080).optional().describe(
-        "Relative time window ending now, in minutes (default 60). Ignored if startTime is set."
-      ),
-      startTime: z9.string().optional().describe("ISO 8601 lower bound (overrides sinceMinutes)"),
-      endTime: z9.string().optional().describe("ISO 8601 upper bound (default now)"),
-      severity: z9.enum(SEVERITY_ENUM).optional().describe("Minimum severity, inclusive \u2014 ERROR returns ERROR and above"),
-      services: z9.array(z9.string()).optional().describe(
-        "Restrict to these Cloud Run service names (prod/dev only). Defaults to all services linked in project settings."
-      ),
-      sqlInstances: z9.array(z9.string()).optional().describe("Restrict to these Cloud SQL instance names (prod/dev only)"),
-      allServices: z9.boolean().optional().describe(
-        "Set true to search ALL logs in the GCP project, ignoring the linked-resource scope"
-      ),
-      search: z9.string().max(256).optional().describe("Free-text search across all log fields (exact substring, not regex)"),
-      filter: z9.string().max(1e3).optional().describe("Advanced: raw Cloud Logging filter expression, ANDed with the scope"),
-      limit: z9.number().int().min(1).max(200).optional().describe("Max entries per page (default 50)"),
-      pageToken: z9.string().optional().describe("Opaque token from a previous response to fetch the next page")
-    },
-    async (params) => {
-      const text = await runQueryGcpLogs(conn2, params);
-      return { content: [{ type: "text", text }] };
+
+// src/tools/drive.ts
+var MAX_READ_CHARS = 1e5;
+function registerDriveTools(server2, conn2) {
+  registerContractTool(server2, driveListFilesContract, async (params) => {
+    const result = await conn2.listProjectDriveFiles(params);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  registerContractTool(server2, driveReadFileContract, async (params) => {
+    const result = await conn2.readProjectDriveFile(params);
+    const overCap = result.content.length > MAX_READ_CHARS;
+    const content = overCap ? result.content.slice(0, MAX_READ_CHARS) : result.content;
+    const notes = [
+      result.exported ? "(exported from a Google-native document)" : null,
+      result.truncated || overCap ? "(truncated at the 100 KB read limit)" : null
+    ].filter(Boolean);
+    const header = `${result.file.name} ${notes.join(" ")}`.trim();
+    return { content: [{ type: "text", text: `${header}
+
+${content}` }] };
+  });
+  registerContractTool(server2, driveCreateFileContract, async (params) => {
+    const file = await conn2.createProjectDriveFile(params);
+    return { content: [{ type: "text", text: `Created "${file.name}" (${file.id})` }] };
+  });
+  registerContractTool(server2, driveUpdateFileContract, async (params) => {
+    const file = await conn2.updateProjectDriveFile(params);
+    return { content: [{ type: "text", text: `Updated "${file.name}" (${file.id})` }] };
+  });
+  registerContractTool(server2, driveDeleteFileContract, async (params) => {
+    const result = await conn2.deleteProjectDriveFile(params);
+    return {
+      content: [
+        { type: "text", text: `Moved "${result.name}" (${result.id}) to the Google Drive trash` }
+      ]
+    };
+  });
+  registerContractTool(server2, driveCreateFolderContract, async (params) => {
+    const folder = await conn2.createProjectDriveFolder(params);
+    return { content: [{ type: "text", text: `Created folder "${folder.name}" (${folder.id})` }] };
+  });
+}
+
+// src/tools/meetings.ts
+function registerMeetingTools(server2, conn2) {
+  registerContractTool(server2, listMeetingsContract, async (params) => {
+    const res = await conn2.listMeetings(params);
+    if (res.meetings.length === 0) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: params.search ? `No meetings match "${params.search}". Try list_meetings with no search to see what exists.` : "This project has no meetings yet."
+          }
+        ]
+      };
     }
-  );
-  registerGrafanaLogTool(server2, conn2);
+    return { content: [{ type: "text", text: JSON.stringify(res.meetings, null, 2) }] };
+  });
+  registerContractTool(server2, getMeetingContract, async (params) => {
+    const res = await conn2.getMeeting(params);
+    return { content: [{ type: "text", text: JSON.stringify(res, null, 2) }] };
+  });
+  registerContractTool(server2, readMeetingTranscriptContract, async (params) => {
+    const res = await conn2.readMeetingTranscript(params);
+    const header = `${res.title} \u2014 segments ${res.offset + 1}-${res.offset + res.lines.length} of ${res.segmentCount}`;
+    const footer = res.nextOffset === void 0 ? "" : `
+
+-- more remains: pass offset=${res.nextOffset} to continue`;
+    return { content: [{ type: "text", text: `${header}
+
+${res.lines.join("\n")}${footer}` }] };
+  });
 }
 
 // src/tools/index.ts
@@ -2630,6 +5119,9 @@ function registerAllTools(server2, conn2) {
   registerChecklistTools(server2, conn2);
   registerWorkspaceTools(server2, conn2);
   registerLogTools(server2, conn2);
+  registerIntegrationTools(server2, conn2);
+  registerDriveTools(server2, conn2);
+  registerMeetingTools(server2, conn2);
 }
 
 // src/cli.ts