@taiga-ai/mcp-server 0.26.0-dev.511 → 0.26.0-dev.516

package/dist/index.js

@@ -321,6 +321,7 @@ var TaigaClient = class {
 	async listBuildRuns(productId, opts) {
 		const params = new URLSearchParams();
 		if (opts?.backlogItemId) params.set("backlogItemId", opts.backlogItemId);
+		if (opts?.status?.length) params.set("status", opts.status.join(","));
 		if (opts?.limit) params.set("limit", String(opts.limit));
 		if (opts?.cursor) params.set("cursor", opts.cursor);
 		const qs = params.toString();
@@ -330,6 +331,7 @@ var TaigaClient = class {
 	async listBuildRunActivity(opts) {
 		const params = new URLSearchParams();
 		if (opts?.active) params.set("active", "true");
+		if (opts?.status?.length) params.set("status", opts.status.join(","));
 		if (opts?.limit) params.set("limit", String(opts.limit));
 		if (opts?.cursor) params.set("cursor", opts.cursor);
 		const qs = params.toString();
@@ -356,6 +358,17 @@ var TaigaClient = class {
 	async getFinding(id) {
 		return this.request("GET", `/maintenance/findings/${seg(id)}`);
 	}
+	/** The package inventory (PRO-2862); 404 where the `licenses` feature is not enabled. */
+	async listPackages(productId, opts) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/packages${query$1({ ...opts })}`);
+	}
+	async getLicenseSummary(productId) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/licenses`);
+	}
+	/** A repository's CycloneDX 1.5 SBOM (PRO-2894), the document itself. */
+	async getSbom(productId, repositoryId) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/repositories/${seg(repositoryId)}/sbom`);
+	}
 	async updateFinding(id, body) {
 		return this.request("PATCH", `/maintenance/findings/${seg(id)}`, body);
 	}
@@ -2461,7 +2474,7 @@ const DOCUMENT_INPUTS = Object.freeze({
 * reads as deleted) and fields they explain would simply be missing. So it
 * refuses to start, and says what to do.
 */
-function apiLevelProblem(introspection, apiUrl, required = 3, version = SERVER_VERSION) {
+function apiLevelProblem(introspection, apiUrl, required = 4, version = SERVER_VERSION) {
 	const offered = introspection.mcpApiLevel ?? 0;
 	if (offered >= required) return null;
 	return `The Taiga API at ${apiUrl} is older than @taiga-ai/mcp-server ${version} needs (API level ${offered}, needs ${required}). Run the version published for it, or wait for that API to be updated; an earlier release of this package works against it.`;
@@ -2675,7 +2688,7 @@ function setupNextStep(product) {
 	if (product?.status !== "draft") return null;
 	if (isImportedProduct(product)) switch (importStatusOf(product)) {
 		case "analyzing":
-		case "generating_docs": return `The import is running and derives the documents from the code (taiga_wait_for_job follows its job). Then review them, and ${FINISH_DISCOVERY}`;
+		case "generating_docs": return `The import is running and derives the documents from the code (taiga_wait (jobId) follows its job). Then review them, and ${FINISH_DISCOVERY}`;
 		case "complete": return "The import is done: review the reality documents (taiga_get_product_document without type), then taiga_finish_discovery opens the product and starts planning its first initiatives (paid agent work: ask the person first).";
 		case "failed":
 		case "cancelled": return "The last import did not finish: taiga_start_import runs it again.";
@@ -2703,21 +2716,22 @@ const BY_ARGUMENT = {
 	initiativeId: ITEM_ID_HINT,
 	runId: "taiga_list_runs lists the runs, of one product or of every product the key can see.",
 	planId: "taiga_get_plan gives the initiative's active plan and its ID.",
-	repositoryId: "taiga_list_product_repositories lists the product's repository links; a linkable repository id is not a link ID.",
-	replacesRepositoryId: "taiga_list_product_repositories lists the product's repository links.",
+	linkId: "taiga_list_product_repositories lists the product's repository links; a linkable repository id is not a link ID.",
+	replacesLinkId: "taiga_list_product_repositories lists the product's repository links.",
 	linkableRepositoryId: "taiga_list_linkable_repositories lists the repositories the GitHub connection reaches, with their ids.",
 	installationId: "taiga_list_linkable_repositories lists the connected GitHub accounts.",
 	jobId: "A job ID is what the tool that started the job returned (taiga_request_initiatives, taiga_start_import).",
 	factoryId: "taiga_list_factories lists the factories the key can see.",
 	findingId: "taiga_list_findings lists a product's findings.",
 	violationId: "taiga_get_policy_standing lists a product's policy violations.",
-	environmentId: "taiga_list_environments lists the product's environments with their IDs; a product ID is not one.",
+	environmentId: "taiga_get_deployments lists the product's environments with their IDs; a product ID is not one.",
 	knowledgeId: "taiga_list_knowledge lists the knowledge files.",
 	productId: "taiga_list_products lists the products the key can see; a name is not an ID (taiga_get_product takes a slug)."
 };
 /** Where an argument means something else on one tool, or the tool's 404 needs its own word. */
 const BY_TOOL = {
 	taiga_resolve_action: () => "taiga_list_action_required lists the items with their IDs.",
+	taiga_get_sbom: () => "An SBOM exists once a sweep has inventoried that repository, where the licenses feature is enabled; taiga_list_packages (linkId) says whether it has packages, and taiga_list_product_repositories lists the links.",
 	taiga_get_plan: (said) => /\bplan\b/i.test(said) ? "taiga_get_initiative's situation says whether one is being planned or failed, and names the call that asks for one (taiga_queue_initiative off the line, taiga_plan_again for a failed plan)." : ITEM_ID_HINT
 };
 /**
@@ -2730,8 +2744,8 @@ const MISSING_THING = {
 	initiativeId: /backlog item|initiative/i,
 	runId: /\b(build )?run\b/i,
 	planId: /\bplan\b/i,
-	repositoryId: /repository link|\blink\b/i,
-	replacesRepositoryId: /repository link|\blink\b/i,
+	linkId: /repository link|\blink\b|repository/i,
+	replacesLinkId: /repository link|\blink\b/i,
 	linkableRepositoryId: /github repository/i,
 	installationId: /installation|account/i,
 	jobId: /\bjob\b/i,
@@ -2812,6 +2826,7 @@ function ownArgumentLike(key, own) {
 const PRODUCT_WORDS = {
 	backlogItemId: "initiativeId",
 	buildRunId: "runId",
+	productRepositoryId: "linkId",
 	latestBuild: "latestRun"
 };
 /**
@@ -2854,7 +2869,7 @@ function inProductWords(value) {
 }
 /** The API's 404 sentence in the product's words: "Backlog item not found" is an initiative not found. */
 function inProductWording(said) {
-	return said.replace(/^Backlog item not found/i, "Initiative not found").replace(/^Build run step not found/i, "Run step not found").replace(/^Build run not found/i, "Run not found").replace(/^Custom document not found/i, "Knowledge file not found").replace(/^(Branch "[^"]*" does not exist in \S+?)\.?$/i, "$1. taiga_list_repository_branches lists the branches it has.").replace(/^This product already has a repository\. Change it instead of linking another\./i, "This product already has a repository. Pass replacesRepositoryId to swap it in one step, or taiga_unlink_repository first (taiga_list_product_repositories gives its ID).");
+	return said.replace(/^Backlog item not found/i, "Initiative not found").replace(/^Build run step not found/i, "Run step not found").replace(/^Build run not found/i, "Run not found").replace(/^Custom document not found/i, "Knowledge file not found").replace(/^(Branch "[^"]*" does not exist in \S+?)\.?$/i, "$1. taiga_list_repository_branches lists the branches it has.").replace(/^This product already has a repository\. Change it instead of linking another\./i, "This product already has a repository. Pass replacesLinkId to swap it in one step, or taiga_unlink_repository first (taiga_list_product_repositories gives its ID).");
 }
 /**
 * A float without its binary noise: six significant digits. Delivery metrics
@@ -3293,7 +3308,7 @@ function nextStepFor(state) {
 		if (state.linked === false) return "Link its repository (taiga_list_linkable_repositories, then taiga_link_repository), then taiga_start_import.";
 		if (state.linked === null && state.importState === "not started") return setupNextStep(state.product);
 		switch (state.importState) {
-			case "running": return "The import is running and derives the documents from the code; taiga_wait_for_job follows it.";
+			case "running": return "The import is running and derives the documents from the code; taiga_wait (jobId) follows it.";
 			case "failed": return "The last import did not finish: taiga_start_import runs it again.";
 			case "complete":
 				if (state.missing && state.missing.length > 0) return `The import finished but ${named(state.missing)} ${state.missing.length === 1 ? "is" : "are"} not published: taiga_get_product_document without type shows them, taiga_publish_product_document publishes a draft.`;
@@ -3772,7 +3787,7 @@ function registerProductTools(server, client) {
 		}));
 		server.registerTool("taiga_get_product", {
 			title: "Get product",
-			description: "Read one product and its settings by ID, slug or git remote URL (git remote get-url origin; a URL linked to more than one product is refused with their IDs): name, factory, kind, autonomy, what Taiga builds (application, infrastructure, deployment) and network access, unsetMeans saying what a null setting follows. In setup, readiness says whether it can finish now and what is missing (repository, import, unpublished documents, unstamped checks), plus nextStep. For initiatives, runs and findings, use taiga_get_product_context.",
+			description: "Read one product's settings only (for where it stands, use taiga_get_product_context), by ID, slug or git remote URL (git remote get-url origin; a URL linked to more than one product is refused with their IDs): name, factory, kind, autonomy, what Taiga builds (application, infrastructure, deployment) and network access, unsetMeans saying what a null setting follows. In setup, readiness says whether it can finish now and what is missing (repository, import, unpublished documents, unstamped checks), plus nextStep. For initiatives, runs and findings, use taiga_get_product_context.",
 			inputSchema: z.object({
 				productId: productId.optional(),
 				slug: slug.optional(),
@@ -3924,6 +3939,10 @@ async function publishDraft(scope) {
 		...published.warnings ? { warnings: published.warnings } : {}
 	});
 }
+/** The section ids that are not control ids at all. GDPR-1.1 is a control id, so it is not among them, though it names no single policy. */
+function notControls(sections) {
+	return sections.filter((id) => !isControlId(id.toUpperCase()));
+}
 /** The policies the section ids name when every one is a control id (SEC-5.1), else none. */
 function policiesNamed(sections) {
 	if (sections.length === 0) return [];
@@ -3949,7 +3968,7 @@ function registerDocumentTools(server, client) {
 			sections: params.sections?.map((id) => id.toUpperCase())
 		} : params;
 		if (args.type === void 0) {
-			if (args.sections) return toolError("VALIDATION_ERROR", named.length > 1 ? `Those control ids are in different policies (${named.join(", ")}): read one type at a time.` : "Name the document (type) to read its sections; a control id such as SEC-5.1 names its policy itself.");
+			if (args.sections) return toolError("VALIDATION_ERROR", named.length > 1 ? `Those control ids are in different policies (${named.join(", ")}): read one type at a time.` : notControls(args.sections).length > 0 && notControls(args.sections).length < args.sections.length ? `Not a control id: ${notControls(args.sections).join(", ")}. A control id such as SEC-5.1 names its policy; any other section id needs type.` : "Name the document (type) to read its sections; a control id such as SEC-5.1 names its policy itself, but one of a family that spans policies (GDPR, NIS2) does not.");
 			const result = await client.listTenantDocuments({
 				limit: args.limit,
 				cursor: args.cursor
@@ -4120,7 +4139,7 @@ function registerJobTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_get_job", {
 		title: "Get an agent job",
-		description: "Read one agent job, such as a taiga_request_initiatives request: status (pending, processing, completed, failed, cancelled), progress and any error. A finished initiative request lists the initiatives it added, or why none (already covered, not readable as work, outside the product, or not allowed by a policy, with the rule it conflicts with and how to decide otherwise). taiga_wait_for_job waits for it.",
+		description: "Read one agent job, such as a taiga_request_initiatives request: status (pending, processing, completed, failed, cancelled), progress and any error. A finished initiative request lists the initiatives it added, or why none (already covered, not readable as work, outside the product, or not allowed by a policy, with the rule it conflicts with and how to decide otherwise). taiga_wait (jobId) waits for it.",
 		inputSchema: z.object({ jobId: idInput("job", "the tool that started the job returned it") }),
 		annotations: READ_ONLY
 	}, (params) => runTool(async () => toolResult(jobReport((await client.getAgentJob(params.jobId)).data))));
@@ -4578,11 +4597,12 @@ function registerBuildTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_runs", {
 		title: "List runs",
-		description: "List coding agent runs, newest first: status, branch, pull request, step progress, actions and outcome, one sentence saying how it stands: running, waiting for a person to review and merge, merged, failed, stopped, its pull request closed unmerged, or nobody waiting on it because its initiative ended. Without productId, every product's runs; active: true keeps running ones. taiga_get_run reads one; carry work on from the initiative (taiga_resume_initiative).",
+		description: "List coding agent runs, newest first: status, branch, pull request, step progress, actions and outcome, one sentence saying how it stands: running, waiting for a person to review and merge, merged, failed, stopped, its pull request closed unmerged, or nobody waiting on it because its initiative ended. Without productId, every product's runs; active: true keeps running ones, and status narrows to some statuses (status: [\"failed\", \"stopped\"] for what failed). taiga_get_run reads one; carry work on from the initiative (taiga_resume_initiative).",
 		inputSchema: z.object({
 			productId: productId.optional(),
 			initiativeId: idInput("initiative", "taiga_list_initiatives (query finds one by title) gives it").optional().describe("Only this initiative's runs -- get from taiga_list_initiatives"),
 			active: z.boolean().optional().describe("Only runs the agent is executing now (cloning through reviewing; a queued pending run is not yet executing and is left out); for the org-wide list"),
+			status: z.array(z.enum(BUILD_RUN_STATUSES)).min(1).optional().describe("Only runs in these statuses, such as [\"failed\", \"stopped\"]"),
 			...pagination
 		}),
 		annotations: READ_ONLY
@@ -4593,6 +4613,7 @@ function registerBuildTools(server, client) {
 		if (productIdOf) {
 			const result = await client.listBuildRuns(productIdOf, {
 				backlogItemId: params.initiativeId,
+				status: params.status,
 				limit: params.limit,
 				cursor: params.cursor
 			});
@@ -4707,7 +4728,7 @@ function waitingOn(rows, station) {
 }
 const STATION_NAMED = 3;
 /** Who holds the station, or null when the key cannot read the backlog or the read failed. */
-async function stationHolders(client, product, head) {
+async function stationHolders(client, product, except) {
 	if (!client.hasCapability("backlog:read")) return null;
 	try {
 		const columns = await Promise.all(["plan", "build"].map((state) => client.listBacklogItems(product, {
@@ -4715,7 +4736,7 @@ async function stationHolders(client, product, head) {
 			order: "newest",
 			limit: 100
 		})));
-		const rows = columns.flatMap((page) => page.data).filter((row) => row.id !== head);
+		const rows = columns.flatMap((page) => page.data).filter((row) => !except.has(row.id));
 		const capped = columns.some((page) => page.nextCursor !== null);
 		return {
 			count: rows.length,
@@ -4791,10 +4812,14 @@ async function queueView(client, product, options = { name: "all" }) {
 	});
 	const note = unnamed === 0 ? null : !canName ? "Entries carry initiativeId only: naming them needs backlog:read, which this key lacks." : entries.length > NAMED_ENTRIES ? `Only the first ${NAMED_ENTRIES} entries are named; the rest carry initiativeId only.` : "An entry whose initiative could not be read carries initiativeId only; taiga_get_initiative reads it.";
 	const line = typeof paused === "string" ? `The line is paused (since ${paused}): nothing is planned or built until a person resumes it.` : null;
+	const idle = rows.length > 0 && blockingIndex(rows, (row) => row.entryState) < 0;
+	const station = rows.length > 0 || options.name === "all" ? await stationHolders(client, product, new Set(idle ? [rows[0].backlogItemId] : rows.map((row) => row.backlogItemId))) : null;
+	const offLine = !idle && station && station.count > 0 ? { offTheLine: `${station.atLeast ? "At least " : ""}${station.count} initiative${station.count === 1 ? " is" : "s are"} in Plan or Build without a queue entry (${station.titles.map((title) => `"${title}"`).join(", ")}${station.count > station.titles.length ? ", and more" : ""}): moved there by hand or waiting on a pull request review. Each holds the station like the active entry; taiga_list_initiatives with column: 'plan' or 'build' lists them.` } : {};
 	return {
 		linePaused: paused === null ? null : typeof paused === "string",
 		entries: rows.map(({ lifecycle: _lifecycle, runId: _runId, ...row }) => row),
-		waitingOn: line ?? waitingOn(rows, rows.length > 0 && blockingIndex(rows, (row) => row.entryState) < 0 ? await stationHolders(client, product, rows[0].backlogItemId) : null),
+		waitingOn: line ?? waitingOn(rows, idle ? station : null),
+		...offLine,
 		...note ? { note } : {}
 	};
 }
@@ -5222,7 +5247,7 @@ function registerBacklogReads(server, client) {
 function registerRequest(server, client) {
 	server.registerTool("taiga_request_initiatives", {
 		title: "Request new initiatives",
-		description: "Ask an agent to turn described work into initiatives in the product's Backlog, and return the job. One piece of work becomes one initiative, a program an ordered set with dependencies. It may add none and say why (already covered, not work, outside the product, or a named policy forbids it). Omit title and description for the one next initiative the product most needs. taiga_wait_for_job gives the outcome. One request per product at a time (CONFLICT). Nothing goes on the line.",
+		description: "Ask an agent to turn described work into initiatives in the product's Backlog, and return the job. One piece of work becomes one initiative, a program an ordered set with dependencies. It may add none and say why (already covered, not work, outside the product, or a named policy forbids it). Omit title and description for the one next initiative the product most needs. taiga_wait (jobId) gives the outcome. One request per product at a time (CONFLICT). Nothing goes on the line.",
 		inputSchema: z.object({
 			productId,
 			title: z.string().max(500).optional().describe("What the work is, in a line"),
@@ -5398,6 +5423,19 @@ function registerPlanVerdicts(server, client) {
 * next sweep no longer detects it, so there is no tool for either.
 */
 /** A finding as a list row: enough to decide whether to open, fix or ignore it. */
+const PACKAGE_ROW_FIELDS = [
+	"id",
+	"ecosystem",
+	"packageName",
+	"version",
+	"purl",
+	"licenses",
+	"scope",
+	"relation",
+	"sourcePath",
+	"productRepositoryId",
+	"detectedAt"
+];
 const FINDING_ROW_FIELDS = [
 	"id",
 	"kind",
@@ -5421,6 +5459,77 @@ const FINDING_ROW_FIELDS = [
 	"ignoreReason",
 	"ignoreExpiresAt"
 ];
+/** Locations a folded row names before it says how many more there are. */
+const GROUP_WHERE = 5;
+/** What makes two findings one rule's: its rule id for code, infrastructure and secrets, its license verdict for a license. */
+/** The scanner's title cap (deps.py _COLUMN_CAP): a title cut there ends in "...". */
+const TITLE_CAP = 300;
+/**
+* The license verdict of a license finding's title: what follows "<package> <version>: ". A title the scanner cut
+* at its cap has no whole verdict, so it folds with nothing: two cut titles could share a prefix and differ.
+*/
+function licenseVerdict(row) {
+	const title = String(row["title"] ?? "");
+	if (title.length >= TITLE_CAP && title.endsWith("...")) return "";
+	return title.split(": ").slice(1).join(": ");
+}
+function groupKey(row) {
+	const status = String(row["status"] ?? "");
+	const link = String(row["productRepositoryId"] ?? "");
+	if (row["kind"] === "license_violation") {
+		const verdict = licenseVerdict(row);
+		return verdict ? `license|${status}|${link}|${verdict}` : null;
+	}
+	const location = row["location"];
+	const rule = typeof location?.ruleId === "string" ? location.ruleId : null;
+	return rule ? `${String(row["kind"])}|${String(row["severity"])}|${status}|${link}|${rule}` : null;
+}
+/** Where one finding is, in a few characters: its path and line, or its package. */
+function whereOf(row) {
+	const location = row["location"];
+	if (typeof location?.path === "string") return location.line ? `${location.path}:${String(location.line)}` : location.path;
+	return [row["packageName"], row["currentVersion"]].filter(Boolean).join(" ") || String(row["id"]);
+}
+/**
+* Findings of one rule or license verdict on a page, folded into one row (PRO-2941): a review read seven
+* CKV_GHA_7 rows and fifteen sharp license rows, identical but for where. The first stands for them, with
+* count, every findingId (what fix and ignore take) and the first few locations.
+*/
+function grouped(rows, fold) {
+	if (!fold) return rows;
+	const groups = /* @__PURE__ */ new Map();
+	const order = [];
+	for (const row of rows) {
+		const key = groupKey(row);
+		if (!key) {
+			order.push(row);
+			continue;
+		}
+		if (!groups.has(key)) {
+			groups.set(key, []);
+			order.push(key);
+		}
+		groups.get(key).push(row);
+	}
+	return order.map((entry) => {
+		if (typeof entry !== "string") return entry;
+		const members = groups.get(entry);
+		if (members.length === 1) return members[0];
+		const where = members.map(whereOf);
+		const first = members[0];
+		const shared = Object.fromEntries(Object.entries(first).filter(([key, value]) => key !== "id" && members.every((member) => JSON.stringify(member[key]) === JSON.stringify(value))));
+		const location = first["location"];
+		const said = first["kind"] === "license_violation" ? licenseVerdict(first) : typeof location?.ruleId === "string" ? location.ruleId : String(first["title"]);
+		return {
+			...shared,
+			...shared["title"] === void 0 ? { title: said } : {},
+			count: members.length,
+			findingIds: members.map((member) => member["id"]),
+			where: where.slice(0, GROUP_WHERE),
+			...where.length > GROUP_WHERE ? { moreWhere: where.length - GROUP_WHERE } : {}
+		};
+	});
+}
 /**
 * Whether taiga_fix_finding would take a finding, said on the row (PRO-2800): three reviews found a dependency
 * marked remediableBy coding_agent with no fixed version, which the API refuses to fix. The API's own refusals,
@@ -5579,13 +5688,14 @@ function registerMaintenanceTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_findings", {
 		title: "List maintenance findings",
-		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. controlId lists the findings that breach one control. taiga_get_finding reads one.",
+		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. controlId lists the findings that breach one control. Findings of one rule or license verdict in one repository fold into one row per page, with count, findingIds (what fix and ignore take), where, and only the fields they share; group: false lists each. taiga_get_finding reads one.",
 		inputSchema: z.object({
 			productId,
 			controlId: z.string().trim().min(1).max(40).optional().describe("Only the findings that breach this control, such as SEC-5.1 (one page, searched across all)"),
 			status: z.enum(MAINTENANCE_FINDING_STATUSES).optional().describe("Only findings in this status; omit for the ones needing action"),
 			severity: z.enum(MAINTENANCE_FINDING_SEVERITIES).optional().describe("Only this severity"),
 			kind: z.enum(MAINTENANCE_FINDING_KINDS).optional().describe("Only this kind of finding"),
+			group: z.boolean().optional().describe("Fold findings of one rule or license on this page into one row (default true); false lists each"),
 			...pagination
 		}),
 		annotations: READ_ONLY
@@ -5600,7 +5710,7 @@ function registerMaintenanceTools(server, client) {
 				cursor
 			}), "", () => [""], params.limit ?? 25, (row) => Array.isArray(row["controls"]) && row["controls"].some((c) => String(c).toUpperCase() === wanted));
 			return toolResult({
-				...page(findingRows(found.rows), null),
+				...page(grouped(findingRows(found.rows), params.group !== false), null),
 				...found.more ? { more: found.rows.length < (params.limit ?? 25) ? `Only the first 1000 findings were searched; narrow by status, severity or kind to reach the rest.` : "There may be more than the limit carries: raise the limit, or narrow by status, severity or kind." } : {},
 				...found.rows.length === 0 && !found.more ? { note: `No ${params.status ? `${params.status} ` : "open "}finding breaches ${wanted}. That is no all-clear on its own: taiga_list_findings without controlId says when the product was last swept.` } : {}
 			});
@@ -5614,11 +5724,43 @@ function registerMaintenanceTools(server, client) {
 				sweep: null,
 				sweepNote: "The sweep overview could not be read: an empty list here is not an all-clear."
 			} : sweep ? { sweep } : {},
-			...page(findingRows(result.data), result.nextCursor),
+			...page(grouped(findingRows(result.data), params.group !== false), result.nextCursor),
 			...typeof result.totalCount === "number" ? { totalCount: result.totalCount } : {},
 			...params.status === void 0 && params.severity === void 0 && params.kind === void 0 && typeof result.totalCount === "number" && sweep && sweep !== "unread" && typeof sweep["openFindings"] === "number" && sweep["openFindings"] !== result.totalCount ? { totalNote: "totalCount includes findings with a fix under way (remediating) and ignored findings whose ignore has expired; sweep.openFindings counts open ones only." } : {}
 		});
 	}));
+	server.registerTool("taiga_list_packages", {
+		title: "List the package inventory",
+		description: "Every package a product's repositories resolve, vulnerable or not, as the latest sweep read it: name, version, ecosystem, SPDX licenses, scope (dev / runtime / unknown), relation (direct / transitive / unknown) and the lockfile. The first page opens with licenses: each license string across the inventory, how many packages carry it and its standing against the allowlist (allowed, not_allowed, unknown), plus the allowlist and when each repository was last inventoried. Filter by one license string (UNKNOWN for the ones the data source could not name), a name substring or a repository. A license outside the allowlist is also a license_violation finding in taiga_list_findings. Where the licenses feature is not enabled the product answers NOT_FOUND. taiga_get_sbom downloads one repository as CycloneDX.",
+		inputSchema: z.object({
+			productId,
+			license: z.string().min(1).max(4096).optional().describe("Only packages carrying exactly this SPDX string"),
+			search: z.string().min(1).max(255).optional().describe("Case-insensitive substring of the package name"),
+			linkId: idInput("repository link", "taiga_list_product_repositories gives it", "only this repository").optional(),
+			...pagination
+		}),
+		annotations: READ_ONLY
+	}, (params) => runTool(async () => {
+		const { productId: id, linkId: link, ...filters } = params;
+		const [result, summary] = await Promise.all([client.listPackages(id, {
+			...filters,
+			...link ? { productRepositoryId: link } : {}
+		}), params.cursor === void 0 ? client.getLicenseSummary(id) : Promise.resolve(null)]);
+		return toolResult({
+			...summary ? { licenses: summary.data } : {},
+			...page(pickFields(result.data, PACKAGE_ROW_FIELDS), result.nextCursor),
+			...typeof result.totalCount === "number" ? { totalCount: result.totalCount } : {}
+		});
+	}));
+	server.registerTool("taiga_get_sbom", {
+		title: "Download a repository SBOM",
+		description: "One repository's software bill of materials as a CycloneDX 1.5 JSON document, rendered from the stored package inventory: metadata (timestamp, tools, the repository), every package with its purl, license and scope, and the packages the repository declares directly. The whole document is returned, so for a large repository the answer is large; read taiga_list_packages when a summary is enough. NOT_FOUND where the licenses feature is not enabled, and for a repository no sweep has inventoried yet.",
+		inputSchema: z.object({
+			productId,
+			linkId: idInput("repository link", "taiga_list_product_repositories gives it")
+		}),
+		annotations: READ_ONLY
+	}, (params) => runTool(async () => toolResult(await client.getSbom(params.productId, params.linkId))));
 	server.registerTool("taiga_get_finding", {
 		title: "Get a maintenance finding",
 		description: "Read one maintenance finding: exploit likelihood (EPSS, known-exploited list), the advisory summarized (full: true for its whole record: every affected range and reference) and fixed version, code location, breached policy controls, why it ranks where it does, history (reintroduced, previously resolved) and the remediation under way. fixable: false with fixNote says taiga_fix_finding would refuse it. A secret's value is never stored, only the rule and location.",
@@ -6558,10 +6700,15 @@ async function standingPart(client, productId) {
 	const standing = (await client.getPolicyStanding(productId)).data;
 	const summary = standingSummary(standing);
 	const state = standing.assessment?.state;
+	const controls = Array.isArray(standing.controls) ? standing.controls : [];
+	const withAny = (key) => controls.filter((control) => Number(control[key] ?? 0) > 0).length;
 	return {
 		openViolations: summary.violations,
 		bySeverity: summary.bySeverity,
-		controlsViolated: summary.controls,
+		controlsBreached: withAny("findingCount"),
+		controlsDiverged: withAny("divergenceCount"),
+		controlsMet: summary.controlsMet,
+		controlsNotApplicable: summary.controlsNotApplicable,
 		...state === "never" || state === "failed" ? { note: `The assessment ${state === "never" ? "has never run" : "failed"}: no violations here is not an all-clear.` } : {}
 	};
 }
@@ -6926,7 +7073,7 @@ function deploymentLines(rows) {
 		};
 	});
 }
-const environmentId = idInput("environment", "taiga_list_environments lists them; a product ID is not one");
+const environmentId = idInput("environment", "taiga_get_deployments lists them; a product ID is not one");
 /** The windows the pages offer, as the schema's own values rather than a number checked afterwards. */
 const windowDays = z.literal([
 	30,
@@ -6936,11 +7083,11 @@ const windowDays = z.literal([
 /** Whether a failure is the API's (refused, missing, unreachable) rather than a bug here. */
 const isApiFailure = (error) => error instanceof TaigaApiError || isNetworkFailure(error);
 /** A part that may fail on its own without failing the read: null and the reason, or the value. */
-async function part(read) {
+async function part(read, rethrow = () => false) {
 	try {
 		return { value: await read() };
 	} catch (error) {
-		if (!isApiFailure(error)) throw error;
+		if (!isApiFailure(error) || rethrow(error)) throw error;
 		return { unavailable: error instanceof TaigaApiError ? `${error.status}: ${error.apiMessage ?? ""}`.trim() : "unreachable" };
 	}
 }
@@ -6971,7 +7118,7 @@ function registerObserveTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_get_deployments", {
 		title: "Get what runs where",
-		description: "Read what runs in each of a product's environments and its recent deployments, newest first: commit, pull request, status, deployer and, on failure, the provider's error. What runs is the latest successful deployment, so a newer failure shows beside it. History is mirrored from the provider, including deployments made outside Taiga; syncStatus says when it last synced. environmentId narrows to one environment. Taiga never deploys.",
+		description: "Read a product's environments with their IDs, what runs in each, and its recent deployments, newest first: commit, pull request, status, deployer and, on failure, the provider's error. What runs is the latest successful deployment, so a newer failure shows beside it. History is mirrored from the provider, including deployments made outside Taiga; syncStatus says when it last synced. environmentId narrows to one environment. Taiga never deploys.",
 		inputSchema: z.object({
 			productId,
 			environmentId: environmentId.optional(),
@@ -6979,25 +7126,31 @@ function registerObserveTools(server, client) {
 		}),
 		annotations: READ_ONLY
 	}, (params) => runTool(async () => {
-		const [environments, current, history, sync] = await Promise.all([
+		const [environments, currentRead, historyRead, sync] = await Promise.all([
 			allEnvironments(client, params.productId),
-			client.getCurrentDeployments(params.productId),
-			client.listDeployments(params.productId, {
+			part(() => client.getCurrentDeployments(params.productId)),
+			part(() => client.listDeployments(params.productId, {
 				environmentId: params.environmentId,
 				limit: params.limit ?? 10,
 				cursor: params.cursor
-			}),
+			}), (error) => Boolean(params.environmentId) && error instanceof TaigaApiError && error.status === 404),
 			part(() => client.getDeploymentSyncStatus(params.productId))
 		]);
-		const now = current.data;
-		const note = environments.rows.length === 0 ? "This product has no environments yet: an environment is defined with taiga_create_environment, and its deployments are mirrored from the provider once it is." : history.data.length === 0 && !params.cursor ? "No deployments recorded yet: none was mirrored from the provider (syncStatus says when it last synced), or nothing has been deployed." : null;
-		const live = new Set([...now.current ?? [], ...now.deploying ?? []].map((row) => row.id));
+		const now = "value" in currentRead ? currentRead.value.data : null;
+		const history = "value" in historyRead ? historyRead.value : null;
+		const note = environments.rows.length === 0 ? "This product has no environments yet: an environment is defined with taiga_create_environment, and its deployments are mirrored from the provider once it is." : history && history.data.length === 0 && !params.cursor ? "No deployments recorded yet: none was mirrored from the provider (syncStatus says when it last synced), or nothing has been deployed." : null;
+		const live = new Set([...now?.current ?? [], ...now?.deploying ?? []].map((row) => row.id));
+		const unavailable = {
+			..."unavailable" in currentRead ? { running: currentRead.unavailable } : {},
+			..."unavailable" in historyRead ? { history: historyRead.unavailable } : {}
+		};
 		return toolResult({
 			environments: pickFields(environments.rows, ENVIRONMENT_FIELDS),
 			...environments.more ? { moreEnvironments: true } : {},
-			running: deploymentLines(now.current ?? []),
-			deploying: deploymentLines(now.deploying ?? []),
-			history: page(deploymentLines(history.data.filter((row) => !live.has(row.id))), history.nextCursor),
+			running: now ? deploymentLines(now.current ?? []) : null,
+			deploying: now ? deploymentLines(now.deploying ?? []) : null,
+			history: history ? page(deploymentLines(history.data.filter((row) => !live.has(row.id))), history.nextCursor) : null,
+			...Object.keys(unavailable).length > 0 ? { unavailable } : {},
 			..."value" in sync ? { syncStatus: sync.value.data } : {
 				syncStatus: null,
 				syncUnavailable: sync.unavailable
@@ -7005,19 +7158,6 @@ function registerObserveTools(server, client) {
 			...note ? { note } : {}
 		});
 	}));
-	server.registerTool("taiga_list_environments", {
-		title: "List a product's environments",
-		description: "List a product's environments with ID, type, order and App URL. These are the environment IDs taiga_get_delivery_metrics, taiga_get_monitoring and taiga_update_environment take. taiga_get_deployments lists them too, with what runs where.",
-		inputSchema: z.object({ productId }),
-		annotations: READ_ONLY
-	}, (params) => runTool(async () => {
-		const { rows, more } = await allEnvironments(client, params.productId);
-		return toolResult({
-			data: pickFields(rows, ENVIRONMENT_FIELDS),
-			...more ? { more: "More environments than this answer reads; the rest were left out." } : {},
-			...rows.length === 0 ? { note: "No environment is defined yet; taiga_create_environment adds one." } : {}
-		});
-	}));
 	server.registerTool("taiga_get_delivery_metrics", {
 		title: "Get delivery metrics",
 		description: "Read DORA's five delivery metrics for one environment (the page shows production) over 30, 60 or 90 days: deployment frequency, lead time, failed deployment recovery time, change-failure rate and rework rate, each with its trend against the window before and a performance band (none for rework rate). Computed from deployments, not incidents; previews and checks do not count. Under ten deployments a trend is approximate; a metric with no data says so instead of a number. Without environmentId, the product's production environment when it has exactly one.",
@@ -7037,7 +7177,7 @@ function registerObserveTools(server, client) {
 				note: "This product has no environments, so there is nothing to measure: an environment is defined with taiga_create_environment, and its deployments are mirrored from the provider once it is."
 			});
 			const production = all.filter((env) => env.type === "production");
-			if (production.length !== 1 || more) return toolError("VALIDATION_ERROR", `Pass environmentId: the product has ${more ? "more environments than one read holds, and " : ""}${production.length === 0 ? "no" : production.length} production environment${production.length === 1 ? "" : "s"}${more ? " among the first" : ""}. taiga_list_environments lists them with their IDs.`, { environments: all.map((env) => ({
+			if (production.length !== 1 || more) return toolError("VALIDATION_ERROR", `Pass environmentId: the product has ${more ? "more environments than one read holds, and " : ""}${production.length === 0 ? "no" : production.length} production environment${production.length === 1 ? "" : "s"}${more ? " among the first" : ""}. taiga_get_deployments lists them with their IDs.`, { environments: all.map((env) => ({
 				id: env.id,
 				name: env.name,
 				type: env.type
@@ -7166,7 +7306,7 @@ function registerProductDocumentWrites(server, client) {
 	}, (params) => runTool(async () => toolResult((await client.markProductDocumentReviewed(params.productId, params.type)).data)));
 	if (canRead) server.registerTool("taiga_regenerate_product_document", {
 		title: "Regenerate a product document",
-		description: "Regenerate one product document from the documents it derives from, when it is outdated or needs another pass, and return the job. The result is published and documents derived from it are marked outdated. The Specification (from the Discovery conversation) and the Look & Feel (from its concepts) are made in the web. Documents Discovery requires regenerate only while Discovery is open; the optional Service Blueprint any time. taiga_wait_for_job says when it is done.",
+		description: "Regenerate one product document from the documents it derives from, when it is outdated or needs another pass, and return the job. The result is published and documents derived from it are marked outdated. The Specification (from the Discovery conversation) and the Look & Feel (from its concepts) are made in the web. Documents Discovery requires regenerate only while Discovery is open; the optional Service Blueprint any time. taiga_wait (jobId) says when it is done.",
 		inputSchema: z.object({
 			productId,
 			type: generatedType
@@ -21942,7 +22082,11 @@ const GITHUB_REPOSITORY_FIELDS = [
 	"linked",
 	"linkedProduct"
 ];
-const repositoryId = idInput("repository link", "taiga_list_product_repositories gives it; a linkable repository id is not one");
+/**
+* A product's link to a repository: one name for it in every tool (PRO-2941). Reviews met it as repositoryId
+* here, productRepositoryId on findings and packages, and linkableRepositoryId (a different thing) beside both.
+*/
+const linkId = idInput("repository link", "taiga_list_product_repositories gives it (its id); a linkable repository id is not one");
 /** Round-robin over lists: the first of each, then the second of each, and so on. */
 function interleave(lists) {
 	const out = [];
@@ -22006,11 +22150,11 @@ function registerRepositoryTools(server, client) {
 			description: "List the branches of a product's linked repository, each with whether it is protected, to choose the one Taiga works on (taiga_set_repository_branch). truncated: true means there are more than listed.",
 			inputSchema: z.object({
 				productId,
-				repositoryId
+				linkId
 			}),
 			annotations: READ_ONLY
 		}, (params) => runTool(async () => {
-			const result = await client.listRepositoryBranches(params.productId, params.repositoryId);
+			const result = await client.listRepositoryBranches(params.productId, params.linkId);
 			return toolResult({
 				data: result.data,
 				truncated: result.truncated
@@ -22066,11 +22210,11 @@ function registerRepositoryTools(server, client) {
 	if (!client.hasCapability("vcs:manage")) return;
 	server.registerTool("taiga_link_repository", {
 		title: "Link a repository to a product",
-		description: "Link a GitHub repository to a product (taiga_list_linkable_repositories gives its id). replacesRepositoryId swaps out the one linked now in one step (the same one changes nothing); linking while one is linked without it is refused. A managed link (isManaged) cannot be replaced or unlinked. Once linked, planning reads its code, runs open pull requests in it, sweeps scan it, and its deployment history is imported.",
+		description: "Link a GitHub repository to a product (taiga_list_linkable_repositories gives its id). replacesLinkId swaps out that link in one step (the same one changes nothing). Whether a product may link more than one repository depends on the organization; when it may not, a second link is refused and the refusal says to pass replacesLinkId. A managed link (isManaged) cannot be replaced or unlinked. Once linked, planning reads its code, runs open pull requests in it, sweeps scan it, and its deployment history is imported.",
 		inputSchema: z.object({
 			productId,
 			linkableRepositoryId: idInput("linkable repository", "taiga_list_linkable_repositories gives it (a row's id; not GitHub's numeric id, not a link ID)"),
-			replacesRepositoryId: repositoryId.optional().describe("The link this one replaces")
+			replacesLinkId: linkId.optional().describe("The link this one replaces")
 		}),
 		annotations: OPERATE
 	}, (params) => runTool(async () => {
@@ -22078,7 +22222,7 @@ function registerRepositoryTools(server, client) {
 		try {
 			linked = await client.linkRepository(params.productId, {
 				githubRepositoryId: params.linkableRepositoryId,
-				...params.replacesRepositoryId ? { replacesRepositoryId: params.replacesRepositoryId } : {}
+				...params.replacesLinkId ? { replacesRepositoryId: params.replacesLinkId } : {}
 			});
 		} catch (error) {
 			const holder = await holderOf(client, error, params.productId);
@@ -22095,14 +22239,14 @@ function registerRepositoryTools(server, client) {
 		description: "Choose the branch Taiga branches from and opens pull requests against (taiga_list_repository_branches lists them), or null for the repository's default. A protected branch is accepted, but Taiga may not be able to merge into it; the result says when it is protected. Optionally sets a label for the link.",
 		inputSchema: z.object({
 			productId,
-			repositoryId,
+			linkId,
 			baseBranch: z.string().trim().min(1).max(255).nullable().optional().describe("The branch; null for the default"),
 			label: z.string().trim().min(1).max(100).nullable().optional().describe("A label for the link; null clears it")
 		}),
 		annotations: OPERATE_SETTING
 	}, (params) => runTool(async () => {
 		if (params.baseBranch === void 0 && params.label === void 0) return toolError("VALIDATION_ERROR", "Set baseBranch, label or both.");
-		const updated = (await client.updateRepository(params.productId, params.repositoryId, {
+		const updated = (await client.updateRepository(params.productId, params.linkId, {
 			...params.baseBranch !== void 0 ? { baseBranch: params.baseBranch } : {},
 			...params.label !== void 0 ? { label: params.label } : {}
 		})).data;
@@ -22114,16 +22258,16 @@ function registerRepositoryTools(server, client) {
 	}));
 	server.registerTool("taiga_unlink_repository", {
 		title: "Unlink a repository from a product",
-		description: "Unlink a repository from a product. The product keeps its documents and initiatives, but nothing is planned against code, built or swept. The repository itself is untouched; one Taiga created for the product cannot be unlinked. To swap it, use taiga_link_repository with replacesRepositoryId.",
+		description: "Unlink a repository from a product. The product keeps its documents and initiatives, but nothing is planned against code, built or swept. The repository itself is untouched; one Taiga created for the product cannot be unlinked. To swap it, use taiga_link_repository with replacesLinkId.",
 		inputSchema: z.object({
 			productId,
-			repositoryId
+			linkId
 		}),
 		annotations: OPERATE
 	}, (params) => runTool(async () => {
-		await client.unlinkRepository(params.productId, params.repositoryId);
+		await client.unlinkRepository(params.productId, params.linkId);
 		return toolResult({
-			repositoryId: params.repositoryId,
+			linkId: params.linkId,
 			unlinked: true
 		});
 	}));
@@ -22507,7 +22651,7 @@ function registerSetupTools(server, client) {
 	}));
 	server.registerTool("taiga_refresh_reality_documents", {
 		title: "Refresh a product's documents from its code",
-		description: "Derive the reality documents again from the code on the branch Taiga works on (effectiveBranch): all, or the ones named. For a document the import misread, refresh it instead of importing again; unchanged sections are not republished. Returns the job; taiga_wait_for_job says when it is done.",
+		description: "Derive the reality documents again from the code on the branch Taiga works on (effectiveBranch): all, or the ones named. For a document the import misread, refresh it instead of importing again; unchanged sections are not republished. Returns the job; taiga_wait (jobId) says when it is done.",
 		inputSchema: z.object({
 			productId,
 			docTypes: z.array(z.enum(REALITY_DERIVED_DOCUMENT_TYPES)).min(1).max(REALITY_DERIVED_DOCUMENT_TYPES.length).optional().describe("The documents to refresh; omit for all")
@@ -22536,7 +22680,7 @@ function registerSetupTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_start_import", {
 		title: "Import a codebase into a product",
-		description: "Start importing a product created for import, and return the job. Taiga reads the linked repository and derives the full document set from the code, citing the files. Then the scanners sweep it, the documents are assessed against policies, and the first initiatives are planned when Discovery finishes. Refused for a scratch product, without a linked repository, or while an import runs. taiga_wait_for_job says when it is done (it takes a while).",
+		description: "Start importing a product created for import, and return the job. Taiga reads the linked repository and derives the full document set from the code, citing the files. Then the scanners sweep it, the documents are assessed against policies, and the first initiatives are planned when Discovery finishes. Refused for a scratch product, without a linked repository, or while an import runs. taiga_wait (jobId) says when it is done (it takes a while).",
 		inputSchema: z.object({ productId }),
 		annotations: OPERATE
 	}, (params) => runTool(async () => {
@@ -22803,20 +22947,25 @@ function judgeBuild(until) {
 		return null;
 	};
 }
+/** What each target may be waited for. A job has one condition, finished, so it takes none. */
+const UNTIL_FOR = {
+	initiative: ITEM_CONDITIONS,
+	run: BUILD_CONDITIONS
+};
+const ALL_CONDITIONS = [.../* @__PURE__ */ new Set([...ITEM_CONDITIONS, ...BUILD_CONDITIONS])];
+/**
+* One tool for waiting (PRO-2941): three wait tools, one per thing waited on, were two more names in a catalogue
+* every review ranked too large. The ID says what is waited on; until says for what, refused when it does not
+* apply to that thing.
+*/
 function registerWaitTools(server, client, options) {
-	if (client.hasCapability("backlog:read")) server.registerTool("taiga_wait_for_initiative", {
-		title: "Wait for an initiative",
-		description: "Wait until an initiative reaches a condition instead of polling: changed, planned, your_turn (waits on a person), pr_open (open now; merged or closed does not count), run_settled (latest run stopped moving) or done. Returns reached: true when it holds; early with stoppedBecause when only a person can move it (a flag, failed plan, plan or pull request awaiting review, a cancel); or reached: false at the timeout: call again. A condition already true answers at once. Planning takes minutes, a run up to an hour.",
-		inputSchema: z.object({
-			initiativeId: idInput("initiative", "taiga_list_initiatives (query finds one by title) gives it"),
-			until: z.enum(ITEM_CONDITIONS).describe("What to wait for"),
-			timeoutSeconds
-		}),
-		annotations: READ_ONLY
-	}, (params, ctx) => runTool(async () => {
+	const items = client.hasCapability("backlog:read");
+	const runs = client.hasCapability("products:read");
+	if (!items && !runs) return;
+	const waitInitiative = async (target, until, params, ctx) => {
 		const gate = { product: void 0 };
 		const read = async (signal) => {
-			const item = (await client.getBacklogItem(params.initiativeId, signal)).data;
+			const item = (await client.getBacklogItem(target, signal)).data;
 			if (gate.product === void 0 && typeof item.autoBuild !== "boolean") gate.product = client.hasCapability("products:read") ? await client.getProduct(String(item.productId), signal).then((p) => {
 				const value = p.data.autoBuild;
 				return typeof value === "boolean" ? value : true;
@@ -22826,48 +22975,31 @@ function registerWaitTools(server, client, options) {
 			}) : null;
 			return item;
 		};
-		const { now, ...outcome } = await waitFor(read, judgeItem(params.until, gate), (params.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1e3, options, {
+		const { now, ...outcome } = await waitFor(read, judgeItem(until, gate), (params.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1e3, options, {
 			progressToken: ctx.mcpReq._meta?.progressToken,
 			notify: ctx.mcpReq.notify,
 			signal: ctx.mcpReq.signal
 		});
 		return toolResult({
-			until: params.until,
+			until,
 			...outcome,
 			item: now ? itemReport(now) : null
 		});
-	}));
-	if (client.hasCapability("products:read")) server.registerTool("taiga_wait_for_run", {
-		title: "Wait for a run",
-		description: "Wait until a run reaches a condition: changed, step_done (one more step finished), pr_open (open now) or settled (in review, completed, failed, stopped). Returns reached: true when it holds; early with stoppedBecause if the run settled without it; or reached: false at the timeout: call again. A settled run answers settled at once; run is null if the first read timed out.",
-		inputSchema: z.object({
-			runId: idInput("run", "taiga_list_runs gives it"),
-			until: z.enum(BUILD_CONDITIONS).describe("What to wait for"),
-			timeoutSeconds
-		}),
-		annotations: READ_ONLY
-	}, (params, ctx) => runTool(async () => {
-		const { now, ...outcome } = await waitFor(async (signal) => (await client.getBuildRun(params.runId, signal)).data, judgeBuild(params.until), (params.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1e3, options, {
+	};
+	const waitRun = async (target, until, params, ctx) => {
+		const { now, ...outcome } = await waitFor(async (signal) => (await client.getBuildRun(target, signal)).data, judgeBuild(until), (params.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1e3, options, {
 			progressToken: ctx.mcpReq._meta?.progressToken,
 			notify: ctx.mcpReq.notify,
 			signal: ctx.mcpReq.signal
 		});
 		return toolResult({
-			until: params.until,
+			until,
 			...outcome,
 			run: now ? readableRow(pickFields([now], RUN_REPORT_FIELDS)[0]) : null
 		});
-	}));
-	if (client.hasCapability("products:read")) server.registerTool("taiga_wait_for_job", {
-		title: "Wait for an agent job",
-		description: "Wait until an agent job finishes (completed, failed or cancelled). Returns the job as taiga_get_job reads it, with an initiative request's outcome, and reached: true; or reached: false at the timeout: call again to keep waiting. Most jobs take a few minutes.",
-		inputSchema: z.object({
-			jobId: idInput("job", "the tool that started the job returned it"),
-			timeoutSeconds
-		}),
-		annotations: READ_ONLY
-	}, (params, ctx) => runTool(async () => {
-		const { now, ...outcome } = await waitFor(async (signal) => (await client.getAgentJob(params.jobId, signal)).data, (job) => SETTLED_JOB_STATUSES.has(String(job.status)) ? { reached: true } : null, (params.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1e3, options, {
+	};
+	const waitJob = async (target, params, ctx) => {
+		const { now, ...outcome } = await waitFor(async (signal) => (await client.getAgentJob(target, signal)).data, (job) => SETTLED_JOB_STATUSES.has(String(job.status)) ? { reached: true } : null, (params.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1e3, options, {
 			progressToken: ctx.mcpReq._meta?.progressToken,
 			notify: ctx.mcpReq.notify,
 			signal: ctx.mcpReq.signal
@@ -22876,6 +23008,38 @@ function registerWaitTools(server, client, options) {
 			...outcome,
 			job: now ? jobReport(now) : null
 		});
+	};
+	server.registerTool("taiga_wait", {
+		title: "Wait for an initiative, run or job",
+		description: "Wait instead of polling, for one of: an initiative (initiativeId) to reach until: changed, planned, your_turn (waits on a person), pr_open (open now; merged or closed does not count), run_settled (latest run stopped moving) or done; a run (runId) to reach until: changed, step_done, pr_open or settled (in review, completed, failed, stopped); or an agent job (jobId) to finish, which takes no until. Returns reached: true when it holds; early with stoppedBecause when it cannot happen without a person; or reached: false at the timeout: call again. A condition already true answers at once. Planning takes minutes, a run up to an hour, most jobs a few minutes.",
+		inputSchema: z.object({
+			initiativeId: idInput("initiative", "taiga_list_initiatives (query finds one by title) gives it").optional(),
+			runId: idInput("run", "taiga_list_runs gives it").optional(),
+			jobId: idInput("job", "the tool that started the job returned it").optional(),
+			until: z.enum(ALL_CONDITIONS).optional().describe("What to wait for: an initiative and a run need one"),
+			timeoutSeconds
+		}),
+		annotations: READ_ONLY
+	}, (params, ctx) => runTool(async () => {
+		if ([
+			"initiativeId",
+			"runId",
+			"jobId"
+		].filter((key) => params[key] !== void 0).length !== 1) return toolError("VALIDATION_ERROR", "Name exactly one of initiativeId, runId or jobId: the thing to wait on.");
+		if (params.jobId !== void 0) {
+			if (params.until !== void 0) return toolError("VALIDATION_ERROR", "A job is waited on until it finishes: leave until out.");
+			if (!runs) return toolError("FORBIDDEN", "Waiting on a job needs products:read, which this key lacks.");
+			return waitJob(params.jobId, params, ctx);
+		}
+		const kind = params.initiativeId !== void 0 ? "initiative" : "run";
+		const allowed = UNTIL_FOR[kind];
+		if (params.until === void 0 || !allowed.includes(params.until)) return toolError("VALIDATION_ERROR", `Waiting on ${kind === "initiative" ? "an initiative" : "a run"} takes until: ${allowed.join(", ")}.`);
+		if (kind === "initiative") {
+			if (!items) return toolError("FORBIDDEN", "Waiting on an initiative needs backlog:read, which this key lacks.");
+			return waitInitiative(params.initiativeId, params.until, params, ctx);
+		}
+		if (!runs) return toolError("FORBIDDEN", "Waiting on a run needs products:read, which this key lacks.");
+		return waitRun(params.runId, params.until, params, ctx);
 	}));
 }
 //#endregion
@@ -22933,6 +23097,12 @@ function refusedArguments(args) {
 	}));
 	return toolError("VALIDATION_ERROR", `Invalid arguments for ${tool}. ${lines.map((line) => line.argument ? `${line.argument}: ${line.message}` : line.message).join(" ")}`, { arguments: lines });
 }
+/** Argument names this release replaced, and what replaced them. */
+const RENAMED_ARGUMENTS = {
+	repositoryId: "linkId",
+	replacesRepositoryId: "replacesLinkId",
+	productRepositoryId: "linkId"
+};
 /**
 * A refused call says what to do next (PRO-2841), as a 404 already does. The
 * SDK validates the arguments before the handler runs, where the 404 hints
@@ -22947,6 +23117,8 @@ function withRecoveryHints(tool, schema, inputs, isRead) {
 	const hinted = (issue) => {
 		if (issue.code === "unrecognized_keys" && issue.keys?.length) {
 			const pointers = issue.keys.map((key) => {
+				const renamed = RENAMED_ARGUMENTS[key];
+				if (renamed && (inputs.get(tool) ?? []).includes(renamed)) return `${tool} takes ${renamed}, which replaced ${key}.`;
 				const own = ownArgumentLike(key, inputs.get(tool) ?? []);
 				if (own) return `${tool} takes ${own}, spelled that way.`;
 				const other = closestToolTaking(key, tool, inputs, isRead);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-dev.511",
+  "version": "0.26.0-dev.516",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",