@taiga-ai/mcp-server 0.25.0-rc.464 → 0.25.0-rc.474

package/dist/index.js

@@ -356,11 +356,11 @@ var TaigaClient = class {
 	async getPolicyStanding(productId) {
 		return this.request("GET", `/products/${seg(productId)}/maintenance/policies`);
 	}
-	async remediatePolicyControl(productId, controlId) {
-		return this.request("POST", `/products/${seg(productId)}/maintenance/policies/controls/${seg(controlId)}/remediate`, {});
+	async remediatePolicyControl(productId, controlId, body = {}) {
+		return this.request("POST", `/products/${seg(productId)}/maintenance/policies/controls/${seg(controlId)}/remediate`, body);
 	}
-	async remediatePolicyViolation(productId, divergenceId) {
-		return this.request("POST", `/products/${seg(productId)}/maintenance/policies/divergences/${seg(divergenceId)}/remediate`, {});
+	async remediatePolicyViolation(productId, divergenceId, body = {}) {
+		return this.request("POST", `/products/${seg(productId)}/maintenance/policies/divergences/${seg(divergenceId)}/remediate`, body);
 	}
 	async listInbox(opts) {
 		const { productId, ...rest } = opts;
@@ -670,6 +670,29 @@ const POLICY_TYPE_BY_CONTROL_PREFIX = {
 	SCS: "policy_supply_chain",
 	CLD: "policy_cloud_governance"
 };
+/** The policy document a control id belongs to, or undefined for an unknown prefix. */
+function policyTypeForControl(controlId) {
+	return POLICY_TYPE_BY_CONTROL_PREFIX[controlId.split("-")[0] ?? ""];
+}
+/**
+* The policy a control id points a reader to (PRO-2809): its rightmost base
+* prefix. An overlay family names its host policy last: TEL-TIC-1.1 is a
+* telecom control in policy_tic, HC-FI-DATA-1.1 a Finnish healthcare control in
+* policy_data, ARC-AWS-5 an AWS preset in policy_architecture. A regulatory
+* family with no base prefix (GDPR, NIS2, AIACT) spans several policies and
+* names none.
+*
+* For saying where to read a control, not for deciding who holds it:
+* {@link policyTypeForControl} keeps an overlay control with the document it is
+* written in, whatever its id says.
+*/
+function policyNamedByControl(controlId) {
+	const prefixes = controlId.split("-").filter((part) => /^[A-Z]/.test(part));
+	for (let at = prefixes.length - 1; at >= 0; at -= 1) {
+		const owner = POLICY_TYPE_BY_CONTROL_PREFIX[prefixes[at]];
+		if (owner) return owner;
+	}
+}
 /**
 * The shape of a control id in a policy's control table: `SEC-3.4`, and the
 * overlay families too (`TEL-TIC-1.1`, `HC-FI-DATA-1.1`, `GDPR-1.1`). One
@@ -2663,17 +2686,6 @@ const sectionsInput = z.array(z.string().min(1).max(200)).max(50).optional().des
 /** The sections input of a company document, where a policy control id also names the sections that state it. */
 const policySectionsInput = sectionsInput.describe("Only these sections, by id, or a policy control id (SEC-5.1) for the sections that state it; [] for the outline (under outline: every section id and its size, no text); omit for the whole document");
 /**
-* The policy that states a control: the rightmost policy prefix in its id, so an overlay family's
-* TEL-TIC-1.1 is policy_tic and HC-FI-DATA-1.1 policy_data, as the overlays file them.
-*/
-function policyOfControl(id) {
-	const prefixes = id.split("-").filter((part) => /^[A-Z]/.test(part));
-	for (const prefix of prefixes.reverse()) {
-		const policy = POLICY_TYPE_BY_CONTROL_PREFIX[prefix];
-		if (policy) return policy;
-	}
-}
-/**
 * The sections that state each control id asked for (PRO-2800): policy
 * standing cites SEC-5.1, and the section holding it has an id of its own
 * (secretsManagement) an agent could only guess. A control id is found in
@@ -2699,7 +2711,7 @@ function withControls(outline, sections, policyType) {
 	return outline.map((entry) => {
 		const text = sectionContent(sections, entry.id) ?? "";
 		const ids = [...new Set([...text.matchAll(pattern)].filter((match) => !/^_?Reserved_?/i.test(match[2] ?? "")).map((match) => match[1]).filter((id) => {
-			const owner = POLICY_TYPE_BY_CONTROL_PREFIX[id.split("-")[0] ?? ""];
+			const owner = policyTypeForControl(id);
 			return owner === void 0 || owner === policyType;
 		}))];
 		return ids.length > 0 ? {
@@ -2727,7 +2739,7 @@ function sectionReadResult(doc, asked, label, options = {}) {
 	const known = ids.filter((id) => all.includes(id));
 	const found = Object.keys(controls).length > 0 ? { controls } : {};
 	const asControl = options.controlIds ? void 0 : unknownSections.find((id) => isControlId(id));
-	const policy = asControl ? policyOfControl(asControl) : void 0;
+	const policy = asControl ? policyNamedByControl(asControl) : void 0;
 	const controlNote = asControl ? { note: policy ? `${asControl} is a control of ${policy}: read it with taiga_get_document (type: ${policy}, sections: ["${asControl}"]).` : `${asControl} looks like a policy control id, which only a policy resolves: taiga_get_document without type lists them.` } : {};
 	if (known.length === 0) {
 		const { data: _data, ...meta } = cut.doc;
@@ -3729,6 +3741,22 @@ function runOutcome(run) {
 	};
 }
 /**
+* What hardening left blocking, in a sentence: the findings the run names (PRO-2817), or, for a run reported before
+* it recorded them, how many.
+*/
+function hardeningSaid(blocking, named) {
+	const count = `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix`;
+	if (named.length === 0) return `${count}; the run records how many, not which.`;
+	const shown = named.slice(0, 3).map((finding) => {
+		const message = String(finding["message"]);
+		const where = finding["line"] ? `${String(finding["path"])}:${String(finding["line"])}` : String(finding["path"]);
+		return `${message} (${String(finding["tool"])}, ${where})`;
+	});
+	const rest = blocking - shown.length;
+	const recorded = named.length > shown.length ? `, ${named.length} recorded in taiga_get_run` : "";
+	return `${count}: ${shown.join("; ")}${rest > 0 ? `; and ${rest} more${recorded}` : ""}.`;
+}
+/**
 * What each failedReason means for the next move (PRO-2800): reviewers met dispatch_rejected and agent_reported as
 * bare enums. As @taiga/types documents them.
 */
@@ -3753,10 +3781,11 @@ function readableRun(run, opts = {}) {
 	const means = FAILED_REASON_MEANS[String(run["failedReason"])];
 	const hardening = run["hardeningResult"];
 	const blocking = typeof hardening?.blockingFindings === "number" ? hardening.blockingFindings : 0;
+	const named = Array.isArray(hardening?.blocking) ? hardening.blocking : [];
 	return {
 		...rest,
 		...means ? { failedReasonMeans: means } : {},
-		...blocking > 0 ? { hardeningNote: `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix; the run records how many, not which.` } : {},
+		...blocking > 0 ? { hardeningNote: hardeningSaid(blocking, named) } : {},
 		...opts.row || error === void 0 ? {} : { error },
 		...opts.row || reviewEscalation === void 0 ? {} : { reviewEscalation },
 		...typeof rest["prNumber"] === "number" || rest["prUrl"] ? { prDraft } : {},
@@ -3769,20 +3798,27 @@ const INITIATIVE_CHECKS = 10;
 * The status of the initiative behind each run still waiting on its pull
 * request (PRO-2800). A reviewing agent read a run of a canceled initiative as
 * "waiting for a person to review and merge" while Action Required called the
-* same review stale. A 404 is 'deleted'. Best effort: an initiative past the
-* cap, one whose read failed, and every one without backlog:read is
-* 'unchecked', which withInitiativeState adds to the row's outcome.
+* same review stale.
+*
+* The run says it itself since PRO-2808 (initiativeClosed: done, canceled,
+* archived, deleted, or null while live), for every key that can read it.
+* Against an API from before that, each initiative is read: a 404 is
+* 'deleted', and an initiative past the cap, one whose read failed, and every
+* one without backlog:read is 'unchecked', which withInitiativeState adds to
+* the row's outcome.
 */
 async function initiativeStates(client, rows) {
 	const states = /* @__PURE__ */ new Map();
 	const waiting = rows.filter((row) => ["needs_review", "completed"].includes(String(row["status"])) && row["prMerged"] !== true);
-	const all = [...new Set(waiting.map((row) => row["backlogItemId"]).filter((id) => typeof id === "string"))];
+	const told = waiting.filter((row) => "initiativeClosed" in row);
+	for (const row of told) if (typeof row["backlogItemId"] === "string") states.set(row["backlogItemId"], typeof row["initiativeClosed"] === "string" ? row["initiativeClosed"] : "live");
+	const all = [...new Set(waiting.filter((row) => !("initiativeClosed" in row)).map((row) => row["backlogItemId"]).filter((id) => typeof id === "string" && !states.has(id)))];
 	const ids = client.hasCapability("backlog:read") ? all.slice(0, INITIATIVE_CHECKS) : [];
 	for (const id of all) if (!ids.includes(id)) states.set(id, "unchecked");
 	await Promise.all(ids.map(async (id) => {
 		try {
 			const item = (await client.getBacklogItem(id)).data;
-			states.set(id, String(item["status"] ?? item["state"]));
+			states.set(id, item["archivedAt"] ? "archived" : String(item["status"] ?? item["state"]));
 		} catch (error) {
 			if (error instanceof TaigaApiError && error.status === 404) return void states.set(id, "deleted");
 			if (!(error instanceof TaigaApiError || isNetworkFailure(error))) throw error;
@@ -3791,7 +3827,18 @@ async function initiativeStates(client, rows) {
 	}));
 	return states;
 }
-/** A readable run row that also says when its initiative was canceled or deleted while its pull request waited. */
+/**
+* How each way an initiative ends reads on a run it left waiting: the same set
+* Action Required closes a run's review for (PRO-2806). A done one's waiting
+* run is not the one that landed it: that run is merged and never waiting.
+*/
+const INITIATIVE_ENDED = {
+	done: "was marked done",
+	canceled: "was canceled",
+	archived: "was archived",
+	deleted: "was deleted"
+};
+/** A readable run row that also says when its initiative ended while its pull request waited. */
 function withInitiativeState(row, states) {
 	const state = states.get(String(row["backlogItemId"]));
 	if (!["gated", "unmerged"].includes(String(row["disposition"]))) return row;
@@ -3799,14 +3846,15 @@ function withInitiativeState(row, states) {
 		...row,
 		outcome: `${String(row["outcome"])} Whether its initiative still wants it was not checked.`
 	};
-	if (state !== "canceled" && state !== "deleted") return row;
+	const ended = state ? INITIATIVE_ENDED[state] : void 0;
+	if (!ended) return row;
 	const pr = typeof row["prNumber"] === "number" ? `PR #${row["prNumber"]}` : "its pull request";
 	const open = row["prState"] === "open" ? ` ${pr} is still open on the forge.` : "";
 	return {
 		...row,
 		disposition: "abandoned",
 		actions: [],
-		outcome: `Its initiative was ${state}, so nobody is waiting on this run.${open}`
+		outcome: `Its initiative ${ended}, so nobody is waiting on this run.${open}`
 	};
 }
 /** A step that changed only prose: no code of its own could have broken a test. */
@@ -3913,7 +3961,7 @@ function registerBuildTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_runs", {
 		title: "List runs",
-		description: "List coding agent runs, newest first: branch, pull request, step progress, outcome (one sentence), actions and disposition: in_flight, gated (a person owes a review and merge), succeeded (merged), failed, stopped, rejected (pull request closed unmerged), unmerged, or abandoned (initiative canceled or deleted). Without productId, every product's runs; active: true keeps running ones. taiga_get_run reads one; carry work on from the initiative (taiga_resume_initiative).",
+		description: "List coding agent runs, newest first: branch, pull request, step progress, outcome (one sentence), actions and disposition: in_flight, gated (a person owes a review and merge), succeeded (merged), failed, stopped, rejected (pull request closed unmerged), unmerged, or abandoned (its initiative ended: done, canceled, archived or deleted). Without productId, every product's runs; active: true keeps running ones. taiga_get_run reads one; carry work on from the initiative (taiga_resume_initiative).",
 		inputSchema: z.object({
 			productId: productId.optional(),
 			initiativeId: idInput("initiative", "taiga_list_initiatives (query finds one by title) gives it").optional().describe("Only this initiative's runs -- get from taiga_list_initiatives; needs productId"),
@@ -4236,6 +4284,7 @@ function situationOf(item) {
 		const handback = handbackSaid(build.reviewEscalation);
 		if (handback) stage += `, handed back because ${handback}`;
 	}
+	if (life.stage === "done" || life.stage === "canceled") stage += endingSaid(item);
 	parts.push(`${stage}.`);
 	if (typeof item["needsHumanCause"] === "string") {
 		const why = [renderHalt({
@@ -4253,6 +4302,26 @@ function situationOf(item) {
 	else if (move) parts.push(`Next: ${move}.`);
 	return parts.join(" ");
 }
+/**
+* How a settled initiative ended, as the rest of its "Done" or "Canceled"
+* sentence (PRO-2821): the pull request that landed it, the move that settled
+* it and who made it, and what took over. Only the single read carries
+* `ending`; a list row says nothing more.
+*/
+function endingSaid(item) {
+	const ending = item["ending"];
+	const merged = typeof ending?.landedPr?.number === "number" ? ending.landedPr.number : null;
+	const said = [];
+	if (merged !== null) said.push(`: PR #${merged} merged`);
+	else if (ending && (ending.via === "moved" || ending.via === "off_the_line")) {
+		const who = typeof ending.by?.name === "string" ? ending.by.name : ending.by?.type === "system" ? "Taiga" : "someone";
+		const when = typeof ending.at === "string" ? ` on ${ending.at.slice(0, 10)}` : "";
+		said.push(ending.via === "off_the_line" ? ` by ${who}${when}, who took it off the line` : ` by ${who}${when}`);
+	}
+	const next = ending?.supersededBy;
+	if (next && typeof next.id === "string") said.push(`; superseded by "${String(next.title)}" (${next.id})`);
+	return said.join("");
+}
 /** A row or item with its situation added when it has a lifecycle. */
 function withSituation(item, row = item) {
 	const situation = situationOf(item);
@@ -4815,7 +4884,7 @@ function registerMaintenanceTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_findings", {
 		title: "List maintenance findings",
-		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (upstream_only: no fixed version), breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.",
+		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.",
 		inputSchema: z.object({
 			productId,
 			status: z.enum(MAINTENANCE_FINDING_STATUSES).optional().describe("Only findings in this status; omit for the ones needing action"),
@@ -4861,7 +4930,7 @@ function registerMaintenanceTools(server, client) {
 	}));
 	server.registerTool("taiga_get_policy_standing", {
 		title: "Get a product's policy standing",
-		description: "How a product stands against the organization's published policies: summary counts, when the documents were assessed, and each violated control with its violations (critical and high only, citing the policy sentence and the contradicting passage) and the work on each. state: breached (open scanner findings map to it, by findingsByTier; routine-only is not urgent) or diverged (the documents contradict it). live: false means the violation's initiative ended without fixing it: it needs a person or a new fix. An unlisted control is not \"passing\" (summary.controlsWithNothingRecorded counts them). full: true adds evidence and resolved ones. Fix with taiga_fix_policy_violation.",
+		description: "How a product stands against the organization's published policies: summary counts, when the documents were assessed, and each violated control with its violations (critical and high only, citing the policy sentence and the contradicting passage) and the work on each. state: breached (open scanner findings map to it, by findingsByTier; routine-only is not urgent) or diverged (the documents contradict it). live: false means the violation's initiative ended without fixing it: it needs a person or a new fix. raisedFor: false means the link is the backlog planner's: it said an initiative a person asked it for would close the violation, which may be a dedicated fix or broader work; true means a fix was raised for it (taiga_fix_policy_violation or the sweep). An unlisted control is not \"passing\" (summary.controlsWithNothingRecorded counts them). full: true adds evidence and resolved ones. Fix with taiga_fix_policy_violation.",
 		inputSchema: z.object({
 			productId,
 			full: z.boolean().optional().describe("Carry each violation's evidence and policy excerpt, cut to about 1,500 characters each, and up to 20 resolved violations (default false)"),
@@ -4944,7 +5013,7 @@ function registerMaintenanceTools(server, client) {
 	}));
 	server.registerTool("taiga_fix_finding", {
 		title: "Fix a finding",
-		description: "Raise an initiative that fixes a maintenance finding, at the end of the product's line; it ends in a pull request a person merges, and the initiative's review gate applies. wholeGroup: true fixes the group in one initiative: every open advisory on that package version in one bump, or every location the same rule flagged. Refused for a secret only in history, anything in a submodule, and remediableBy upstream_only.",
+		description: "Raise an initiative that fixes a maintenance finding, at the end of the product's line; it ends in a pull request a person merges, and the initiative's review gate applies. wholeGroup: true fixes the group in one initiative: every open advisory on that package version in one bump, or every location the same rule flagged. Refused for a secret only in history, remediableBy upstream_only (code in a submodule), and a dependency with no fixed version yet (fixable: false).",
 		inputSchema: z.object({
 			productId,
 			findingId,
@@ -4970,16 +5039,18 @@ function registerMaintenanceTools(server, client) {
 	}));
 	server.registerTool("taiga_fix_policy_violation", {
 		title: "Fix policy violations",
-		description: "Raise one initiative that fixes a product's policy violations and add it to the end of the line. Name a control to cover all its violations with no initiative yet, or one violationId when the control has several. The violation stays listed until the next assessment no longer finds it, even while the fix is under way.",
+		description: "Raise one initiative that fixes a product's policy violations and add it to the end of the line. Name a control to cover all its violations with no initiative yet, or one violationId when the control has several. The violation stays listed until the next assessment no longer finds it, even while the fix is under way. A violation whose last fix was done after it was last assessed is refused: refresh the reality documents to reassess it first, or pass fixAgain: true if the person wants another fix anyway.",
 		inputSchema: z.object({
 			productId,
 			controlId: z.string().min(1).max(40).optional().describe("The control's identifier, e.g. SEC-3.4"),
-			violationId: idInput("violation", "taiga_get_policy_standing gives it").optional()
+			violationId: idInput("violation", "taiga_get_policy_standing gives it").optional(),
+			fixAgain: z.boolean().optional().describe("Raise a fix even though the last one was done after the last assessment (default false)")
 		}),
 		annotations: OPERATE
 	}, (params) => runTool(async () => {
 		if (params.controlId === void 0 === (params.violationId === void 0)) return toolError("VALIDATION_ERROR", "Name either a control (controlId) or one violation (violationId), not both or neither.");
-		return toolResult((params.controlId ? await client.remediatePolicyControl(params.productId, params.controlId) : await client.remediatePolicyViolation(params.productId, params.violationId)).data);
+		const body = { refuseIfFixedSinceAssessment: params.fixAgain !== true };
+		return toolResult((params.controlId ? await client.remediatePolicyControl(params.productId, params.controlId, body) : await client.remediatePolicyViolation(params.productId, params.violationId, body)).data);
 	}));
 }
 //#endregion
@@ -5196,7 +5267,8 @@ const SETUP_TASK_FIELDS = [
 	"providerActionUrl",
 	"inboxItemId",
 	"inboxItemStatus",
-	"createdAt"
+	"createdAt",
+	"stale"
 ];
 /** The API's count across every page, on the first page; nothing from an API that does not send one. */
 function totalOf(result) {
@@ -5236,7 +5308,10 @@ function sameKeyOnce(rows) {
 			const { alsoFiledAs: _also, ...was } = kept;
 			for (const field of Object.keys(kept)) delete kept[field];
 			Object.assign(kept, row, { alsoFiledAs: [...also, record(was)] });
-		} else kept["alsoFiledAs"] = [...also, record(row)];
+		} else {
+			kept["alsoFiledAs"] = [...also, record(row)];
+			if (isOpen(row) && row["stale"] === void 0) delete kept["stale"];
+		}
 	}
 	return out;
 }
@@ -5311,7 +5386,7 @@ function registerInboxTools(server, client) {
 	}));
 	server.registerTool("taiga_list_setup_tasks", {
 		title: "List setup tasks",
-		description: "List what a person must set up for a product (secrets, variables, accounts), with exactly what and where: key (the name to create; Taiga never stores values), the provider page, and phase: prereq (the deploy fails without it), wiring (generated values back to providers) or followup (can wait until after launch). Runs do not wait for them. One product or all, oldest first; includeDone: true adds done and dismissed. A variable filed twice lists the others under alsoFiledAs; totalCount counts records, and a page that folded some says recordsOnPage. Unlike taiga_list_action_required, which lists the same work as items to resolve.",
+		description: "List what a person must set up for a product (secrets, variables, accounts), with exactly what and where: key (the name to create; Taiga never stores values), the provider page, and phase: prereq (the deploy fails without it), wiring (generated values back to providers) or followup (can wait until after launch). Runs do not wait for them. One product or all, oldest first; includeDone: true adds done and dismissed. A variable filed twice lists the others under alsoFiledAs; totalCount counts records, and a page that folded some says recordsOnPage. stale on an open task says no document derived from the code since it was raised mentions its key: it may not apply any more, so check before asking anyone to set it. Unlike taiga_list_action_required, which lists the same work as items to resolve.",
 		inputSchema: z.object({
 			productId: productId.optional(),
 			includeDone: z.boolean().optional().describe("Also the tasks already done or dismissed (default false)"),
@@ -21059,7 +21134,8 @@ const GITHUB_REPOSITORY_FIELDS = [
 	"defaultBranch",
 	"description",
 	"language",
-	"linked"
+	"linked",
+	"linkedProduct"
 ];
 const repositoryId = idInput("repository link", "taiga_list_product_repositories gives it; a linkable repository id is not one");
 /** Round-robin over lists: the first of each, then the second of each, and so on. */
@@ -21075,7 +21151,8 @@ function interleave(lists) {
 */
 async function holderOf(client, error, productId) {
 	if (!(error instanceof TaigaApiError) || error.status !== 409) return null;
-	const name = /^(\S+\/\S+) is already linked to another product\.?$/.exec(error.apiMessage ?? "")?.[1];
+	if (error.details?.["holder"]) return null;
+	const name = /^(\S+\/\S+) is already linked to another product\./.exec(error.apiMessage ?? "")?.[1];
 	if (!name) return null;
 	try {
 		const holders = (await client.listProducts({
@@ -21137,7 +21214,7 @@ function registerRepositoryTools(server, client) {
 	}
 	if (client.hasCapability("vcs:read")) server.registerTool("taiga_list_linkable_repositories", {
 		title: "Find a repository to link",
-		description: "List the repositories the organization's GitHub connection can reach, to link one with taiga_link_repository (it takes the row's id as linkableRepositoryId). query searches by name; account (login, owner, or installationId) reads one account, else rows come from every account in turn. linked: true means a product already links it (taiga_get_product with its URL says which). No connection means GitHub is not connected yet; someone who can install the app does that once, in the web.",
+		description: "List the repositories the organization's GitHub connection can reach, to link one with taiga_link_repository (it takes the row's id as linkableRepositoryId). query searches by name; account (login, owner, or installationId) reads one account, else rows come from every account in turn. linked: true means a product already links it, and linkedProduct names it to a key that sees every product. No connection means GitHub is not connected yet; someone who can install the app does that once, in the web.",
 		inputSchema: z.object({
 			query: z.string().trim().min(1).max(256).optional().describe("Part of the repository name"),
 			account: z.string().trim().min(1).max(140).optional().describe("The GitHub account login (the owner in owner/repo), case-insensitive"),
@@ -21406,41 +21483,29 @@ const MISSING_DOCUMENTS_HOW = "An imported product gets them from its import (ta
 /**
 * Refuse a name already taken (PRO-2800): the API appends -2 to the slug and
 * creates a second one, so a retried call or two agents at once left
-* duplicates nobody asked for. allowDuplicateName says the person means it.
+* duplicates nobody asked for. The API checks it in the create's transaction
+* (PRO-2808), so names past any page and two creates at once are caught too.
+* allowDuplicateName says the person means it.
 */
 const allowDuplicateName = z.boolean().optional().describe("Create it even when one with the same name exists (default false: refused, naming the existing one)");
-/** The same name, as a person would read it: case and surrounding space aside. */
-const sameName = (a, b) => a.trim().toLowerCase() === b.trim().toLowerCase();
-/** Pages read looking for a taken name; past this the create goes ahead. */
-const NAME_PAGES = 5;
-/**
-* The first row with this name, across pages. Best effort: a list the API
-* refuses or fails leaves the check out rather than the create.
-*/
-async function firstNamed(name, read) {
-	let cursor;
-	try {
-		for (let pageIndex = 0; pageIndex < NAME_PAGES; pageIndex += 1) {
-			const result = await read(cursor);
-			const same = result.data.find((row) => sameName(row.name, name));
-			if (same) return same;
-			if (!result.nextCursor) return null;
-			cursor = result.nextCursor;
-		}
-	} catch (error) {
-		if (!(error instanceof TaigaApiError || isNetworkFailure(error))) throw error;
-	}
-	return null;
-}
 /**
-* The refusal names the one that exists and leaves the choice to the person: another session may have made it, so
-* "use it" would hand the agent someone else's work (PRO-2800, review 6).
-*/
-function duplicateName(kind, existing, where) {
-	const made = typeof existing.createdAt === "string" ? `, created ${existing.createdAt}` : "";
-	return toolError("DUPLICATE_NAME", `A ${kind} named "${existing.name}" already exists ${where} (${existing.id}${made}). It may not be this person's: ask whether they meant that one, want another name, or want a second (allowDuplicateName: true).`, {
-		existingId: existing.id,
-		...existing.slug ? { existingSlug: existing.slug } : {}
+* The API's refusal of a taken name, as the tool's: it names the one that
+* exists when the caller may read it, and leaves the choice to the person.
+* Another session may have made it, so "use it" would hand the agent someone
+* else's work (PRO-2800, review 6). Anything else is not this refusal.
+*/
+function duplicateName(kind, error, where) {
+	if (!(error instanceof TaigaApiError) || error.status !== 409 || error.details?.["reason"] !== "duplicate_name") return null;
+	const said = (key) => typeof error.details?.[key] === "string" ? error.details[key] : void 0;
+	const [existingId, existingSlug, name, createdAt] = [
+		said("existingId"),
+		said("existingSlug"),
+		said("existingName"),
+		said("existingCreatedAt")
+	];
+	return toolError("DUPLICATE_NAME", `${name ? `A ${kind} named "${name}"` : `A ${kind} with this name`} already exists ${where}${existingId ? ` (${existingId}${createdAt ? `, created ${createdAt}` : ""})` : ""}. ${existingId ? "It may not be this person's: ask whether they meant that one, want another name, or want a second" : "The caller cannot read it: ask whether they want another name or a second"} (allowDuplicateName: true).`, {
+		...existingId ? { existingId } : {},
+		...existingSlug ? { existingSlug } : {}
 	});
 }
 /** A product row the model can act on: how it started, and while in setup what it still needs. */
@@ -21481,14 +21546,16 @@ function registerSetupTools(server, client) {
 			}),
 			annotations: WRITE
 		}, (params) => runTool(async () => {
-			if (!params.allowDuplicateName) {
-				const same = await firstNamed(params.name, async (cursor) => client.listFactories({
-					limit: 100,
-					cursor
-				}));
-				if (same) return duplicateName("factory", same, "in this organization");
+			try {
+				return toolResult(pickFields([(await client.createFactory({
+					name: params.name,
+					refuseDuplicateName: !params.allowDuplicateName
+				})).data], FACTORY_FIELDS)[0]);
+			} catch (error) {
+				const refused = duplicateName("factory", error, "in this organization");
+				if (refused) return refused;
+				throw error;
 			}
-			return toolResult(pickFields([(await client.createFactory({ name: params.name })).data], FACTORY_FIELDS)[0]);
 		}));
 		server.registerTool("taiga_rename_factory", {
 			title: "Rename a factory",
@@ -21553,22 +21620,22 @@ function registerSetupTools(server, client) {
 	}, (params) => runTool(async () => {
 		const contradiction = notesWithNothingToDescribe(params);
 		if (contradiction) return contradiction;
-		if (!params.allowDuplicateName) {
-			const same = await firstNamed(params.name, async (cursor) => client.listProducts({
+		let product;
+		try {
+			product = (await client.createProduct({
+				name: params.name,
 				factoryId: params.factoryId,
-				limit: 100,
-				cursor
-			}));
-			if (same) return duplicateName("product", same, "in this factory");
+				...params.start === "import" ? { projectType: "brownfield" } : {},
+				...params.ownsInfrastructure !== void 0 ? { ownsInfrastructure: params.ownsInfrastructure } : {},
+				...params.ownsDeployment !== void 0 ? { ownsDeployment: params.ownsDeployment } : {},
+				...params.deploymentNotes !== void 0 ? { deploymentNotes: params.deploymentNotes } : {},
+				refuseDuplicateName: !params.allowDuplicateName
+			})).data;
+		} catch (error) {
+			const refused = duplicateName("product", error, "in this factory");
+			if (refused) return refused;
+			throw error;
 		}
-		const product = (await client.createProduct({
-			name: params.name,
-			factoryId: params.factoryId,
-			...params.start === "import" ? { projectType: "brownfield" } : {},
-			...params.ownsInfrastructure !== void 0 ? { ownsInfrastructure: params.ownsInfrastructure } : {},
-			...params.ownsDeployment !== void 0 ? { ownsDeployment: params.ownsDeployment } : {},
-			...params.deploymentNotes !== void 0 ? { deploymentNotes: params.deploymentNotes } : {}
-		})).data;
 		return toolResult(await productRow(client, product));
 	}));
 	server.registerTool("taiga_update_product", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.25.0-rc.464",
+  "version": "0.25.0-rc.474",
   "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
   "type": "module",
   "main": "./dist/index.js",

package/src/client.ts

@@ -31,6 +31,7 @@ import type {
   MonitoringHistory,
   MoveProductResult,
   PolicyConformance,
+  PolicyRemediationInput,
   PolicyRemediationResult,
   Product,
   ProductDocument,
@@ -44,6 +45,8 @@ import type {
   SetupTaskListEntry,
   TenantDocument,
   UptimeReport,
+  CreateFactoryInput,
+  CreateProductInput,
 } from '@taiga/types';
 import { SERVER_VERSION } from './version.js';
 
@@ -645,19 +648,19 @@ export class TaigaClient {
     return this.request<One<PolicyConformance>>('GET', `/products/${seg(productId)}/maintenance/policies`);
   }
 
-  async remediatePolicyControl(productId: string, controlId: string) {
+  async remediatePolicyControl(productId: string, controlId: string, body: PolicyRemediationInput = {}) {
     return this.request<One<PolicyRemediationResult>>(
       'POST',
       `/products/${seg(productId)}/maintenance/policies/controls/${seg(controlId)}/remediate`,
-      {}
+      body
     );
   }
 
-  async remediatePolicyViolation(productId: string, divergenceId: string) {
+  async remediatePolicyViolation(productId: string, divergenceId: string, body: PolicyRemediationInput = {}) {
     return this.request<One<PolicyRemediationResult>>(
       'POST',
       `/products/${seg(productId)}/maintenance/policies/divergences/${seg(divergenceId)}/remediate`,
-      {}
+      body
     );
   }
 
@@ -844,7 +847,7 @@ export class TaigaClient {
     return this.request<Page<Factory>>('GET', `/factories${qs ? `?${qs}` : ''}`);
   }
 
-  async createFactory(body: { name: string }) {
+  async createFactory(body: CreateFactoryInput) {
     return this.request<One<Factory>>('POST', '/factories', body);
   }
 
@@ -856,14 +859,18 @@ export class TaigaClient {
   // Setting a product up
   // ---------------------------------------------------------------------------
 
-  async createProduct(body: {
-    name: string;
-    factoryId: string;
-    projectType?: 'brownfield' | undefined;
-    ownsInfrastructure?: boolean | null | undefined;
-    ownsDeployment?: boolean | null | undefined;
-    deploymentNotes?: string | undefined;
-  }) {
+  async createProduct(
+    body: Pick<
+      CreateProductInput,
+      | 'name'
+      | 'factoryId'
+      | 'projectType'
+      | 'ownsInfrastructure'
+      | 'ownsDeployment'
+      | 'deploymentNotes'
+      | 'refuseDuplicateName'
+    >
+  ) {
     return this.request<One<Product>>('POST', '/products', body);
   }