ai-foreman 1.4.0 → 1.6.0

package/dist/tickets/sourceFetch.d.ts

@@ -0,0 +1,24 @@
+export interface SourceFetchLimits {
+    timeoutMs: number;
+    maxBytes: number;
+    maxRedirects: number;
+}
+export declare const DEFAULT_SOURCE_FETCH_LIMITS: SourceFetchLimits;
+export interface FetchedSource {
+    requestedUrl: string;
+    finalUrl: string;
+    contentType: "html" | "text" | "markdown" | "pdf";
+    text: string;
+    bytes: number;
+    fingerprint: string;
+    snapshotPath: string;
+    metadataPath: string;
+    fetchedAt: string;
+}
+export declare function fetchAndSnapshotUrl(projectDir: string, input: string, limits?: Partial<SourceFetchLimits>): Promise<FetchedSource>;
+export declare function normalizePublicHttpUrl(input: string): string;
+export declare function assertPublicDestination(input: string): Promise<void>;
+export declare function isPublicAddress(address: string): boolean;
+export declare function htmlToText(html: string): string;
+/** Snapshot a local file outside the repository so absolute paths are never persisted. */
+export declare function snapshotExternalLocalFile(projectDir: string, inputPath: string): string;

package/dist/tickets/sourceFetch.js

@@ -0,0 +1,246 @@
+import { createHash } from "node:crypto";
+import { copyFileSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { basename, extname, isAbsolute, join, relative, resolve } from "node:path";
+import { readdirSync } from "node:fs";
+import { parse as parseHtml } from "parse5";
+export const DEFAULT_SOURCE_FETCH_LIMITS = {
+    timeoutMs: 15_000,
+    maxBytes: 10 * 1024 * 1024,
+    maxRedirects: 5,
+};
+export async function fetchAndSnapshotUrl(projectDir, input, limits = {}) {
+    const effective = { ...DEFAULT_SOURCE_FETCH_LIMITS, ...limits };
+    const requested = normalizePublicHttpUrl(input);
+    let current = requested;
+    let response;
+    for (let redirects = 0; redirects <= effective.maxRedirects; redirects++) {
+        await assertPublicDestination(current);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), effective.timeoutMs);
+        try {
+            response = await fetch(current, {
+                redirect: "manual",
+                signal: controller.signal,
+                headers: { Accept: "text/html,text/plain,text/markdown,application/pdf;q=0.9" },
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (response.status >= 300 && response.status < 400) {
+            const location = response.headers.get("location");
+            if (!location)
+                throw new Error(`URL redirect ${response.status} did not include Location`);
+            if (redirects === effective.maxRedirects)
+                throw new Error(`URL exceeded ${effective.maxRedirects} redirects`);
+            current = normalizePublicHttpUrl(new URL(location, current).toString());
+            continue;
+        }
+        break;
+    }
+    if (!response)
+        throw new Error("URL fetch did not produce a response");
+    if (!response.ok)
+        throw new Error(`URL fetch failed with HTTP ${response.status}`);
+    const declaredLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declaredLength) && declaredLength > effective.maxBytes)
+        throw new Error(`URL content exceeds ${effective.maxBytes} byte limit`);
+    const bytes = await readLimitedBody(response, effective.maxBytes);
+    const kind = detectContentType(response.headers.get("content-type"), bytes, current);
+    const text = await extractSourceText(kind, bytes);
+    const fetchedAt = new Date().toISOString();
+    const fingerprint = createHash("sha256").update(bytes).digest("hex");
+    const importsDir = join(resolve(projectDir), ".tickets", "imports");
+    mkdirSync(importsDir, { recursive: true });
+    const stamp = fetchedAt.replace(/[:.]/g, "-");
+    const stem = `url-${stamp}-${fingerprint.slice(0, 12)}`;
+    const snapshotPath = join(importsDir, `${stem}.md`);
+    const metadataPath = join(importsDir, `${stem}.json`);
+    writeFileSync(snapshotPath, `${text.trimEnd()}\n`, "utf8");
+    writeFileSync(metadataPath, `${JSON.stringify({ requestedUrl: requested, finalUrl: current, fetchedAt, bytes: bytes.length, contentType: kind, fingerprint }, null, 2)}\n`, "utf8");
+    return { requestedUrl: requested, finalUrl: current, contentType: kind, text, bytes: bytes.length, fingerprint, snapshotPath: relative(resolve(projectDir), snapshotPath), metadataPath: relative(resolve(projectDir), metadataPath), fetchedAt };
+}
+export function normalizePublicHttpUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new Error(`invalid URL: ${input}`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        throw new Error("URL source must use HTTP or HTTPS");
+    if (url.username || url.password)
+        throw new Error("URL source must not contain credentials");
+    if (!url.hostname)
+        throw new Error("URL source must include a hostname");
+    url.hash = "";
+    return url.toString();
+}
+export async function assertPublicDestination(input) {
+    const url = new URL(normalizePublicHttpUrl(input));
+    const addresses = isIP(url.hostname)
+        ? [{ address: url.hostname }]
+        : await dnsLookup(url.hostname, { all: true, verbatim: true });
+    if (addresses.length === 0)
+        throw new Error(`URL hostname did not resolve: ${url.hostname}`);
+    for (const { address } of addresses) {
+        if (!isPublicAddress(address))
+            throw new Error(`URL destination is not public: ${url.hostname} resolved to ${address}`);
+    }
+}
+export function isPublicAddress(address) {
+    const normalized = address.toLowerCase().split("%")[0];
+    if (normalized === "::1" || normalized === "::" || normalized.startsWith("fe80:") || normalized.startsWith("fc") || normalized.startsWith("fd"))
+        return false;
+    if (normalized.startsWith("::ffff:"))
+        return isPublicAddress(normalized.slice(7));
+    if (isIP(normalized) === 6) {
+        return !(normalized.startsWith("ff") ||
+            normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb") ||
+            normalized.startsWith("fc") || normalized.startsWith("fd") ||
+            normalized.startsWith("fec") || normalized.startsWith("fed") || normalized.startsWith("fee") || normalized.startsWith("fef") ||
+            normalized.startsWith("2001:db8:") || normalized.startsWith("2001:10:") || normalized.startsWith("2001:2:") ||
+            normalized.startsWith("100:") || normalized.startsWith("64:ff9b:1:"));
+    }
+    const parts = normalized.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return false;
+    const [a, b] = parts;
+    return !(a === 0 || a === 10 || a === 127 || a >= 224 ||
+        (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && (b === 0 || b === 88 || b === 168)) ||
+        (a === 100 && b >= 64 && b <= 127) || (a === 198 && (b === 18 || b === 19 || b === 51)) ||
+        (a === 203 && b === 0));
+}
+async function readLimitedBody(response, maxBytes) {
+    if (!response.body)
+        return new Uint8Array();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.length;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new Error(`URL content exceeds ${maxBytes} byte limit`);
+        }
+        chunks.push(value);
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return out;
+}
+function detectContentType(header, bytes, url) {
+    const mime = (header ?? "").split(";", 1)[0].trim().toLowerCase();
+    const magic = Buffer.from(bytes.subarray(0, 8)).toString("latin1");
+    if (magic.startsWith("%PDF-")) {
+        if (mime && mime !== "application/pdf" && mime !== "application/octet-stream")
+            throw new Error(`content-type ${mime} conflicts with PDF magic bytes`);
+        return "pdf";
+    }
+    if (["application/pdf"].includes(mime))
+        throw new Error("response claimed PDF but PDF magic bytes were missing");
+    if (["text/html", "application/xhtml+xml"].includes(mime))
+        return "html";
+    if (["text/markdown", "text/x-markdown"].includes(mime) || /\.md(?:own)?$/i.test(new URL(url).pathname))
+        return "markdown";
+    if (!mime || mime.startsWith("text/") || mime === "application/octet-stream") {
+        if (bytes.subarray(0, Math.min(bytes.length, 1024)).includes(0))
+            throw new Error("binary URL content is not supported");
+        if ((!mime || mime === "application/octet-stream") && /^\s*(?:<!doctype\s+html|<html\b)/i.test(Buffer.from(bytes.subarray(0, 1024)).toString("utf8")))
+            return "html";
+        return "text";
+    }
+    throw new Error(`unsupported URL content-type: ${mime}`);
+}
+async function extractSourceText(kind, bytes) {
+    if (kind === "pdf") {
+        const pdfjs = await import("pdfjs-dist/legacy/build/pdf.mjs");
+        const document = await pdfjs.getDocument({ data: bytes, useWorkerFetch: false, isEvalSupported: false }).promise;
+        const pages = [];
+        for (let pageNumber = 1; pageNumber <= document.numPages; pageNumber++) {
+            const page = await document.getPage(pageNumber);
+            const content = await page.getTextContent();
+            pages.push(content.items.map((item) => "str" in item ? item.str : "").join(" "));
+            page.cleanup();
+        }
+        await document.destroy();
+        return pages.join("\n\n");
+    }
+    const decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return kind === "html" ? htmlToText(decoded) : decoded;
+}
+export function htmlToText(html) {
+    const doc = parseHtml(html);
+    const blocks = new Set(["address", "article", "aside", "blockquote", "br", "div", "footer", "h1", "h2", "h3", "h4", "h5", "h6", "header", "li", "main", "p", "section", "table", "tr"]);
+    const skip = new Set(["script", "style", "noscript", "svg"]);
+    const out = [];
+    const walk = (node) => {
+        const named = node;
+        const name = named.nodeName?.toLowerCase();
+        if (name && skip.has(name))
+            return;
+        if (name === "#text" && named.value)
+            out.push(named.value);
+        for (const child of named.childNodes ?? [])
+            walk(child);
+        if (name && blocks.has(name))
+            out.push("\n");
+    };
+    for (const child of doc.childNodes)
+        walk(child);
+    return out.join(" ").replace(/[ \t]+/g, " ").replace(/ *\n */g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+}
+/** Snapshot a local file outside the repository so absolute paths are never persisted. */
+export function snapshotExternalLocalFile(projectDir, inputPath) {
+    const root = realpathSync(resolve(projectDir));
+    const file = realpathSync(resolve(inputPath));
+    const rel = relative(root, file);
+    if (!rel.startsWith("..") && !isAbsolute(rel))
+        return rel;
+    if (statSync(file).isDirectory()) {
+        const hash = createHash("sha256").update(file).digest("hex").slice(0, 12);
+        const targetRoot = join(root, ".tickets", "imports", `local-${hash}-${basename(file).replace(/[^A-Za-z0-9._-]/g, "-")}`);
+        let count = 0;
+        let bytes = 0;
+        const copyDirectory = (source, target) => {
+            mkdirSync(target, { recursive: true });
+            for (const entry of readdirSync(source, { withFileTypes: true })) {
+                if (entry.isSymbolicLink())
+                    continue;
+                const from = join(source, entry.name);
+                const to = join(target, entry.name);
+                if (entry.isDirectory())
+                    copyDirectory(from, to);
+                else if (entry.isFile()) {
+                    count++;
+                    bytes += statSync(from).size;
+                    if (count > 1000 || bytes > DEFAULT_SOURCE_FETCH_LIMITS.maxBytes)
+                        throw new Error("external local source directory exceeds snapshot limits");
+                    copyFileSync(from, to);
+                }
+            }
+        };
+        copyDirectory(file, targetRoot);
+        return relative(root, targetRoot);
+    }
+    if (!statSync(file).isFile())
+        throw new Error(`local source is not a file or directory: ${inputPath}`);
+    const bytes = readFileSync(file);
+    const hash = createHash("sha256").update(bytes).digest("hex").slice(0, 12);
+    const dir = join(root, ".tickets", "imports");
+    mkdirSync(dir, { recursive: true });
+    const target = join(dir, `local-${hash}-${basename(file).replace(/[^A-Za-z0-9._-]/g, "-")}${extname(file) ? "" : ".txt"}`);
+    copyFileSync(file, target);
+    return relative(root, target);
+}

package/dist/tickets/stateDb.d.ts

@@ -81,6 +81,14 @@ export interface ReviewRecommendation {
     source_json: string;
     updated_at: string | null;
 }
+export interface OperationReceipt {
+    operation_id: string;
+    operation_type: string;
+    ticket_id: string | null;
+    run_id: string;
+    completed_at: string;
+    payload_json: string;
+}
 export declare class StateDb {
     private db;
     constructor(dbPath: string);
@@ -103,5 +111,7 @@ export declare class StateDb {
     getReviewRecommendations(status?: ReviewRecommendationStatus): ReviewRecommendation[];
     getReviewRecommendation(id: number): ReviewRecommendation | undefined;
     updateReviewRecommendationStatus(id: number, status: ReviewRecommendationStatus, updatedAt: string): void;
+    getOperationReceipt(operationId: string): OperationReceipt | undefined;
+    recordOperationReceipt(receipt: OperationReceipt): boolean;
     transaction<T>(fn: () => T): T;
 }

package/dist/tickets/stateDb.js

@@ -96,12 +96,22 @@ CREATE TABLE IF NOT EXISTS review_recommendations (
   CHECK (status IN ('pending','accepted','deferred','dismissed'))
 );
 
+CREATE TABLE IF NOT EXISTS operation_receipts (
+  operation_id TEXT PRIMARY KEY,
+  operation_type TEXT NOT NULL,
+  ticket_id TEXT,
+  run_id TEXT NOT NULL,
+  completed_at TEXT NOT NULL,
+  payload_json TEXT NOT NULL DEFAULT '{}'
+);
+
 CREATE INDEX IF NOT EXISTS idx_ticket_state_status ON ticket_state(status);
 CREATE INDEX IF NOT EXISTS idx_ticket_events_ticket_id ON ticket_events(ticket_id);
 CREATE INDEX IF NOT EXISTS idx_ticket_events_timestamp ON ticket_events(timestamp);
 CREATE INDEX IF NOT EXISTS idx_validation_snapshots_timestamp ON validation_snapshots(timestamp);
 CREATE INDEX IF NOT EXISTS idx_future_work_disposition ON future_work(disposition);
 CREATE INDEX IF NOT EXISTS idx_review_recommendations_status ON review_recommendations(status);
+CREATE INDEX IF NOT EXISTS idx_operation_receipts_run ON operation_receipts(run_id);
 `;
 export class StateDb {
     db;
@@ -291,6 +301,20 @@ export class StateDb {
             .prepare("UPDATE review_recommendations SET status = ?, updated_at = ? WHERE id = ?")
             .run(status, updatedAt, id);
     }
+    // ── operation_receipts ───────────────────────────────────────────────────
+    getOperationReceipt(operationId) {
+        return this.db.prepare("SELECT * FROM operation_receipts WHERE operation_id = ?").get(operationId);
+    }
+    recordOperationReceipt(receipt) {
+        const result = this.db.prepare(`
+      INSERT OR IGNORE INTO operation_receipts (
+        operation_id,operation_type,ticket_id,run_id,completed_at,payload_json
+      ) VALUES (
+        @operation_id,@operation_type,@ticket_id,@run_id,@completed_at,@payload_json
+      )
+    `).run(receipt);
+        return result.changes === 1;
+    }
     // ── transactions ──────────────────────────────────────────────────────────
     transaction(fn) {
         return this.db.transaction(fn)();

package/dist/tickets/ticketLoader.js

@@ -47,6 +47,24 @@ export function validateTicketDefs(tickets) {
                 errors.push({ path: `tickets[${t.id}].depends_on`, message: `references unknown ticket: ${dep}` });
             }
         }
+        for (const replacement of t.superseded_by ?? []) {
+            if (!ids.has(replacement))
+                errors.push({ path: `tickets[${t.id}].superseded_by`, message: `references unknown ticket: ${replacement}` });
+            if (replacement === t.id)
+                errors.push({ path: `tickets[${t.id}].superseded_by`, message: "ticket cannot supersede itself" });
+            const reciprocal = tickets.find((candidate) => candidate.id === replacement)?.supersedes ?? [];
+            if (ids.has(replacement) && !reciprocal.includes(t.id))
+                errors.push({ path: `tickets[${t.id}].superseded_by`, message: `${replacement} is missing reciprocal supersedes link to ${t.id}` });
+        }
+        for (const replaced of t.supersedes ?? []) {
+            if (!ids.has(replaced))
+                errors.push({ path: `tickets[${t.id}].supersedes`, message: `references unknown ticket: ${replaced}` });
+            if (replaced === t.id)
+                errors.push({ path: `tickets[${t.id}].supersedes`, message: "ticket cannot supersede itself" });
+            const reciprocal = tickets.find((candidate) => candidate.id === replaced)?.superseded_by ?? [];
+            if (!reciprocal.includes(t.id))
+                errors.push({ path: `tickets[${t.id}].supersedes`, message: `${replaced} is missing reciprocal superseded_by link to ${t.id}` });
+        }
     }
     for (const t of tickets) {
         if ((t.risk === "Medium" || t.risk === "High") && !t.rollback) {

package/dist/tickets/ticketSchema.d.ts

@@ -7,6 +7,14 @@ export interface TicketExternalRef {
     key?: string | null;
     url?: string | null;
 }
+/** General provenance reference. `external_refs` remains accepted for compatibility. */
+export interface TicketSourceRef {
+    source: string;
+    item: string;
+    url?: string | null;
+    fingerprint?: string | null;
+    note?: string | null;
+}
 export interface TicketDef {
     id: string;
     order: number;
@@ -23,6 +31,9 @@ export interface TicketDef {
     rollback?: string | null;
     notes?: string | null;
     external_refs?: TicketExternalRef[];
+    source_refs?: TicketSourceRef[];
+    superseded_by?: string[];
+    supersedes?: string[];
 }
 export declare const TICKET_JSON_SCHEMA: {
     readonly type: "object";
@@ -117,6 +128,47 @@ export declare const TICKET_JSON_SCHEMA: {
                 };
             };
         };
+        readonly source_refs: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly required: readonly ["source", "item"];
+                readonly additionalProperties: true;
+                readonly properties: {
+                    readonly source: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly item: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly url: {
+                        readonly type: readonly ["string", "null"];
+                    };
+                    readonly fingerprint: {
+                        readonly type: readonly ["string", "null"];
+                    };
+                    readonly note: {
+                        readonly type: readonly ["string", "null"];
+                    };
+                };
+            };
+        };
+        readonly superseded_by: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly uniqueItems: true;
+        };
+        readonly supersedes: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly uniqueItems: true;
+        };
     };
 };
 export declare const TICKETS_FILE_SCHEMA: {
@@ -218,6 +270,47 @@ export declare const TICKETS_FILE_SCHEMA: {
                             };
                         };
                     };
+                    readonly source_refs: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "object";
+                            readonly required: readonly ["source", "item"];
+                            readonly additionalProperties: true;
+                            readonly properties: {
+                                readonly source: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                                readonly item: {
+                                    readonly type: "string";
+                                    readonly minLength: 1;
+                                };
+                                readonly url: {
+                                    readonly type: readonly ["string", "null"];
+                                };
+                                readonly fingerprint: {
+                                    readonly type: readonly ["string", "null"];
+                                };
+                                readonly note: {
+                                    readonly type: readonly ["string", "null"];
+                                };
+                            };
+                        };
+                    };
+                    readonly superseded_by: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly uniqueItems: true;
+                    };
+                    readonly supersedes: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly uniqueItems: true;
+                    };
                 };
             };
         };

package/dist/tickets/ticketSchema.js

@@ -34,6 +34,23 @@ export const TICKET_JSON_SCHEMA = {
                 },
             },
         },
+        source_refs: {
+            type: "array",
+            items: {
+                type: "object",
+                required: ["source", "item"],
+                additionalProperties: true,
+                properties: {
+                    source: { type: "string", minLength: 1 },
+                    item: { type: "string", minLength: 1 },
+                    url: { type: ["string", "null"] },
+                    fingerprint: { type: ["string", "null"] },
+                    note: { type: ["string", "null"] },
+                },
+            },
+        },
+        superseded_by: { type: "array", items: { type: "string" }, uniqueItems: true },
+        supersedes: { type: "array", items: { type: "string" }, uniqueItems: true },
     },
 };
 export const TICKETS_FILE_SCHEMA = {

package/dist/tickets/validate.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { validateTicketDefs, detectCycles } from "./ticketLoader.js";
 import { buildNextQueue } from "./queue.js";
+import { loadDeliveryConfig, validateDeliveryConfig } from "./delivery.js";
 export function runAllValidation(config, projectDir, ticketDefs, states, db) {
     const issues = [];
     // Pass 1: schema and source
@@ -11,6 +12,17 @@ export function runAllValidation(config, projectDir, ticketDefs, states, db) {
     for (const cycle of detectCycles(ticketDefs)) {
         issues.push({ pass: 1, severity: "error", message: `[cycle] dependency cycle: ${cycle}` });
     }
+    try {
+        const delivery = loadDeliveryConfig(projectDir);
+        if (delivery) {
+            for (const issue of validateDeliveryConfig(delivery, ticketDefs)) {
+                issues.push({ pass: 1, severity: "error", message: `[delivery] ${issue.path}: ${issue.message}` });
+            }
+        }
+    }
+    catch (err) {
+        issues.push({ pass: 1, severity: "error", message: `[delivery] ${err instanceof Error ? err.message : String(err)}` });
+    }
     // Pass 2: state validation
     const ticketIds = new Set(ticketDefs.map((t) => t.id));
     for (const [id, state] of states) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-foreman",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "An orchestrator that keeps Codex CLI / Claude Code builders moving through their step list unattended. Part of Rafi.",
   "license": "Apache-2.0",
   "type": "module",
@@ -21,6 +21,34 @@
       "types": "./dist/agentRun.d.ts",
       "default": "./dist/agentRun.js"
     },
+    "./interviews.js": {
+      "types": "./dist/interviews.d.ts",
+      "default": "./dist/interviews.js"
+    },
+    "./runtime-readiness.js": {
+      "types": "./dist/runtimeReadiness.d.ts",
+      "default": "./dist/runtimeReadiness.js"
+    },
+    "./roles.js": {
+      "types": "./dist/roles.d.ts",
+      "default": "./dist/roles.js"
+    },
+    "./build-runs.js": {
+      "types": "./dist/buildRuns.d.ts",
+      "default": "./dist/buildRuns.js"
+    },
+    "./ticket-planning.js": {
+      "types": "./dist/ticketPlanning.d.ts",
+      "default": "./dist/ticketPlanning.js"
+    },
+    "./tickets/source-fetch.js": {
+      "types": "./dist/tickets/sourceFetch.d.ts",
+      "default": "./dist/tickets/sourceFetch.js"
+    },
+    "./tickets/setup-config.js": {
+      "types": "./dist/tickets/setupConfig.d.ts",
+      "default": "./dist/tickets/setupConfig.js"
+    },
     "./cli/tickets.js": {
       "types": "./dist/cli/tickets.d.ts",
       "default": "./dist/cli/tickets.js"
@@ -69,13 +97,16 @@
     "@anthropic-ai/claude-agent-sdk": "^0.3.148"
   },
   "dependencies": {
-    "special-agents": "0.5.0",
+    "special-agents": "0.7.0",
+    "rafi-spec": "0.7.0",
     "@clack/prompts": "^1.4.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "better-sqlite3": "^12.10.0",
     "commander": "^12.1.0",
     "luxon": "^3.7.2",
+    "parse5": "7.2.1",
+    "pdfjs-dist": "4.10.38",
     "yaml": "^2.5.1"
   },
   "devDependencies": {