@sideboard-ai/core 0.1.202 → 0.1.203

package/dist/mcp/run-stdio.cjs

@@ -3424,6 +3424,9 @@ function normalizeVault(raw) {
   if (typeof raw.abletimeAccessToken === "string" && raw.abletimeAccessToken.trim()) {
     out.abletimeAccessToken = raw.abletimeAccessToken.trim();
   }
+  if (typeof raw.abletimeRefreshToken === "string" && raw.abletimeRefreshToken.trim()) {
+    out.abletimeRefreshToken = raw.abletimeRefreshToken.trim();
+  }
   if (typeof raw.vercelToken === "string" && raw.vercelToken.trim()) {
     out.vercelToken = raw.vercelToken.trim();
   }
@@ -3629,6 +3632,7 @@ function emptyPublicIntegrations() {
     hasSlackAppToken: false,
     hasGithubPat: false,
     hasAbleTimeToken: false,
+    hasAbleTimeOAuth: false,
     hasVercelToken: false,
     hasSupabaseToken: false,
     hasPosthogToken: false,
@@ -3653,6 +3657,7 @@ function toPublicAppSettings(settings) {
   const slackAppToken = integrations.slackAppToken;
   const githubPat = integrations.githubPat;
   const abletimeAccessToken = integrations.abletimeAccessToken;
+  const abletimeRefreshToken = integrations.abletimeRefreshToken;
   const vercelToken = integrations.vercelToken;
   const supabaseAccessToken = integrations.supabaseAccessToken;
   const posthogPersonalApiKey = integrations.posthogPersonalApiKey;
@@ -3665,6 +3670,7 @@ function toPublicAppSettings(settings) {
   delete integrations.slackAppToken;
   delete integrations.githubPat;
   delete integrations.abletimeAccessToken;
+  delete integrations.abletimeRefreshToken;
   delete integrations.vercelToken;
   delete integrations.supabaseAccessToken;
   delete integrations.posthogPersonalApiKey;
@@ -3679,7 +3685,8 @@ function toPublicAppSettings(settings) {
       hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
       hasSlackAppToken: Boolean(slackAppToken?.trim()),
       hasGithubPat: Boolean(githubPat?.trim()),
-      hasAbleTimeToken: Boolean(abletimeAccessToken?.trim()),
+      hasAbleTimeToken: Boolean(abletimeAccessToken?.trim() || abletimeRefreshToken?.trim()),
+      hasAbleTimeOAuth: Boolean(abletimeRefreshToken?.trim()),
       hasVercelToken: Boolean(vercelToken?.trim()),
       hasSupabaseToken: Boolean(supabaseAccessToken?.trim()),
       hasPosthogToken: Boolean(posthogPersonalApiKey?.trim()),
@@ -3817,6 +3824,16 @@ function normalizeIntegrations(raw) {
     const token = source.abletimeAccessToken.trim();
     if (token) out.abletimeAccessToken = token;
   }
+  if (typeof source.abletimeRefreshToken === "string") {
+    const token = source.abletimeRefreshToken.trim();
+    if (token) out.abletimeRefreshToken = token;
+  }
+  if (typeof source.abletimeTokenExpiresAt === "number" && Number.isFinite(source.abletimeTokenExpiresAt)) {
+    out.abletimeTokenExpiresAt = source.abletimeTokenExpiresAt;
+  } else if (typeof source.abletimeTokenExpiresAt === "string") {
+    const n = Number(source.abletimeTokenExpiresAt);
+    if (Number.isFinite(n)) out.abletimeTokenExpiresAt = n;
+  }
   if (typeof source.abletimeHost === "string") {
     const host = source.abletimeHost.trim();
     if (host) out.abletimeHost = host;
@@ -4094,7 +4111,7 @@ function readSettingsFile() {
 }
 function diskHoldsSecrets(disk) {
   return Boolean(
-    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || disk.integrations.abletimeAccessToken || disk.integrations.vercelToken || disk.integrations.supabaseAccessToken || disk.integrations.posthogPersonalApiKey || disk.integrations.sentryAuthToken || Object.keys(disk.environment).length > 0
+    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.githubPat || disk.integrations.abletimeAccessToken || disk.integrations.abletimeRefreshToken || disk.integrations.vercelToken || disk.integrations.supabaseAccessToken || disk.integrations.posthogPersonalApiKey || disk.integrations.sentryAuthToken || Object.keys(disk.environment).length > 0
   );
 }
 function mergeVault(disk) {
@@ -4125,6 +4142,9 @@ function mergeVault(disk) {
   if (vault.abletimeAccessToken && !integrations.abletimeAccessToken) {
     integrations.abletimeAccessToken = vault.abletimeAccessToken;
   }
+  if (vault.abletimeRefreshToken && !integrations.abletimeRefreshToken) {
+    integrations.abletimeRefreshToken = vault.abletimeRefreshToken;
+  }
   if (vault.vercelToken && !integrations.vercelToken) {
     integrations.vercelToken = vault.vercelToken;
   }
@@ -4149,6 +4169,7 @@ function persistSplit(settings) {
   const slackAppToken = integrations.slackAppToken;
   const githubPat = integrations.githubPat;
   const abletimeAccessToken = integrations.abletimeAccessToken;
+  const abletimeRefreshToken = integrations.abletimeRefreshToken;
   const vercelToken = integrations.vercelToken;
   const supabaseAccessToken = integrations.supabaseAccessToken;
   const posthogPersonalApiKey = integrations.posthogPersonalApiKey;
@@ -4161,6 +4182,7 @@ function persistSplit(settings) {
   delete integrations.slackAppToken;
   delete integrations.githubPat;
   delete integrations.abletimeAccessToken;
+  delete integrations.abletimeRefreshToken;
   delete integrations.vercelToken;
   delete integrations.supabaseAccessToken;
   delete integrations.posthogPersonalApiKey;
@@ -4179,6 +4201,7 @@ function persistSplit(settings) {
     slackAppToken,
     githubPat,
     abletimeAccessToken,
+    abletimeRefreshToken,
     vercelToken,
     supabaseAccessToken,
     posthogPersonalApiKey,
@@ -4365,6 +4388,8 @@ function updateIntegrationsSettings(patch) {
   if ("abletimeAccessToken" in patch) {
     if (patch.abletimeAccessToken == null || patch.abletimeAccessToken.trim() === "") {
       delete integrations.abletimeAccessToken;
+      delete integrations.abletimeRefreshToken;
+      delete integrations.abletimeTokenExpiresAt;
       delete integrations.abletimeViewerName;
     } else {
       integrations.abletimeAccessToken = patch.abletimeAccessToken.trim();
@@ -4715,7 +4740,9 @@ function disconnectLinearConnection() {
   return saveAppSettings({ ...current, integrations });
 }
 function isAbleTimeConnected(settings = loadAppSettings()) {
-  return Boolean(settings.integrations.abletimeAccessToken?.trim());
+  return Boolean(
+    settings.integrations.abletimeAccessToken?.trim() || settings.integrations.abletimeRefreshToken?.trim()
+  );
 }
 function getAbleTimeAccessToken(settings = loadAppSettings()) {
   const token = settings.integrations.abletimeAccessToken?.trim();
@@ -4728,6 +4755,12 @@ function saveAbleTimeConnection(input) {
   const current = loadAppSettings();
   const integrations = { ...current.integrations };
   integrations.abletimeAccessToken = input.accessToken.trim();
+  if (input.refreshToken?.trim()) {
+    integrations.abletimeRefreshToken = input.refreshToken.trim();
+  }
+  if (typeof input.expiresIn === "number" && Number.isFinite(input.expiresIn)) {
+    integrations.abletimeTokenExpiresAt = Date.now() + Math.max(0, input.expiresIn) * 1e3;
+  }
   if (input.host?.trim()) {
     integrations.abletimeHost = input.host.trim();
   }
@@ -4740,6 +4773,8 @@ function disconnectAbleTimeConnection() {
   const current = loadAppSettings();
   const integrations = { ...current.integrations };
   delete integrations.abletimeAccessToken;
+  delete integrations.abletimeRefreshToken;
+  delete integrations.abletimeTokenExpiresAt;
   delete integrations.abletimeViewerName;
   return saveAppSettings({ ...current, integrations });
 }
@@ -15373,6 +15408,645 @@ var init_home_board = __esm({
   }
 });
 
+// src/integrations/abletime-oauth.ts
+var abletime_oauth_exports = {};
+__export(abletime_oauth_exports, {
+  ABLETIME_OAUTH_CANCELLED: () => ABLETIME_OAUTH_CANCELLED,
+  ABLETIME_OAUTH_PORT: () => ABLETIME_OAUTH_PORT,
+  ABLETIME_OAUTH_REDIRECT: () => ABLETIME_OAUTH_REDIRECT,
+  ABLETIME_OAUTH_RESOURCE: () => ABLETIME_OAUTH_RESOURCE,
+  AbleTimeOAuthCancelledError: () => AbleTimeOAuthCancelledError,
+  BAKED_ABLETIME_OAUTH_CLIENT_ID: () => BAKED_ABLETIME_OAUTH_CLIENT_ID,
+  ableTimeOAuthAuthorizeUrl: () => ableTimeOAuthAuthorizeUrl,
+  ableTimeOAuthClientId: () => ableTimeOAuthClientId,
+  ableTimeOAuthResource: () => ableTimeOAuthResource,
+  createAbleTimePkce: () => createAbleTimePkce,
+  ensureAbleTimeAccessToken: () => ensureAbleTimeAccessToken,
+  hasBakedAbleTimeOAuth: () => hasBakedAbleTimeOAuth,
+  isAbleTimeOAuthCancelled: () => isAbleTimeOAuthCancelled,
+  startAbleTimeOAuth: () => startAbleTimeOAuth
+});
+function hasBakedAbleTimeOAuth() {
+  return Boolean(BAKED_ABLETIME_OAUTH_CLIENT_ID.trim());
+}
+function ableTimeOAuthClientId() {
+  return process.env.SIDEBOARD_ABLETIME_OAUTH_CLIENT_ID?.trim() || BAKED_ABLETIME_OAUTH_CLIENT_ID.trim();
+}
+function ableTimeOAuthResource(host) {
+  return `${normalizeAbleTimeHost(host)}/api/public/v2/mcp`;
+}
+function createAbleTimePkce() {
+  const verifier = (0, import_node_crypto9.randomBytes)(32).toString("base64url");
+  const challenge = (0, import_node_crypto9.createHash)("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function ableTimeOAuthAuthorizeUrl(clientId, state, codeChallenge, host) {
+  const base = normalizeAbleTimeHost(host);
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: ABLETIME_OAUTH_REDIRECT,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state,
+    resource: ableTimeOAuthResource(host)
+  });
+  return `${base}/oauth/authorize?${params.toString()}`;
+}
+function htmlPage(title, body) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
+h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
+}
+async function exchangeAbleTimeToken(body, host) {
+  const url = `${normalizeAbleTimeHost(host)}/api/oauth/token`;
+  const res = await httpFetch(url, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || data.error || !data.access_token?.trim()) {
+    const detail = data.error_description || data.error || `HTTP ${res.status}`;
+    throw new Error(`AbleTime OAuth token exchange failed: ${detail}`);
+  }
+  return data;
+}
+function persistAbleTimeTokens(data, input) {
+  return saveAbleTimeConnection({
+    accessToken: data.access_token.trim(),
+    refreshToken: data.refresh_token?.trim(),
+    expiresIn: data.expires_in,
+    host: input?.host,
+    viewerName: input?.viewerName
+  });
+}
+async function refreshAbleTimeAccessToken(refreshToken) {
+  const host = getAbleTimeHost();
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: ableTimeOAuthClientId(),
+    resource: ableTimeOAuthResource(host)
+  });
+  try {
+    const data = await exchangeAbleTimeToken(body, host);
+    persistAbleTimeTokens(data, { host });
+    return data.access_token.trim();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/invalid_grant|invalid_token|unauthorized/i.test(message)) {
+      disconnectAbleTimeConnection();
+      throw new Error("AbleTime sign-in expired \u2014 connect again in Account settings");
+    }
+    throw err;
+  }
+}
+async function ensureAbleTimeAccessToken() {
+  const settings = loadAppSettings();
+  const access = settings.integrations.abletimeAccessToken?.trim() || "";
+  const refresh = settings.integrations.abletimeRefreshToken?.trim() || "";
+  const expiresAt = settings.integrations.abletimeTokenExpiresAt ?? 0;
+  if (access && (!refresh || Date.now() < expiresAt - REFRESH_SKEW_MS2)) {
+    return access;
+  }
+  if (refresh) {
+    if (!refreshInFlight) {
+      refreshInFlight = refreshAbleTimeAccessToken(refresh).finally(() => {
+        refreshInFlight = null;
+      });
+    }
+    return refreshInFlight;
+  }
+  return access || null;
+}
+function isAbleTimeOAuthCancelled(err) {
+  if (err instanceof AbleTimeOAuthCancelledError) return true;
+  const message = err instanceof Error ? err.message : String(err);
+  return message.includes(ABLETIME_OAUTH_CANCELLED);
+}
+async function startAbleTimeOAuth(opts) {
+  if (opts?.signal?.aborted) {
+    throw new AbleTimeOAuthCancelledError();
+  }
+  const clientId = ableTimeOAuthClientId();
+  if (!clientId) {
+    throw new Error(
+      `AbleTime browser sign-in needs a Client ID Metadata Document URL. Host ${BAKED_ABLETIME_OAUTH_CLIENT_ID} (see site/oauth/abletime-client.json), or set SIDEBOARD_ABLETIME_OAUTH_CLIENT_ID.`
+    );
+  }
+  const host = opts?.host?.trim() || void 0;
+  const state = (0, import_node_crypto9.randomBytes)(16).toString("hex");
+  const pkce = createAbleTimePkce();
+  const authorizeUrl = ableTimeOAuthAuthorizeUrl(clientId, state, pkce.challenge, host);
+  const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
+  const code = await new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (err, value) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (err) reject(err);
+      else resolve(value);
+    };
+    const server = (0, import_node_http.createServer)((req, res) => {
+      try {
+        const url = new URL(req.url || "/", `http://127.0.0.1:${ABLETIME_OAUTH_PORT}`);
+        if (url.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end("Not found");
+          return;
+        }
+        const err = url.searchParams.get("error");
+        const gotState = url.searchParams.get("state");
+        const gotCode = url.searchParams.get("code");
+        if (err) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("AbleTime", `<h1>Authorization cancelled</h1><p>${err}</p>`));
+          finish(new AbleTimeOAuthCancelledError(`AbleTime OAuth: ${err}`));
+          return;
+        }
+        if (gotState !== state || !gotCode) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("AbleTime", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
+          finish(new Error("AbleTime OAuth callback was invalid"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(
+          htmlPage(
+            "AbleTime connected",
+            "<h1>AbleTime connected</h1><p>You can close this tab and return to Sideboard.</p>"
+          )
+        );
+        finish(void 0, gotCode);
+      } catch (e) {
+        finish(e instanceof Error ? e : new Error(String(e)));
+      }
+    });
+    const timer = setTimeout(() => {
+      finish(new Error("AbleTime sign-in timed out \u2014 try again"));
+    }, timeoutMs);
+    const onAbort = () => finish(new AbleTimeOAuthCancelledError());
+    const cleanup = () => {
+      clearTimeout(timer);
+      opts?.signal?.removeEventListener("abort", onAbort);
+      server.close();
+    };
+    opts?.signal?.addEventListener("abort", onAbort, { once: true });
+    if (opts?.signal?.aborted) {
+      onAbort();
+      return;
+    }
+    server.on("error", (e) => {
+      finish(
+        e instanceof Error && e.code === "EADDRINUSE" ? new Error(
+          `Port ${ABLETIME_OAUTH_PORT} is in use. Close whatever is bound there, or paste an AbleTime token instead.`
+        ) : e instanceof Error ? e : new Error(String(e))
+      );
+    });
+    server.listen(ABLETIME_OAUTH_PORT, "127.0.0.1", () => {
+      void Promise.resolve(opts?.openUrl?.(authorizeUrl)).catch((e) => {
+        finish(e instanceof Error ? e : new Error(String(e)));
+      });
+    });
+  });
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: ABLETIME_OAUTH_REDIRECT,
+    client_id: clientId,
+    code_verifier: pkce.verifier,
+    resource: ableTimeOAuthResource(host)
+  });
+  const data = await exchangeAbleTimeToken(body, host);
+  persistAbleTimeTokens(data, { host });
+  const token = data.access_token.trim();
+  try {
+    const { getAbleTimeOrientation: getAbleTimeOrientation2 } = await Promise.resolve().then(() => (init_abletime(), abletime_exports));
+    const orientation = await getAbleTimeOrientation2({ token, host });
+    return saveAbleTimeConnection({
+      accessToken: token,
+      refreshToken: data.refresh_token?.trim(),
+      expiresIn: data.expires_in,
+      host,
+      viewerName: orientation.viewer.name
+    });
+  } catch {
+    return loadAppSettings();
+  }
+}
+var import_node_crypto9, import_node_http, ABLETIME_OAUTH_PORT, ABLETIME_OAUTH_REDIRECT, BAKED_ABLETIME_OAUTH_CLIENT_ID, ABLETIME_OAUTH_RESOURCE, REFRESH_SKEW_MS2, refreshInFlight, ABLETIME_OAUTH_CANCELLED, AbleTimeOAuthCancelledError;
+var init_abletime_oauth = __esm({
+  "src/integrations/abletime-oauth.ts"() {
+    "use strict";
+    import_node_crypto9 = require("crypto");
+    import_node_http = require("http");
+    init_fetch();
+    init_app_settings();
+    init_abletime_mcp();
+    ABLETIME_OAUTH_PORT = 19849;
+    ABLETIME_OAUTH_REDIRECT = `http://127.0.0.1:${ABLETIME_OAUTH_PORT}/callback`;
+    BAKED_ABLETIME_OAUTH_CLIENT_ID = "https://www.sideboard.cloud/oauth/abletime-client.json";
+    ABLETIME_OAUTH_RESOURCE = `${DEFAULT_ABLETIME_HOST}/api/public/v2/mcp`;
+    REFRESH_SKEW_MS2 = 5 * 6e4;
+    refreshInFlight = null;
+    ABLETIME_OAUTH_CANCELLED = "AbleTime sign-in cancelled";
+    AbleTimeOAuthCancelledError = class extends Error {
+      constructor(message = ABLETIME_OAUTH_CANCELLED) {
+        super(message);
+        this.name = "AbleTimeOAuthCancelledError";
+      }
+    };
+  }
+});
+
+// src/integrations/abletime-rest.ts
+var abletime_rest_exports = {};
+__export(abletime_rest_exports, {
+  ABLETIME_REST_PREFIX: () => ABLETIME_REST_PREFIX,
+  ableTimeDocFromText: () => ableTimeDocFromText,
+  abletimeRestUrl: () => abletimeRestUrl,
+  callAbleTimeRestTool: () => callAbleTimeRestTool,
+  looksLikeAbleTimeUlid: () => looksLikeAbleTimeUlid,
+  textFromAbleTimeDoc: () => textFromAbleTimeDoc
+});
+function asRecord4(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function asList(value) {
+  if (Array.isArray(value)) return value;
+  const record = asRecord4(value);
+  if (!record) return [];
+  for (const key of ["data", "tasks", "projects", "users", "items", "results"]) {
+    if (Array.isArray(record[key])) return record[key];
+  }
+  return [];
+}
+function ableTimeDocFromText(text7) {
+  const trimmed = text7.trim();
+  if (!trimmed) return { type: "doc", content: [] };
+  return {
+    type: "doc",
+    content: [{ type: "paragraph", content: [{ type: "text", text: trimmed }] }]
+  };
+}
+function textFromAbleTimeDoc(value) {
+  if (typeof value === "string") return value.trim();
+  const record = asRecord4(value);
+  if (!record) return "";
+  if (typeof record.text === "string" && record.text.trim()) return record.text.trim();
+  const chunks = [];
+  const walk = (node) => {
+    const rec = asRecord4(node);
+    if (!rec) return;
+    if (typeof rec.text === "string" && rec.text) chunks.push(rec.text);
+    if (Array.isArray(rec.content)) rec.content.forEach(walk);
+  };
+  walk(record);
+  return chunks.join("").trim();
+}
+function abletimeRestUrl(path, host, query) {
+  const base = `${normalizeAbleTimeHost(host)}${ABLETIME_REST_PREFIX}`;
+  const suffix = path.startsWith("/") ? path : `/${path}`;
+  const url = new URL(`${base}${suffix}`);
+  for (const [key, value] of Object.entries(query ?? {})) {
+    if (value) url.searchParams.set(key, value);
+  }
+  return url.href;
+}
+function looksLikeAbleTimeUlid(id) {
+  return ULID_RE.test(id.trim());
+}
+async function abletimeRestRequest(path, opts = {}) {
+  const raw = opts.token ?? getAbleTimeAccessToken();
+  const token = normalizeAbleTimeCredential(raw ?? "");
+  if (!token) {
+    throw new Error("AbleTime is not connected \u2014 paste an API key or personal access token in Account settings");
+  }
+  const host = opts.host ?? (opts.token ? DEFAULT_ABLETIME_HOST : getAbleTimeHost());
+  const url = abletimeRestUrl(path, host, opts.query);
+  const method = (opts.method ?? "GET").toUpperCase();
+  const res = await httpFetch(url, {
+    method,
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${token}`,
+      ...opts.body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+  });
+  const text7 = await res.text().catch(() => "");
+  if (!res.ok) {
+    throw new Error(
+      rewriteAbleTimeError(
+        `AbleTime API error ${res.status}${text7 ? `: ${text7.slice(0, 240)}` : ""}`
+      )
+    );
+  }
+  if (!text7.trim()) return null;
+  try {
+    return JSON.parse(text7);
+  } catch {
+    throw new Error(`AbleTime API returned a non-JSON response: ${text7.slice(0, 200)}`);
+  }
+}
+async function restPages(path, opts, maxPages = 20) {
+  const items = [];
+  let cursor;
+  for (let i = 0; i < maxPages; i += 1) {
+    const raw = await abletimeRestRequest(path, {
+      ...opts,
+      query: { ...opts.query, ...cursor ? { cursor } : {} }
+    });
+    items.push(...asList(raw));
+    const page = asRecord4(asRecord4(raw)?.page);
+    const next = page ? asString(page.nextCursor) : "";
+    if (!next) break;
+    cursor = next;
+  }
+  return items;
+}
+function userDisplayName(raw) {
+  const rec = asRecord4(raw);
+  if (!rec) return null;
+  const id = asString(rec.userId) || asString(rec.id);
+  const name = [asString(rec.firstName), asString(rec.lastName)].filter(Boolean).join(" ") || asString(rec.username) || asString(rec.email) || asString(rec.name);
+  if (!name) return null;
+  return { id: id || void 0, name };
+}
+function restTaskToRaw(raw, users) {
+  const rec = asRecord4(raw);
+  if (!rec) return null;
+  const id = asString(rec.timeflowTaskId) || asString(rec.taskId) || asString(rec.id);
+  const identifier = asString(rec.taskRef) || asString(rec.reference) || id;
+  const title = asString(rec.title);
+  if (!id && !identifier && !title) return null;
+  const assigned = asString(rec.assignedUserId);
+  const assignee = assigned ? users.get(assigned) : void 0;
+  const comments = asList(rec.comments).map((item) => {
+    const comment = asRecord4(item) ?? {};
+    const user = userDisplayName(comment);
+    return {
+      id: asString(comment.commentId) || asString(comment.id),
+      body: textFromAbleTimeDoc(comment.content) || asString(comment.contentSanitized) || asString(comment.body),
+      createdAt: asString(comment.createdAt) || asString(comment.lastUpdate),
+      user: user?.name || asString(comment.username)
+    };
+  });
+  return {
+    id,
+    taskId: id,
+    timeflowTaskId: id,
+    reference: identifier,
+    taskRef: identifier,
+    title: title || identifier,
+    state: asString(rec.taskState) || asString(rec.state),
+    description: textFromAbleTimeDoc(rec.description) || asString(rec.descriptionSanitized),
+    projectId: asString(rec.projectId),
+    categoryId: asString(rec.projectCategoryId) || asString(rec.categoryId),
+    tags: rec.tags,
+    comments,
+    createdAt: asString(rec.dateCreated) || asString(rec.createdAt),
+    updatedAt: asString(rec.lastUpdate) || asString(rec.updatedAt),
+    ...assignee ? { assignee } : {}
+  };
+}
+function restProjectToRaw(raw) {
+  const rec = asRecord4(raw);
+  if (!rec) return null;
+  const id = asString(rec.projectId) || asString(rec.id);
+  const name = asString(rec.projectName) || asString(rec.name);
+  if (!id && !name) return null;
+  const categories = asList(rec.categories).map((item) => {
+    const cat = asRecord4(item) ?? {};
+    return {
+      id: asString(cat.projectCategoryId) || asString(cat.categoryId) || asString(cat.id),
+      name: asString(cat.categoryName) || asString(cat.name)
+    };
+  });
+  return { id, name, projectId: id, projectName: name, categories };
+}
+async function listUsers(opts) {
+  const users = /* @__PURE__ */ new Map();
+  for (const item of await restPages("/users", opts).catch(() => [])) {
+    const user = userDisplayName(item);
+    const rec = asRecord4(item);
+    const id = user?.id || (rec ? asString(rec.userId) : "");
+    if (user && id) users.set(id, user);
+  }
+  return users;
+}
+async function listProjectsRaw(opts) {
+  const items = await restPages("/projects", { ...opts, query: { expand: "categories" } });
+  return items.map(restProjectToRaw).filter((item) => Boolean(item));
+}
+async function listTasksRaw(opts) {
+  const [users, items] = await Promise.all([
+    listUsers(opts),
+    restPages("/tasks", {
+      ...opts,
+      query: {
+        ...opts.projectId ? { projectId: opts.projectId } : {}
+      }
+    })
+  ]);
+  let tasks = items.map((item) => restTaskToRaw(item, users)).filter((item) => Boolean(item));
+  const needle = opts.query?.trim().toLowerCase();
+  if (needle) {
+    tasks = tasks.filter((task) => {
+      const hay = [task.title, task.reference, task.taskRef, task.id].map((value) => String(value ?? "").toLowerCase()).join(" ");
+      const tags = Array.isArray(task.tags) ? task.tags.join(" ").toLowerCase() : "";
+      return hay.includes(needle) || tags.includes(needle);
+    });
+  }
+  return tasks;
+}
+async function resolveTaskId(id, opts) {
+  const wanted = id.trim();
+  if (!wanted) throw new Error("AbleTime task id is required");
+  if (looksLikeAbleTimeUlid(wanted)) return wanted;
+  const tasks = await listTasksRaw(opts);
+  const match = tasks.find((task) => {
+    const ref = String(task.reference ?? task.taskRef ?? "").toLowerCase();
+    const taskId = String(task.id ?? "").toLowerCase();
+    return ref === wanted.toLowerCase() || taskId === wanted.toLowerCase();
+  });
+  if (!match?.id) throw new Error(`AbleTime task not found: ${id}`);
+  return String(match.id);
+}
+async function getTaskRaw(id, opts) {
+  const taskId = await resolveTaskId(id, opts);
+  const [users, raw] = await Promise.all([
+    listUsers(opts),
+    abletimeRestRequest(`/tasks/${encodeURIComponent(taskId)}`, {
+      ...opts,
+      query: { expand: "comments" }
+    })
+  ]);
+  const task = restTaskToRaw(raw, users);
+  if (!task) throw new Error(`AbleTime task not found: ${id}`);
+  return task;
+}
+function firstStringArg(args, keys) {
+  for (const key of keys) {
+    const value = asString(args[key]);
+    if (value) return value;
+  }
+  return "";
+}
+async function callAbleTimeRestTool(name, args = {}, opts) {
+  const token = normalizeAbleTimeCredential(opts?.token ?? getAbleTimeAccessToken() ?? "");
+  if (ableTimeCredentialKind(token) !== "org") {
+    throw new Error("AbleTime REST transport is for organization API keys (atk_\u2026)");
+  }
+  const requestOpts = { ...opts, token };
+  switch (name) {
+    case "orientation": {
+      const [users, projects, tasks] = await Promise.all([
+        listUsers(requestOpts),
+        listProjectsRaw(requestOpts),
+        listTasksRaw(requestOpts)
+      ]);
+      const viewer = [...users.values()].find((user) => user.name) ?? [...users.values()][0] ?? { name: "AbleTime" };
+      return { viewer, projects, tasks };
+    }
+    case "list_projects":
+      return { data: await listProjectsRaw(requestOpts) };
+    case "list_users":
+      return { data: [...(await listUsers(requestOpts)).values()] };
+    case "list_tasks":
+      return {
+        data: await listTasksRaw({
+          ...requestOpts,
+          projectId: firstStringArg(args, ["project_id", "projectId", "project"])
+        })
+      };
+    case "search_tasks":
+      return {
+        data: await listTasksRaw({
+          ...requestOpts,
+          query: firstStringArg(args, ["query", "q"])
+        })
+      };
+    case "get_task":
+      return await getTaskRaw(firstStringArg(args, ["id", "task_id", "task"]), requestOpts);
+    case "create_task": {
+      const title = firstStringArg(args, ["title"]);
+      if (!title) throw new Error("AbleTime task title is required");
+      const projectId = firstStringArg(args, ["project_id", "projectId", "project"]);
+      if (!projectId) throw new Error("AbleTime project is required");
+      const projects = await listProjectsRaw(requestOpts);
+      const project = projects.find(
+        (item) => String(item.id).toLowerCase() === projectId.toLowerCase() || String(item.name).toLowerCase() === projectId.toLowerCase()
+      ) ?? projects[0];
+      if (!project) throw new Error("AbleTime has no projects to create a task in");
+      const categories = asList(project.categories);
+      const wantedCategory = firstStringArg(args, ["category_id", "categoryId", "category"]);
+      const category = categories.map((item) => asRecord4(item)).find((item) => {
+        if (!item || !wantedCategory) return false;
+        return asString(item.id).toLowerCase() === wantedCategory.toLowerCase() || asString(item.name).toLowerCase() === wantedCategory.toLowerCase();
+      }) ?? asRecord4(categories[0]);
+      const created = await abletimeRestRequest("/tasks", {
+        ...requestOpts,
+        method: "POST",
+        body: {
+          projectId: project.id,
+          projectCategoryId: category ? asString(category.id) : void 0,
+          title
+        }
+      });
+      const state = firstStringArg(args, ["state"]);
+      const createdId = asString(asRecord4(created)?.timeflowTaskId);
+      const description = asString(args.description);
+      if (createdId && description) {
+        await abletimeRestRequest(`/tasks/${encodeURIComponent(createdId)}`, {
+          ...requestOpts,
+          method: "PATCH",
+          body: { description: ableTimeDocFromText(description) }
+        }).catch(() => void 0);
+      }
+      if (createdId && state && state !== "todo") {
+        await abletimeRestRequest(`/tasks/${encodeURIComponent(createdId)}/state`, {
+          ...requestOpts,
+          method: "POST",
+          body: { taskState: state }
+        }).catch(() => void 0);
+      }
+      return createdId ? await getTaskRaw(createdId, requestOpts) : restTaskToRaw(created, await listUsers(requestOpts));
+    }
+    case "update_task": {
+      const id = await resolveTaskId(firstStringArg(args, ["id", "task_id", "task"]), requestOpts);
+      const patch = {};
+      const title = firstStringArg(args, ["title"]);
+      if (title) patch.title = title;
+      if (args.description !== void 0) {
+        patch.description = args.description == null || args.description === "" ? null : ableTimeDocFromText(String(args.description));
+      }
+      if (args.tags !== void 0 || args.labels !== void 0) {
+        patch.tags = args.tags ?? args.labels ?? args.tag_names;
+      }
+      if (Object.keys(patch).length > 0) {
+        await abletimeRestRequest(`/tasks/${encodeURIComponent(id)}`, {
+          ...requestOpts,
+          method: "PATCH",
+          body: patch
+        });
+      }
+      return await getTaskRaw(id, requestOpts);
+    }
+    case "set_task_state": {
+      const id = await resolveTaskId(firstStringArg(args, ["id", "task_id", "task"]), requestOpts);
+      const state = firstStringArg(args, ["state", "taskState"]);
+      if (!state) throw new Error("AbleTime task state is required");
+      await abletimeRestRequest(`/tasks/${encodeURIComponent(id)}/state`, {
+        ...requestOpts,
+        method: "POST",
+        body: { taskState: state }
+      });
+      return await getTaskRaw(id, requestOpts);
+    }
+    case "create_comment": {
+      const id = await resolveTaskId(firstStringArg(args, ["id", "task_id", "task"]), requestOpts);
+      const body = firstStringArg(args, ["body", "comment", "text"]);
+      if (!body) throw new Error("AbleTime comment body is required");
+      const created = await abletimeRestRequest(`/tasks/${encodeURIComponent(id)}/comments`, {
+        ...requestOpts,
+        method: "POST",
+        body: { content: ableTimeDocFromText(body) }
+      });
+      const rec = asRecord4(created) ?? {};
+      return {
+        id: asString(rec.commentId) || void 0,
+        body: textFromAbleTimeDoc(rec.content) || body
+      };
+    }
+    case "set_task_dependency":
+      throw new Error(
+        "AbleTime organization API keys cannot set task dependencies on REST yet \u2014 use a personal access token (apt_\u2026) for MCP project-management tools."
+      );
+    default:
+      throw new Error(`AbleTime organization API keys do not support ${name} on REST`);
+  }
+}
+var ABLETIME_REST_PREFIX, ULID_RE;
+var init_abletime_rest = __esm({
+  "src/integrations/abletime-rest.ts"() {
+    "use strict";
+    init_fetch();
+    init_app_settings();
+    init_abletime_mcp();
+    ABLETIME_REST_PREFIX = "/api/public/v2";
+    ULID_RE = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+  }
+});
+
 // src/integrations/abletime-mcp.ts
 function abletimeToolUsesPm(name) {
   return ABLETIME_PM_TOOL_NAMES.includes(name);
@@ -15386,22 +16060,49 @@ function abletimeMcpUrl(host, opts) {
   const path = opts?.pm ? ABLETIME_MCP_PM_PATH : ABLETIME_MCP_PATH;
   return `${normalizeAbleTimeHost(host)}${path}`;
 }
+function normalizeAbleTimeCredential(raw) {
+  return raw.trim().replace(/^bearer\s+/i, "").trim();
+}
+function ableTimeCredentialKind(raw) {
+  const token = normalizeAbleTimeCredential(raw).toLowerCase();
+  if (token.startsWith(ABLETIME_PAT_PREFIX)) return "pat";
+  if (token.startsWith(ABLETIME_ORG_KEY_PREFIX)) return "org";
+  return "unknown";
+}
+function assertAbleTimeMcpCredential(raw) {
+  const token = normalizeAbleTimeCredential(raw);
+  if (!token) {
+    throw new Error("AbleTime personal access token is required");
+  }
+  if (ableTimeCredentialKind(token) === "org") {
+    throw new Error(ORG_KEY_HINT);
+  }
+  return token;
+}
+function assertAbleTimeCredential(raw) {
+  const token = normalizeAbleTimeCredential(raw);
+  if (!token) {
+    throw new Error("AbleTime API key or personal access token is required");
+  }
+  return token;
+}
 function rewriteAbleTimeError(message) {
-  if (/INTEGRATION_AGENT_ACCESS_DISABLED|agent access/i.test(message)) {
+  if (REWRITE_APPLIED.test(message)) return message;
+  if (/INTEGRATION_AGENT_ACCESS_DISABLED/i.test(message)) {
     return `${message} \u2014 Enable Agent access (MCP) in AbleTime Settings \u2192 Integrations \u2192 API Keys.`;
   }
-  if (/INTEGRATION_PAT_REQUIRED|organization api key/i.test(message)) {
-    return `${message} \u2014 AbleTime MCP needs a personal access token (apt_\u2026), not an organization API key.`;
+  if (/INTEGRATION_PAT_REQUIRED/i.test(message)) {
+    return `${message} \u2014 ${ORG_KEY_HINT}`;
   }
   if (/INTEGRATION_PLAN_REQUIRED/i.test(message)) {
     return `${message} \u2014 AbleTime plan does not include API access.`;
   }
   if (/INTEGRATION_KEY_INVALID|INTEGRATION_KEY_MISSING|401|unauthorized|invalid token/i.test(message)) {
-    return `${message} \u2014 Reconnect AbleTime from Account settings (Profile \u2192 API Access).`;
+    return `${message} \u2014 ${REJECTED_CREDENTIAL_HINT}`;
   }
   return message;
 }
-function asRecord4(value) {
+function asRecord5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function parseSseJson(body) {
@@ -15423,12 +16124,12 @@ function parseSseJson(body) {
   }
 }
 function unwrapToolResult(result) {
-  const record = asRecord4(result);
+  const record = asRecord5(result);
   if (!record) return result;
   const content = record.content;
   if (Array.isArray(content)) {
     const texts = content.map((part) => {
-      const item = asRecord4(part);
+      const item = asRecord5(part);
       if (!item) return "";
       return typeof item.text === "string" ? item.text : "";
     }).filter(Boolean);
@@ -15450,17 +16151,18 @@ function unwrapToolResult(result) {
   return result;
 }
 function textsFromUnknown(value) {
-  const record = asRecord4(value);
+  const record = asRecord5(value);
   if (!record) return "";
   if (typeof record.message === "string") return record.message;
   if (typeof record.error === "string") return record.error;
   return "";
 }
 async function abletimeMcpRequest(method, params, opts) {
-  const token = (opts?.token ?? getAbleTimeAccessToken())?.trim();
-  if (!token) {
+  const rawToken = opts?.token ?? await Promise.resolve().then(() => (init_abletime_oauth(), abletime_oauth_exports)).then((m) => m.ensureAbleTimeAccessToken());
+  if (!rawToken?.trim()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
+  const token = assertAbleTimeMcpCredential(rawToken);
   const url = abletimeMcpUrl(
     opts?.host ?? (opts?.token ? DEFAULT_ABLETIME_HOST : getAbleTimeHost()),
     { pm: opts?.pm }
@@ -15496,7 +16198,7 @@ async function abletimeMcpRequest(method, params, opts) {
       return parseSseJson(body);
     }
   })();
-  const rpc = asRecord4(parsed);
+  const rpc = asRecord5(parsed);
   if (rpc?.error) {
     const detail = typeof rpc.error.message === "string" && rpc.error.message.trim() ? rpc.error.message : `AbleTime MCP error ${rpc.error.code ?? ""}`.trim();
     throw new Error(rewriteAbleTimeError(detail));
@@ -15527,6 +16229,11 @@ async function callAbleTimeTool(name, args = {}, opts) {
   if (!opts?.token && !isAbleTimeConnected()) {
     throw new Error("AbleTime is not connected \u2014 paste a personal access token in Account settings");
   }
+  const rawToken = opts?.token ?? await Promise.resolve().then(() => (init_abletime_oauth(), abletime_oauth_exports)).then((m) => m.ensureAbleTimeAccessToken());
+  if (rawToken && ableTimeCredentialKind(rawToken) === "org") {
+    const { callAbleTimeRestTool: callAbleTimeRestTool2 } = await Promise.resolve().then(() => (init_abletime_rest(), abletime_rest_exports));
+    return callAbleTimeRestTool2(name, args, { ...opts, token: rawToken });
+  }
   const requestOpts = { ...opts, pm: opts?.pm ?? abletimeToolUsesPm(name) };
   const call = () => abletimeMcpRequest("tools/call", { name, arguments: args }, requestOpts).then((result) => {
     return unwrapToolResult(result);
@@ -15542,7 +16249,7 @@ async function callAbleTimeTool(name, args = {}, opts) {
     throw err instanceof Error ? new Error(rewriteAbleTimeError(err.message)) : err;
   }
 }
-var DEFAULT_ABLETIME_HOST, ABLETIME_MCP_PATH, ABLETIME_MCP_PM_PATH, MCP_PROTOCOL_VERSION, ABLETIME_PM_TOOL_NAMES;
+var DEFAULT_ABLETIME_HOST, ABLETIME_MCP_PATH, ABLETIME_MCP_PM_PATH, MCP_PROTOCOL_VERSION, ABLETIME_PM_TOOL_NAMES, ABLETIME_PAT_PREFIX, ABLETIME_ORG_KEY_PREFIX, ORG_KEY_HINT, REJECTED_CREDENTIAL_HINT, REWRITE_APPLIED;
 var init_abletime_mcp = __esm({
   "src/integrations/abletime-mcp.ts"() {
     "use strict";
@@ -15564,6 +16271,11 @@ var init_abletime_mcp = __esm({
       "archive_task",
       "delete_task"
     ];
+    ABLETIME_PAT_PREFIX = "apt_";
+    ABLETIME_ORG_KEY_PREFIX = "atk_";
+    ORG_KEY_HINT = "AbleTime MCP needs a personal access token (apt_\u2026) from Edit Profile \u2192 API Access, not an organization API key (atk_\u2026) from Settings \u2192 Integrations \u2192 API Keys.";
+    REJECTED_CREDENTIAL_HINT = "AbleTime rejected this credential (unknown, revoked, or expired). Use a personal access token (apt_\u2026) from Edit Profile \u2192 API Access \u2014 organization API keys (atk_\u2026) cannot call MCP. Tokens are shown once; rotating replaces the previous one.";
+    REWRITE_APPLIED = /— Enable Agent access \(MCP\)|— AbleTime MCP needs a personal access token|— AbleTime plan does not include API access|— AbleTime rejected this credential/;
   }
 });
 
@@ -15587,16 +16299,16 @@ __export(abletime_exports, {
   updateAbleTimeTask: () => updateAbleTimeTask,
   verifyAbleTimeConnection: () => verifyAbleTimeConnection
 });
-function asRecord5(value) {
+function asRecord6(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function asString(value) {
+function asString2(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 function firstString(record, keys) {
   if (!record) return "";
   for (const key of keys) {
-    const value = asString(record[key]);
+    const value = asString2(record[key]);
     if (value) return value;
   }
   return "";
@@ -15604,14 +16316,14 @@ function firstString(record, keys) {
 function firstRecord(record, keys) {
   if (!record) return null;
   for (const key of keys) {
-    const value = asRecord5(record[key]);
+    const value = asRecord6(record[key]);
     if (value) return value;
   }
   return null;
 }
-function asList(value) {
+function asList2(value) {
   if (Array.isArray(value)) return value;
-  const record = asRecord5(value);
+  const record = asRecord6(value);
   if (!record) return [];
   for (const key of ["data", "tasks", "projects", "items", "results", "nodes"]) {
     if (Array.isArray(record[key])) return record[key];
@@ -15623,21 +16335,21 @@ function labelsOf(record) {
   if (!Array.isArray(raw)) return [];
   return raw.map((item) => {
     if (typeof item === "string") return item.trim();
-    const rec = asRecord5(item);
+    const rec = asRecord6(item);
     return rec ? firstString(rec, ["name", "title", "label"]) : "";
   }).filter(Boolean);
 }
 function commentsOf(record) {
   const raw = record.comments ?? record.notes ?? record.discussion;
   const out = [];
-  for (const item of asList(raw)) {
-    const rec = asRecord5(item);
+  for (const item of asList2(raw)) {
+    const rec = asRecord6(item);
     if (!rec) continue;
-    const body = firstString(rec, ["body", "text", "comment", "content", "message"]);
+    const body = firstString(rec, ["body", "text", "comment", "message", "contentSanitized"]) || textFromAbleTimeDoc(rec.content);
     if (!body) continue;
-    const user = firstString(asRecord5(rec.user) ?? asRecord5(rec.author), ["name", "display_name"]) || firstString(rec, ["user_name", "author"]);
+    const user = firstString(asRecord6(rec.user) ?? asRecord6(rec.author), ["name", "display_name", "username"]) || firstString(rec, ["user_name", "author", "username"]);
     const comment = { body };
-    const id = firstString(rec, ["id", "comment_id"]);
+    const id = firstString(rec, ["id", "comment_id", "commentId"]);
     if (id) comment.id = id;
     const url = firstString(rec, ["url", "permalink"]);
     if (url) comment.url = url;
@@ -15661,11 +16373,11 @@ function taskUrl(task, host) {
   return `${base}/tasks/${slug}`;
 }
 function mapAbleTimeTask(raw, host) {
-  const record = asRecord5(raw);
+  const record = asRecord6(raw);
   if (!record) return null;
   const nested = firstRecord(record, ["task", "data"]) ?? record;
-  const id = firstString(nested, ["id", "task_id", "taskId"]);
-  const identifier = firstString(nested, ["reference", "ref", "identifier", "key", "code", "number"]) || id;
+  const id = firstString(nested, ["id", "task_id", "taskId", "timeflowTaskId"]);
+  const identifier = firstString(nested, ["reference", "ref", "identifier", "key", "code", "number", "taskRef"]) || id;
   const title = firstString(nested, ["title", "name"]);
   if (!id && !identifier && !title) return null;
   const resolvedId = id || identifier;
@@ -15676,21 +16388,22 @@ function mapAbleTimeTask(raw, host) {
     identifier: resolvedIdentifier,
     title: title || resolvedIdentifier,
     url,
-    description: firstString(nested, ["description", "body", "details"]) || void 0,
-    state: firstString(nested, ["state", "board_state", "boardState", "status"]) || void 0,
-    projectId: firstString(nested, ["project_id", "projectId"]) || firstString(asRecord5(nested.project), ["id"]) || void 0,
-    categoryId: firstString(nested, ["category_id", "categoryId"]) || firstString(asRecord5(nested.category), ["id"]) || void 0,
+    description: firstString(nested, ["description", "body", "details", "descriptionSanitized"]) || textFromAbleTimeDoc(nested.description) || void 0,
+    state: firstString(nested, ["state", "board_state", "boardState", "status", "taskState"]) || void 0,
+    projectId: firstString(nested, ["project_id", "projectId"]) || firstString(asRecord6(nested.project), ["id"]) || void 0,
+    categoryId: firstString(nested, ["category_id", "categoryId", "projectCategoryId"]) || firstString(asRecord6(nested.category), ["id"]) || void 0,
     assignee: assigneeOf(nested),
     labels: labelsOf(nested),
     comments: commentsOf(nested),
-    createdAt: firstString(nested, ["created_at", "createdAt", "created"]) || void 0,
+    createdAt: firstString(nested, ["created_at", "createdAt", "created", "dateCreated"]) || void 0,
     updatedAt: firstString(nested, [
       "updated_at",
       "updatedAt",
       "modified_at",
       "modifiedAt",
       "last_activity_at",
-      "lastActivityAt"
+      "lastActivityAt",
+      "lastUpdate"
     ]) || void 0
   };
 }
@@ -15721,16 +16434,16 @@ function issueAttachmentForAbleTimeTask(task) {
   };
 }
 function mapProject(raw) {
-  const record = asRecord5(raw);
+  const record = asRecord6(raw);
   if (!record) return null;
-  const id = firstString(record, ["id", "project_id"]);
-  const name = firstString(record, ["name", "title"]);
+  const id = firstString(record, ["id", "project_id", "projectId"]);
+  const name = firstString(record, ["name", "title", "projectName"]);
   if (!id && !name) return null;
-  const categories = asList(record.categories ?? record.category).map((item) => {
-    const rec = asRecord5(item);
+  const categories = asList2(record.categories ?? record.category).map((item) => {
+    const rec = asRecord6(item);
     if (!rec) return null;
-    const categoryId = firstString(rec, ["id", "category_id"]);
-    const categoryName = firstString(rec, ["name", "title"]);
+    const categoryId = firstString(rec, ["id", "category_id", "projectCategoryId", "categoryId"]);
+    const categoryName = firstString(rec, ["name", "title", "categoryName"]);
     if (!categoryId && !categoryName) return null;
     return { id: categoryId || categoryName, name: categoryName || categoryId };
   }).filter((item) => Boolean(item));
@@ -15742,21 +16455,21 @@ function isOpenTask(task) {
 }
 async function getAbleTimeOrientation(opts) {
   const raw = await callAbleTimeTool("orientation", {}, opts);
-  const record = asRecord5(raw);
+  const record = asRecord6(raw);
   const viewerRec = firstRecord(record, ["viewer", "user", "actor", "me", "person"]) ?? record;
   const viewer = {
     id: firstString(viewerRec, ["id", "user_id"]) || void 0,
     name: firstString(viewerRec, ["name", "display_name", "full_name"]) || firstString(record, ["name"]) || void 0
   };
-  const projects = asList(
+  const projects = asList2(
     record?.projects ?? record?.current_projects ?? record?.currentProjects
   ).map(mapProject).filter((item) => Boolean(item));
-  const tasks = asList(record?.tasks ?? record?.active_tasks ?? record?.activeTasks).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item));
+  const tasks = asList2(record?.tasks ?? record?.active_tasks ?? record?.activeTasks).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item));
   return { viewer, projects, tasks, raw };
 }
 async function listAbleTimeProjects(opts) {
   const raw = await callAbleTimeTool("list_projects", { include_categories: true }, opts);
-  return asList(raw).map(mapProject).filter((item) => Boolean(item));
+  return asList2(raw).map(mapProject).filter((item) => Boolean(item));
 }
 async function listAbleTimeTasks(opts) {
   const args = {};
@@ -15766,14 +16479,14 @@ async function listAbleTimeTasks(opts) {
   }
   if (opts?.query) args.query = opts.query;
   const raw = await callAbleTimeTool("list_tasks", args, opts);
-  const tasks = asList(raw).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item));
+  const tasks = asList2(raw).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item));
   return opts?.includeClosed ? tasks : tasks.filter(isOpenTask);
 }
 async function searchAbleTimeTasks(query, opts) {
   const q = query.trim();
   if (!q) return [];
   const raw = await callAbleTimeTool("search_tasks", { query: q, q }, opts);
-  return asList(raw).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item)).filter(isOpenTask);
+  return asList2(raw).map((item) => mapAbleTimeTask(item, opts?.host)).filter((item) => Boolean(item)).filter(isOpenTask);
 }
 async function getAbleTimeTask(id, opts) {
   const raw = await callAbleTimeTool("get_task", { id, task_id: id }, opts);
@@ -15821,7 +16534,7 @@ async function commentAbleTimeTask(input, opts) {
     { id, task_id: id, task: id, body, comment: body, text: body },
     opts
   );
-  const rec = asRecord5(raw);
+  const rec = asRecord6(raw);
   return {
     id: rec ? firstString(rec, ["id", "comment_id"]) || void 0 : void 0,
     body: rec ? firstString(rec, ["body", "text", "comment"]) || body : body
@@ -16011,8 +16724,7 @@ async function listAbleTimeAssignedIssues(opts) {
   };
 }
 async function verifyAbleTimeConnection(input) {
-  const token = input.token.trim();
-  if (!token) throw new Error("AbleTime personal access token is required");
+  const token = assertAbleTimeCredential(input.token);
   const host = input.host?.trim() || void 0;
   const orientation = await getAbleTimeOrientation({ token, host });
   saveAbleTimeConnection({
@@ -16028,6 +16740,7 @@ var init_abletime = __esm({
     "use strict";
     init_app_settings();
     init_abletime_mcp();
+    init_abletime_rest();
     CLOSED_STATES = /* @__PURE__ */ new Set([
       "done",
       "completed",
@@ -16599,12 +17312,19 @@ function buildQuotaHandoffAttachment(from, limitText, fallbackAgent) {
     ...instructions
   ].join("\n");
   return {
-    id: (0, import_node_crypto9.randomUUID)(),
+    id: (0, import_node_crypto10.randomUUID)(),
     name: orch ? "Orchestration quota handoff.md" : "Quota handoff.md",
     kind: "transcript",
     content: body
   };
 }
+async function isolateQuotaFailover(run2) {
+  try {
+    return await run2();
+  } catch {
+    return true;
+  }
+}
 function createQuotaFailoverChat(from, fallbackAgent, limitText) {
   const handoff = buildQuotaHandoffAttachment(from, limitText, fallbackAgent);
   const tab = createChatTab({
@@ -16623,11 +17343,11 @@ function createQuotaFailoverChat(from, fallbackAgent, limitText) {
   }
   return updateThread(tab.id, patch);
 }
-var import_node_crypto9, QUOTA_CONTINUE_PROMPT, QUOTA_RESUME_PROMPT;
+var import_node_crypto10, QUOTA_CONTINUE_PROMPT, QUOTA_RESUME_PROMPT;
 var init_quota_failover = __esm({
   "src/orchestrator/quota-failover.ts"() {
     "use strict";
-    import_node_crypto9 = require("crypto");
+    import_node_crypto10 = require("crypto");
     init_session_quota();
     init_app_settings();
     init_global_workspace();
@@ -18938,7 +19658,7 @@ var init_optional_services = __esm({
 });
 
 // src/plan/plan-present.ts
-function asRecord6(v) {
+function asRecord7(v) {
   return v != null && typeof v === "object" && !Array.isArray(v) ? v : null;
 }
 function isPresentPlanToolName(name) {
@@ -18950,7 +19670,7 @@ function extractPresentedPlan(parts) {
   for (let i = parts.length - 1; i >= 0; i--) {
     const p = parts[i];
     if (p.type !== "tool" || !isPresentPlanToolName(p.name)) continue;
-    const input = asRecord6(p.input) ?? {};
+    const input = asRecord7(p.input) ?? {};
     const content = typeof input.content === "string" ? input.content : typeof input.plan === "string" ? input.plan : typeof input.markdown === "string" ? input.markdown : "";
     if (!content.trim()) continue;
     const title = typeof input.title === "string" && input.title.trim() ? input.title.trim() : "Plan";
@@ -19385,7 +20105,7 @@ function buildTask(input, now) {
   const ts = nowIso2(now);
   const agent = input.agent ? coerceOrchestratorAgent(input.agent) : null;
   return {
-    id: (0, import_node_crypto10.randomUUID)(),
+    id: (0, import_node_crypto11.randomUUID)(),
     name: input.name?.trim() || defaultScheduleName(prompt),
     prompt,
     enabled: input.enabled !== false,
@@ -19472,11 +20192,11 @@ function recordScheduleRun(id, result) {
   writeAll2(rows);
   return next;
 }
-var import_node_crypto10, import_node_fs52, import_node_path49, import_croner, DURATION_RE, UNIT_MS;
+var import_node_crypto11, import_node_fs52, import_node_path49, import_croner, DURATION_RE, UNIT_MS;
 var init_schedules = __esm({
   "src/store/schedules.ts"() {
     "use strict";
-    import_node_crypto10 = require("crypto");
+    import_node_crypto11 = require("crypto");
     import_node_fs52 = require("fs");
     import_node_path49 = require("path");
     import_croner = require("croner");
@@ -20165,51 +20885,62 @@ var init_orchestrator = __esm({
         if (plan.action === "wait_reset" && plan.resumeAt) {
           this.haltDrain.add(threadId);
           this.scheduleQuotaResume(threadId, plan.resumeAt);
-          setStatus(threadId, "idle", null);
-          appendMessage(threadId, {
-            role: "agent",
-            text: `Sideboard will auto-retry this chat around ${plan.resumeAt.toLocaleString()} when the session limit resets.`,
-            ts: (/* @__PURE__ */ new Date()).toISOString()
-          });
-          this.emit({
-            type: "quota_failover",
-            threadId,
-            action: "wait_reset",
-            message: plan.reason,
-            resumeAt: plan.resumeAt.toISOString()
-          });
-          this.emit({ type: "status_changed", threadId, status: "idle" });
+          try {
+            setStatus(threadId, "idle", null);
+            appendMessage(threadId, {
+              role: "agent",
+              text: `Sideboard will auto-retry this chat around ${plan.resumeAt.toLocaleString()} when the session limit resets.`,
+              ts: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            this.emit({
+              type: "quota_failover",
+              threadId,
+              action: "wait_reset",
+              message: plan.reason,
+              resumeAt: plan.resumeAt.toISOString()
+            });
+            this.emit({ type: "status_changed", threadId, status: "idle" });
+          } catch {
+          }
           return true;
         }
         if (plan.action === "switch_agent" && plan.fallbackAgent) {
           this.haltDrain.add(threadId);
-          const next = createQuotaFailoverChat(
-            thread,
-            plan.fallbackAgent,
-            plan.limitText
-          );
+          let next;
+          try {
+            next = createQuotaFailoverChat(
+              thread,
+              plan.fallbackAgent,
+              plan.limitText
+            );
+          } catch {
+            return false;
+          }
           this.clearQuotaResumeTimer(threadId);
           try {
             updateThread(threadId, { quotaResumeAt: null });
           } catch {
           }
-          appendMessage(threadId, {
-            role: "agent",
-            text: `Session limit on ${thread.agent}. Sideboard continued on ${plan.fallbackAgent} (Auto) in [${next.title}](sideboard://thread/${next.id}).`,
-            ts: (/* @__PURE__ */ new Date()).toISOString()
-          });
-          this.emit({
-            type: "quota_failover",
-            threadId,
-            action: "switch_agent",
-            toThreadId: next.id,
-            message: plan.reason
-          });
-          this.emit({
-            type: "status_changed",
-            threadId: next.id,
-            status: next.status
-          });
+          try {
+            appendMessage(threadId, {
+              role: "agent",
+              text: `Session limit on ${thread.agent}. Sideboard continued on ${plan.fallbackAgent} (Auto) in [${next.title}](sideboard://thread/${next.id}).`,
+              ts: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            this.emit({
+              type: "quota_failover",
+              threadId,
+              action: "switch_agent",
+              toThreadId: next.id,
+              message: plan.reason
+            });
+            this.emit({
+              type: "status_changed",
+              threadId: next.id,
+              status: next.status
+            });
+          } catch {
+          }
           void this.send(
             next.id,
             QUOTA_CONTINUE_PROMPT(thread.agent, plan.fallbackAgent)
@@ -20940,9 +21671,8 @@ var init_orchestrator = __esm({
               this.maybeEnqueueJobContinue(threadId, chatText, parts);
             } else {
               const blob = [chatText, detail].filter(Boolean).join("\n");
-              const failedOver = await this.maybeHandleOrchestrationQuotaFailover(
-                threadId,
-                blob
+              const failedOver = await isolateQuotaFailover(
+                () => this.maybeHandleOrchestrationQuotaFailover(threadId, blob)
               );
               this.maybeEnqueueCrashContinue(threadId, {
                 detail: detail || failDetail,
@@ -20976,9 +21706,8 @@ var init_orchestrator = __esm({
               this.emit({ type: "status_changed", threadId, status: "error" });
             }
             this.emit({ type: "turn_finished", threadId, exitCode: 1 });
-            const failedOver = await this.maybeHandleOrchestrationQuotaFailover(
-              threadId,
-              message
+            const failedOver = await isolateQuotaFailover(
+              () => this.maybeHandleOrchestrationQuotaFailover(threadId, message)
             );
             this.maybeEnqueueCrashContinue(threadId, {
               detail: message,
@@ -22068,7 +22797,7 @@ init_system_ca();
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 var import_zod9 = require("zod");
-var import_node_crypto13 = require("crypto");
+var import_node_crypto14 = require("crypto");
 var import_node_path53 = require("path");
 init_orchestrator();
 init_worktree();
@@ -22495,8 +23224,8 @@ async function createGitHubIssue(input, opts) {
 init_fetch();
 
 // src/integrations/linear-oauth.ts
-var import_node_crypto11 = require("crypto");
-var import_node_http = require("http");
+var import_node_crypto12 = require("crypto");
+var import_node_http2 = require("http");
 init_app_settings();
 init_fetch();
 
@@ -22507,7 +23236,7 @@ var BAKED_LINEAR_CLIENT_ID = "39a15abc7ea5bea17c47f47f85ff5fd0";
 var LINEAR_OAUTH_PORT = 19848;
 var LINEAR_OAUTH_REDIRECT = `http://127.0.0.1:${LINEAR_OAUTH_PORT}/callback`;
 var LINEAR_TOKEN = "https://api.linear.app/oauth/token";
-var REFRESH_SKEW_MS2 = 5 * 6e4;
+var REFRESH_SKEW_MS3 = 5 * 6e4;
 function linearOAuthCredentials() {
   const settings = loadAppSettings();
   const clientId = process.env.SIDEBOARD_LINEAR_CLIENT_ID?.trim() || settings.integrations.linearClientId?.trim() || BAKED_LINEAR_CLIENT_ID.trim();
@@ -22548,7 +23277,7 @@ async function persistLinearTokens(data, viewer) {
     organizationName: viewer?.organizationName
   });
 }
-var refreshInFlight = null;
+var refreshInFlight2 = null;
 async function refreshLinearAccessToken(refreshToken) {
   const { clientId, clientSecret } = linearOAuthCredentials();
   const body = new URLSearchParams({
@@ -22575,16 +23304,16 @@ async function getLinearAuthToken(settings = loadAppSettings()) {
   const refresh = settings.integrations.linearRefreshToken?.trim() || "";
   const expiresAt = settings.integrations.linearTokenExpiresAt ?? 0;
   const apiKey = settings.integrations.linearApiKey?.trim() || "";
-  if (access && (!refresh || Date.now() < expiresAt - REFRESH_SKEW_MS2)) {
+  if (access && (!refresh || Date.now() < expiresAt - REFRESH_SKEW_MS3)) {
     return access;
   }
   if (refresh) {
-    if (!refreshInFlight) {
-      refreshInFlight = refreshLinearAccessToken(refresh).finally(() => {
-        refreshInFlight = null;
+    if (!refreshInFlight2) {
+      refreshInFlight2 = refreshLinearAccessToken(refresh).finally(() => {
+        refreshInFlight2 = null;
       });
     }
-    return refreshInFlight.catch((err) => {
+    return refreshInFlight2.catch((err) => {
       if (apiKey) return apiKey;
       throw err;
     });
@@ -25478,7 +26207,7 @@ init_worktree();
 init_paths();
 
 // src/board/board-pins.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var import_node_fs55 = require("fs");
 var import_node_path51 = require("path");
 init_paths();
@@ -26327,7 +27056,7 @@ async function startMcpServer() {
           const ident = issue?.identifier ?? ref.trim();
           const attachments = issue ? [
             {
-              id: (0, import_node_crypto13.randomUUID)(),
+              id: (0, import_node_crypto14.randomUUID)(),
               name: issue.identifier,
               kind: "issue",
               content: [