popilot 0.6.0 → 0.8.0

package/scaffold/pm-api/src/routes/v2-rewards.ts

@@ -0,0 +1,132 @@
+import { Hono } from 'hono'
+import type { AppEnv } from '../types.js'
+import { queryOrThrow, executeOrThrow } from '../utils/db.js'
+import { isAdmin } from '../utils/admin.js'
+
+const app = new Hono<AppEnv>()
+
+// Admin-only middleware for write APIs
+async function requireAdmin(c: any, next: () => Promise<void>) {
+  const userName = c.get('userName')
+  if (!await isAdmin(userName)) return c.json({ error: 'Admin privileges required' }, 403)
+  await next()
+}
+
+// GET / — full history (filterable by member)
+app.get('/', async (c) => {
+  const member = c.req.query('member')
+  const status = c.req.query('status')
+
+  let sql = 'SELECT * FROM rewards'
+  const conditions: string[] = []
+  const args: (string | number)[] = []
+
+  if (member) { conditions.push('member_name = ?'); args.push(member) }
+  if (status) { conditions.push('status = ?'); args.push(status) }
+
+  if (conditions.length) sql += ' WHERE ' + conditions.join(' AND ')
+  sql += ' ORDER BY created_at DESC'
+
+  const { rows } = await queryOrThrow(sql, args)
+  return c.json({ rewards: rows })
+})
+
+// GET /summary — balance summary by member
+app.get('/summary', async (c) => {
+  const { rows } = await queryOrThrow(
+    `SELECT member_name,
+       SUM(CASE WHEN type = 'reward' THEN amount ELSE 0 END) as total_rewards,
+       SUM(CASE WHEN type = 'penalty' THEN amount ELSE 0 END) as total_penalties,
+       SUM(CASE WHEN type = 'reward' THEN amount ELSE -amount END) as balance,
+       SUM(CASE WHEN status = 'pending' AND type = 'reward' THEN amount WHEN status = 'pending' AND type = 'penalty' THEN -amount ELSE 0 END) as pending_balance
+     FROM rewards GROUP BY member_name ORDER BY member_name`,
+  )
+  return c.json({ summary: rows })
+})
+
+// POST / — register reward/penalty
+app.post('/', requireAdmin, async (c) => {
+  const body = await c.req.json<{
+    memberName: string
+    type: 'reward' | 'penalty'
+    amount: number
+    reason: string
+    issuedBy?: string
+  }>()
+
+  const issuedBy = body.issuedBy || c.get('userName') || 'system'
+
+  await executeOrThrow(
+    `INSERT INTO rewards (member_name, type, amount, reason, status, issued_by)
+     VALUES (?, ?, ?, ?, 'pending', ?)`,
+    [body.memberName, body.type, body.amount, body.reason, issuedBy],
+  )
+  return c.json({ ok: true }, 201)
+})
+
+// PATCH /:id/pay — pending -> paid transition
+app.patch('/:id/pay', requireAdmin, async (c) => {
+  const id = Number(c.req.param('id'))
+  const body = await c.req.json<{ txHash?: string }>()
+
+  await executeOrThrow(
+    `UPDATE rewards SET status = 'paid', tx_hash = ?, paid_at = CURRENT_TIMESTAMP WHERE id = ? AND status = 'pending'`,
+    [body.txHash ?? null, id],
+  )
+  return c.json({ ok: true })
+})
+
+// PATCH /batch-pay — batch pay all pending for a member
+app.patch('/batch-pay', requireAdmin, async (c) => {
+  const body = await c.req.json<{ memberName: string; txHash?: string }>()
+
+  const { rowsAffected } = await executeOrThrow(
+    `UPDATE rewards SET status = 'paid', tx_hash = ?, paid_at = CURRENT_TIMESTAMP WHERE member_name = ? AND status = 'pending'`,
+    [body.txHash ?? null, body.memberName],
+  )
+  return c.json({ ok: true, paidCount: rowsAffected })
+})
+
+// DELETE /:id — delete (admin)
+app.delete('/:id', requireAdmin, async (c) => {
+  const id = Number(c.req.param('id'))
+  await executeOrThrow('DELETE FROM rewards WHERE id = ?', [id])
+  return c.json({ ok: true })
+})
+
+// GET /wallets — bulk wallet balance query via blockchain adapter
+app.get('/wallets', async (c) => {
+  const { rows: members } = await queryOrThrow<{ display_name: string; wallet_address: string | null }>(
+    "SELECT display_name, wallet_address FROM members WHERE is_active = 1 AND wallet_address IS NOT NULL AND wallet_address != ''",
+  )
+
+  const { getBlockchainAdapter } = await import('../blockchain/adapter.js')
+  const blockchain = getBlockchainAdapter()
+
+  const wallets = await Promise.all(members.map(async (m) => {
+    try {
+      const balance = await blockchain.getBalance(m.wallet_address!)
+      return { name: m.display_name, address: m.wallet_address, ...balance }
+    } catch {
+      return { name: m.display_name, address: m.wallet_address, native: 0, token: 0 }
+    }
+  }))
+
+  return c.json({ wallets })
+})
+
+// GET /onchain/:address — on-chain balance query via blockchain adapter
+app.get('/onchain/:address', async (c) => {
+  const address = c.req.param('address')
+
+  try {
+    const { getBlockchainAdapter } = await import('../blockchain/adapter.js')
+    const blockchain = getBlockchainAdapter()
+    const balance = await blockchain.getBalance(address)
+    return c.json({ address, ...balance })
+  } catch (e) {
+    return c.json({ address, native: 0, token: 0, error: 'Blockchain query failed' })
+  }
+})
+
+export default app

package/scaffold/pm-api/src/routes/v2-scenarios.ts

@@ -0,0 +1,48 @@
+import { Hono } from 'hono'
+import type { AppEnv } from '../types.js'
+import { query, execute } from '../db/adapter.js'
+import { queryOrThrow, executeOrThrow } from '../utils/db.js'
+
+const app = new Hono<AppEnv>()
+
+// GET /:pageId/:sprint
+app.get('/:pageId/:sprint', async (c) => {
+  const pageId = c.req.param('pageId')
+  const sprint = c.req.param('sprint')
+  const { rows } = await queryOrThrow(
+    'SELECT * FROM scenario_data WHERE page_id = ? AND sprint = ?',
+    [pageId, sprint],
+  )
+  return c.json({ rows: rows })
+})
+
+// PUT /:pageId/:sprint/:scenarioId — UPSERT
+app.put('/:pageId/:sprint/:scenarioId', async (c) => {
+  const pageId = c.req.param('pageId')
+  const sprint = c.req.param('sprint')
+  const scenarioId = c.req.param('scenarioId')
+  const body = await c.req.json<{ label: string; dataJson: string; author: string }>()
+
+  const { rowsAffected } = await executeOrThrow(
+    `INSERT INTO scenario_data (page_id, sprint, scenario_id, label, data_json, author)
+     VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT (page_id, sprint, scenario_id)
+     DO UPDATE SET label = excluded.label, data_json = excluded.data_json, author = excluded.author, updated_at = CURRENT_TIMESTAMP`,
+    [pageId, sprint, scenarioId, body.label, body.dataJson, body.author],
+  )
+  return c.json({ ok: true })
+})
+
+// DELETE /:pageId/:sprint/:scenarioId
+app.delete('/:pageId/:sprint/:scenarioId', async (c) => {
+  const pageId = c.req.param('pageId')
+  const sprint = c.req.param('sprint')
+  const scenarioId = c.req.param('scenarioId')
+  const { rowsAffected } = await executeOrThrow(
+    'DELETE FROM scenario_data WHERE page_id = ? AND sprint = ? AND scenario_id = ?',
+    [pageId, sprint, scenarioId],
+  )
+  return c.json({ ok: true })
+})
+
+export default app

package/scaffold/pm-api/src/routes/v2-search.ts

@@ -0,0 +1,32 @@
+import { Hono } from 'hono'
+import type { AppEnv } from '../types.js'
+import { query } from '../db/adapter.js'
+
+const app = new Hono<AppEnv>()
+
+// GET / — unified search
+app.get('/', async (c) => {
+  const q = c.req.query('q')
+  if (!q || q.length < 2) return c.json({ results: [] })
+
+  const keyword = `%${q}%`
+  const perType = 5
+
+  const [stories, memos, docs, meetings] = await Promise.all([
+    query('SELECT id, title, SUBSTR(description, 1, 50) as preview, created_at FROM pm_stories WHERE title LIKE ? OR description LIKE ? ORDER BY created_at DESC LIMIT ?', [keyword, keyword, perType]),
+    query('SELECT id, title, SUBSTR(content, 1, 50) as preview, created_at FROM memos_v2 WHERE content LIKE ? OR title LIKE ? ORDER BY created_at DESC LIMIT ?', [keyword, keyword, perType]),
+    query('SELECT id, title, SUBSTR(content, 1, 50) as preview, updated_at as created_at FROM docs WHERE title LIKE ? OR content LIKE ? ORDER BY updated_at DESC LIMIT ?', [keyword, keyword, perType]),
+    query('SELECT id, title, SUBSTR(summary, 1, 50) as preview, date as created_at FROM meetings WHERE title LIKE ? OR summary LIKE ? ORDER BY date DESC LIMIT ?', [keyword, keyword, perType]),
+  ])
+
+  const results = [
+    ...(stories.rows ?? []).map((r: any) => ({ type: 'story', ...r, url: `/board?story=${r.id}` })),
+    ...(memos.rows ?? []).map((r: any) => ({ type: 'memo', ...r, url: `/memos/${r.id}` })),
+    ...(docs.rows ?? []).map((r: any) => ({ type: 'doc', ...r, url: `/docs/${r.id}` })),
+    ...(meetings.rows ?? []).map((r: any) => ({ type: 'meeting', ...r, url: `/meetings` })),
+  ]
+
+  return c.json({ results })
+})
+
+export default app

package/scaffold/pm-api/src/routes/v2-standup.ts

@@ -0,0 +1,127 @@
+import { Hono } from 'hono'
+import type { AppEnv } from '../types.js'
+import { query, execute } from '../db/adapter.js'
+import { queryOrThrow, executeOrThrow } from '../utils/db.js'
+
+const app = new Hono<AppEnv>()
+
+// GET /entries — sprint optional, date-based primary view
+app.get('/entries', async (c) => {
+  const sprint = c.req.query('sprint')
+  const date = c.req.query('date')
+
+  if (date && sprint) {
+    const { rows } = await queryOrThrow(
+      'SELECT * FROM pm_standup_entries WHERE sprint = ? AND entry_date = ? ORDER BY user_name',
+      [sprint, date],
+    )
+    return c.json({ entries: rows })
+  }
+
+  if (date) {
+    const { rows } = await queryOrThrow(
+      'SELECT * FROM pm_standup_entries WHERE entry_date = ? ORDER BY user_name',
+      [date],
+    )
+    return c.json({ entries: rows })
+  }
+
+  if (sprint) {
+    const { rows } = await queryOrThrow(
+      'SELECT * FROM pm_standup_entries WHERE sprint = ? ORDER BY entry_date DESC, user_name LIMIT 50',
+      [sprint],
+    )
+    return c.json({ entries: rows })
+  }
+
+  return c.json({ error: 'sprint or date query param required' }, 400)
+})
+
+// PUT /entries — UPSERT
+app.put('/entries', async (c) => {
+  const body = await c.req.json<{
+    sprint: string; userName: string; date: string
+    doneText?: string; planText?: string; planStoryIds?: number[] | string | null; blockers?: string
+  }>()
+
+  // planStoryIds: number[] -> JSON string for storage
+  const storyIdsJson = Array.isArray(body.planStoryIds) && body.planStoryIds.length
+    ? JSON.stringify(body.planStoryIds)
+    : (typeof body.planStoryIds === 'string' ? body.planStoryIds : null)
+
+  const { rowsAffected } = await executeOrThrow(
+    `INSERT INTO pm_standup_entries (sprint, user_name, entry_date, done_text, plan_text, plan_story_ids, blockers)
+     VALUES (?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT (sprint, user_name, entry_date)
+     DO UPDATE SET done_text = excluded.done_text, plan_text = excluded.plan_text,
+       plan_story_ids = excluded.plan_story_ids, blockers = excluded.blockers,
+       updated_at = CURRENT_TIMESTAMP`,
+    [body.sprint, body.userName, body.date, body.doneText ?? null, body.planText ?? null, storyIdsJson, body.blockers ?? null],
+  )
+  return c.json({ ok: true })
+})
+
+// ── Standup Feedback (1:N) ──
+
+// GET /feedback?standup_entry_id= or ?sprint=&user=
+app.get('/feedback', async (c) => {
+  const entryId = c.req.query('standup_entry_id')
+  const sprint = c.req.query('sprint')
+  const user = c.req.query('user')
+
+  if (entryId) {
+    const { rows } = await queryOrThrow(
+      'SELECT * FROM pm_standup_feedback WHERE standup_entry_id = ? ORDER BY created_at ASC',
+      [Number(entryId)],
+    )
+    return c.json({ feedback: rows })
+  }
+
+  if (sprint && user) {
+    const { rows } = await queryOrThrow(
+      'SELECT f.* FROM pm_standup_feedback f WHERE f.sprint = ? AND f.target_user = ? ORDER BY f.created_at DESC LIMIT 50',
+      [sprint, user],
+    )
+    return c.json({ feedback: rows })
+  }
+
+  return c.json({ error: 'standup_entry_id or (sprint + user) query params required' }, 400)
+})
+
+// POST /feedback — add feedback to a standup entry
+app.post('/feedback', async (c) => {
+  const body = await c.req.json<{
+    standupEntryId: number
+    sprint: string
+    targetUser: string
+    feedbackBy: string
+    feedbackText: string
+    reviewType?: string
+  }>()
+
+  if (!body.standupEntryId || !body.sprint || !body.targetUser || !body.feedbackBy || !body.feedbackText) {
+    return c.json({ error: 'standupEntryId, sprint, targetUser, feedbackBy, feedbackText required' }, 400)
+  }
+
+  const reviewType = body.reviewType ?? 'comment'
+  if (!['comment', 'approve', 'request_changes'].includes(reviewType)) {
+    return c.json({ error: 'reviewType must be comment, approve, or request_changes' }, 400)
+  }
+
+  // Verify the standup entry exists
+  const entryCheck = await query(
+    'SELECT id FROM pm_standup_entries WHERE id = ?',
+    [body.standupEntryId],
+  )
+  if (entryCheck.error) return c.json({ error: entryCheck.error }, 500)
+  if (entryCheck.rows.length === 0) return c.json({ error: 'Standup entry not found' }, 404)
+
+  const { rowsAffected } = await executeOrThrow(
+    `INSERT INTO pm_standup_feedback (standup_entry_id, sprint, target_user, feedback_by, feedback_text, review_type)
+     VALUES (?, ?, ?, ?, ?, ?)`,
+    [body.standupEntryId, body.sprint, body.targetUser, body.feedbackBy, body.feedbackText, reviewType],
+  )
+  return c.json({ ok: true })
+})
+
+export default app

package/scaffold/pm-api/src/routes/v2-user.ts

@@ -0,0 +1,38 @@
+import { Hono } from 'hono'
+import type { AppEnv } from '../types.js'
+import { query, execute } from '../db/adapter.js'
+import { queryOrThrow, executeOrThrow } from '../utils/db.js'
+
+const app = new Hono<AppEnv>()
+
+// GET /members — members table based (no duplicates)
+app.get('/members', async (c) => {
+  const { rows } = await queryOrThrow(
+    'SELECT display_name FROM members WHERE is_active = 1 ORDER BY display_name',
+  )
+  return c.json({ members: rows.map((r: Record<string, unknown>) => String(r.display_name)) })
+})
+
+// POST /activity
+app.post('/activity', async (c) => {
+  const body = await c.req.json<{ userName: string }>()
+  const { rowsAffected } = await executeOrThrow(
+    `INSERT INTO user_activity (user_name, last_seen_at) VALUES (?, CURRENT_TIMESTAMP)
+     ON CONFLICT (user_name) DO UPDATE SET last_seen_at = CURRENT_TIMESTAMP`,
+    [body.userName],
+  )
+  return c.json({ ok: true })
+})
+
+// POST /memo-seen
+app.post('/memo-seen', async (c) => {
+  const body = await c.req.json<{ userName: string }>()
+  const { rowsAffected } = await executeOrThrow(
+    `INSERT INTO user_activity (user_name, last_memo_seen) VALUES (?, CURRENT_TIMESTAMP)
+     ON CONFLICT (user_name) DO UPDATE SET last_memo_seen = CURRENT_TIMESTAMP`,
+    [body.userName],
+  )
+  return c.json({ ok: true })
+})
+
+export default app

package/scaffold/pm-api/src/types.ts

@@ -0,0 +1,11 @@
+export type AppEnv = {
+  Bindings: {
+    TURSO_URL: string
+    TURSO_AUTH_TOKEN: string
+    NUDGE_WEBHOOK_URL?: string
+    ALLOWED_ORIGINS?: string
+  }
+  Variables: {
+    userName: string
+  }
+}

package/scaffold/pm-api/src/utils/activity.ts

@@ -0,0 +1,22 @@
+import { execute } from '../db/adapter.js'
+
+/**
+ * Log an activity entry (fire-and-forget)
+ */
+export async function logActivity(
+  actor: string,
+  actionType: string,
+  targetType: string,
+  targetId: string | number,
+  targetTitle: string,
+  metadata?: Record<string, unknown>,
+): Promise<void> {
+  try {
+    await execute(
+      'INSERT INTO activity_log (actor, action_type, target_type, target_id, target_title, metadata) VALUES (?, ?, ?, ?, ?, ?)',
+      [actor, actionType, targetType, String(targetId), targetTitle, metadata ? JSON.stringify(metadata) : null],
+    )
+  } catch {
+    // fire-and-forget
+  }
+}

package/scaffold/pm-api/src/utils/admin.ts

@@ -0,0 +1,9 @@
+import { query } from '../db/adapter.js'
+
+export async function isAdmin(userName: string): Promise<boolean> {
+  const result = await query<{ role: string }>(
+    "SELECT role FROM members WHERE display_name = ? AND is_active = 1",
+    [userName],
+  )
+  return result.rows[0]?.role === 'admin'
+}

package/scaffold/pm-api/src/utils/agent-notify.ts

@@ -0,0 +1,62 @@
+/**
+ * Agent/member notification — DB-based webhook_url
+ *
+ * Sends notifications to the webhook_url registered in members.webhook_url.
+ * Members without a webhook_url will not receive notifications.
+ */
+
+import { query } from '../db/adapter.js'
+
+/** Look up webhook_url by display name (DB) */
+export async function resolveWebhookUrl(assignee: string): Promise<string | null> {
+  const result = await query<{ webhook_url: string | null }>(
+    'SELECT webhook_url FROM members WHERE display_name = ? AND is_active = 1',
+    [assignee],
+  )
+  return result.rows[0]?.webhook_url ?? null
+}
+
+/** Determine webhook format by URL pattern */
+function getWebhookFormat(url: string): 'discord' | 'google' | 'slack' | 'generic' {
+  if (url.includes('/api/webhooks') && (url.includes('discord.com') || url.includes('discordapp.com'))) return 'discord'
+  if (url.includes('chat.googleapis.com')) return 'google'
+  if (url.includes('hooks.slack.com')) return 'slack'
+  return 'generic'
+}
+
+/** Send a webhook notification to a specific member (Discord/Google Chat/Slack compatible) */
+export async function notifyMember(webhookUrl: string, title: string, description: string, color = 0x3B82F6): Promise<void> {
+  try {
+    const format = getWebhookFormat(webhookUrl)
+    let body: string
+
+    if (format === 'discord') {
+      body = JSON.stringify({ embeds: [{ title, description, color }] })
+    } else if (format === 'google') {
+      body = JSON.stringify({ text: `*${title}*\n${description}` })
+    } else if (format === 'slack') {
+      body = JSON.stringify({ text: `*${title}*\n${description}` })
+    } else {
+      body = JSON.stringify({ title, description })
+    }
+
+    await fetch(webhookUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body,
+    })
+  } catch (_) { /* Failure should not block main logic */ }
+}
+
+/** Send notification by name (name -> DB webhook_url -> send) */
+export async function notifyByName(assignee: string, title: string, description: string): Promise<boolean> {
+  const url = await resolveWebhookUrl(assignee)
+  if (!url) return false
+  await notifyMember(url, title, description)
+  return true
+}
+
+/** Send notification to multiple recipients */
+export async function notifyRecipients(assignees: string[], title: string, description: string): Promise<void> {
+  await Promise.all(assignees.map(a => notifyByName(a, title, description)))
+}

package/scaffold/pm-api/src/utils/assignee.ts

@@ -0,0 +1,69 @@
+import { query } from '../db/adapter.js'
+
+/** Simple similarity score: shared characters ratio + substring containment */
+export function similarity(a: string, b: string): number {
+  const al = a.toLowerCase()
+  const bl = b.toLowerCase()
+  if (al === bl) return 1
+  if (al.includes(bl) || bl.includes(al)) return 0.8
+  const setA = new Set(al)
+  const setB = new Set(bl)
+  let shared = 0
+  for (const c of setA) if (setB.has(c)) shared++
+  return shared / Math.max(setA.size, setB.size)
+}
+
+/** Find similar names from a list (threshold: 0.4, max 3) */
+export function findSimilar(name: string, allNames: string[], threshold = 0.4): string[] {
+  return allNames
+    .map(n => ({ name: n, score: similarity(name, n) }))
+    .filter(x => x.score >= threshold)
+    .sort((a, b) => b.score - a.score)
+    .slice(0, 3)
+    .map(x => x.name)
+}
+
+/** Resolve display_name to member id. Returns null if not found. */
+export async function resolveMemberId(displayName: string): Promise<number | null> {
+  const result = await query<{ id: number }>(
+    'SELECT id FROM members WHERE display_name = ? AND is_active = 1',
+    [displayName],
+  )
+  return result.rows[0]?.id ?? null
+}
+
+/** Resolve comma-separated assignee names to comma-separated member ids (same order). Returns null for unresolved names. */
+export async function resolveMemberIds(assignee: string | null | undefined): Promise<(number | null)[]> {
+  if (!assignee) return []
+  const names = assignee.split(',').map(s => s.trim()).filter(Boolean)
+  const ids: (number | null)[] = []
+  for (const name of names) {
+    ids.push(await resolveMemberId(name))
+  }
+  return ids
+}
+
+/** Validate assignee(s) against members table. Supports comma-separated names. Suggests similar names on mismatch. */
+export async function validateAssignee(assignee: string | null | undefined): Promise<string | null> {
+  if (!assignee) return null
+  const names = assignee.split(',').map(s => s.trim()).filter(Boolean)
+  if (names.length === 0) return null
+
+  const allMembers = await query<{ display_name: string }>(
+    'SELECT display_name FROM members WHERE is_active = 1',
+  )
+  const allNames = allMembers.rows.map(r => r.display_name)
+  const validSet = new Set(allNames)
+  const invalid = names.filter(n => !validSet.has(n))
+
+  if (invalid.length > 0) {
+    const suggestions = invalid.map(name => {
+      const similar = findSimilar(name, allNames)
+      return similar.length
+        ? `'${name}' — Did you mean: ${similar.join(', ')}?`
+        : `'${name}'`
+    })
+    return `Invalid assignee: ${suggestions.join(' | ')}. Use list_team_members to verify`
+  }
+  return null
+}

package/scaffold/pm-api/src/utils/db.ts

@@ -0,0 +1,45 @@
+import { query, execute, type ArgValue } from '../db/adapter.js'
+
+export class DbError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'DbError'
+  }
+}
+
+export async function queryOrThrow<T = Record<string, unknown>>(
+  sql: string,
+  args: ArgValue[] = [],
+): Promise<{ rows: T[] }> {
+  const result = await query<T>(sql, args)
+  if (result.error) throw new DbError(result.error)
+  return { rows: result.rows ?? [] }
+}
+
+export async function executeOrThrow(
+  sql: string,
+  args: ArgValue[] = [],
+): Promise<{ rowsAffected: number }> {
+  const result = await execute(sql, args)
+  if (result.error) throw new DbError(result.error)
+  return { rowsAffected: result.rowsAffected }
+}
+
+export function buildUpdateQuery(
+  fieldMap: Record<string, string>,
+  body: Record<string, unknown>,
+): { sets: string[]; args: (string | number | null)[] } | null {
+  const sets: string[] = []
+  const args: (string | number | null)[] = []
+
+  for (const [key, col] of Object.entries(fieldMap)) {
+    if (body[key] !== undefined) {
+      sets.push(`${col} = ?`)
+      args.push(body[key] as string | number | null)
+    }
+  }
+
+  if (sets.length === 0) return null
+  sets.push('updated_at = CURRENT_TIMESTAMP')
+  return { sets, args }
+}

package/scaffold/pm-api/src/utils/initiative.ts

@@ -0,0 +1,23 @@
+/**
+ * Initiative — pure domain logic
+ */
+
+export type InitiativeStatus = 'pending' | 'approved' | 'rejected' | 'deferred'
+
+export const VALID_TRANSITIONS: Record<InitiativeStatus, InitiativeStatus[]> = {
+  pending: ['approved', 'rejected', 'deferred'],
+  approved: [],
+  rejected: ['pending'],
+  deferred: ['pending'],
+}
+
+export function canTransition(from: InitiativeStatus, to: InitiativeStatus): boolean {
+  return VALID_TRANSITIONS[from]?.includes(to) ?? false
+}
+
+export function validateCreate(title: string | undefined, content: string | undefined, author: string | undefined): string | null {
+  if (!title?.trim()) return 'title required'
+  if (!content?.trim()) return 'content required'
+  if (!author?.trim()) return 'author required'
+  return null
+}

package/scaffold/pm-api/src/utils/retro-link.ts

@@ -0,0 +1,32 @@
+/**
+ * Retro → Kickoff Link — pure domain logic
+ */
+
+export interface RetroAction {
+  id: number
+  content: string
+  assignee: string | null
+  status: string
+}
+
+export interface BacklogStory {
+  title: string
+  description: string
+  assignee: string | null
+  source: string
+}
+
+/** Convert action item → backlog story */
+export function actionToStory(action: RetroAction, sprintId: string): BacklogStory {
+  return {
+    title: `[Retro] ${action.content.slice(0, 60)}`,
+    description: `Created from retro (${sprintId}) action item.\n\nOriginal: ${action.content}`,
+    assignee: action.assignee,
+    source: `retro:${sprintId}`,
+  }
+}
+
+/** Filter incomplete action items */
+export function getPendingActions(actions: RetroAction[]): RetroAction[] {
+  return actions.filter(a => a.status !== 'done')
+}