popilot 0.6.0 → 0.8.0

package/scaffold/pm-api/src/db/adapter.ts

@@ -0,0 +1,36 @@
+/**
+ * Database adapter interface — provider-agnostic query layer.
+ * Implementations: TursoAdapter, (future: SupabaseAdapter, SqliteAdapter)
+ */
+
+export type ArgValue = string | number | null
+
+export interface DbAdapter {
+  query<T = Record<string, unknown>>(sql: string, args?: ArgValue[]): Promise<{ rows: T[]; error?: string }>
+  execute(sql: string, args?: ArgValue[]): Promise<{ rowsAffected: number; error?: string }>
+}
+
+let _adapter: DbAdapter | null = null
+
+export function setAdapter(adapter: DbAdapter) {
+  _adapter = adapter
+}
+
+export function getAdapter(): DbAdapter {
+  if (!_adapter) throw new Error('DB adapter not initialized. Call setAdapter() first.')
+  return _adapter
+}
+
+export async function query<T = Record<string, unknown>>(
+  sql: string,
+  args: ArgValue[] = [],
+): Promise<{ rows: T[]; error?: string }> {
+  return getAdapter().query<T>(sql, args)
+}
+
+export async function execute(
+  sql: string,
+  args: ArgValue[] = [],
+): Promise<{ rowsAffected: number; error?: string }> {
+  return getAdapter().execute(sql, args)
+}

package/scaffold/pm-api/src/db/turso.ts

@@ -0,0 +1,147 @@
+/**
+ * Turso HTTP API v2 (/v2/pipeline) adapter
+ * Workers environment: setTursoEnv() injects bindings per request
+ */
+
+import type { DbAdapter, ArgValue } from './adapter.js'
+
+interface HranaValue {
+  type: 'text' | 'integer' | 'float' | 'null'
+  value?: string
+}
+
+function toHranaArg(v: ArgValue): HranaValue {
+  if (v === null) return { type: 'null' }
+  if (typeof v === 'number') {
+    return Number.isInteger(v)
+      ? { type: 'integer', value: String(v) }
+      : { type: 'float', value: String(v) }
+  }
+  return { type: 'text', value: String(v) }
+}
+
+interface PipelineResult {
+  results: Array<{
+    type: 'ok' | 'error'
+    response?: {
+      type: string
+      result?: {
+        cols: Array<{ name: string }>
+        rows: Array<Array<HranaValue>>
+        affected_row_count: number
+        last_insert_rowid: string | null
+      }
+    }
+    error?: { message: string }
+  }>
+}
+
+export class TursoAdapter implements DbAdapter {
+  private url: string
+  private token: string
+
+  constructor(url: string, token: string) {
+    this.url = url
+    this.token = token
+  }
+
+  async query<T = Record<string, unknown>>(
+    sql: string,
+    args: ArgValue[] = [],
+  ): Promise<{ rows: T[]; error?: string }> {
+    if (!this.url || !this.token) {
+      return { rows: [], error: 'Missing TURSO_URL or TURSO_AUTH_TOKEN' }
+    }
+
+    try {
+      const resp = await fetch(this.url + '/v2/pipeline', {
+        method: 'POST',
+        headers: {
+          Authorization: 'Bearer ' + this.token,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          requests: [
+            { type: 'execute', stmt: { sql, args: args.map(toHranaArg) } },
+            { type: 'close' },
+          ],
+        }),
+      })
+
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => '')
+        return { rows: [], error: `HTTP ${resp.status}: ${text}` }
+      }
+
+      const data: PipelineResult = await resp.json()
+      const first = data.results[0]
+
+      if (first.type === 'error') {
+        return { rows: [], error: first.error?.message ?? 'Unknown error' }
+      }
+
+      const result = first.response?.result
+      if (!result) return { rows: [] }
+
+      const colNames = result.cols.map(c => c.name)
+      const rows = result.rows.map(row => {
+        const obj: Record<string, unknown> = {}
+        colNames.forEach((col, i) => {
+          const cell = row[i]
+          if (cell.type === 'null') obj[col] = null
+          else if (cell.type === 'integer') obj[col] = Number(cell.value)
+          else if (cell.type === 'float') obj[col] = Number(cell.value)
+          else obj[col] = cell.value
+        })
+        return obj as T
+      })
+
+      return { rows }
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : 'Unknown error'
+      return { rows: [], error: message }
+    }
+  }
+
+  async execute(
+    sql: string,
+    args: ArgValue[] = [],
+  ): Promise<{ rowsAffected: number; error?: string }> {
+    if (!this.url || !this.token) {
+      return { rowsAffected: 0, error: 'Missing TURSO_URL or TURSO_AUTH_TOKEN' }
+    }
+
+    try {
+      const resp = await fetch(this.url + '/v2/pipeline', {
+        method: 'POST',
+        headers: {
+          Authorization: 'Bearer ' + this.token,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          requests: [
+            { type: 'execute', stmt: { sql, args: args.map(toHranaArg) } },
+            { type: 'close' },
+          ],
+        }),
+      })
+
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => '')
+        return { rowsAffected: 0, error: `HTTP ${resp.status}: ${text}` }
+      }
+
+      const data: PipelineResult = await resp.json()
+      const first = data.results[0]
+
+      if (first.type === 'error') {
+        return { rowsAffected: 0, error: first.error?.message ?? 'Unknown error' }
+      }
+
+      return { rowsAffected: first.response?.result?.affected_row_count ?? 0 }
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : 'Unknown error'
+      return { rowsAffected: 0, error: message }
+    }
+  }
+}

package/scaffold/pm-api/src/index.ts

@@ -0,0 +1,114 @@
+import { Hono } from 'hono'
+import { cors } from 'hono/cors'
+import type { AppEnv } from './types.js'
+import { setAdapter } from './db/adapter.js'
+import { TursoAdapter } from './db/turso.js'
+import { authMiddleware } from './auth.js'
+import mcpRoutes from './mcp.js'
+import authRoutes from './routes/auth.js'
+
+import v2NavRoutes from './routes/v2-nav.js'
+import v2PageContentRoutes from './routes/v2-page-content.js'
+import v2ScenariosRoutes from './routes/v2-scenarios.js'
+import v2PmRoutes from './routes/v2-pm.js'
+import v2PolicyRoutes from './routes/v2-policy.js'
+import v2StandupRoutes from './routes/v2-standup.js'
+import v2RetroRoutes from './routes/v2-retro.js'
+import v2NotificationsRoutes from './routes/v2-notifications.js'
+import v2MemosRoutes from './routes/v2-memos.js'
+import v2UserRoutes from './routes/v2-user.js'
+import v2AdminRoutes from './routes/v2-admin.js'
+import v2DashboardRoutes from './routes/v2-dashboard.js'
+import v2KickoffRoutes from './routes/v2-kickoff.js'
+import v2InitiativeRoutes from './routes/v2-initiatives.js'
+import v2DocsRoutes from './routes/v2-docs.js'
+import v2MeetingsRoutes from './routes/v2-meetings.js'
+import v2RewardsRoutes from './routes/v2-rewards.js'
+import v2ActivityRoutes from './routes/v2-activity.js'
+import v2SearchRoutes from './routes/v2-search.js'
+
+const app = new Hono<AppEnv>()
+
+// CORS — origins from env var (comma-separated) or default to localhost
+app.use('*', cors({
+  origin: (origin, c) => {
+    const allowed = c.env.ALLOWED_ORIGINS
+      ? c.env.ALLOWED_ORIGINS.split(',').map(s => s.trim())
+      : ['http://localhost:5173', 'http://localhost:5174']
+    return allowed.includes(origin) ? origin : null
+  },
+  allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+  allowHeaders: ['Content-Type', 'Authorization'],
+}))
+
+// DB error handling
+app.onError((err, c) => {
+  if (err.name === 'DbError') {
+    return c.json({ error: err.message }, 500)
+  }
+  throw err
+})
+
+// Inject DB adapter per request
+app.use('*', async (c, next) => {
+  setAdapter(new TursoAdapter(c.env.TURSO_URL, c.env.TURSO_AUTH_TOKEN))
+  await next()
+})
+
+// Public routes (no auth)
+app.get('/health', (c) => c.json({ ok: true }))
+app.route('/api/auth', authRoutes)
+
+// Auth middleware for /api/* and /mcp
+app.use('/api/*', authMiddleware)
+app.use('/mcp/*', authMiddleware)
+
+// MCP endpoint
+app.route('/mcp', mcpRoutes)
+
+// v2 API routes
+app.route('/api/v2/nav', v2NavRoutes)
+app.route('/api/v2/page-content', v2PageContentRoutes)
+app.route('/api/v2/scenarios', v2ScenariosRoutes)
+app.route('/api/v2/pm', v2PmRoutes)
+app.route('/api/v2/policy', v2PolicyRoutes)
+app.route('/api/v2/standup', v2StandupRoutes)
+app.route('/api/v2/retro', v2RetroRoutes)
+app.route('/api/v2/notifications', v2NotificationsRoutes)
+app.route('/api/v2/memos', v2MemosRoutes)
+app.route('/api/v2/user', v2UserRoutes)
+app.route('/api/v2/admin', v2AdminRoutes)
+app.route('/api/v2/dashboard', v2DashboardRoutes)
+app.route('/api/v2/kickoff', v2KickoffRoutes)
+app.route('/api/v2/initiatives', v2InitiativeRoutes)
+app.route('/api/v2/docs', v2DocsRoutes)
+app.route('/api/v2/meetings', v2MeetingsRoutes)
+app.route('/api/v2/rewards', v2RewardsRoutes)
+app.route('/api/v2/activity', v2ActivityRoutes)
+app.route('/api/v2/search', v2SearchRoutes)
+
+// Proactive Nudge (Cron Trigger)
+import { handleScheduled } from './nudge.js'
+import { isAdmin } from './utils/admin.js'
+
+// Manual nudge trigger — admin only
+app.post('/api/v2/dashboard/nudge-trigger', async (c) => {
+  const userName = c.get('userName')
+  if (!await isAdmin(userName)) {
+    return c.json({ error: 'Admin permission required' }, 403)
+  }
+  const env = {
+    TURSO_URL: c.env.TURSO_URL,
+    TURSO_AUTH_TOKEN: c.env.TURSO_AUTH_TOKEN,
+    NUDGE_WEBHOOK_URL: c.env.NUDGE_WEBHOOK_URL,
+  }
+  await handleScheduled(env)
+  return c.json({ ok: true, message: 'Nudge triggered manually' })
+})
+
+export default {
+  fetch: app.fetch,
+  scheduled: async (event: ScheduledEvent, env: Record<string, string>) => {
+    await handleScheduled(env as unknown as { TURSO_URL: string; TURSO_AUTH_TOKEN: string; NUDGE_WEBHOOK_URL?: string })
+  },
+}

package/scaffold/pm-api/src/mcp-tools/dashboard.ts

@@ -0,0 +1,40 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolDashboard(user: string): Promise<ToolResult> {
+  const sprint = await resolveSprint()
+  if (!sprint) return err('No active sprint found.')
+
+  const [taskResult, memoResult, standupResult, notifResult] = await Promise.all([
+    query<{ status: string; cnt: number }>(
+      `SELECT t.status, COUNT(*) as cnt FROM pm_tasks t JOIN pm_stories s ON t.story_id = s.id WHERE t.assignee = ? AND s.sprint = ? GROUP BY t.status`,
+      [user, sprint],
+    ),
+    query<{ cnt: number }>("SELECT COUNT(*) as cnt FROM memos_v2 WHERE (assigned_to = ? OR assigned_to LIKE ? OR assigned_to LIKE ? OR assigned_to LIKE ?) AND status = 'open'", [user, `${user},%`, `%,${user},%`, `%,${user}`]),
+    query<{ id: number }>('SELECT id FROM pm_standup_entries WHERE user_name = ? AND sprint = ? AND entry_date = ? LIMIT 1', [user, sprint, today()]),
+    query<{ cnt: number }>("SELECT COUNT(*) as cnt FROM notifications WHERE user_name = ? AND is_read = 0", [user]),
+  ])
+
+  const s: Record<string, number> = { todo: 0, 'in-progress': 0, done: 0 }
+  if (!taskResult.error) for (const r of taskResult.rows) s[r.status] = r.cnt
+
+  return text([
+    `📊 ${user}'s Dashboard (${sprint.toUpperCase()})`,
+    '─────────────',
+    `📋 Tasks: todo ${s.todo} | in-progress ${s['in-progress']} | done ${s.done}`,
+    `📩 Unread memos: ${memoResult.rows[0]?.cnt ?? 0}`,
+    `🔔 Unread notifications: ${notifResult.rows[0]?.cnt ?? 0}`,
+    `📝 Today's standup: ${standupResult.rows.length > 0 ? 'submitted' : 'not submitted'}`,
+  ].join('\n'))
+}
+
+export async function toolListTeamMembers(): Promise<ToolResult> {
+  const result = await query<{ id: number; display_name: string; role: string }>('SELECT id, display_name, role FROM members WHERE is_active = 1 ORDER BY display_name')
+  if (result.error) return err(result.error)
+  const lines = ['👥 Team Members', '─────────────']
+  for (const r of result.rows) {
+    const badge = r.role === 'admin' ? ' 👑' : ''
+    lines.push(`  • [M${r.id}] ${r.display_name}${badge}`)
+  }
+  return text(lines.join('\n'))
+}

package/scaffold/pm-api/src/mcp-tools/epic.ts

@@ -0,0 +1,67 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolListEpics(): Promise<ToolResult> {
+  const result = await query<{ id: number; title: string; status: string; owner: string | null; story_count: number }>(
+    `SELECT e.id, e.title, e.status, e.owner, COUNT(s.id) as story_count
+     FROM pm_epics e LEFT JOIN pm_stories s ON s.epic_id = e.id
+     GROUP BY e.id ORDER BY e.title`,
+  )
+  if (result.error) return err(result.error)
+  if (result.rows.length === 0) return text('No epics found.')
+
+  const lines = ['🏷 Epic List', '─────────────']
+  for (const e of result.rows) {
+    const statusIcon: Record<string, string> = { active: '🟢', planned: '📋', completed: '✅', archived: '📦' }
+    lines.push(`${statusIcon[e.status] ?? '⚪'} [E${e.id}] ${e.title} (${e.status}, ${e.story_count} stories${e.owner ? `, owner: ${e.owner}` : ''})`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolAddEpic(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const title = args.title as string
+  const description = (args.description as string) ?? null
+  const owner = (args.owner as string) || user
+  const status = (args.status as string) || 'active'
+
+  const result = await execute(
+    'INSERT INTO pm_epics (title, description, owner, status) VALUES (?, ?, ?, ?)',
+    [title, description, owner, status],
+  )
+  if (result.error) return err(result.error)
+  const idResult = await query<{ id: number }>('SELECT last_insert_rowid() as id')
+  const newId = idResult.rows[0]?.id ?? '?'
+  return text(`✅ Epic created: ${title} (ID: ${newId})`)
+}
+
+export async function toolUpdateEpic(args: Record<string, unknown>): Promise<ToolResult> {
+  const epicId = args.epic_id as number
+  const fieldMap: Record<string, string> = { title: 'title', description: 'description', status: 'status', owner: 'owner' }
+  const sets: string[] = []
+  const sqlArgs: (string | number | null)[] = []
+
+  for (const [key, col] of Object.entries(fieldMap)) {
+    if (args[key] !== undefined) {
+      sets.push(`${col} = ?`)
+      sqlArgs.push(args[key] as string | number | null)
+    }
+  }
+  if (sets.length === 0) return text('No fields to update.')
+
+  sets.push('updated_at = CURRENT_TIMESTAMP')
+  sqlArgs.push(epicId)
+  const result = await execute(`UPDATE pm_epics SET ${sets.join(', ')} WHERE id = ?`, sqlArgs)
+  if (result.error) return err(result.error)
+  if (result.rowsAffected === 0) return err(`Epic #${epicId} not found.`)
+  return text(`✅ Epic #${epicId} updated`)
+}
+
+export async function toolDeleteEpic(args: Record<string, unknown>): Promise<ToolResult> {
+  const epicId = args.epic_id as number
+  const r1 = await execute('UPDATE pm_stories SET epic_id = NULL WHERE epic_id = ?', [epicId])
+  if (r1.error) return err(r1.error)
+  const r2 = await execute('DELETE FROM pm_epics WHERE id = ?', [epicId])
+  if (r2.error) return err(r2.error)
+  if (r2.rowsAffected === 0) return err(`Epic #${epicId} not found.`)
+  return text(`✅ Epic #${epicId} deleted`)
+}

package/scaffold/pm-api/src/mcp-tools/event.ts

@@ -0,0 +1,89 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolEmitEvent(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  if (!checkRateLimit(user)) {
+    return err('Rate limit exceeded: Maximum 10 events per minute.')
+  }
+
+  const eventType = args.event_type as string
+
+  const HOOK_ONLY_TYPES = ['memo_assigned', 'memo_replied', 'memo_resolved']
+  if (HOOK_ONLY_TYPES.includes(eventType)) {
+    return err('Memo-related events are emitted automatically. Cannot emit directly.')
+  }
+  const targetAgent = args.target_agent as string
+  const targetUser = args.target_user as string
+  const payload = args.payload as string
+  const ttlHours = (args.ttl_hours as number) ?? 24
+  const sourceAgent = (args.source_agent as string) ?? user
+
+  // Validate payload is valid JSON
+  try {
+    JSON.parse(payload)
+  } catch {
+    return err('Payload is not valid JSON.')
+  }
+
+  const expiresAt = new Date(Date.now() + ttlHours * 3600_000).toISOString()
+
+  const result = await execute(
+    `INSERT INTO agent_events (event_type, source_agent, target_agent, target_user, payload, expires_at)
+     VALUES (?, ?, ?, ?, ?, ?)`,
+    [eventType, sourceAgent, targetAgent, targetUser, payload, expiresAt],
+  )
+  if (result.error) return err(result.error)
+
+  const idResult = await query<{ id: number }>('SELECT last_insert_rowid() as id')
+  const newId = idResult.rows[0]?.id ?? '?'
+
+  return text(`✅ Event emitted: [${eventType}] → ${targetUser} (ID: ${newId}, TTL: ${ttlHours}h)`)
+}
+
+export async function toolPollEvents(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const eventType = args.event_type as string | undefined
+  const limit = (args.limit as number) ?? 20
+
+  let sql = `SELECT id, event_type, source_agent, target_agent, payload, status, created_at
+             FROM agent_events
+             WHERE target_user = ? AND status = 'pending'
+               AND (expires_at IS NULL OR expires_at > datetime('now'))`
+  const sqlArgs: (string | number)[] = [user]
+
+  if (eventType) {
+    sql += ' AND event_type = ?'
+    sqlArgs.push(eventType)
+  }
+
+  sql += ' ORDER BY created_at DESC LIMIT ?'
+  sqlArgs.push(limit)
+
+  const result = await query<{
+    id: number; event_type: string; source_agent: string; target_agent: string
+    payload: string; status: string; created_at: string
+  }>(sql, sqlArgs)
+
+  if (result.error) return err(result.error)
+  if (result.rows.length === 0) return text('📭 No pending events.')
+
+  const lines = [`📬 Pending events (${result.rows.length})`, '─────────────']
+  for (const e of result.rows) {
+    const payloadPreview = e.payload.length > 60 ? e.payload.slice(0, 60) + '...' : e.payload
+    lines.push(`[E${e.id}] ${e.event_type} from ${e.source_agent} (${e.created_at.slice(5, 16)})`)
+    lines.push(`  payload: ${payloadPreview}`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolAckEvent(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const eventId = args.event_id as number
+
+  const result = await execute(
+    `UPDATE agent_events SET status = 'acked', acked_at = datetime('now')
+     WHERE id = ? AND status IN ('pending', 'delivered') AND target_user = ?`,
+    [eventId, user],
+  )
+  if (result.error) return err(result.error)
+  if (result.rowsAffected === 0) return err(`Event #${eventId} not found or already acknowledged.`)
+  return text(`✅ Event #${eventId} acknowledged`)
+}

package/scaffold/pm-api/src/mcp-tools/index.ts

@@ -0,0 +1,11 @@
+export * from './sprint.js'
+export * from './epic.js'
+export * from './story.js'
+export * from './task.js'
+export * from './memo.js'
+export * from './initiative.js'
+export * from './notification.js'
+export * from './standup.js'
+export * from './retro.js'
+export * from './dashboard.js'
+export * from './event.js'

package/scaffold/pm-api/src/mcp-tools/initiative.ts

@@ -0,0 +1,51 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolCreateInitiative(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const title = args.title as string
+  const content = args.content as string
+  if (!title?.trim() || !content?.trim()) return err('title, content required')
+  const decider = (args.decider as string) ?? null
+  const sourceContext = (args.source_context as string) ?? null
+  const r = await execute(
+    'INSERT INTO initiatives (title, content, author, decider, source_context) VALUES (?, ?, ?, ?, ?)',
+    [title, content, user, decider, sourceContext],
+  )
+  if (r.error) return err(r.error)
+  return text(`✅ Initiative created: "${title}"`)
+}
+
+export async function toolListInitiatives(args: Record<string, unknown>): Promise<ToolResult> {
+  const status = args.status as string | undefined
+  let sql = 'SELECT id, title, author, decider, status, created_at FROM initiatives'
+  const sqlArgs: string[] = []
+  if (status) { sql += ' WHERE status = ?'; sqlArgs.push(status) }
+  sql += ' ORDER BY created_at DESC LIMIT 20'
+  const r = await query<{ id: number; title: string; author: string; decider: string | null; status: string; created_at: string }>(sql, sqlArgs)
+  if (r.error) return err(r.error)
+  if (!r.rows.length) return text('No initiatives found.')
+  const lines = ['📋 Initiative List', '─────────────']
+  for (const i of r.rows) {
+    const dec = i.decider ? ` → ${i.decider}` : ''
+    lines.push(`  [${i.status}] #${i.id}: ${i.title} (${i.author}${dec})`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolUpdateInitiativeStatus(args: Record<string, unknown>): Promise<ToolResult> {
+  const id = args.initiative_id as number
+  const newStatus = args.status as string
+  const note = (args.decision_note as string) ?? null
+  if (!id || !newStatus) return err('initiative_id, status required')
+  const { canTransition } = await import('../utils/initiative.js')
+  const current = await query<{ status: string }>('SELECT status FROM initiatives WHERE id = ?', [id])
+  if (!current.rows.length) return err('Initiative not found.')
+  if (!canTransition(current.rows[0].status as 'pending' | 'approved' | 'rejected' | 'deferred', newStatus as 'pending' | 'approved' | 'rejected' | 'deferred')) {
+    return err(`${current.rows[0].status} → ${newStatus} transition not allowed`)
+  }
+  await execute(
+    `UPDATE initiatives SET status = ?, decision_note = ?, decided_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP WHERE id = ?`,
+    [newStatus, note, id],
+  )
+  return text(`✅ Initiative #${id}: ${current.rows[0].status} → ${newStatus}`)
+}