@taiga-ai/mcp-server 0.36.0-rc.778 → 0.36.0-rc.800

package/dist/index.js

@@ -505,6 +505,7 @@ function hide(inst, key, value) {
 	return own$5(inst, key, value, false);
 }
 /** Adds members a table derives from the instance: each builds on first read and shadows as own data, and assignment shadows the same way, as when these were own properties. */
+/* @__NO_SIDE_EFFECTS__ */
 function derived(computes, table) {
 	for (const key in computes) {
 		const compute = computes[key];
@@ -658,6 +659,7 @@ function newError(Definition) {
 	}
 	return new Definition();
 }
+/* @__NO_SIDE_EFFECTS__ */
 function $constructor(name, initializer, proto, params) {
 	const zodProto = {};
 	function Internals(def) {
@@ -788,8 +790,7 @@ const initializer$1 = (inst, def) => {
 		});
 	}
 };
-const $ZodError = $constructor("$ZodError", initializer$1);
-$constructor("$ZodError", initializer$1, void 0, { Parent: Error });
+const $ZodError = /* @__PURE__ */ $constructor("$ZodError", initializer$1);
 /** Get-or-create `obj[key]` as an own data property. A path segment naming an inherited member
 * ("toString", "constructor") would otherwise read through to the prototype, and assigning
 * "__proto__" would hit the setter instead of creating a key. */
@@ -1078,7 +1079,7 @@ const guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9
 /** Returns a regex for validating an RFC 9562/4122 UUID.
 *
 * @param version Optionally specify a version 1-8. If no version is specified, all versions are supported. */
-const uuid = (version) => {
+const uuid$1 = (version) => {
 	if (!version) return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
 	return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
@@ -1618,8 +1619,8 @@ const $ZodUUID = /*@__PURE__*/ $constructor("$ZodUUID", (inst, def) => {
 			v8: 8
 		}[def.version];
 		if (v === void 0) throw new Error(`Invalid UUID version: "${def.version}"`);
-		def.pattern ?? (def.pattern = uuid(v));
-	} else def.pattern ?? (def.pattern = uuid());
+		def.pattern ?? (def.pattern = uuid$1(v));
+	} else def.pattern ?? (def.pattern = uuid$1());
 	$ZodStringFormat.init(inst, def);
 });
 const $ZodEmail = /*@__PURE__*/ $constructor("$ZodEmail", (inst, def) => {
@@ -5675,6 +5676,14 @@ function object(shape, params) {
 	};
 	return new ZodObject(def);
 }
+function strictObject(shape, params) {
+	return new ZodObject({
+		type: "object",
+		shape,
+		catchall: never(),
+		...normalizeParams(params)
+	});
+}
 function looseObject(shape, params) {
 	return new ZodObject({
 		type: "object",
@@ -7941,7 +7950,23 @@ var SdkError = class extends Error {
 		stampErrorBrands(this, new.target);
 	}
 };
-(class extends SdkError {
+/**
+* An {@linkcode SdkError} subclass for HTTP transport failures.
+*
+* Thrown by the streamable HTTP transport when the server responds with a
+* non-OK status code. Narrows {@linkcode SdkError.data | data} to
+* {@linkcode SdkHttpErrorData} so consumers can inspect the HTTP status
+* without unsafe casting.
+*
+* @example
+* ```ts source="./sdkErrors.examples.ts#SdkHttpError_basicUsage"
+* if (error instanceof SdkHttpError) {
+*     console.log(error.status); // number
+*     console.log(error.statusText); // string | undefined
+* }
+* ```
+*/
+var SdkHttpError = class extends SdkError {
 	static {
 		Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
 	}
@@ -7958,7 +7983,7 @@ var SdkError = class extends Error {
 	get statusText() {
 		return this.data.statusText;
 	}
-});
+};
 function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -24089,6 +24114,25 @@ var TaigaClient = class {
 	}
 };
 //#endregion
+//#region ../../packages/types/dist/clouds.js
+/**
+* Cloud provider platforms that Taiga can connect to.
+*/
+const CLOUD_PROVIDERS = [
+	"aws",
+	"gcp",
+	"azure",
+	"upcloud",
+	"kubernetes",
+	"digitalocean",
+	"vercel",
+	"railway",
+	"render",
+	"fly",
+	"on_prem",
+	"other"
+];
+//#endregion
 //#region ../../packages/types/dist/lenient-schema.js
 /**
 * Building blocks for reading JSON that arrives untyped -- a stored jsonb
@@ -24150,6 +24194,14 @@ const optionalUuid = string$2().uuid().optional();
 */
 const optionalLineAnchor = number$1().int().min(0).optional().transform((v) => v ? v : void 0);
 //#endregion
+//#region ../../packages/types/dist/entitlements.js
+/**
+* Which agent implementation serves a planning job or build run (PRO-1331).
+* Recorded on `agent_jobs.runtime` / `build_runs.runtime` at dispatch so
+* outcomes can be compared per runtime and the UI can badge runs.
+*/
+const AGENT_RUNTIMES = ["legacy", "engineer"];
+//#endregion
 //#region ../../packages/types/dist/tenants.js
 const TENANT_DOCUMENT_TYPES = [
 	"policy_security",
@@ -24365,6 +24417,14 @@ Object.fromEntries([...EU_COUNTRIES.map((c) => [c.code, "eu"]), ...EEA_COUNTRIES
 //#endregion
 //#region ../../packages/types/dist/factories.js
 const FACTORY_DOCUMENT_TYPES = ["factory_instructions"];
+/** The single canonical factory-document type (the free-form Factory Instructions doc). */
+const FACTORY_INSTRUCTIONS_TYPE = "factory_instructions";
+/**
+* The pre-PRO-1671 value of that type. Old clients still name it in URLs
+* (`/factories/:id/documents/team_instructions`), so the API accepts it as
+* an alias for a deprecation window.
+*/
+const LEGACY_FACTORY_INSTRUCTIONS_TYPE = "team_instructions";
 //#endregion
 //#region ../../packages/types/dist/forge.js
 /** Source-control hosts. `bitbucket` is a stored link provider without an adapter yet. */
@@ -24416,6 +24476,15 @@ const FORGE_SUPPORT = {
 	],
 	bitbucket: []
 };
+/**
+* Whether a repository link under this forge may name a GitHub App
+* installation's repository: only GitHub's. Stored under another forge, the
+* link would be dispatched with GitHub credentials while the rest of its
+* lifecycle reads it as that forge.
+*/
+function linksGitHubAppRepositories(provider) {
+	return provider === "github";
+}
 const FORGE_TERMS = {
 	github: {
 		name: "GitHub",
@@ -24471,6 +24540,11 @@ const PRODUCT_DOCUMENT_TYPES = [
 	"product_instructions"
 ];
 /**
+* The pre-PRO-1671 value of `product_instructions`. Old clients still name it
+* in URLs, so the API accepts it as an alias for a deprecation window.
+*/
+const LEGACY_PRODUCT_INSTRUCTIONS_TYPE = "project_instructions";
+/**
 * The document types the codebase-intelligence agent can derive from a repo --
 * the valid values for a single-document reality refresh (PRO-1141).
 *
@@ -24566,6 +24640,8 @@ const PRODUCT_DOCUMENT_DISPLAY_NAMES = {
 	service_blueprint: "Service Blueprint"
 };
 const PRODUCT_DOCUMENT_ORIGINS = ["plan", "reality"];
+/** The forges a repository link can name: `FORGE_PROVIDERS`, under the name links have always used. */
+const VCS_PROVIDERS = FORGE_PROVIDERS;
 //#endregion
 //#region ../../packages/types/dist/route-key.js
 /**
@@ -25524,6 +25600,29 @@ object({
 [...BUILD_RUN_ACTIVE_STATUSES.filter((s) => s !== "reviewing")];
 //#endregion
 //#region ../../packages/types/dist/agents.js
+const AGENT_JOB_TYPES = [
+	"generate_document",
+	"generate_backlog",
+	"plan_backlog_item",
+	"infer_backlog_dependencies",
+	"deploy",
+	"provision_infrastructure",
+	"health_check",
+	"refresh_reality_docs",
+	"derive_policy_update",
+	"derive_design_from_documents",
+	"sync_design_tokens",
+	"generate_design_component",
+	"maintenance_sweep",
+	"maintenance_verify",
+	"propose_ui_concepts",
+	"iterate_ui_concept",
+	"fill_questionnaire",
+	"read_questionnaire_layout",
+	"generate_ui_direction",
+	"assess_policy_conformance",
+	"replan_run"
+];
 /**
 * Why a PROMPTED `generate_backlog` job planned nothing.
 *
@@ -25936,6 +26035,23 @@ const MCP_TOOLSETS = [
 /** Longest request for changes from Taiga (PRO-3035): about four pages of prose. */
 const CHANGE_REQUEST_MAX_CHARS = 1e4;
 //#endregion
+//#region ../../packages/types/dist/requests.js
+/** Every way a request can be answered, whatever its kind. */
+const REQUEST_EXITS = [
+	"resume_run",
+	"replan",
+	"clear",
+	"leave_line",
+	"approve",
+	"reject",
+	"merge",
+	"close",
+	"request_changes",
+	"done",
+	"dismiss",
+	"reviewed"
+];
+//#endregion
 //#region ../../packages/types/dist/maintenance.js
 /**
 * Maintenance taxonomy + API DTOs.
@@ -26261,6 +26377,19 @@ object({
 */
 const MAINTENANCE_LICENSE_FILTER_MAX = 4096;
 //#endregion
+//#region ../../packages/types/dist/custom-documents.js
+/**
+* Shared types for the custom-documents feature: customer-uploaded reference
+* files (PDFs, Markdown, OpenAPI specs, etc.) indexed into a Bedrock
+* Knowledge Base for retrieval by Taiga's internal agents.
+*/
+const CUSTOM_DOCUMENT_STATUSES = [
+	"pending",
+	"ingesting",
+	"ready",
+	"failed"
+];
+//#endregion
 //#region ../../packages/types/dist/design-tokens.js
 /**
 * The brand grounding contract (PRO-929).
@@ -26436,6 +26565,457 @@ object({
 	fontSize: lenient(union([string$2(), number$1()]))
 });
 //#endregion
+//#region ../../packages/types/dist/questionnaires.js
+/**
+* Questionnaire filling (PRO-932).
+*
+* A customer uploads their own requirement spreadsheet; Taiga answers what the
+* project's evidence settles, cites the document version each answer rests on,
+* and hands back the gaps. The register these types describe is the durable
+* object -- the workbook is an import format on one side and an export format
+* on the other.
+*/
+/**
+* Lifecycle of one questionnaire.
+*
+* `filling` is deliberately NOT set by the fill workflow (PRO-1187), and that
+* is a decision rather than an omission. A status set at the start of a
+* multi-minute run needs something to clear it when the run does not finish --
+* and if the worker dies mid-fill, nothing would: `agent_jobs` has a reaper for
+* stale JOBS, but it knows nothing about this table, so the register would read
+* `filling` forever. A state nothing can leave is worse than one nothing
+* enters.
+*
+* "Is a fill running" is already answerable, and from the row that has a reaper:
+* an active `fill_questionnaire` job with this questionnaire as its target.
+* Wire `filling` up when it comes with a path off it.
+*/
+/**
+* `reading` and `needs_columns` are the import itself (PRO-1506). A workbook
+* is stored and its row exists from the first byte; the column read runs as
+* a job. `reading` is that job in flight; `needs_columns` is the read done
+* without confidence, waiting for a person to confirm the map. Only once the
+* map is confirmed do items exist and the row becomes `draft`.
+*/
+/**
+* A sheet map's bounds, Excel's own: a column index becomes a column letter
+* in a cell reference the export writes to, so an unbounded one names
+* whatever it likes.
+*/
+const EXCEL_MAX_COLUMN = 16384;
+const EXCEL_MAX_ROW = 1048576;
+//#endregion
+//#region ../../packages/types/dist/product-network.js
+/**
+* Where an engineer build's sandbox may connect to (PRO-2793, part of
+* PRO-1980).
+*
+* The engineer pod's credential gateway is the sandbox's only way out. By
+* default it lets through a standard list: the public package registries,
+* toolchain downloads, container registries, GitHub for reading public
+* dependencies, and the tenant's own registries. A product adds to that:
+*
+* - `allowlist` (the default, also what `null` means): the standard list plus
+*   the product's own `networkHosts`.
+* - `unrestricted`: any public host. For a product whose builds need hosts
+*   nobody can list in advance; the gateway still refuses private and
+*   metadata addresses, and still never hands the sandbox a credential.
+*
+* A host is one exact name (`api.example.com`). There are no wildcards: a
+* wildcard over a multi-label public suffix (`*.co.uk`) or a provider's
+* namespace would admit every tenant under it, and telling those apart needs
+* the public suffix list. A build that needs many names under one domain is
+* what `unrestricted` is for.
+*/
+const PRODUCT_NETWORK_ACCESS = ["allowlist", "unrestricted"];
+/**
+* A host a product may add: lowercase DNS labels, at least two, ending in a
+* letter label. No wildcard, scheme, port, path or IP literal.
+*/
+const PRODUCT_NETWORK_HOST_PATTERN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/;
+/**
+* Domains where anyone can host content under their own name: a bucket, an
+* app, a tunnel. Listing one whole would let a prompt injection send code to
+* a bucket the attacker made, the way the gateway's standard list never lists
+* a shared CDN whole. A specific name under one (`my-bucket.s3.amazonaws.com`)
+* is fine.
+*/
+const SHARED_HOSTING_DOMAINS = [
+	"amazonaws.com",
+	"s3.amazonaws.com",
+	"cloudfront.net",
+	"googleapis.com",
+	"storage.googleapis.com",
+	"appspot.com",
+	"firebaseapp.com",
+	"web.app",
+	"blob.core.windows.net",
+	"azureedge.net",
+	"azurewebsites.net",
+	"githubusercontent.com",
+	"github.io",
+	"herokuapp.com",
+	"vercel.app",
+	"netlify.app",
+	"pages.dev",
+	"workers.dev",
+	"trycloudflare.com",
+	"ngrok.io",
+	"ngrok-free.app",
+	"onrender.com",
+	"fly.dev"
+];
+/** Whether `host` has the shape of a host a product may list. */
+function isProductNetworkHost(host) {
+	return PRODUCT_NETWORK_HOST_PATTERN.test(host);
+}
+/** Whether `host` is a domain anyone can host content on, listed whole. */
+function isSharedHostingDomain(host) {
+	return SHARED_HOSTING_DOMAINS.includes(host);
+}
+strictObject({});
+const uuid = string$2().uuid();
+const sha256 = string$2().regex(/^[0-9a-f]{64}$/, "sha256 must be 64 lowercase hex characters");
+object({ jobId: string$2() });
+/** An upload's grant: a presigned PUT to staging and the headers it signed. */
+const uploadGrant = object({
+	id: string$2(),
+	url: string$2(),
+	headers: record(string$2(), string$2()),
+	expiresAt: string$2()
+});
+object({ version: number$1().int().min(1) });
+/** The uploads a product's move could not re-file, named while they fit the answer (PRO-3497). */
+const failedDocuments = array(object({
+	id: string$2(),
+	fileName: string$2(),
+	error: string$2()
+}));
+object({
+	backlogItemId: string$2(),
+	divergenceCount: number$1(),
+	created: boolean()
+});
+/** The options of a policy fix: build it once planned, and refuse it when the violation was fixed since. */
+const policyFixOptions = {
+	autoBuild: boolean().optional(),
+	refuseIfFixedSinceAssessment: boolean().optional()
+};
+object({
+	findings: number$1(),
+	findingIds: array(string$2()).nullable()
+});
+/** An ignore's expiry, when it has one, is in the future. */
+const expiresInFuture = (expiresAt) => !expiresAt || new Date(expiresAt).getTime() > Date.now();
+const EXPIRY_IN_FUTURE = {
+	message: "The ignore expiry must be in the future.",
+	path: ["ignoreExpiresAt"]
+};
+const ignoreNote = string$2().trim().max(280).nullish();
+const ignoreExpiresAt = string$2().datetime({ offset: true }).nullish();
+const productDocumentType = _enum([...PRODUCT_DOCUMENT_TYPES, LEGACY_PRODUCT_INSTRUCTIONS_TYPE]).transform((type) => type === "project_instructions" ? "product_instructions" : type);
+const customDocumentStatus = _enum(CUSTOM_DOCUMENT_STATUSES);
+const cloudPreferences = object({
+	iacTool: _enum([
+		"terraform",
+		"pulumi",
+		"cdk",
+		"none"
+	]).nullable().optional(),
+	stateBackend: _enum([
+		"aws-s3",
+		"gcs",
+		"azurerm",
+		"tfcloud",
+		"other"
+	]).nullable().optional(),
+	ciSystem: _enum([
+		"github-actions",
+		"gitlab-ci",
+		"circleci",
+		"jenkins",
+		"other"
+	]).nullable().optional(),
+	authMethod: _enum([
+		"oidc",
+		"static-keys",
+		"unknown"
+	]).optional(),
+	accountIsolation: _enum([
+		"per-env",
+		"shared",
+		"unknown"
+	]).optional()
+}).optional();
+const cloudBestPractices = object({
+	dedicatedAccount: boolean().optional(),
+	oidcAuth: boolean().optional(),
+	regionMatchesPolicy: boolean().optional(),
+	stateInSameAccount: boolean().optional()
+}).optional();
+const cloudProviderConfig = discriminatedUnion("provider", [
+	object({
+		provider: literal("aws"),
+		accountId: string$2().regex(/^\d{12}$/, "AWS account ID must be 12 digits").optional(),
+		region: string$2().min(1),
+		preferences: cloudPreferences,
+		bestPractices: cloudBestPractices
+	}),
+	object({
+		provider: literal("gcp"),
+		projectId: string$2().regex(/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/, "Invalid GCP project ID").optional(),
+		region: string$2().min(1),
+		preferences: cloudPreferences,
+		bestPractices: cloudBestPractices
+	}),
+	object({
+		provider: literal("azure"),
+		subscriptionId: string$2().uuid("Azure subscription ID must be a UUID").optional(),
+		tenantId: string$2().uuid("Azure tenant ID must be a UUID").optional(),
+		region: string$2().min(1),
+		preferences: cloudPreferences,
+		bestPractices: cloudBestPractices
+	}),
+	object({
+		provider: literal("upcloud"),
+		zone: string$2().min(1),
+		username: string$2().min(1).optional(),
+		authMethod: _enum(["password", "token"]).optional(),
+		preferences: cloudPreferences,
+		bestPractices: cloudBestPractices
+	})
+]);
+const columnIndex = number$1().int().min(1).max(EXCEL_MAX_COLUMN);
+const sheetMap = object({
+	sheetName: string$2().min(1).max(120),
+	idColumn: columnIndex,
+	questionColumn: columnIndex,
+	detailColumns: array(columnIndex).max(20).optional(),
+	sectionColumn: columnIndex.optional(),
+	answerColumn: columnIndex,
+	justificationColumn: columnIndex.optional(),
+	firstDataRow: number$1().int().min(1).max(EXCEL_MAX_ROW)
+});
+const answerValue = string$2().trim().min(1).max(64);
+const justification = string$2().trim().max(2e3);
+const notApplicableReason = string$2().trim().min(1).max(1200);
+strictObject({ comment: string$2().trim().min(1).max(PLAN_REJECTION_COMMENT_MAX_CHARS) });
+strictObject({ expectedRunId: uuid.optional() }), strictObject({ force: boolean().optional() });
+strictObject({
+	notes: string$2().trim().min(1).max(CHANGE_REQUEST_MAX_CHARS),
+	/** Show the revised plan before the run continues (PRO-3164). */
+	reviewPlan: boolean().optional(),
+	/** The repository whose pull request should change, by its full name, for a run in several (PRO-3346). */
+	repository: string$2().trim().min(1).max(255).optional()
+}), object({ steer: _enum([
+	"replanning",
+	"after_step",
+	"after_round",
+	"held"
+]).optional() });
+strictObject({
+	exit: _enum(REQUEST_EXITS),
+	comment: string$2().trim().min(1).max(PLAN_REJECTION_COMMENT_MAX_CHARS).optional(),
+	force: boolean().optional()
+}).refine((answer) => answer.exit === "reject" === (answer.comment !== void 0), {
+	message: "A rejection takes a comment for the planner, and no other answer takes one.",
+	path: ["comment"]
+}).refine((answer) => answer.exit === "replan" || answer.force === void 0, {
+	message: "Only Plan again can plan anyway.",
+	path: ["force"]
+});
+strictObject({ type: productDocumentType }), object({
+	version: number$1().int().min(1),
+	unknownCitations: object({
+		shown: array(string$2()),
+		count: number$1().int().min(0)
+	})
+}), strictObject({ type: productDocumentType }), strictObject({ type: productDocumentType }), object({ documentId: string$2().uuid() }), strictObject({
+	githubRepositoryId: uuid.optional(),
+	/** A GitLab project, by the connection whose bot reaches it and GitLab's numeric id (P-PRO-150). */
+	gitlabConnectionId: uuid.optional(),
+	gitlabProjectId: number$1().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+	provider: _enum(VCS_PROVIDERS).optional().default("github"),
+	repositoryName: string$2().min(1).max(512).optional(),
+	repositoryUrl: string$2().url().max(2048).optional(),
+	repositoryDefaultBranch: string$2().max(255).optional().default("main"),
+	/** The link this one replaces, retired in the same transaction (PRO-2522). */
+	replacesRepositoryId: uuid.optional()
+}).refine((b) => b.gitlabConnectionId === void 0 === (b.gitlabProjectId === void 0), { message: "gitlabConnectionId and gitlabProjectId go together" }).refine((b) => b.gitlabConnectionId === void 0 || b.githubRepositoryId === void 0, { message: "A link is to a GitHub repository or a GitLab project, not both" }).refine((b) => b.githubRepositoryId === void 0 || linksGitHubAppRepositories(b.provider), { message: "githubRepositoryId is a GitHub repository; provider must be github" }), strictObject({
+	repositoryId: uuid,
+	baseBranch: string$2().trim().min(1).max(255).nullable()
+}), object({
+	effectiveBranch: string$2(),
+	protection: object({
+		protected: boolean(),
+		requiredStatusChecks: array(string$2()),
+		enforcementLevel: string$2().nullable()
+	}).nullable()
+}), strictObject({
+	license: string$2().trim().min(1).max(200),
+	ignoreReason: _enum(MAINTENANCE_IGNORE_REASONS),
+	ignoreNote,
+	ignoreExpiresAt
+}).refine((args) => expiresInFuture(args.ignoreExpiresAt), EXPIRY_IN_FUTURE), strictObject({
+	license: string$2().trim().min(1).max(200),
+	findingIds: array(uuid).min(1).optional()
+}), strictObject({ host: string$2().trim().toLowerCase().refine(isProductNetworkHost, { message: "A host is one exact DNS name, such as api.example.com: no wildcard, scheme, port or path" }).refine((host) => !isSharedHostingDomain(host), { message: "Anyone can host content on this domain, so it cannot be listed whole; list the one host you need under it" }) }), strictObject({
+	type: _enum(AGENT_JOB_TYPES),
+	documentType: string$2().max(30).optional(),
+	priority: number$1().int().min(0).max(99).optional(),
+	metadata: record(string$2(), unknown$1()).optional(),
+	/** Which implementation should serve it (PRO-1332): a request the server may refuse. */
+	runtime: _enum(AGENT_RUNTIMES).optional()
+}), strictObject({
+	fileName: string$2().trim().min(1).max(1024),
+	sizeBytes: number$1().int().nonnegative(),
+	sha256
+}), object({ upload: uploadGrant }), strictObject({ uploadId: uuid }), object({
+	questionnaireId: string$2(),
+	jobId: string$2()
+}), strictObject({ mode: _enum(["generate", "republish"]).default("generate") }), strictObject({ docTypes: array(_enum(REALITY_DERIVED_DOCUMENT_TYPES)).min(1).max(REALITY_DERIVED_DOCUMENT_TYPES.length).optional() }), object({ jobIds: array(string$2()) }), object({ cancelledJobIds: array(string$2()) }), strictObject({
+	factoryId: uuid,
+	stopLine: boolean().optional()
+}), object({
+	changed: boolean(),
+	previousFactoryId: string$2().nullable(),
+	lineStopped: boolean(),
+	failedDocuments,
+	/** How many uploads kept the old factory; null while not known, never read as none. */
+	failedCount: number$1().int().min(0).nullable()
+}), strictObject({ documentIds: array(uuid).min(1).max(100).optional() }), object({
+	rescopedCount: number$1().int().min(0).nullable(),
+	failedDocuments,
+	failedCount: number$1().int().min(0).nullable()
+}), strictObject({ repositoryId: uuid }), strictObject({
+	ecosystem: string$2().min(1).max(50),
+	packageName: string$2().min(1).max(255),
+	/** The installed version, for a package resolved at several in a monorepo. */
+	currentVersion: string$2().min(1).max(100).nullish(),
+	/** The linked repository the group belongs to: a fix touches one. */
+	productRepositoryId: uuid.nullish(),
+	/** Build the fix as soon as it is planned (PRO-949). */
+	autoBuild: boolean().optional()
+}), object({
+	backlogItemId: string$2(),
+	findingCount: number$1()
+}), strictObject({
+	...policyFixOptions,
+	controlId: string$2().min(1).max(40)
+}), strictObject({ environments: array(string$2()).default(["development"]) }), strictObject({
+	connection: object({
+		name: string$2().min(1).max(150),
+		provider: _enum(CLOUD_PROVIDERS),
+		providerConfig: cloudProviderConfig
+	}).refine((connection) => connection.provider === connection.providerConfig.provider, {
+		message: "connection.provider must match connection.providerConfig.provider",
+		path: ["providerConfig", "provider"]
+	}),
+	environment: object({
+		name: string$2().min(1).max(100),
+		slug: string$2().min(1).max(63).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Slug must be lowercase letters, digits, and dashes"),
+		type: _enum(ENVIRONMENT_TYPES),
+		ordinal: number$1().int().min(0).default(0),
+		isProtected: boolean().default(false)
+	}).optional()
+});
+object({
+	status: customDocumentStatus.nullable(),
+	/** The retry itself threw; absent when it went through. */
+	error: string$2().optional()
+});
+strictObject({ type: _enum([...FACTORY_DOCUMENT_TYPES, LEGACY_FACTORY_INSTRUCTIONS_TYPE]).transform((type) => type === "team_instructions" ? FACTORY_INSTRUCTIONS_TYPE : type) });
+strictObject({ type: _enum(TENANT_DOCUMENT_TYPES) }), strictObject({
+	name: string$2().min(1).max(50),
+	action: _enum(["accept", "decline"])
+}), object({
+	applied: _enum([
+		"draft",
+		"published",
+		"declined"
+	]),
+	version: number$1().int().nullable()
+}), strictObject({
+	fileName: string$2().trim().min(1).max(255),
+	mime: string$2().min(1).max(255),
+	sizeBytes: number$1().int().positive(),
+	sha256,
+	factoryId: string$2().optional(),
+	productId: string$2().optional(),
+	origin: string$2().optional()
+}), discriminatedUnion("deduplicated", [object({
+	deduplicated: literal(true),
+	documentId: string$2(),
+	factoryId: string$2().nullable(),
+	status: customDocumentStatus
+}), object({
+	deduplicated: literal(false),
+	upload: uploadGrant
+})]), strictObject({ uploadId: uuid }), object({
+	documentId: string$2(),
+	factoryId: string$2().nullable(),
+	deduplicated: boolean(),
+	status: customDocumentStatus.nullable(),
+	/** Filing it threw; absent when it went through. */
+	error: string$2().optional()
+}), strictObject({ ids: array(uuid).min(1).max(100) }), object({
+	failedIds: array(string$2()).nullable(),
+	deletedIds: array(string$2()).optional()
+}), strictObject({ ids: array(uuid).min(1).max(25) }), object({ referenced: array(string$2()) }), strictObject({
+	approve: array(string$2().min(1).max(100)).max(200).default([]),
+	remove: array(string$2().min(1).max(100)).max(200).default([])
+}).refine((b) => b.approve.length + b.remove.length > 0, { message: "Name a license to approve or remove" }), object({ version: number$1().nullable() });
+strictObject({
+	ignoreReason: _enum(MAINTENANCE_IGNORE_REASONS),
+	ignoreNote,
+	ignoreExpiresAt
+}).refine((args) => expiresInFuture(args.ignoreExpiresAt), EXPIRY_IN_FUTURE), strictObject({ autoBuild: boolean().optional() }), object({ backlogItemId: string$2() });
+strictObject(policyFixOptions);
+strictObject({ tier: _enum([
+	"development",
+	"staging",
+	"production"
+]) });
+object({
+	url: string$2().url(),
+	expiresAt: string$2(),
+	written: number$1(),
+	unwrittenCount: number$1(),
+	summary: object({
+		byTaiga: number$1(),
+		byYou: number$1(),
+		notApplicable: number$1(),
+		blank: number$1()
+	})
+}), strictObject({
+	columnMap: object({ sheets: array(sheetMap).min(1).max(50) }),
+	answerVocabulary: array(string$2().min(1).max(64)).max(16).nullable().optional(),
+	answerLegend: string$2().max(4e3).nullable().optional()
+}), object({
+	imported: number$1(),
+	skippedRows: number$1()
+});
+discriminatedUnion("action", [
+	strictObject({ action: literal("accept") }),
+	strictObject({ action: literal("reject") }),
+	strictObject({
+		action: literal("edit"),
+		answerValue: answerValue.optional(),
+		justification: justification.optional()
+	}),
+	strictObject({
+		action: literal("answer"),
+		answerValue,
+		justification: justification.optional()
+	}),
+	strictObject({
+		action: literal("not_applicable"),
+		/** The token the form uses for it, when it has one -- `NA`, `N/A`, `es`. */
+		answerValue: answerValue.optional(),
+		reason: notApplicableReason
+	})
+]);
+//#endregion
 //#region ../../packages/types/dist/auto-build.js
 /**
 * Auto-build: the review-plans gate (PRO-1305).
@@ -26520,30 +27100,6 @@ Object.freeze({
 	applicationOwnership: true
 });
 //#endregion
-//#region ../../packages/types/dist/product-network.js
-/**
-* Where an engineer build's sandbox may connect to (PRO-2793, part of
-* PRO-1980).
-*
-* The engineer pod's credential gateway is the sandbox's only way out. By
-* default it lets through a standard list: the public package registries,
-* toolchain downloads, container registries, GitHub for reading public
-* dependencies, and the tenant's own registries. A product adds to that:
-*
-* - `allowlist` (the default, also what `null` means): the standard list plus
-*   the product's own `networkHosts`.
-* - `unrestricted`: any public host. For a product whose builds need hosts
-*   nobody can list in advance; the gateway still refuses private and
-*   metadata addresses, and still never hands the sandbox a credential.
-*
-* A host is one exact name (`api.example.com`). There are no wildcards: a
-* wildcard over a multi-label public suffix (`*.co.uk`) or a provider's
-* namespace would admit every tenant under it, and telling those apart needs
-* the public suffix list. A build that needs many names under one domain is
-* what `unrestricted` is for.
-*/
-const PRODUCT_NETWORK_ACCESS = ["allowlist", "unrestricted"];
-//#endregion
 //#region src/compat.ts
 /**
 * Why this server should not serve the API it reached, or null when it may
@@ -26664,6 +27220,39 @@ const TOOLSET_OF = {
 	taiga_retry_knowledge: "documents"
 };
 /**
+* Deliver & Operate's tools (PRO-3834): initiatives, plans, runs and the line, fixes, environments, deployments,
+* monitoring and delivery metrics. An organization whose plan refuses delivery work does not see them, as its web app
+* shows none of their views; the API says which (`deliveryIncluded` at introspection), so the plan, not the key,
+* decides. Fixing a finding plans and builds, so it goes with them.
+*/
+const DELIVERY_TOOLS = /* @__PURE__ */ new Set([
+	"taiga_list_initiatives",
+	"taiga_get_initiative",
+	"taiga_get_plan",
+	"taiga_list_runs",
+	"taiga_get_run",
+	"taiga_get_line",
+	"taiga_queue_initiative",
+	"taiga_move_initiative",
+	"taiga_review_plan",
+	"taiga_plan_again",
+	"taiga_resume_initiative",
+	"taiga_stop_run",
+	"taiga_request_changes",
+	"taiga_request_initiatives",
+	"taiga_fix_finding",
+	"taiga_fix_policy_violation",
+	"taiga_set_auto_build",
+	"taiga_set_auto_merge",
+	"taiga_pause_line",
+	"taiga_create_environment",
+	"taiga_update_environment",
+	"taiga_get_deployments",
+	"taiga_get_monitoring",
+	"taiga_get_delivery_metrics",
+	"taiga_sync_design_tokens"
+]);
+/**
 * TAIGA_TOOLSETS as written: comma-separated names, or "all"; a name it does not know is said, not ignored, and so
 * is a value that names none.
 */
@@ -26894,7 +27483,7 @@ function setupNextStep(product) {
 	if (isImportedProduct(product)) switch (importStatusOf(product)) {
 		case "analyzing":
 		case "generating_docs": return `The import is running and derives the documents from the code (taiga_wait (jobId) follows its job). Then review them, and ${FINISH_DISCOVERY}`;
-		case "complete": return "The import is done: review the reality documents (taiga_get_product_document without type), then taiga_finish_discovery opens the product and starts planning its first initiatives (paid agent work: ask the person first).";
+		case "complete": return "The import is done: review the reality documents (taiga_get_product_document without type), then " + FINISH_DISCOVERY;
 		case "failed":
 		case "cancelled": return "The last import did not finish: taiga_start_import runs it again.";
 		default: return "Link its repository if it has none (taiga_list_linkable_repositories, taiga_link_repository), then taiga_start_import: the import derives the documents from the code and runs by itself.";
@@ -27590,11 +28179,25 @@ function withFixability(row) {
 	if (dependency && !row["recommendedVersion"] && row["remediableBy"] === "coding_agent") return {
 		...row,
 		fixable: false,
-		fixNote: "No fixed version is known yet: taiga_fix_finding refuses it until one is published."
+		fixNote: noVersionNote(row["data"])
 	};
 	return row;
 }
 /**
+* Why a dependency has no version to move to. A language runtime declared as
+* a container image moves only to a release the image has published
+* (PRO-3729), so its vendor's fix can be out while Fix is refused: the
+* finding's runtime data says so where the row carries it (taiga_get_finding).
+*/
+function noVersionNote(data) {
+	const runtime = data?.runtime;
+	const fixedIn = typeof runtime?.["fixedIn"] === "string" ? runtime["fixedIn"] : null;
+	if (fixedIn) return `Fixed in ${fixedIn}, but there is no release to move to yet: the image the repository declares has not published it, or, where the line has ended, a supported line (the summary says which). taiga_fix_finding refuses it until there is one.`;
+	if (runtime && (typeof runtime["newest"] === "string" || "endOfLife" in runtime)) return "A newer release is out, but the image the repository declares has not published one to move to yet (the summary names the image): taiga_fix_finding refuses it until it does.";
+	if (runtime) return "No fixed release is known yet, or, where the line has ended, the image the repository declares has not published a supported line (the summary says which): taiga_fix_finding refuses it until there is one.";
+	return "No version to move to yet: no fixed version is known, or for a language runtime the image the repository declares has not published one (taiga_get_finding says which). taiga_fix_finding refuses it until there is one.";
+}
+/**
 * Dev-only, runtime or unknown, said on a dependency row (PRO-2861) in place of the raw per-lockfile groups
 * the API carries: the groups need the lockfile name to read, which `dependencyScope` does once here.
 */
@@ -27990,7 +28593,7 @@ function registerMaintenanceTools(server, client) {
 	}));
 	server.registerTool("taiga_fix_finding", {
 		title: "Fix a finding",
-		description: "Raise an initiative that fixes a finding; it ends in a pull request, which merges on its own only where the product's auto-merge allows it. wholeGroup: true fixes, in that repository, every open advisory on that package version in one bump, or every place the rule flagged. A malicious package is removed, with every advisory on that version, whatever wholeGroup says. Refused when no fixed version is known (fixable: false), the code is in a submodule, or a secret is only in history (rotate it outside Taiga).",
+		description: "Raise an initiative that fixes a finding; it ends in a pull request, which merges on its own only where the product's auto-merge allows it. wholeGroup: true fixes, in that repository, every open advisory on that package version in one bump, or every place the rule flagged. A malicious package is removed, with every advisory on that version, whatever wholeGroup says. A language runtime moves every file declaring it together, in a container image only to a tag the image has published. Refused when there is no version to move to (fixable: false; for a runtime, also while its image has not published the fix), the code is in a submodule, or a secret is only in history (rotate it outside Taiga).",
 		inputSchema: object({
 			productId,
 			findingId,
@@ -48338,6 +48941,7 @@ function withStrictInputs(server, client, registered, toolsets, left) {
 	const inputs = /* @__PURE__ */ new Map();
 	const register = server.registerTool.bind(server);
 	server.registerTool = ((name, config, callback) => {
+		if (DELIVERY_TOOLS.has(name) && client.getIntrospection()?.deliveryIncluded === false) return void 0;
 		const toolset = TOOLSET_OF[name];
 		if (name !== "taiga_whoami") {
 			if (!toolset) throw new Error(`Tool ${name}: no toolset in toolsets.ts`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.36.0-rc.778",
+  "version": "0.36.0-rc.800",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",