feat(KAN-72): complete MCP ticket editing and discovery

Reviewed-on: #176

.agents/skills/inertia-vue-development/SKILL.md

@@ -1,394 +0,0 @@
----
-name: inertia-vue-development
-description: "Develops Inertia.js v2 Vue client-side applications. Activates when creating Vue pages, forms, or navigation; using <Link>, <Form>, useForm, or router; working with deferred props, prefetching, or polling; or when user mentions Vue with Inertia, Vue pages, Vue forms, or Vue navigation."
-license: MIT
-metadata:
-  author: laravel
----
-
-# Inertia Vue Development
-
-## When to Apply
-
-Activate this skill when:
-
-- Creating or modifying Vue page components for Inertia
-- Working with forms in Vue (using `<Form>` or `useForm`)
-- Implementing client-side navigation with `<Link>` or `router`
-- Using v2 features: deferred props, prefetching, WhenVisible, InfiniteScroll, once props, flash data, or polling
-- Building Vue-specific features with the Inertia protocol
-
-## Documentation
-
-Use `search-docs` for detailed Inertia v2 Vue patterns and documentation.
-
-## Basic Usage
-
-### Page Components Location
-
-Vue page components should be placed in the `resources/js/pages` directory.
-
-### Page Component Structure
-
-<!-- Basic Vue Page Component -->
-```vue
-<script setup>
-defineProps({
-    users: Array
-})
-</script>
-
-<template>
-    <div>
-        <h1>Users</h1>
-        <ul>
-            <li v-for="user in users" :key="user.id">
-                {{ user.name }}
-            </li>
-        </ul>
-    </div>
-</template>
-```
-
-## Client-Side Navigation
-
-### Basic Link Component
-
-Use `<Link>` for client-side navigation instead of traditional `<a>` tags:
-
-<!-- Inertia Vue Navigation -->
-```vue
-<script setup>
-import { Link } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <div>
-        <Link href="/">Home</Link>
-        <Link href="/users">Users</Link>
-        <Link :href="`/users/${user.id}`">View User</Link>
-    </div>
-</template>
-```
-
-### Link with Method
-
-<!-- Link with POST Method -->
-```vue
-<script setup>
-import { Link } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Link href="/logout" method="post" as="button">
-        Logout
-    </Link>
-</template>
-```
-
-### Prefetching
-
-Prefetch pages to improve perceived performance:
-
-<!-- Prefetch on Hover -->
-```vue
-<script setup>
-import { Link } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Link href="/users" prefetch>
-        Users
-    </Link>
-</template>
-```
-
-### Programmatic Navigation
-
-<!-- Router Visit -->
-```vue
-<script setup>
-import { router } from '@inertiajs/vue3'
-
-function handleClick() {
-    router.visit('/users')
-}
-
-// Or with options
-function createUser() {
-    router.visit('/users', {
-        method: 'post',
-        data: { name: 'John' },
-        onSuccess: () => console.log('Done'),
-    })
-}
-</script>
-
-<template>
-    <Link href="/users">Users</Link>
-    <Link href="/logout" method="post" as="button">Logout</Link>
-</template>
-```
-
-## Form Handling
-
-### Form Component (Recommended)
-
-The recommended way to build forms is with the `<Form>` component:
-
-<!-- Form Component Example -->
-```vue
-<script setup>
-import { Form } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Form action="/users" method="post" #default="{ errors, processing, wasSuccessful }">
-        <input type="text" name="name" />
-        <div v-if="errors.name">{{ errors.name }}</div>
-
-        <input type="email" name="email" />
-        <div v-if="errors.email">{{ errors.email }}</div>
-
-        <button type="submit" :disabled="processing">
-            {{ processing ? 'Creating...' : 'Create User' }}
-        </button>
-
-        <div v-if="wasSuccessful">User created!</div>
-    </Form>
-</template>
-```
-
-### Form Component With All Props
-
-<!-- Form Component Full Example -->
-```vue
-<script setup>
-import { Form } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Form
-        action="/users"
-        method="post"
-        #default="{
-            errors,
-            hasErrors,
-            processing,
-            progress,
-            wasSuccessful,
-            recentlySuccessful,
-            setError,
-            clearErrors,
-            resetAndClearErrors,
-            defaults,
-            isDirty,
-            reset,
-            submit
-        }"
-    >
-        <input type="text" name="name" :value="defaults.name" />
-        <div v-if="errors.name">{{ errors.name }}</div>
-
-        <button type="submit" :disabled="processing">
-            {{ processing ? 'Saving...' : 'Save' }}
-        </button>
-
-        <progress v-if="progress" :value="progress.percentage" max="100">
-            {{ progress.percentage }}%
-        </progress>
-
-        <div v-if="wasSuccessful">Saved!</div>
-    </Form>
-</template>
-```
-
-### Form Component Reset Props
-
-The `<Form>` component supports automatic resetting:
-
-- `resetOnError` - Reset form data when the request fails
-- `resetOnSuccess` - Reset form data when the request succeeds
-- `setDefaultsOnSuccess` - Update default values on success
-
-Use the `search-docs` tool with a query of `form component resetting` for detailed guidance.
-
-<!-- Form with Reset Props -->
-```vue
-<script setup>
-import { Form } from '@inertiajs/vue3'
-</script>
-
-<template>
-    <Form
-        action="/users"
-        method="post"
-        reset-on-success
-        set-defaults-on-success
-        #default="{ errors, processing, wasSuccessful }"
-    >
-        <input type="text" name="name" />
-        <div v-if="errors.name">{{ errors.name }}</div>
-
-        <button type="submit" :disabled="processing">
-            Submit
-        </button>
-    </Form>
-</template>
-```
-
-Forms can also be built using the `useForm` composable for more programmatic control. Use the `search-docs` tool with a query of `useForm helper` for guidance.
-
-### `useForm` Composable
-
-For more programmatic control or to follow existing conventions, use the `useForm` composable:
-
-<!-- useForm Composable Example -->
-```vue
-<script setup>
-import { useForm } from '@inertiajs/vue3'
-
-const form = useForm({
-    name: '',
-    email: '',
-    password: '',
-})
-
-function submit() {
-    form.post('/users', {
-        onSuccess: () => form.reset('password'),
-    })
-}
-</script>
-
-<template>
-    <form @submit.prevent="submit">
-        <input type="text" v-model="form.name" />
-        <div v-if="form.errors.name">{{ form.errors.name }}</div>
-
-        <input type="email" v-model="form.email" />
-        <div v-if="form.errors.email">{{ form.errors.email }}</div>
-
-        <input type="password" v-model="form.password" />
-        <div v-if="form.errors.password">{{ form.errors.password }}</div>
-
-        <button type="submit" :disabled="form.processing">
-            Create User
-        </button>
-    </form>
-</template>
-```
-
-## Inertia v2 Features
-
-### Deferred Props
-
-Use deferred props to load data after initial page render:
-
-<!-- Deferred Props with Empty State -->
-```vue
-<script setup>
-defineProps({
-    users: Array
-})
-</script>
-
-<template>
-    <div>
-        <h1>Users</h1>
-        <div v-if="!users" class="animate-pulse">
-            <div class="h-4 bg-gray-200 rounded w-3/4 mb-2"></div>
-            <div class="h-4 bg-gray-200 rounded w-1/2"></div>
-        </div>
-        <ul v-else>
-            <li v-for="user in users" :key="user.id">
-                {{ user.name }}
-            </li>
-        </ul>
-    </div>
-</template>
-```
-
-### Polling
-
-Automatically refresh data at intervals:
-
-<!-- Polling Example -->
-```vue
-<script setup>
-import { router } from '@inertiajs/vue3'
-import { onMounted, onUnmounted } from 'vue'
-
-defineProps({
-    stats: Object
-})
-
-let interval
-
-onMounted(() => {
-    interval = setInterval(() => {
-        router.reload({ only: ['stats'] })
-    }, 5000) // Poll every 5 seconds
-})
-
-onUnmounted(() => {
-    clearInterval(interval)
-})
-</script>
-
-<template>
-    <div>
-        <h1>Dashboard</h1>
-        <div>Active Users: {{ stats.activeUsers }}</div>
-    </div>
-</template>
-```
-
-### WhenVisible
-
-Lazy-load a prop when an element scrolls into view. Useful for deferring expensive data that sits below the fold:
-
-<!-- WhenVisible Example -->
-```vue
-<script setup>
-import { WhenVisible } from '@inertiajs/vue3'
-
-defineProps({
-    stats: Object
-})
-</script>
-
-<template>
-    <div>
-        <h1>Dashboard</h1>
-
-        <!-- stats prop is loaded only when this section scrolls into view -->
-        <WhenVisible data="stats" :buffer="200">
-            <template #fallback>
-                <div class="animate-pulse">Loading stats...</div>
-            </template>
-
-            <template #default="{ fetching }">
-                <div>
-                    <p>Total Users: {{ stats.total_users }}</p>
-                    <p>Revenue: {{ stats.revenue }}</p>
-                    <span v-if="fetching">Refreshing...</span>
-                </div>
-            </template>
-        </WhenVisible>
-    </div>
-</template>
-```
-
-## Server-Side Patterns
-
-Server-side patterns (Inertia::render, props, middleware) are covered in inertia-laravel guidelines.
-
-## Common Pitfalls
-
-- Using traditional `<a>` links instead of Inertia's `<Link>` component (breaks SPA behavior)
-- Forgetting that Vue components must have a single root element
-- Forgetting to add loading states (skeleton screens) when using deferred props
-- Not handling the `undefined` state of deferred props before data loads
-- Using `<form>` without preventing default submission (use `<Form>` component or `@submit.prevent`)
-- Forgetting to check if `<Form>` component is available in your Inertia version

.agents/skills/tailwindcss-development/SKILL.md

@@ -1,119 +0,0 @@
----
-name: tailwindcss-development
-description: "Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS."
-license: MIT
-metadata:
-  author: laravel
----
-
-# Tailwind CSS Development
-
-## Documentation
-
-Use `search-docs` for detailed Tailwind CSS v4 patterns and documentation.
-
-## Basic Usage
-
-- Use Tailwind CSS classes to style HTML. Check and follow existing Tailwind conventions in the project before introducing new patterns.
-- Offer to extract repeated patterns into components that match the project's conventions (e.g., Blade, JSX, Vue).
-- Consider class placement, order, priority, and defaults. Remove redundant classes, add classes to parent or child elements carefully to reduce repetition, and group elements logically.
-
-## Tailwind CSS v4 Specifics
-
-- Always use Tailwind CSS v4 and avoid deprecated utilities.
-- `corePlugins` is not supported in Tailwind v4.
-
-### CSS-First Configuration
-
-In Tailwind v4, configuration is CSS-first using the `@theme` directive — no separate `tailwind.config.js` file is needed:
-
-<!-- CSS-First Config -->
-```css
-@theme {
-  --color-brand: oklch(0.72 0.11 178);
-}
-```
-
-### Import Syntax
-
-In Tailwind v4, import Tailwind with a regular CSS `@import` statement instead of the `@tailwind` directives used in v3:
-
-<!-- v4 Import Syntax -->
-```diff
-- @tailwind base;
-- @tailwind components;
-- @tailwind utilities;
-+ @import "tailwindcss";
-```
-
-### Replaced Utilities
-
-Tailwind v4 removed deprecated utilities. Use the replacements shown below. Opacity values remain numeric.
-
-| Deprecated | Replacement |
-|------------|-------------|
-| bg-opacity-* | bg-black/* |
-| text-opacity-* | text-black/* |
-| border-opacity-* | border-black/* |
-| divide-opacity-* | divide-black/* |
-| ring-opacity-* | ring-black/* |
-| placeholder-opacity-* | placeholder-black/* |
-| flex-shrink-* | shrink-* |
-| flex-grow-* | grow-* |
-| overflow-ellipsis | text-ellipsis |
-| decoration-slice | box-decoration-slice |
-| decoration-clone | box-decoration-clone |
-
-## Spacing
-
-Use `gap` utilities instead of margins for spacing between siblings:
-
-<!-- Gap Utilities -->
-```html
-<div class="flex gap-8">
-    <div>Item 1</div>
-    <div>Item 2</div>
-</div>
-```
-
-## Dark Mode
-
-If existing pages and components support dark mode, new pages and components must support it the same way, typically using the `dark:` variant:
-
-<!-- Dark Mode -->
-```html
-<div class="bg-white dark:bg-gray-900 text-gray-900 dark:text-white">
-    Content adapts to color scheme
-</div>
-```
-
-## Common Patterns
-
-### Flexbox Layout
-
-<!-- Flexbox Layout -->
-```html
-<div class="flex items-center justify-between gap-4">
-    <div>Left content</div>
-    <div>Right content</div>
-</div>
-```
-
-### Grid Layout
-
-<!-- Grid Layout -->
-```html
-<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
-    <div>Card 1</div>
-    <div>Card 2</div>
-    <div>Card 3</div>
-</div>
-```
-
-## Common Pitfalls
-
-- Using deprecated v3 utilities (bg-opacity-*, flex-shrink-*, etc.)
-- Using `@tailwind` directives instead of `@import "tailwindcss"`
-- Trying to use `tailwind.config.js` instead of CSS `@theme` directive
-- Using margins for spacing between siblings instead of gap utilities
-- Forgetting to add dark mode variants when the project uses dark mode

.agents/skills/wayfinder-development/SKILL.md

@@ -61,10 +61,14 @@ show(1, { query: { page: 1 } }) // "/posts/1?page=1"
 
 ## Wayfinder + Inertia
 
-Use Wayfinder with the `<Form>` component:
-<!-- Wayfinder Form (Vue) -->
-```vue
-<Form v-bind="store.form()"><input name="title" /></Form>
+Use Wayfinder with `useForm`:
+
+<!-- Wayfinder useForm -->
+```typescript
+import { store } from "@/actions/App/Http/Controllers/ExampleController";
+
+const form = useForm({ name: "My Big Post" });
+form.submit(store());
 ```
 
 ## Verification

.dockerignore

@@ -33,9 +33,6 @@
 vendor
 **/.DS_Store
 .editorconfig
-.env.example
-.env.mariadb
-.env.mariadb.example
 .env.production
 LICENSE
 README.md
@@ -46,3 +43,7 @@ storage/framework/sessions/*
 storage/framework/testing/*
 storage/framework/views/*
 storage/logs/*
+
+# Native build artifacts are independent of the Laravel image.
+native/src-tauri/target
+native/src-tauri/gen

.env.mariadb.example

@@ -1,4 +0,0 @@
-MARIADB_DATABASE=kanbangit
-MARIADB_USER=kanbangit
-MARIADB_PASSWORD=
-MARIADB_ROOT_PASSWORD=

.github/workflows/ci_cd.yml

@@ -2,7 +2,13 @@ name: CI/CD
 
 on:
   push:
+    branches:
+      - main
+    tags:
+      - "v*"
   pull_request:
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -11,9 +17,19 @@ env:
   REGISTRY: git.twyco.de
 
 jobs:
-  test_and_check_app:
-    name: test_and_check_app
+  preconditions:
+    if: >
+      !(contains(github.event.head_commit.message, '[no-ci]') || contains(github.event.head_commit.message, '[skip-ci]'))
     runs-on: ubuntu-latest
+    steps:
+      - name: Conditions met
+        run: |
+          echo "Conditions for CI/CD are met. Proceeding with the workflow."
+
+  test_and_check_app:
+    runs-on: ubuntu-latest
+    needs:
+      - preconditions
     steps:
       - name: Check out repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -27,6 +43,7 @@ jobs:
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
     needs:
+      - preconditions
       - test_and_check_app
     runs-on: ubuntu-latest
     steps:

.github/workflows/macos-checks.yml

@@ -0,0 +1,58 @@
+name: macOS checks
+
+on:
+  push:
+    branches: [main]
+    paths: ["native/**", ".github/**", "package.json", "pnpm-lock.yaml", "eslint.config.mjs", "resources/css/app.css"]
+  pull_request:
+    paths: ["native/**", ".github/**", "package.json", "pnpm-lock.yaml", "eslint.config.mjs", "resources/css/app.css"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  macos:
+    name: Native Rust tests and unsigned build
+    runs-on: ${{ vars.MACOS_CHECK_RUNNER || vars.MACOS_RUNNER || 'macos-arm64' }}
+    timeout-minutes: 45
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
+        with:
+          package-json-file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: 1.98.1
+          components: rustfmt, clippy
+
+      - name: Install locked native dependencies
+        run: pnpm --dir native install --frozen-lockfile
+
+      - name: Run native tests
+        run: pnpm --dir native test
+
+      - name: Check Rust formatting and warnings
+        run: pnpm --dir native check
+
+      - name: Build unsigned macOS app without release credentials
+        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        with:
+          projectPath: native
+          tauriScript: pnpm exec tauri
+          args: --ci --debug --no-sign --bundles app -- --locked
+          uploadUpdaterJson: false
+          uploadUpdaterSignatures: false
+          uploadWorkflowArtifacts: false

.github/workflows/macos-release.yml

@@ -0,0 +1,228 @@
+name: macOS release to Hetzner
+
+on:
+  push:
+    # Gitea enforces the configured macos-v* protection when tags are pushed.
+    # Reading /tag_protections requires admin rights unavailable to job tokens.
+    tags:
+      - "macos-v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing protected macos-vMAJOR.MINOR.PATCH tag on main"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  # Partial release files may be replaced until the feed is promoted.
+  # Keep every publisher in this group to prevent overlapping rebuilds.
+  group: macos-release
+  cancel-in-progress: false
+
+env:
+  APPLE_SIGNING_IDENTITY: "Developer ID Application: Nico Schröder (ZZX2KZGTHU)"
+  APPLE_TEAM_ID: ZZX2KZGTHU
+  MACOS_RELEASE_TARGET: ${{ vars.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin' }}
+  S3_BUCKET: ${{ vars.S3_BUCKET }}
+  S3_REGION: ${{ vars.S3_REGION }}
+  S3_PREFIX: ${{ vars.S3_PREFIX || 'releases/macos' }}
+  S3_PUBLIC_BASE_URL: ${{ vars.S3_PUBLIC_BASE_URL }}
+
+jobs:
+  prepare:
+    name: Validate release ref and configuration
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      commit: ${{ steps.ref.outputs.commit }}
+      tag: ${{ steps.ref.outputs.tag }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Select an existing version tag contained in main
+        id: ref
+        shell: bash
+        env:
+          REQUESTED_TAG: ${{ inputs.tag }}
+          MACOS_RUNNER: ${{ vars.MACOS_RUNNER }}
+        run: |
+          set -Eeuo pipefail
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            [[ "$GITHUB_REF" == refs/heads/main ]] || { echo 'Dispatch this workflow from main.' >&2; exit 1; }
+            tag="$REQUESTED_TAG"
+          else
+            tag="${GITHUB_REF#refs/tags/}"
+          fi
+          [[ "$tag" =~ ^macos-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || { echo 'Invalid macOS release tag.' >&2; exit 1; }
+          [[ "$MACOS_RUNNER" =~ ^[a-zA-Z0-9_-]+$ ]] || { echo 'Set MACOS_RUNNER to a registered macOS runner label.' >&2; exit 1; }
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          commit="$(git rev-parse --verify "refs/tags/$tag^{commit}")"
+          git merge-base --is-ancestor "$commit" origin/main || { echo 'Release tag must belong to main.' >&2; exit 1; }
+          git checkout --detach "$commit"
+          printf 'commit=%s\ntag=%s\n' "$commit" "$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Validate app versions and Hetzner configuration
+        env:
+          RELEASE_TAG: ${{ steps.ref.outputs.tag }}
+        run: |
+          node native/macos-ci.mjs metadata
+          node native/publish-macos.mjs config
+
+  release:
+    name: Sign, notarize, verify and publish macOS
+    needs: prepare
+    # Gitea resolves runner labels before outputs from prepare are available.
+    runs-on: ${{ vars.MACOS_RUNNER }}
+    timeout-minutes: 120
+    env:
+      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+    steps:
+      - name: Check out the validated commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.prepare.outputs.commit }}
+          persist-credentials: false
+
+      - name: Validate runner and required secrets
+        shell: bash
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
+        run: |
+          set -Eeuo pipefail
+          [[ "$(uname -s)" == Darwin ]] || { echo 'A macOS runner is required.' >&2; exit 1; }
+          case "$MACOS_RELEASE_TARGET:$(uname -m)" in
+            aarch64-apple-darwin:arm64|x86_64-apple-darwin:x86_64) ;;
+            *) echo 'Runner architecture must match MACOS_RELEASE_TARGET.' >&2; exit 1 ;;
+          esac
+          xcodebuild -version
+          xcrun --find notarytool
+          aws --version | grep '^aws-cli/2\.' || { echo 'Install AWS CLI v2 permanently on this runner.' >&2; exit 1; }
+          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_PASSWORD TAURI_SIGNING_PRIVATE_KEY S3_ACCESS_KEY_ID S3_SECRET_ACCESS_KEY; do
+            [[ -n "${!name}" ]] || { echo "Missing repository secret: $name" >&2; exit 1; }
+          done
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
+        with:
+          package-json-file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: 1.98.1
+          targets: ${{ env.MACOS_RELEASE_TARGET }}
+          components: rustfmt, clippy
+
+      - name: Install locked dependencies
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm --dir native install --frozen-lockfile
+
+      - name: Run native checks before importing signing credentials
+        run: |
+          pnpm exec eslint native --max-warnings 0
+          pnpm --dir native test
+          pnpm --dir native check
+
+      - name: Prepare isolated signing keychain
+        id: signing
+        shell: bash
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+        run: |
+          set -Eeuo pipefail
+          umask 077
+          signing_dir="$(mktemp -d "$RUNNER_TEMP/kanbangit-signing.XXXXXX")"
+          printf 'SIGNING_DIRECTORY=%s\n' "$signing_dir" >> "$GITHUB_ENV"
+          security list-keychains -d user > "$signing_dir/original-keychains.txt"
+          printf '%s' "$APPLE_CERTIFICATE" | base64 --decode > "$signing_dir/certificate.p12"
+          password="$(openssl rand -hex 32)"
+          echo "::add-mask::$password"
+          printf 'keychain=kanbangit-%s-%s\npassword=%s\ncertificate=%s/certificate.p12\n' "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" "$password" "$signing_dir" >> "$GITHUB_OUTPUT"
+
+      - name: Import Developer ID certificate
+        uses: Apple-Actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7.0.0; deletes its keychain in the post step
+        with:
+          keychain: ${{ steps.signing.outputs.keychain }}
+          keychain-password: ${{ steps.signing.outputs.password }}
+          p12-filepath: ${{ steps.signing.outputs.certificate }}
+          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+      - name: Confirm release signing identity
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          security find-identity -v -p codesigning | grep -F "\"$APPLE_SIGNING_IDENTITY\""
+
+      - name: Build, sign and notarize with Tauri
+        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
+        env:
+          # The DMG bundler reads these variables separately from --ci.
+          CI: "true"
+          TAURI_BUNDLER_DMG_IGNORE_CI: "false"
+          APPLE_ID: dev@petsch-studios.de
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        with:
+          projectPath: native
+          tauriScript: pnpm exec tauri
+          args: >-
+            --ci --target ${{ env.MACOS_RELEASE_TARGET }} --bundles app,dmg
+            --config '{"bundle":{"createUpdaterArtifacts":true,"macOS":{"hardenedRuntime":true}}}'
+            -- --locked
+          uploadUpdaterJson: false
+          uploadUpdaterSignatures: false
+          uploadWorkflowArtifacts: false
+
+      - name: Verify signed app and packaged download
+        id: package
+        run: node native/macos-ci.mjs package
+
+      - name: Upload release files and promote the verified update feed
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
+          AWS_EC2_METADATA_DISABLED: "true"
+          AWS_REQUEST_CHECKSUM_CALCULATION: when_required
+          AWS_RESPONSE_CHECKSUM_VALIDATION: when_required
+          RELEASE_DIRECTORY: ${{ steps.package.outputs.directory }}
+        run: node native/publish-macos.mjs upload
+
+      - name: Restore keychain search list and remove certificate export
+        if: ${{ always() }}
+        shell: bash
+        run: |
+          python3 - <<'PY'
+          import os, pathlib, shlex, shutil, subprocess
+          value = os.environ.get('SIGNING_DIRECTORY')
+          if value:
+              directory = pathlib.Path(value)
+              original = directory / 'original-keychains.txt'
+              try:
+                  if original.exists():
+                      subprocess.run(['security', 'list-keychains', '-d', 'user', '-s', *shlex.split(original.read_text())], check=True)
+              finally:
+                  shutil.rmtree(directory)
+          PY

.github/workflows/native-checks.yml

@@ -0,0 +1,57 @@
+name: Native JavaScript checks
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "native/**"
+      - ".github/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "eslint.config.mjs"
+      - "resources/css/app.css"
+  pull_request:
+    paths:
+      - "native/**"
+      - ".github/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "eslint.config.mjs"
+      - "resources/css/app.css"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  native_javascript:
+    name: Native launcher and release tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v11.7.0
+        with:
+          package-json-file: package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install locked development dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint native JavaScript
+        run: pnpm exec eslint native --max-warnings 0
+
+      - name: Test native launcher and release safeguards without credentials
+        run: node --test native/tests/*.test.js

.gitignore

@@ -28,3 +28,16 @@ yarn-error.log
 /.vscode
 /.zed
 .codex/config.toml
+
+/native/node_modules
+/native/src-tauri/target
+/native/src-tauri/gen/*
+!/native/src-tauri/gen/android/
+!/native/src-tauri/gen/apple/
+/native/src-tauri/gen/apple/build/
+/native/src-tauri/gen/apple/Externals/
+/native/src-tauri/gen/apple/assets/
+/native/src-tauri/gen/apple/Pods/
+/native/src-tauri/gen/apple/ExportOptions.plist
+/native/src-tauri/gen/apple/**/*.xcuserstate
+/native/src-tauri/gen/apple/**/xcuserdata/

AGENTS.md

@@ -1,3 +1,19 @@
+# Working Agreements
+
+## Native app versions and build numbers
+
+For every delivered change under `native/`, increment the app version and bundle/build number for the affected platforms in the same change before committing. Do this for fixes and follow-up changes too; do not wait for a separate release or a user reminder.
+
+- macOS changes require a higher macOS app version and `bundle.macOS.bundleVersion`.
+- iOS changes require a higher iOS app version and `bundle.iOS.bundleVersion`, including the matching Xcode `MARKETING_VERSION` and `CURRENT_PROJECT_VERSION` in both `project.yml` and `project.pbxproj`.
+- Shared changes require a higher general native app version and higher bundle/build numbers for every affected platform. Android changes also require a higher `bundle.android.versionCode`; this metadata rule does not imply Android build support.
+- The app version is currently shared: keep `native/package.json`, `native/src-tauri/tauri.conf.json`, the native package entries in `Cargo.toml` and `Cargo.lock`, and the Xcode marketing versions consistent. Use a patch increment unless the requested release calls for a minor or major increment. Never decrease or reuse an existing build number.
+- Update the native release notes and run the existing version consistency test. One coordinated increment per delivered change is sufficient; intermediate edits and test reruns do not need additional increments.
+
+## Missing programs and SDKs
+
+If implementation or verification requires a missing program, SDK, runtime, toolchain, or platform component, do not download or install a temporary copy in `/tmp` or another temporary directory. Do not use an ad hoc toolchain as a workaround. Tell the user which prerequisites are missing, ask them to install them permanently and confirm when installation is complete, and wait for that confirmation before continuing dependent work. This rule applies to every implementation task in this project.
+
 <laravel-boost-guidelines>
 === foundation rules ===
 
@@ -9,7 +25,7 @@ The Laravel Boost guidelines are specifically curated by Laravel maintainers for
 
 This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
 
-- php - 8.4
+- php - 8.5
 - inertiajs/inertia-laravel (INERTIA_LARAVEL) - v2
 - laravel/fortify (FORTIFY) - v1
 - laravel/framework (LARAVEL) - v13
@@ -21,12 +37,6 @@ This application is a Laravel application and its main Laravel ecosystems packag
 - laravel/pint (PINT) - v1
 - laravel/sail (SAIL) - v1
 - phpunit/phpunit (PHPUNIT) - v12
-- @inertiajs/vue3 (INERTIA_VUE) - v2
-- tailwindcss (TAILWINDCSS) - v4
-- vue (VUE) - v3
-- @laravel/vite-plugin-wayfinder (WAYFINDER_VITE) - v0
-- eslint (ESLINT) - v9
-- prettier (PRETTIER) - v3
 
 ## Skills Activation
 
@@ -36,8 +46,6 @@ This project has domain-specific skills available. You MUST activate the relevan
 - `laravel-best-practices` — Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.
 - `mcp-development` — Use this skill for Laravel MCP development only. Trigger when creating or editing MCP tools, resources, prompts, or servers in Laravel projects. Covers: artisan make:mcp-* generators, mcp:inspector, routes/ai.php, Tool/Resource/Prompt classes, schema validation, shouldRegister(), OAuth setup, URI templates, read-only attributes, and MCP debugging. Do not use for non-Laravel MCP projects or generic AI features without MCP.
 - `wayfinder-development` — Use this skill for Laravel Wayfinder which auto-generates typed functions for Laravel controllers and routes. ALWAYS use this skill when frontend code needs to call backend routes or controller actions. Trigger when: connecting any React/Vue/Svelte/Inertia frontend to Laravel controllers, routes, building end-to-end features with both frontend and backend, wiring up forms or links to backend endpoints, fixing route-related TypeScript errors, importing from @/actions or @/routes, or running wayfinder:generate. Use Wayfinder route functions instead of hardcoded URLs. Covers: wayfinder() vite plugin, .url()/.get()/.post()/.form(), query params, route model binding, tree-shaking. Do not use for backend-only task
-- `inertia-vue-development` — Develops Inertia.js v2 Vue client-side applications. Activates when creating Vue pages, forms, or navigation; using <Link>, <Form>, useForm, or router; working with deferred props, prefetching, or polling; or when user mentions Vue with Inertia, Vue pages, Vue forms, or Vue navigation.
-- `tailwindcss-development` — Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS.
 
 ## Conventions
 
@@ -56,7 +64,7 @@ This project has domain-specific skills available. You MUST activate the relevan
 
 ## Frontend Bundling
 
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
+- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `pnpm run build`, `pnpm run dev`, or `composer run dev`. Ask them.
 
 ## Documentation Files
 
@@ -130,7 +138,6 @@ This project has domain-specific skills available. You MUST activate the relevan
 - Inertia creates fully client-side rendered SPAs without modern SPA complexity, leveraging existing server-side patterns.
 - Components live in `resources/js/pages` (unless specified in `vite.config.js`). Use `Inertia::render()` for server-side routing instead of Blade views.
 - ALWAYS use `search-docs` tool for version-specific Inertia documentation and updated code examples.
-- IMPORTANT: Activate `inertia-vue-development` when working with Inertia Vue client-side patterns.
 
 # Inertia v2
 
@@ -166,7 +173,7 @@ This project has domain-specific skills available. You MUST activate the relevan
 
 ## Vite Error
 
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
+- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `pnpm run build` or ask the user to run `pnpm run dev` or `composer run dev`.
 
 ## Deployment
 
@@ -203,11 +210,4 @@ Use Wayfinder to generate TypeScript functions for Laravel routes. Import from `
 - To run all tests in a file: `php artisan test --compact tests/Feature/ExampleTest.php`.
 - To filter on a particular test name: `php artisan test --compact --filter=testName` (recommended after making a change to a related file).
 
-=== inertia-vue/core rules ===
-
-# Inertia + Vue
-
-Vue components must have a single root element.
-- IMPORTANT: Activate `inertia-vue-development` when working with Inertia Vue client-side patterns.
-
 </laravel-boost-guidelines>

Dockerfile

@@ -55,12 +55,14 @@ COPY --from=node_binary /usr/local/ /usr/local/
 COPY . /var/www
 
 RUN composer install --prefer-dist --no-interaction --no-progress \
-    && npm ci \
-    && npm run build
+    && corepack enable pnpm \
+    && pnpm install --frozen-lockfile \
+    && pnpm run build
 
 FROM build AS test
 
-RUN touch .env \
+RUN cp .env.example .env \
+    && php artisan key:generate\
     && composer audit --locked --no-interaction \
     && COMPOSER_ALLOW_SUPERUSER=1 composer ci:check
 

app/Actions/Notifications/BuildProjectNotificationSettingsPayload.php

@@ -2,6 +2,8 @@
 
 namespace App\Actions\Notifications;
 
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Actions\Projects\ResolveProjectTemplateState;
 use App\Enums\DiscordAllowedMentionType;
 use App\Enums\NotificationChannel;
 use App\Enums\NotificationEventType;
@@ -15,6 +17,7 @@ class BuildProjectNotificationSettingsPayload
 {
     public function __construct(
         private readonly ListProjectNotificationActions $listProjectNotificationActions,
+        private readonly ResolveProjectTemplateState $resolveProjectTemplateState,
     ) {}
 
     /**
@@ -33,6 +36,9 @@ class BuildProjectNotificationSettingsPayload
             )->resolve(),
             'project' => ProjectResource::make($project)->resolve(),
             'status' => $status,
+            'templateState' => $this->resolveProjectTemplateState->handle($project, [
+                DuplicateProjectConfiguration::COPY_NOTIFICATION_ACTIONS,
+            ]),
             'templateVariables' => $this->templateVariables(),
         ];
     }

app/Actions/Permissions/PermissionService.php

@@ -8,6 +8,7 @@ use App\Models\Project;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
@@ -113,6 +114,41 @@ class PermissionService
         );
     }
 
+    /**
+     * @param  EloquentCollection<int, User>  $users
+     * @return array{directPermissions: array, teamPermissions: array, effectivePermissions: array, globalAdminUserIds: array<int, int>}
+     */
+    public function projectAccessMap(EloquentCollection $users, Project $project): array
+    {
+        $users->loadMissing('teams');
+        $directPermissions = $this->assignmentMap(User::class, $project);
+        $teamPermissions = $this->assignmentMap(Team::class, $project);
+        $globalPermissions = $this->assignmentMap(User::class);
+        $effectivePermissions = [];
+        $globalAdminUserIds = [];
+
+        foreach ($users as $user) {
+            $permissions = $directPermissions[$user->id] ?? [];
+
+            foreach ($user->teams as $team) {
+                $permissions = array_merge($permissions, $teamPermissions[$team->id] ?? []);
+            }
+
+            if (in_array(Permission::GlobalAdmin->value, $globalPermissions[$user->id] ?? [], true)) {
+                $permissions[] = Permission::GlobalAdmin->value;
+                $globalAdminUserIds[] = $user->id;
+            }
+
+            $expanded = $this->expandPermissions(array_map(Permission::from(...), $permissions));
+            $effectivePermissions[$user->id] = Permission::values(array_values(array_filter(
+                Permission::projectAssignable(),
+                fn (Permission $permission): bool => in_array($permission, $expanded, true),
+            )));
+        }
+
+        return compact('directPermissions', 'teamPermissions', 'effectivePermissions', 'globalAdminUserIds');
+    }
+
     /**
      * @return array<string, array<int, string>>
      */

app/Actions/ProjectBoard/UpdateTicketStatusTransitions.php

@@ -2,11 +2,19 @@
 
 namespace App\Actions\ProjectBoard;
 
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Actions\Projects\ProjectTemplateOverrideManager;
+use App\Actions\Projects\RefreshProjectBaseTemplate;
 use App\Models\TicketStatus;
 use Illuminate\Support\Arr;
 
 class UpdateTicketStatusTransitions
 {
+    public function __construct(
+        private readonly ProjectTemplateOverrideManager $projectTemplateOverrideManager,
+        private readonly RefreshProjectBaseTemplate $refreshProjectBaseTemplate,
+    ) {}
+
     /**
      * @param  array{allowed_ticket_status_ids?: array<int, int|string>|null}  $validated
      */
@@ -19,6 +27,14 @@ class UpdateTicketStatusTransitions
             ->all();
 
         $ticketStatus->allowedTargetStatuses()->sync($allowedTicketStatusIds);
+        $this->projectTemplateOverrideManager->mark(
+            $ticketStatus->project,
+            DuplicateProjectConfiguration::COPY_STATUS_TRANSITIONS,
+        );
+        $this->refreshProjectBaseTemplate->handle(
+            $ticketStatus->project,
+            DuplicateProjectConfiguration::COPY_STATUS_TRANSITIONS,
+        );
 
         return $ticketStatus->fresh();
     }

app/Actions/ProjectTicketMetadata/UpdateProjectTicketMetadataSettings.php

@@ -2,11 +2,19 @@
 
 namespace App\Actions\ProjectTicketMetadata;
 
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Actions\Projects\ProjectTemplateOverrideManager;
+use App\Actions\Projects\RefreshProjectBaseTemplate;
 use App\Models\Project;
 use Illuminate\Support\Arr;
 
 class UpdateProjectTicketMetadataSettings
 {
+    public function __construct(
+        private readonly ProjectTemplateOverrideManager $projectTemplateOverrideManager,
+        private readonly RefreshProjectBaseTemplate $refreshProjectBaseTemplate,
+    ) {}
+
     /**
      * @param  array{show_author?: bool|null, show_story_points?: bool|null}  $validated
      */
@@ -16,6 +24,14 @@ class UpdateProjectTicketMetadataSettings
             'show_author' => Arr::get($validated, 'show_author', false),
             'show_story_points' => Arr::get($validated, 'show_story_points', false),
         ]);
+        $this->projectTemplateOverrideManager->mark(
+            $project,
+            DuplicateProjectConfiguration::COPY_PROJECT_SETTINGS,
+        );
+        $this->refreshProjectBaseTemplate->handle(
+            $project,
+            DuplicateProjectConfiguration::COPY_PROJECT_SETTINGS,
+        );
 
         return $project->fresh();
     }

app/Actions/Projects/BuildProjectBacklogPayload.php

@@ -47,6 +47,7 @@ class BuildProjectBacklogPayload
             'tickets' => TicketResource::collection(
                 Ticket::query()
                     ->with([
+                        'assignee',
                         'ticketPriority',
                         'ticketStatus.allowedTargetStatuses.boardColumn',
                         'ticketStatus.boardColumn',

app/Actions/Projects/BuildProjectBoardPayload.php

@@ -29,6 +29,7 @@ class BuildProjectBoardPayload
                         'ticketStatuses',
                         'tickets' => fn ($query) => $query
                             ->with([
+                                'assignee',
                                 'ticketPriority',
                                 'ticketStatus.allowedTargetStatuses.boardColumn',
                                 'ticketStatus.boardColumn',

app/Actions/Projects/BuildProjectBoardSettingsPayload.php

@@ -9,6 +9,10 @@ use App\Models\Project;
 
 class BuildProjectBoardSettingsPayload
 {
+    public function __construct(
+        private readonly ResolveProjectTemplateState $resolveProjectTemplateState,
+    ) {}
+
     /**
      * @return array<string, mixed>
      */
@@ -27,6 +31,9 @@ class BuildProjectBoardSettingsPayload
             )->resolve(),
             'project' => ProjectResource::make($project)->resolve(),
             'status' => $status,
+            'templateState' => $this->resolveProjectTemplateState->handle($project, [
+                DuplicateProjectConfiguration::COPY_BOARD_WORKFLOW,
+            ]),
             'ticketStatuses' => TicketStatusResource::collection(
                 $project->ticketStatuses()
                     ->with(['allowedTargetStatuses.boardColumn', 'boardColumn'])

app/Actions/Projects/BuildProjectTicketMetadataSettingsPayload.php

@@ -13,6 +13,10 @@ use App\Models\TicketFieldDefinition;
 
 class BuildProjectTicketMetadataSettingsPayload
 {
+    public function __construct(
+        private readonly ResolveProjectTemplateState $resolveProjectTemplateState,
+    ) {}
+
     /**
      * @return array<string, mixed>
      */
@@ -23,8 +27,15 @@ class BuildProjectTicketMetadataSettingsPayload
             'project' => ProjectResource::make($project)->resolve(),
             'error' => $error,
             'status' => $status,
-            'ticketFieldDefinitions' => TicketFieldDefinitionResource::collection($project->ticketFieldDefinitions()->get())->resolve(),
-            'ticketLinkTypes' => TicketLinkTypeResource::collection($project->ticketLinkTypes()->get())->resolve(),
+            'templateState' => $this->resolveProjectTemplateState->handle($project, [
+                DuplicateProjectConfiguration::COPY_PROJECT_SETTINGS,
+                DuplicateProjectConfiguration::COPY_TICKET_TYPES,
+                DuplicateProjectConfiguration::COPY_TICKET_PRIORITIES,
+                DuplicateProjectConfiguration::COPY_TICKET_FIELDS,
+                DuplicateProjectConfiguration::COPY_TICKET_LINK_TYPES,
+            ]),
+            'ticketFieldDefinitions' => TicketFieldDefinitionResource::collection($project->ticketFieldDefinitions()->withCount('ticketFieldValues')->get())->resolve(),
+            'ticketLinkTypes' => TicketLinkTypeResource::collection($project->ticketLinkTypes()->withCount('ticketLinks')->get())->resolve(),
             'ticketPriorities' => TicketPriorityResource::collection($project->ticketPriorities()->get())->resolve(),
             'ticketTypes' => TicketTypeResource::collection($project->ticketTypes()->withCount('tickets')->get())->resolve(),
         ];

app/Actions/Projects/CreateProject.php

@@ -6,25 +6,85 @@ use App\Actions\Permissions\PermissionService;
 use App\Actions\ProjectTicketMetadata\InitializeProjectTicketMetadata;
 use App\Enums\Permission;
 use App\Models\Project;
+use App\Models\ProjectTemplate;
 use App\Models\User;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\DB;
 
 class CreateProject
 {
     public function __construct(
+        private readonly CreateProjectBaseTemplate $createProjectBaseTemplate,
+        private readonly DuplicateProjectConfiguration $duplicateProjectConfiguration,
         private readonly InitializeProjectTicketMetadata $initializeProjectTicketMetadata,
         private readonly PermissionService $permissionService,
+        private readonly ProjectTemplateOverrideManager $projectTemplateOverrideManager,
     ) {}
 
     /**
-     * @param  array{key: string, name: string}  $attributes
+     * @param  array{key: string, name: string, creation_mode?: string, source_project_id?: int|string|null, source_template_id?: int|string|null, copy_areas?: array<int, string>|null}  $attributes
      */
     public function handle(array $attributes, User $actor): Project
     {
-        $project = Project::query()->create($attributes);
+        return DB::transaction(function () use ($attributes, $actor): Project {
+            $project = Project::query()->create(Arr::only($attributes, ['key', 'name']));
+            $creationMode = Arr::get($attributes, 'creation_mode', 'scratch');
+            $sourceTemplateId = Arr::get($attributes, 'source_template_id');
+            $baseTemplate = null;
+            $sourceTemplate = null;
 
-        $this->initializeProjectTicketMetadata->handle($project);
-        $this->permissionService->grant($actor, Permission::ProjectAdmin, $project);
+            if ($creationMode === 'template' && $sourceTemplateId !== null) {
+                $sourceTemplate = ProjectTemplate::query()
+                    ->published()
+                    ->findOrFail((int) $sourceTemplateId);
 
-        return $project;
+                $project->forceFill([
+                    'project_template_id' => $sourceTemplate->id,
+                    'template_overrides' => [],
+                ])->saveQuietly();
+            } else {
+                $baseTemplate = $this->createProjectBaseTemplate->handle($project);
+
+                $project->forceFill([
+                    'project_template_id' => $baseTemplate->id,
+                    'template_overrides' => [],
+                ])->saveQuietly();
+            }
+
+            $project = $project->fresh() ?? $project;
+
+            $this->projectTemplateOverrideManager->withoutRecording(
+                fn () => $this->initializeProjectTicketMetadata->handle($project),
+            );
+            $this->permissionService->grant($actor, Permission::ProjectAdmin, $project);
+
+            if ($creationMode === 'duplicate' && Arr::get($attributes, 'source_project_id') !== null) {
+                $sourceProject = Project::query()->findOrFail((int) Arr::get($attributes, 'source_project_id'));
+
+                $this->duplicateProjectConfiguration->handle(
+                    $sourceProject,
+                    $project,
+                    array_values(Arr::get($attributes, 'copy_areas', [])),
+                );
+            }
+
+            if ($creationMode === 'template' && $sourceTemplate !== null) {
+                $this->duplicateProjectConfiguration->apply(
+                    $project->fresh() ?? $project,
+                    $sourceTemplate->configuration_snapshot ?? [],
+                );
+            }
+
+            if ($baseTemplate !== null) {
+                $baseTemplate->forceFill([
+                    'configuration_snapshot' => $this->duplicateProjectConfiguration->export(
+                        $project->fresh() ?? $project,
+                        DuplicateProjectConfiguration::copyableAreas(),
+                    ),
+                ])->save();
+            }
+
+            return $project->fresh() ?? $project;
+        });
     }
 }

app/Actions/Projects/CreateProjectBaseTemplate.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Actions\Projects;
+
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+
+class CreateProjectBaseTemplate
+{
+    public function __construct(
+        private readonly DuplicateProjectConfiguration $duplicateProjectConfiguration,
+    ) {}
+
+    public function handle(Project $project): ProjectTemplate
+    {
+        $copyAreas = DuplicateProjectConfiguration::copyableAreas();
+
+        return ProjectTemplate::query()->create([
+            'project_id' => $project->id,
+            'source_project_id' => $project->id,
+            'name' => "{$project->name} base template",
+            'slug' => strtolower($project->key).'-base-template',
+            'is_published' => false,
+            'copy_areas' => $copyAreas,
+            'configuration_snapshot' => $this->duplicateProjectConfiguration->export($project, $copyAreas),
+        ]);
+    }
+}

app/Actions/Projects/CreateProjectTemplate.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Actions\Projects;
+
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Support\Arr;
+
+class CreateProjectTemplate
+{
+    public function __construct(
+        private readonly DuplicateProjectConfiguration $duplicateProjectConfiguration,
+    ) {}
+
+    /**
+     * @param  array{name: string, slug: string, copy_areas?: array<int, string>}  $attributes
+     */
+    public function handle(Project $sourceProject, array $attributes): ProjectTemplate
+    {
+        $copyAreas = array_values(Arr::get($attributes, 'copy_areas', []));
+
+        return ProjectTemplate::query()->create([
+            'project_id' => null,
+            'source_project_id' => $sourceProject->id,
+            'name' => $attributes['name'],
+            'slug' => $attributes['slug'],
+            'is_published' => true,
+            'copy_areas' => $this->duplicateProjectConfiguration->normalizeCopyAreas($copyAreas),
+            'configuration_snapshot' => $this->duplicateProjectConfiguration->export($sourceProject, $copyAreas),
+        ]);
+    }
+}

app/Actions/Projects/DeleteProject.php

@@ -3,6 +3,7 @@
 namespace App\Actions\Projects;
 
 use App\Models\Project;
+use Illuminate\Support\Facades\DB;
 
 class DeleteProject
 {
@@ -10,7 +11,13 @@ class DeleteProject
     {
         $projectName = $project->name;
 
-        $project->delete();
+        DB::transaction(function () use ($project): void {
+            $baseTemplate = $project->baseTemplate()->first();
+
+            $project->ticketStatuses()->delete();
+            $project->delete();
+            $baseTemplate?->delete();
+        });
 
         return $projectName;
     }

app/Actions/Projects/DuplicateProjectConfiguration.php

@@ -0,0 +1,339 @@
+<?php
+
+namespace App\Actions\Projects;
+
+use App\Models\Project;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
+use Illuminate\Database\Eloquent\Model;
+
+class DuplicateProjectConfiguration
+{
+    public const COPY_PROJECT_SETTINGS = 'project_settings';
+
+    public const COPY_BOARD_COLUMNS = 'board_columns';
+
+    public const COPY_TICKET_STATUSES = 'ticket_statuses';
+
+    public const COPY_STATUS_TRANSITIONS = 'status_transitions';
+
+    public const COPY_TICKET_TYPES = 'ticket_types';
+
+    public const COPY_TICKET_PRIORITIES = 'ticket_priorities';
+
+    public const COPY_TICKET_FIELDS = 'ticket_fields';
+
+    public const COPY_TICKET_LINK_TYPES = 'ticket_link_types';
+
+    public const COPY_REPOSITORY_CONNECTIONS = 'repository_connections';
+
+    public const COPY_NOTIFICATION_ACTIONS = 'notification_actions';
+
+    public const COPY_BOARD_WORKFLOW = 'board_workflow';
+
+    public function __construct(
+        private readonly ProjectTemplateOverrideManager $projectTemplateOverrideManager,
+    ) {}
+
+    /** @return list<string> */
+    public static function copyableAreas(): array
+    {
+        return [
+            self::COPY_PROJECT_SETTINGS,
+            self::COPY_BOARD_COLUMNS,
+            self::COPY_TICKET_STATUSES,
+            self::COPY_STATUS_TRANSITIONS,
+            self::COPY_TICKET_TYPES,
+            self::COPY_TICKET_PRIORITIES,
+            self::COPY_TICKET_FIELDS,
+            self::COPY_TICKET_LINK_TYPES,
+            self::COPY_REPOSITORY_CONNECTIONS,
+            self::COPY_NOTIFICATION_ACTIONS,
+        ];
+    }
+
+    /** @return list<string> */
+    public static function acceptedCopyAreas(): array
+    {
+        return [...self::copyableAreas(), self::COPY_BOARD_WORKFLOW];
+    }
+
+    /** @return list<array{value: string, label: string, description: string}> */
+    public static function copyAreaOptions(): array
+    {
+        return [
+            ['value' => self::COPY_PROJECT_SETTINGS, 'label' => 'Project settings', 'description' => 'General project preferences like story points and author visibility.'],
+            ['value' => self::COPY_BOARD_COLUMNS, 'label' => 'Board columns', 'description' => 'Columns and their order on the project board.'],
+            ['value' => self::COPY_TICKET_STATUSES, 'label' => 'Ticket statuses', 'description' => 'Statuses and their assignment to board columns.'],
+            ['value' => self::COPY_STATUS_TRANSITIONS, 'label' => 'Status transitions', 'description' => 'Allowed moves between ticket statuses.'],
+            ['value' => self::COPY_TICKET_TYPES, 'label' => 'Ticket types', 'description' => 'Available ticket types, including parent types.'],
+            ['value' => self::COPY_TICKET_PRIORITIES, 'label' => 'Ticket priorities', 'description' => 'Available ticket priorities.'],
+            ['value' => self::COPY_TICKET_FIELDS, 'label' => 'Custom ticket fields', 'description' => 'Custom field definitions without ticket values.'],
+            ['value' => self::COPY_TICKET_LINK_TYPES, 'label' => 'Ticket link types', 'description' => 'Relationship labels between tickets.'],
+            ['value' => self::COPY_REPOSITORY_CONNECTIONS, 'label' => 'Repository connections', 'description' => 'Repositories linked to the project.'],
+            ['value' => self::COPY_NOTIFICATION_ACTIONS, 'label' => 'Notification actions', 'description' => 'Notification rules and delivery settings.'],
+        ];
+    }
+
+    /** @param list<string> $copyAreas @return list<string> */
+    public function normalizeCopyAreas(array $copyAreas): array
+    {
+        if (in_array(self::COPY_BOARD_WORKFLOW, $copyAreas, true)) {
+            $copyAreas = [
+                ...array_diff($copyAreas, [self::COPY_BOARD_WORKFLOW]),
+                self::COPY_BOARD_COLUMNS,
+                self::COPY_TICKET_STATUSES,
+                self::COPY_STATUS_TRANSITIONS,
+            ];
+        }
+
+        return array_values(array_intersect(self::copyableAreas(), array_unique($copyAreas)));
+    }
+
+    /** @param array<string, mixed> $configuration @return array<string, mixed> */
+    public function normalizeConfiguration(array $configuration): array
+    {
+        $workflow = $configuration[self::COPY_BOARD_WORKFLOW] ?? null;
+
+        if (is_array($workflow)) {
+            $statuses = $workflow['ticket_statuses'] ?? [];
+            $configuration[self::COPY_BOARD_COLUMNS] ??= $workflow['board_columns'] ?? [];
+            $configuration[self::COPY_TICKET_STATUSES] ??= array_map(
+                static fn (array $status): array => array_diff_key($status, ['allowed_target_indexes' => true]),
+                $statuses,
+            );
+            $configuration[self::COPY_STATUS_TRANSITIONS] ??= array_map(
+                static fn (array $status): array => $status['allowed_target_indexes'] ?? [],
+                $statuses,
+            );
+            unset($configuration[self::COPY_BOARD_WORKFLOW]);
+        }
+
+        return $configuration;
+    }
+
+    /** @param list<string> $copyAreas @return array<string, mixed> */
+    public function export(Project $sourceProject, array $copyAreas): array
+    {
+        $selectedAreas = $this->normalizeCopyAreas($copyAreas);
+
+        if ($selectedAreas === []) {
+            return [];
+        }
+
+        $sourceProject->load([
+            'boardColumns', 'notificationActions', 'repositoryConnections', 'ticketFieldDefinitions',
+            'ticketLinkTypes', 'ticketPriorities', 'ticketStatuses.allowedTargetStatuses', 'ticketTypes',
+        ]);
+        $configuration = [];
+
+        if (in_array(self::COPY_PROJECT_SETTINGS, $selectedAreas, true)) {
+            $configuration[self::COPY_PROJECT_SETTINGS] = [
+                'show_author' => $sourceProject->show_author,
+                'show_story_points' => $sourceProject->show_story_points,
+            ];
+        }
+
+        $columnIndexes = $sourceProject->boardColumns->values()->mapWithKeys(
+            static fn ($column, int $index): array => [$column->id => $index],
+        );
+        $statusIndexes = $sourceProject->ticketStatuses->values()->mapWithKeys(
+            static fn ($status, int $index): array => [$status->id => $index],
+        );
+
+        if (in_array(self::COPY_BOARD_COLUMNS, $selectedAreas, true)) {
+            $configuration[self::COPY_BOARD_COLUMNS] = $sourceProject->boardColumns->values()->map(
+                static fn ($column): array => ['name' => $column->name, 'position' => $column->position],
+            )->all();
+        }
+
+        if (in_array(self::COPY_TICKET_STATUSES, $selectedAreas, true)) {
+            $configuration[self::COPY_TICKET_STATUSES] = $sourceProject->ticketStatuses->values()->map(
+                static fn ($status): array => [
+                    'board_column_index' => $status->board_column_id === null ? null : $columnIndexes->get($status->board_column_id),
+                    'name' => $status->name,
+                    'position' => $status->position,
+                ],
+            )->all();
+        }
+
+        if (in_array(self::COPY_STATUS_TRANSITIONS, $selectedAreas, true)) {
+            $configuration[self::COPY_STATUS_TRANSITIONS] = $sourceProject->ticketStatuses->values()->map(
+                static fn ($status): array => $status->allowedTargetStatuses->pluck('id')->map(
+                    static fn (int $id): ?int => $statusIndexes->get($id),
+                )->filter(static fn (?int $index): bool => $index !== null)->values()->all(),
+            )->all();
+        }
+
+        $simpleAreas = [
+            self::COPY_TICKET_TYPES => fn ($item): array => ['name' => $item->name, 'position' => $item->position, 'is_parent' => $item->is_parent],
+            self::COPY_TICKET_PRIORITIES => fn ($item): array => ['name' => $item->name, 'position' => $item->position],
+            self::COPY_TICKET_FIELDS => fn ($item): array => ['field_type' => $item->field_type, 'label' => $item->label, 'position' => $item->position],
+            self::COPY_TICKET_LINK_TYPES => fn ($item): array => ['label' => $item->label, 'counterpart_label' => $item->counterpart_label, 'position' => $item->position],
+            self::COPY_REPOSITORY_CONNECTIONS => fn ($item): array => [
+                'provider' => $item->provider->value, 'base_url' => $item->base_url,
+                'provider_repository_id' => $item->provider_repository_id, 'owner_name' => $item->owner_name,
+                'repository_name' => $item->repository_name, 'repository_full_name' => $item->repository_full_name,
+                'repository_url' => $item->repository_url,
+            ],
+            self::COPY_NOTIFICATION_ACTIONS => fn ($item): array => [
+                'name' => $item->name, 'enabled' => $item->enabled, 'event_type' => $item->event_type->value,
+                'channel' => $item->channel->value, 'channel_configuration' => $item->channel_configuration ?? [],
+                'message_template' => $item->message_template, 'delivery_url' => $item->delivery_url,
+                'filters' => $item->filters ?? [],
+            ],
+        ];
+        $relations = [
+            self::COPY_TICKET_TYPES => 'ticketTypes', self::COPY_TICKET_PRIORITIES => 'ticketPriorities',
+            self::COPY_TICKET_FIELDS => 'ticketFieldDefinitions', self::COPY_TICKET_LINK_TYPES => 'ticketLinkTypes',
+            self::COPY_REPOSITORY_CONNECTIONS => 'repositoryConnections', self::COPY_NOTIFICATION_ACTIONS => 'notificationActions',
+        ];
+
+        foreach ($simpleAreas as $area => $mapper) {
+            if (in_array($area, $selectedAreas, true)) {
+                $configuration[$area] = $sourceProject->{$relations[$area]}->values()->map($mapper)->all();
+            }
+        }
+
+        return $configuration;
+    }
+
+    /**
+     * @param  array<string, mixed>  $configuration
+     * @param  array<int|string, int|string>  $statusReplacements
+     * @return list<string> areas which retained referenced local values
+     */
+    public function apply(Project $targetProject, array $configuration, array $statusReplacements = []): array
+    {
+        $configuration = $this->normalizeConfiguration($configuration);
+
+        $blockedAreas = $this->projectTemplateOverrideManager->withoutRecording(function () use ($targetProject, $configuration, $statusReplacements): array {
+            $blockedAreas = [];
+
+            if (isset($configuration[self::COPY_PROJECT_SETTINGS])) {
+                $targetProject->forceFill($configuration[self::COPY_PROJECT_SETTINGS])->saveQuietly();
+            }
+
+            if (isset($configuration[self::COPY_BOARD_COLUMNS])) {
+                $blocked = $this->syncModels(
+                    $targetProject->boardColumns()->get(),
+                    $configuration[self::COPY_BOARD_COLUMNS],
+                    fn (array $item) => $targetProject->boardColumns()->create($item),
+                    static fn (Model $model, array $item) => $model->forceFill($item)->saveQuietly(),
+                    static fn (Model $column): bool => ! $column->ticketStatuses()->exists(),
+                );
+                if ($blocked) {
+                    $blockedAreas[] = self::COPY_BOARD_COLUMNS;
+                }
+            }
+
+            if (isset($configuration[self::COPY_TICKET_STATUSES])) {
+                $columns = $targetProject->boardColumns()->get()->values();
+                $items = collect($configuration[self::COPY_TICKET_STATUSES])->map(static function (array $item) use ($columns): array {
+                    $columnIndex = $item['board_column_index'] ?? null;
+                    $item['board_column_id'] = $columnIndex === null ? null : $columns->get($columnIndex)?->id;
+                    unset($item['board_column_index']);
+
+                    return $item;
+                })->all();
+                $blocked = $this->syncModels(
+                    $targetProject->ticketStatuses()->get(),
+                    $items,
+                    fn (array $item) => $targetProject->ticketStatuses()->create($item),
+                    static fn (Model $model, array $item) => $model->forceFill($item)->saveQuietly(),
+                    function (Model $status) use ($statusReplacements): bool {
+                        if (! $status->tickets()->exists()) {
+                            return true;
+                        }
+                        $replacementId = $statusReplacements[$status->id] ?? null;
+                        if ($replacementId === null) {
+                            return false;
+                        }
+                        $status->tickets()->update(['ticket_status_id' => $replacementId]);
+
+                        return true;
+                    },
+                );
+                if ($blocked) {
+                    $blockedAreas[] = self::COPY_TICKET_STATUSES;
+                }
+            }
+
+            if (isset($configuration[self::COPY_STATUS_TRANSITIONS])) {
+                $statuses = $targetProject->ticketStatuses()->get()->values();
+                foreach ($configuration[self::COPY_STATUS_TRANSITIONS] as $index => $targets) {
+                    $status = $statuses->get($index);
+                    if ($status !== null) {
+                        $status->allowedTargetStatuses()->sync(collect($targets)->map(fn (int $target): ?int => $statuses->get($target)?->id)->filter()->all());
+                    }
+                }
+            }
+
+            $relations = [
+                self::COPY_TICKET_TYPES => ['ticketTypes', fn (Model $item): bool => ! $item->tickets()->exists()],
+                self::COPY_TICKET_PRIORITIES => ['ticketPriorities', fn (Model $item): bool => ! $item->tickets()->exists()],
+                self::COPY_TICKET_FIELDS => ['ticketFieldDefinitions', fn (Model $item): bool => ! $item->ticketFieldValues()->exists()],
+                self::COPY_TICKET_LINK_TYPES => ['ticketLinkTypes', fn (Model $item): bool => ! $item->ticketLinks()->exists()],
+                self::COPY_REPOSITORY_CONNECTIONS => ['repositoryConnections', null],
+                self::COPY_NOTIFICATION_ACTIONS => ['notificationActions', null],
+            ];
+
+            foreach ($relations as $area => [$relation, $canDelete]) {
+                if (! isset($configuration[$area])) {
+                    continue;
+                }
+                $blocked = $this->syncModels(
+                    $targetProject->{$relation}()->get(),
+                    $configuration[$area],
+                    fn (array $item) => $targetProject->{$relation}()->create($item),
+                    static fn (Model $model, array $item) => $model->forceFill($item)->saveQuietly(),
+                    $canDelete,
+                );
+                if ($blocked) {
+                    $blockedAreas[] = $area;
+                }
+            }
+
+            foreach ($targetProject->configurationRelations() as $relation) {
+                $targetProject->{$relation}()->update(['project_template_id' => $targetProject->project_template_id]);
+            }
+
+            return array_values(array_unique($blockedAreas));
+        });
+
+        foreach ($blockedAreas as $area) {
+            $this->projectTemplateOverrideManager->mark($targetProject->fresh(), $area);
+        }
+
+        return $blockedAreas;
+    }
+
+    /** @param list<string> $copyAreas */
+    public function handle(Project $sourceProject, Project $targetProject, array $copyAreas): void
+    {
+        $this->apply($targetProject, $this->export($sourceProject, $copyAreas));
+    }
+
+    /**
+     * @param  EloquentCollection<int, Model>  $models
+     * @param  array<int, array<string, mixed>>  $items
+     */
+    private function syncModels(EloquentCollection $models, array $items, callable $create, callable $update, ?callable $canDelete = null): bool
+    {
+        foreach ($items as $index => $item) {
+            $model = $models->get($index);
+            $model === null ? $create($item) : $update($model, $item);
+        }
+
+        $blocked = false;
+        foreach ($models->slice(count($items)) as $model) {
+            if ($canDelete !== null && ! $canDelete($model)) {
+                $blocked = true;
+
+                continue;
+            }
+            $model->deleteQuietly();
+        }
+
+        return $blocked;
+    }
+}

app/Actions/Projects/ProjectTemplateOverrideManager.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Actions\Projects;
+
+use App\Models\Project;
+
+class ProjectTemplateOverrideManager
+{
+    private static int $suppressionDepth = 0;
+
+    public function mark(Project $project, string $area): void
+    {
+        if (self::$suppressionDepth > 0) {
+            return;
+        }
+
+        $project->loadMissing('projectTemplate');
+
+        if ($project->projectTemplate === null || ! $project->projectTemplate->is_published) {
+            return;
+        }
+
+        $overrides = array_values(array_unique([
+            ...($project->template_overrides ?? []),
+            $area,
+        ]));
+
+        $project->forceFill(['template_overrides' => $overrides])->saveQuietly();
+    }
+
+    /**
+     * @param  list<string>  $areas
+     */
+    public function clear(Project $project, array $areas): void
+    {
+        $remaining = array_values(array_diff($project->template_overrides ?? [], $areas));
+        $project->forceFill(['template_overrides' => $remaining])->saveQuietly();
+    }
+
+    public function withoutRecording(callable $callback): mixed
+    {
+        self::$suppressionDepth++;
+
+        try {
+            return $callback();
+        } finally {
+            self::$suppressionDepth--;
+        }
+    }
+
+    public function isRecording(): bool
+    {
+        return self::$suppressionDepth === 0;
+    }
+}

app/Actions/Projects/RefreshProjectBaseTemplate.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Actions\Projects;
+
+use App\Models\Project;
+
+class RefreshProjectBaseTemplate
+{
+    public function __construct(
+        private readonly DuplicateProjectConfiguration $duplicateProjectConfiguration,
+    ) {}
+
+    public function handle(Project $project, string $area): void
+    {
+        $project->loadMissing('projectTemplate');
+
+        if ($project->projectTemplate === null || $project->projectTemplate->is_published) {
+            return;
+        }
+
+        $snapshot = $this->duplicateProjectConfiguration->normalizeConfiguration(
+            $project->projectTemplate->configuration_snapshot ?? [],
+        );
+
+        $project->projectTemplate->forceFill([
+            'configuration_snapshot' => array_replace(
+                $snapshot,
+                $this->duplicateProjectConfiguration->export($project->fresh(), [$area]),
+            ),
+        ])->saveQuietly();
+    }
+}

app/Actions/Projects/ResolveProjectTemplateState.php

@@ -0,0 +1,136 @@
+<?php
+
+namespace App\Actions\Projects;
+
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+
+class ResolveProjectTemplateState
+{
+    public function __construct(
+        private readonly DuplicateProjectConfiguration $duplicateProjectConfiguration,
+    ) {}
+
+    /**
+     * @param  list<string>|null  $areas
+     * @return array<string, mixed>|null
+     */
+    public function handle(Project $project, ?array $areas = null): ?array
+    {
+        $project->loadMissing('projectTemplate');
+
+        /** @var ProjectTemplate|null $projectTemplate */
+        $projectTemplate = $project->projectTemplate;
+
+        if ($projectTemplate === null) {
+            return null;
+        }
+
+        $selectedAreas = $areas === null
+            ? DuplicateProjectConfiguration::copyableAreas()
+            : $this->duplicateProjectConfiguration->normalizeCopyAreas($areas);
+
+        $normalizedTemplateConfiguration = $this->duplicateProjectConfiguration->normalizeConfiguration(
+            $projectTemplate->configuration_snapshot ?? [],
+        );
+        $templateConfiguration = collect($normalizedTemplateConfiguration)
+            ->only($selectedAreas)
+            ->all();
+        $currentConfiguration = $this->duplicateProjectConfiguration->export($project, $selectedAreas);
+        $persistedOverrides = $projectTemplate->is_published
+            ? array_values(array_intersect($project->template_overrides ?? [], $selectedAreas))
+            : [];
+
+        $overriddenAreas = [];
+        $inheritedAreas = [];
+
+        foreach ($selectedAreas as $area) {
+            $label = $this->labelForArea($area);
+            $hasTemplateValue = array_key_exists($area, $templateConfiguration);
+
+            if (! $hasTemplateValue) {
+                continue;
+            }
+
+            if (! in_array($area, $persistedOverrides, true)) {
+                $inheritedAreas[] = [
+                    'label' => $label,
+                    'value' => $area,
+                ];
+
+                continue;
+            }
+
+            $overriddenAreas[] = [
+                'label' => $label,
+                'value' => $area,
+            ];
+        }
+
+        $overriddenAreaValues = array_flip(array_column($overriddenAreas, 'value'));
+        $inheritedAreaValues = array_flip(array_column($inheritedAreas, 'value'));
+
+        return [
+            'effectiveConfiguration' => array_replace($templateConfiguration, array_intersect_key($currentConfiguration, $overriddenAreaValues)),
+            'inheritedAreas' => $inheritedAreas,
+            'inheritedConfiguration' => array_intersect_key($templateConfiguration, $inheritedAreaValues),
+            'inheritsFromTemplate' => $projectTemplate->is_published,
+            'overriddenAreas' => $overriddenAreas,
+            'overriddenConfiguration' => array_intersect_key($currentConfiguration, $overriddenAreaValues),
+            'resetRequirements' => $this->resetRequirements($project, $templateConfiguration, $persistedOverrides),
+            'templateConfiguration' => $templateConfiguration,
+            'templateId' => $projectTemplate->id,
+            'templateName' => $projectTemplate->name,
+            'templateSlug' => $projectTemplate->slug,
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $templateConfiguration
+     * @param  list<string>  $persistedOverrides
+     * @return array<string, mixed>
+     */
+    private function resetRequirements(Project $project, array $templateConfiguration, array $persistedOverrides): array
+    {
+        if (! in_array(DuplicateProjectConfiguration::COPY_TICKET_STATUSES, $persistedOverrides, true)) {
+            return [];
+        }
+
+        $templateStatuses = $templateConfiguration[DuplicateProjectConfiguration::COPY_TICKET_STATUSES] ?? [];
+        if (! is_array($templateStatuses)) {
+            return [];
+        }
+
+        $statuses = $project->ticketStatuses()->withCount('tickets')->get()->values();
+        $replacementOptions = $statuses->take(count($templateStatuses))->map(
+            static fn ($status): array => ['id' => $status->id, 'name' => $status->name],
+        )->all();
+        $removedStatuses = $statuses->slice(count($templateStatuses))
+            ->filter(static fn ($status): bool => $status->tickets_count > 0)
+            ->map(static fn ($status): array => [
+                'id' => $status->id,
+                'name' => $status->name,
+                'ticketCount' => $status->tickets_count,
+            ])
+            ->values()
+            ->all();
+
+        return $removedStatuses === [] ? [] : [
+            DuplicateProjectConfiguration::COPY_TICKET_STATUSES => [
+                'removedStatuses' => $removedStatuses,
+                'replacementOptions' => $replacementOptions,
+            ],
+        ];
+    }
+
+    private function labelForArea(string $area): string
+    {
+        foreach (DuplicateProjectConfiguration::copyAreaOptions() as $option) {
+            if ($option['value'] === $area) {
+                return $option['label'];
+            }
+        }
+
+        return $area;
+    }
+}

app/Actions/Projects/UpdateProjectTemplate.php

@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Actions\Projects;
+
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\DB;
+
+class UpdateProjectTemplate
+{
+    public function __construct(
+        private readonly DuplicateProjectConfiguration $duplicateProjectConfiguration,
+        private readonly ProjectTemplateOverrideManager $projectTemplateOverrideManager,
+    ) {}
+
+    /**
+     * @param  array{name: string, copy_areas?: array<int, string>}  $attributes
+     */
+    public function handle(ProjectTemplate $projectTemplate, array $attributes): ProjectTemplate
+    {
+        $projectTemplate->loadMissing('sourceProject');
+
+        $sourceProject = $projectTemplate->sourceProject;
+        abort_if($sourceProject === null, 422, 'This template cannot be edited because the source project is missing.');
+
+        $copyAreas = array_values(Arr::get($attributes, 'copy_areas', []));
+        $normalizedCopyAreas = $this->duplicateProjectConfiguration->normalizeCopyAreas($copyAreas);
+        $previousConfiguration = $this->duplicateProjectConfiguration->normalizeConfiguration(
+            $projectTemplate->configuration_snapshot ?? [],
+        );
+        $nextConfiguration = $this->duplicateProjectConfiguration->export($sourceProject, $normalizedCopyAreas);
+        $affectedAreas = collect(array_unique([...array_keys($previousConfiguration), ...array_keys($nextConfiguration)]))
+            ->filter(fn (string $area): bool => ($previousConfiguration[$area] ?? null) !== ($nextConfiguration[$area] ?? null))
+            ->values()
+            ->all();
+
+        DB::transaction(function () use ($projectTemplate, $attributes, $normalizedCopyAreas, $nextConfiguration, $previousConfiguration, $affectedAreas): void {
+            ProjectTemplate::query()->whereKey($projectTemplate->id)->lockForUpdate()->firstOrFail();
+
+            $projectTemplate->forceFill([
+                'name' => $attributes['name'],
+                'copy_areas' => $normalizedCopyAreas,
+                'configuration_snapshot' => $nextConfiguration,
+            ])->save();
+
+            Project::query()
+                ->where('project_template_id', $projectTemplate->id)
+                ->orderBy('id')
+                ->chunkById(100, function ($linkedProjects) use ($affectedAreas, $nextConfiguration, $previousConfiguration): void {
+                    foreach ($linkedProjects as $linkedProject) {
+                        $linkedProject = Project::query()->whereKey($linkedProject->id)->lockForUpdate()->firstOrFail();
+                        $currentConfiguration = $this->duplicateProjectConfiguration->export($linkedProject, $affectedAreas);
+                        $overrides = $linkedProject->template_overrides ?? [];
+                        $replacementConfiguration = [];
+
+                        foreach ($affectedAreas as $area) {
+                            if (in_array($area, $overrides, true)) {
+                                continue;
+                            }
+
+                            if (! array_key_exists($area, $nextConfiguration)) {
+                                $this->projectTemplateOverrideManager->mark($linkedProject, $area);
+
+                                continue;
+                            }
+
+                            if (! array_key_exists($area, $previousConfiguration)
+                                && array_key_exists($area, $currentConfiguration)
+                                && $currentConfiguration[$area] !== []) {
+                                $this->projectTemplateOverrideManager->mark($linkedProject, $area);
+
+                                continue;
+                            }
+
+                            $replacementConfiguration[$area] = $nextConfiguration[$area];
+                        }
+
+                        if ($replacementConfiguration !== []) {
+                            $this->duplicateProjectConfiguration->apply($linkedProject, $replacementConfiguration);
+                        }
+                    }
+                });
+        });
+
+        return $projectTemplate->fresh(['sourceProject'])->loadCount('linkedProjects');
+    }
+}

app/Actions/Projects/UpdateProjectTemplateLink.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Actions\Projects;
+
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Support\Facades\DB;
+
+class UpdateProjectTemplateLink
+{
+    public function __construct(
+        private readonly DuplicateProjectConfiguration $duplicateProjectConfiguration,
+        private readonly ProjectTemplateOverrideManager $projectTemplateOverrideManager,
+    ) {}
+
+    public function switch(Project $project, ProjectTemplate $template): void
+    {
+        DB::transaction(function () use ($project, $template): void {
+            $project = Project::query()->whereKey($project->id)->lockForUpdate()->firstOrFail();
+            $configuration = $this->duplicateProjectConfiguration->normalizeConfiguration(
+                $template->configuration_snapshot ?? [],
+            );
+            $localAreas = array_values(array_diff(
+                DuplicateProjectConfiguration::copyableAreas(),
+                array_keys($configuration),
+            ));
+
+            $project->forceFill([
+                'project_template_id' => $template->id,
+                'template_overrides' => $localAreas,
+            ])->saveQuietly();
+
+            $blockedAreas = $this->duplicateProjectConfiguration->apply($project, $configuration);
+            $this->projectTemplateOverrideManager->clear(
+                $project->fresh(),
+                array_values(array_diff(array_keys($configuration), $blockedAreas)),
+            );
+        });
+    }
+
+    /**
+     * @param  list<string>  $areas
+     * @param  array<int|string, int|string>  $statusReplacements
+     */
+    public function reset(Project $project, array $areas, array $statusReplacements = []): void
+    {
+        $template = $project->projectTemplate;
+
+        if ($template === null) {
+            return;
+        }
+
+        DB::transaction(function () use ($project, $template, $areas, $statusReplacements): void {
+            $project = Project::query()->whereKey($project->id)->lockForUpdate()->firstOrFail();
+            $configuration = collect($this->duplicateProjectConfiguration->normalizeConfiguration(
+                $template->configuration_snapshot ?? [],
+            ))->only($areas)->all();
+            $blockedAreas = $this->duplicateProjectConfiguration->apply(
+                $project,
+                $configuration,
+                $statusReplacements,
+            );
+            $this->projectTemplateOverrideManager->clear(
+                $project->fresh(),
+                array_values(array_diff(array_keys($configuration), $blockedAreas)),
+            );
+        });
+    }
+}

app/Actions/Repositories/BuildProjectRepositorySettingsPayload.php

@@ -4,6 +4,8 @@ namespace App\Actions\Repositories;
 
 use App\Actions\Git\Data\GitRepository;
 use App\Actions\Git\GitProviderManager;
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Actions\Projects\ResolveProjectTemplateState;
 use App\Http\Resources\AvailableGitRepositorySourceResource;
 use App\Http\Resources\ProjectResource;
 use App\Http\Resources\RepositoryConnectionResource;
@@ -18,6 +20,7 @@ class BuildProjectRepositorySettingsPayload
 {
     public function __construct(
         private readonly GitProviderManager $gitProviderManager,
+        private readonly ResolveProjectTemplateState $resolveProjectTemplateState,
     ) {}
 
     /**
@@ -41,6 +44,9 @@ class BuildProjectRepositorySettingsPayload
             'project' => ProjectResource::make($project)->resolve(),
             'repositoryConnections' => RepositoryConnectionResource::collection($repositoryConnections)->resolve(),
             'status' => $status,
+            'templateState' => $this->resolveProjectTemplateState->handle($project, [
+                DuplicateProjectConfiguration::COPY_REPOSITORY_CONNECTIONS,
+            ]),
         ];
     }
 

app/Actions/Tickets/CreateProjectTicket.php

@@ -19,6 +19,7 @@ class CreateProjectTicket
     public function __construct(
         private readonly BuildTicketCreatedPayload $buildTicketCreatedPayload,
         private readonly CreateTicketWorklogEntry $createTicketWorklogEntry,
+        private readonly SyncProjectTicketFieldValues $syncProjectTicketFieldValues,
     ) {}
 
     /**
@@ -29,7 +30,15 @@ class CreateProjectTicket
      *         text: string
      *     }>,
      *     assignee_user_id?: int|null,
+     *     author_user_id?: int|null,
+     *     blocked_comment?: string|null,
      *     description: string|null,
+     *     field_values?: array<int, array{
+     *         ticket_field_definition_id: int,
+     *         value_number?: float|int|string|null,
+     *         value_user_id?: int|string|null
+     *     }>,
+     *     is_blocked?: bool,
      *     parent_ticket_id?: int|null,
      *     story_points?: int|null,
      *     ticket_priority_id: int,
@@ -47,14 +56,17 @@ class CreateProjectTicket
             $nextSequenceNumber = (int) Ticket::query()
                 ->where('project_id', $project->id)
                 ->max('sequence_number') + 1;
-            $ticketStatus = TicketStatus::query()
-                ->where('project_id', $project->id)
-                ->findOrFail(Arr::get($attributes, 'ticket_status_id'));
+            $ticketStatusQuery = TicketStatus::query()->where('project_id', $project->id);
+
+            $ticketStatus = $ticketStatusQuery->findOrFail(Arr::get($attributes, 'ticket_status_id'));
+            $isBlocked = (bool) Arr::get($attributes, 'is_blocked', false);
 
             $ticket = Ticket::query()->create([
                 'assignee_user_id' => Arr::get($attributes, 'assignee_user_id'),
-                'author_user_id' => $actor?->id,
+                'author_user_id' => Arr::get($attributes, 'author_user_id', $actor?->id),
+                'blocked_comment' => $isBlocked ? Arr::get($attributes, 'blocked_comment') : null,
                 'description' => Arr::get($attributes, 'description'),
+                'is_blocked' => $isBlocked,
                 'parent_ticket_id' => Arr::get($attributes, 'parent_ticket_id'),
                 'project_id' => $project->id,
                 'sequence_number' => $nextSequenceNumber,
@@ -68,6 +80,17 @@ class CreateProjectTicket
 
             AcceptanceCriteriaChecklistMapper::syncTicket($ticket, $acceptanceCriteria);
 
+            $fieldValues = Arr::get($attributes, 'field_values', []);
+
+            if ($fieldValues !== []) {
+                $this->syncProjectTicketFieldValues->handle(
+                    $ticket,
+                    $project->ticketFieldDefinitions()->get()->keyBy('id'),
+                    collect(),
+                    $fieldValues,
+                );
+            }
+
             $occurredAt = CarbonImmutable::now();
 
             if ($actor !== null) {

app/Actions/Tickets/ListAssignedTicketsByVisibleProject.php

@@ -41,8 +41,8 @@ class ListAssignedTicketsByVisibleProject
             ->where('assignee_user_id', $assignee->id)
             ->whereIn('project_id', $visibleProjectIds)
             ->with([
+                'acceptanceCriteria',
                 'assignee',
-                'project',
                 'ticketPriority',
                 'ticketStatus.boardColumn',
                 'ticketType',

app/Actions/Tickets/StoreProjectTicketLink.php

@@ -17,18 +17,21 @@ class StoreProjectTicketLink
     ) {}
 
     /**
-     * @param  array{linked_ticket_id: int, ticket_link_type_id: int}  $validated
+     * @param  array{linked_ticket_id: int, ticket_link_type_id: int, link_direction?: 'source'|'counterpart'}  $validated
      */
     public function handle(Project $project, Ticket $ticket, User $user, array $validated): TicketLink
     {
         $linkedTicketId = Arr::get($validated, 'linked_ticket_id');
         $ticketLinkTypeId = Arr::get($validated, 'ticket_link_type_id');
+        $isSourceTicket = Arr::get($validated, 'link_direction', 'source') === 'source';
 
         $linkedTicket = Ticket::query()
             ->where('project_id', $project->id)
             ->findOrFail($linkedTicketId);
+        $sourceTicket = $isSourceTicket ? $ticket : $linkedTicket;
+        $targetTicket = $isSourceTicket ? $linkedTicket : $ticket;
 
-        return DB::transaction(function () use ($linkedTicket, $user, $ticketLinkTypeId, $ticket): TicketLink {
+        return DB::transaction(function () use ($linkedTicket, $user, $ticketLinkTypeId, $ticket, $sourceTicket, $targetTicket, $isSourceTicket): TicketLink {
             Ticket::query()
                 ->whereKey([$ticket->id, $linkedTicket->id])
                 ->orderBy('id')
@@ -50,31 +53,31 @@ class StoreProjectTicketLink
 
             if ($ticketLink === null) {
                 $ticketLink = TicketLink::query()->create([
-                    'source_ticket_id' => $ticket->id,
-                    'target_ticket_id' => $linkedTicket->id,
+                    'source_ticket_id' => $sourceTicket->id,
+                    'target_ticket_id' => $targetTicket->id,
                     'ticket_link_type_id' => $ticketLinkTypeId,
                 ]);
             } else {
                 $ticketLink->update([
-                    'source_ticket_id' => $ticket->id,
-                    'target_ticket_id' => $linkedTicket->id,
+                    'source_ticket_id' => $sourceTicket->id,
+                    'target_ticket_id' => $targetTicket->id,
                     'ticket_link_type_id' => $ticketLinkTypeId,
                 ]);
             }
 
             $ticketLink->load('ticketLinkType');
 
-            $sourceLabel = $ticketLink->ticketLinkType->labelForSource(true);
-            $targetLabel = $ticketLink->ticketLinkType->labelForSource(false);
+            $ticketLabel = $ticketLink->ticketLinkType->labelForSource($isSourceTicket);
+            $linkedTicketLabel = $ticketLink->ticketLinkType->labelForSource(! $isSourceTicket);
 
             $this->createTicketWorklogEntry->handle(
                 $ticket,
                 $user,
                 TicketWorklogEntryType::LinkUpdated,
-                "Linked {$linkedTicket->ticket_key} as {$sourceLabel}.",
+                "Linked {$linkedTicket->ticket_key} as {$ticketLabel}.",
                 [
                     'linked_ticket_key' => $linkedTicket->ticket_key,
-                    'ticket_link_type' => $sourceLabel,
+                    'ticket_link_type' => $ticketLabel,
                 ],
             );
 
@@ -82,10 +85,10 @@ class StoreProjectTicketLink
                 $linkedTicket,
                 $user,
                 TicketWorklogEntryType::LinkUpdated,
-                "Linked {$ticket->ticket_key} as {$targetLabel}.",
+                "Linked {$ticket->ticket_key} as {$linkedTicketLabel}.",
                 [
                     'linked_ticket_key' => $ticket->ticket_key,
-                    'ticket_link_type' => $targetLabel,
+                    'ticket_link_type' => $linkedTicketLabel,
                 ],
             );
 

app/Actions/Tickets/Support/AcceptanceCriteriaChecklistMapper.php

@@ -44,7 +44,7 @@ class AcceptanceCriteriaChecklistMapper
     /**
      * @param  array<int, array{id?: int, checked: bool, indent: int, text: string}>  $items
      */
-    public static function syncTicket(Ticket $ticket, array $items): void
+    public static function syncTicket(Ticket $ticket, array $items, bool $reuseUnidentifiedCriteria = true): void
     {
         $normalized = self::normalize($items);
         $existingCriteria = $ticket->acceptanceCriteria()->get()->keyBy('id');
@@ -73,7 +73,8 @@ class AcceptanceCriteriaChecklistMapper
                 : $existingCriteria->get($criterionId);
 
             while (
-                $criterion === null
+                $reuseUnidentifiedCriteria
+                && $criterion === null
                 && $fallbackIndex < $fallbackCriteria->count()
             ) {
                 /** @var AcceptanceCriterion $candidate */

app/Actions/Tickets/UpdateProjectTicket.php

@@ -51,6 +51,7 @@ class UpdateProjectTicket
         Ticket $ticket,
         User $actor,
         array $validated,
+        bool $replaceCriteriaWithIds = false,
     ): bool {
         $fieldValueAttributes = Arr::get($validated, 'field_values', []);
         $nextAcceptanceCriteria = AcceptanceCriteriaChecklistMapper::normalize(
@@ -58,7 +59,7 @@ class UpdateProjectTicket
         );
         $ticketAttributes = $this->buildTicketAttributes($ticket, $validated);
 
-        return DB::transaction(function () use ($actor, $fieldValueAttributes, $nextAcceptanceCriteria, $ticket, $ticketAttributes): bool {
+        return DB::transaction(function () use ($actor, $fieldValueAttributes, $nextAcceptanceCriteria, $replaceCriteriaWithIds, $ticket, $ticketAttributes): bool {
             if (! $ticketAttributes['is_blocked']) {
                 $ticketAttributes['blocked_comment'] = null;
             }
@@ -91,7 +92,9 @@ class UpdateProjectTicket
             /** @var Collection<int, TicketFieldValue> $existingFieldValues */
             $existingFieldValues = $ticket->fieldValues
                 ->keyBy('ticket_field_definition_id');
-            $currentAcceptanceCriteria = AcceptanceCriteriaChecklistMapper::fromModels($ticket->acceptanceCriteria);
+            $currentAcceptanceCriteria = $replaceCriteriaWithIds
+                ? AcceptanceCriteriaChecklistMapper::fromModelsWithIds($ticket->acceptanceCriteria)
+                : AcceptanceCriteriaChecklistMapper::fromModels($ticket->acceptanceCriteria);
 
             $changes = [];
             $summaryLabels = [];
@@ -209,7 +212,7 @@ class UpdateProjectTicket
             }
 
             if ($currentAcceptanceCriteria !== $nextAcceptanceCriteria) {
-                AcceptanceCriteriaChecklistMapper::syncTicket($ticket, $nextAcceptanceCriteria);
+                AcceptanceCriteriaChecklistMapper::syncTicket($ticket, $nextAcceptanceCriteria, ! $replaceCriteriaWithIds);
             }
 
             $fieldValueChangeSet = $this->syncProjectTicketFieldValues->handle(

app/Http/Controllers/Api/ProjectTicketLinkController.php

@@ -36,11 +36,12 @@ class ProjectTicketLinkController extends ApiController
 
         $ticketLink = $this->storeProjectTicketLink->handle($project, $ticket, $user, $request->validated());
         $ticketLink->setAttribute('current_ticket_id', $ticket->id);
+        $label = $ticketLink->ticketLinkType->labelForSource($ticketLink->source_ticket_id === $ticket->id);
 
         return TicketLinkResource::make($ticketLink->load(['sourceTicket', 'targetTicket', 'ticketLinkType']))
             ->additional([
                 'meta' => [
-                    'message' => "{$ticketLink->ticketLinkType->label} link was saved.",
+                    'message' => "{$label} link was saved.",
                 ],
             ])
             ->response()

app/Http/Controllers/DashboardController.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Tickets\ListAssignedTicketsByVisibleProject;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class DashboardController extends Controller
+{
+    public function __construct(
+        private readonly ListAssignedTicketsByVisibleProject $listAssignedTicketsByVisibleProject,
+    ) {}
+
+    public function __invoke(Request $request): Response
+    {
+        $user = $request->user();
+
+        return Inertia::render('Dashboard', [
+            'assignedTicketsByProject' => $this->listAssignedTicketsByVisibleProject->handle($user, $user),
+        ]);
+    }
+}

app/Http/Controllers/ProjectController.php

@@ -6,16 +6,23 @@ use App\Actions\Permissions\PermissionService;
 use App\Actions\Projects\BuildProjectBacklogPayload;
 use App\Actions\Projects\CreateProject;
 use App\Actions\Projects\DeleteProject;
+use App\Actions\Projects\DuplicateProjectConfiguration;
 use App\Actions\Projects\ListVisibleProjects;
+use App\Actions\Projects\ResolveProjectTemplateState;
+use App\Actions\Projects\UpdateProjectTemplateLink;
 use App\Enums\Permission;
 use App\Http\Requests\DeleteProjectRequest;
+use App\Http\Requests\ResetProjectTemplateRequest;
 use App\Http\Requests\StoreProjectRequest;
+use App\Http\Requests\SwitchProjectTemplateRequest;
 use App\Http\Requests\SyncProjectPermissionsRequest;
 use App\Http\Resources\PermissionOptionResource;
 use App\Http\Resources\ProjectResource;
+use App\Http\Resources\ProjectTemplateResource;
 use App\Http\Resources\TeamResource;
 use App\Http\Resources\UserResource;
 use App\Models\Project;
+use App\Models\ProjectTemplate;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Http\RedirectResponse;
@@ -30,8 +37,11 @@ class ProjectController extends Controller
         private readonly BuildProjectBacklogPayload $buildProjectBacklogPayload,
         private readonly CreateProject $createProject,
         private readonly DeleteProject $deleteProject,
+        private readonly DuplicateProjectConfiguration $duplicateProjectConfiguration,
         private readonly ListVisibleProjects $listVisibleProjects,
         private readonly PermissionService $permissionService,
+        private readonly ResolveProjectTemplateState $resolveProjectTemplateState,
+        private readonly UpdateProjectTemplateLink $updateProjectTemplateLink,
     ) {}
 
     public function index(Request $request): Response
@@ -51,7 +61,23 @@ class ProjectController extends Controller
             403,
         );
 
-        return Inertia::render('projects/Create');
+        $sourceTemplates = ProjectTemplate::query()
+            ->published()
+            ->with('sourceProject')
+            ->orderBy('name')
+            ->get();
+        $selectedTemplateId = $request->integer('template');
+
+        return Inertia::render('projects/Create', [
+            'copyAreaOptions' => DuplicateProjectConfiguration::copyAreaOptions(),
+            'sourceProjects' => ProjectResource::collection(
+                $this->listVisibleProjects->handle($request->user()),
+            )->resolve(),
+            'sourceTemplates' => ProjectTemplateResource::collection($sourceTemplates)->resolve(),
+            'selectedSourceTemplateId' => $sourceTemplates->contains('id', $selectedTemplateId)
+                ? $selectedTemplateId
+                : null,
+        ]);
     }
 
     public function store(StoreProjectRequest $request): RedirectResponse
@@ -73,6 +99,7 @@ class ProjectController extends Controller
         return Inertia::render('projects/Show', [
             'canManageAccess' => $this->permissionService->allows($user, Permission::ProjectAdmin, $project),
             'project' => ProjectResource::make($project)->resolve(),
+            'templateState' => $this->resolveProjectTemplateState->handle($project),
         ]);
     }
 
@@ -95,10 +122,58 @@ class ProjectController extends Controller
     {
         return Inertia::render('projects/settings/General', [
             'project' => ProjectResource::make($project)->resolve(),
+            'sourceTemplates' => ProjectTemplateResource::collection(
+                ProjectTemplate::query()
+                    ->published()
+                    ->with('sourceProject')
+                    ->orderBy('name')
+                    ->get(),
+            )->resolve(),
             'status' => session('status'),
+            'templateState' => $this->resolveProjectTemplateState->handle($project),
         ]);
     }
 
+    public function switchTemplate(SwitchProjectTemplateRequest $request, Project $project): RedirectResponse
+    {
+        $validated = $request->validated();
+        $template = ProjectTemplate::query()
+            ->published()
+            ->findOrFail((int) Arr::get($validated, 'source_template_id'));
+
+        $this->updateProjectTemplateLink->switch($project, $template);
+
+        return to_route('projects.settings.general', $project)
+            ->with('status', "{$project->name} now uses the {$template->name} template.");
+    }
+
+    public function resetTemplate(ResetProjectTemplateRequest $request, Project $project): RedirectResponse
+    {
+        $validated = $request->validated();
+
+        $template = $project->projectTemplate;
+
+        abort_if($template === null, 422, 'This project has no linked template to reset.');
+
+        $configuration = $this->duplicateProjectConfiguration->normalizeConfiguration(
+            $template->configuration_snapshot ?? [],
+        );
+        $areas = array_values(Arr::get($validated, 'areas', array_keys($configuration)));
+        $statusReplacements = Arr::get($validated, 'status_replacements', []);
+
+        $this->updateProjectTemplateLink->reset(
+            $project->load('projectTemplate'),
+            $areas,
+            $statusReplacements,
+        );
+
+        $status = Arr::has($validated, 'areas')
+            ? "Selected settings were reset to the {$template->name} template."
+            : "{$project->name} was reset to the {$template->name} template baseline.";
+
+        return back()->with('status', $status);
+    }
+
     public function access(Request $request, Project $project): Response
     {
         $user = $request->user();
@@ -107,25 +182,22 @@ class ProjectController extends Controller
             403,
         );
 
+        $users = User::query()->orderBy('name')->get();
+
         return Inertia::render('projects/Access', [
-            'directPermissions' => $this->permissionService->assignmentMap(User::class, $project),
+            ...$this->permissionService->projectAccessMap($users, $project),
             'permissionOptions' => PermissionOptionResource::collection(
                 $this->permissionService->permissionOptions(User::class, Project::class),
             )->resolve(),
             'project' => ProjectResource::make($project)->resolve(),
             'status' => session('status'),
-            'teamPermissions' => $this->permissionService->assignmentMap(Team::class, $project),
             'teams' => TeamResource::collection(
                 Team::query()
                     ->with('users')
                     ->orderBy('name')
                     ->get(),
             )->resolve(),
-            'users' => UserResource::collection(
-                User::query()
-                    ->orderBy('name')
-                    ->get(),
-            )->resolve(),
+            'users' => UserResource::collection($users)->resolve(),
         ]);
     }
 
@@ -145,7 +217,9 @@ class ProjectController extends Controller
 
         $this->permissionService->sync($user, $project, $permissions);
 
-        return to_route('projects.access', $project)
+        return ($this->permissionService->allows($request->user(), Permission::ProjectAdmin, $project)
+            ? to_route('projects.access', $project)
+            : to_route('projects.index'))
             ->with('status', "{$user->name} permissions were updated.");
     }
 
@@ -164,7 +238,9 @@ class ProjectController extends Controller
 
         $this->permissionService->sync($team, $project, $permissions);
 
-        return to_route('projects.access', $project)
+        return ($this->permissionService->allows($request->user(), Permission::ProjectAdmin, $project)
+            ? to_route('projects.access', $project)
+            : to_route('projects.index'))
             ->with('status', "{$team->name} permissions were updated.");
     }
 

app/Http/Controllers/ProjectTemplateController.php

@@ -0,0 +1,89 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\Projects\CreateProjectTemplate;
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Actions\Projects\UpdateProjectTemplate;
+use App\Http\Requests\StoreProjectTemplateRequest;
+use App\Http\Requests\UpdateProjectTemplateRequest;
+use App\Http\Resources\ProjectResource;
+use App\Http\Resources\ProjectTemplateResource;
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class ProjectTemplateController extends Controller
+{
+    public function __construct(
+        private readonly CreateProjectTemplate $createProjectTemplate,
+        private readonly UpdateProjectTemplate $updateProjectTemplate,
+    ) {}
+
+    public function index(Request $request): Response
+    {
+        return Inertia::render('project-templates/Index', [
+            'status' => session('status'),
+            'templates' => ProjectTemplateResource::collection(
+                ProjectTemplate::query()
+                    ->published()
+                    ->with('sourceProject')
+                    ->withCount('linkedProjects')
+                    ->orderBy('name')
+                    ->get(),
+            )->resolve(),
+        ]);
+    }
+
+    public function edit(ProjectTemplate $projectTemplate): Response
+    {
+        abort_if(! $projectTemplate->is_published, 404);
+
+        $projectTemplate->load('sourceProject')->loadCount('linkedProjects');
+
+        return Inertia::render('project-templates/Edit', [
+            'copyAreaOptions' => DuplicateProjectConfiguration::copyAreaOptions(),
+            'template' => ProjectTemplateResource::make($projectTemplate)->resolve(),
+        ]);
+    }
+
+    public function create(Project $project): Response
+    {
+        return Inertia::render('project-templates/Create', [
+            'copyAreaOptions' => DuplicateProjectConfiguration::copyAreaOptions(),
+            'project' => ProjectResource::make($project)->resolve(),
+        ]);
+    }
+
+    public function store(StoreProjectTemplateRequest $request, Project $project): RedirectResponse
+    {
+        $template = $this->createProjectTemplate->handle($project, $request->validated());
+
+        return to_route('project-templates.index')
+            ->with('status', "Template {$template->name} was created.");
+    }
+
+    public function update(UpdateProjectTemplateRequest $request, ProjectTemplate $projectTemplate): RedirectResponse
+    {
+        abort_if(! $projectTemplate->is_published, 404);
+
+        $template = $this->updateProjectTemplate->handle($projectTemplate, $request->validated());
+
+        return to_route('project-templates.index')
+            ->with('status', "Template {$template->name} was updated.");
+    }
+
+    public function destroy(ProjectTemplate $projectTemplate): RedirectResponse
+    {
+        abort_if(! $projectTemplate->is_published, 404);
+
+        $templateName = $projectTemplate->name;
+        $projectTemplate->delete();
+
+        return to_route('project-templates.index')
+            ->with('status', "Template {$templateName} was deleted.");
+    }
+}

app/Http/Controllers/ProjectTicketLinkController.php

@@ -34,9 +34,10 @@ class ProjectTicketLinkController extends Controller
         );
 
         $ticketLink = $this->storeProjectTicketLink->handle($project, $ticket, $user, $request->validated());
+        $label = $ticketLink->ticketLinkType->labelForSource($ticketLink->source_ticket_id === $ticket->id);
 
         return to_route('projects.tickets.show', [$project, $ticket])
-            ->with('status', "{$ticketLink->ticketLinkType->label} link was saved.");
+            ->with('status', "{$label} link was saved.");
     }
 
     public function destroy(

app/Http/Middleware/HandleAppearance.php

@@ -16,7 +16,11 @@ class HandleAppearance
      */
     public function handle(Request $request, Closure $next): Response
     {
-        View::share('appearance', $request->cookie('appearance') ?? 'system');
+        $appearance = $request->cookie('appearance');
+        $appearance = in_array($appearance, ['light', 'dark', 'system'], true) ? $appearance : 'system';
+
+        $request->attributes->set('appearance', $appearance);
+        View::share('appearance', $appearance);
 
         return $next($request);
     }

app/Http/Middleware/HandleInertiaRequests.php

@@ -4,6 +4,7 @@ namespace App\Http\Middleware;
 
 use App\Actions\Permissions\PermissionService;
 use App\Enums\Permission;
+use App\Models\Project;
 use Illuminate\Http\Request;
 use Inertia\Middleware;
 
@@ -46,6 +47,11 @@ class HandleInertiaRequests extends Middleware
         return [
             ...parent::share($request),
             'name' => config('app.name'),
+            'appearance' => $request->attributes->get('appearance', 'system'),
+            'localization' => [
+                'locale' => app()->getLocale(),
+                'timeZone' => config('app.timezone'),
+            ],
             'auth' => [
                 'permissions' => [
                     'canManageTeams' => $user !== null && ($this->permissionService->canManageAnyTeam($user) || $this->permissionService->allows($user, Permission::TeamCreate)),
@@ -55,6 +61,36 @@ class HandleInertiaRequests extends Middleware
                 'user' => $user,
             ],
             'sidebarOpen' => ! $request->hasCookie('sidebar_state') || $request->cookie('sidebar_state') === 'true',
+            'navigation' => fn (): array => [
+                'project' => $this->projectNavigation($request),
+            ],
+        ];
+    }
+
+    /**
+     * @return array{id: int, name: string, key: string, canManage: bool, canCreateTickets: bool}|null
+     */
+    private function projectNavigation(Request $request): ?array
+    {
+        $project = $request->route('project');
+        $user = $request->user();
+
+        if (! $project instanceof Project || $user === null) {
+            return null;
+        }
+
+        $permissions = $this->permissionService->effectivePermissions($user, $project);
+
+        if (! in_array(Permission::ProjectRead, $permissions, true)) {
+            return null;
+        }
+
+        return [
+            'id' => $project->id,
+            'name' => $project->name,
+            'key' => $project->key,
+            'canManage' => in_array(Permission::ProjectAdmin, $permissions, true),
+            'canCreateTickets' => in_array(Permission::ProjectWrite, $permissions, true),
         ];
     }
 }

app/Http/Middleware/RequirePasswordChange.php

@@ -23,6 +23,7 @@ class RequirePasswordChange
 
         if ($request->routeIs([
             'logout',
+            'native-app.edit',
             'password.force-change.edit',
             'user-password.update',
         ])) {

app/Http/Requests/Api/MoveProjectTicketRequest.php

@@ -29,7 +29,9 @@ class MoveProjectTicketRequest extends FormRequest
             'ticket_status_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_statuses', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_statuses', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
         ];
     }

app/Http/Requests/DeleteProjectRequest.php

@@ -11,7 +11,7 @@ class DeleteProjectRequest extends FormRequest
 {
     public function authorize(): bool
     {
-        return $this->user()?->can('access-admin') ?? false;
+        return $this->user()?->can('admin-project', $this->route('project')) ?? false;
     }
 
     /**

app/Http/Requests/DestroyProjectTicketTypeRequest.php

@@ -34,7 +34,9 @@ class DestroyProjectTicketTypeRequest extends FormRequest
             'replacement_ticket_type_id' => [
                 'nullable',
                 'integer',
-                Rule::exists('ticket_types', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_types', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
         ];
     }

app/Http/Requests/MoveProjectTicketRequest.php

@@ -34,7 +34,9 @@ class MoveProjectTicketRequest extends FormRequest
             'ticket_status_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_statuses', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_statuses', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
             'redirect_to' => ['required', 'string', Rule::in(['backlog', 'board'])],
         ];

app/Http/Requests/ResetProjectTemplateRequest.php

@@ -0,0 +1,107 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Models\Project;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Arr;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\Validator;
+
+class ResetProjectTemplateRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        /** @var Project $project */
+        $project = $this->route('project');
+
+        return [
+            'areas' => ['sometimes', 'array', 'min:1'],
+            'areas.*' => ['required', 'string', Rule::in(DuplicateProjectConfiguration::copyableAreas())],
+            'confirmation_key' => [
+                'required_without:areas',
+                'string',
+                Rule::in([$project->key]),
+            ],
+            'status_replacements' => ['sometimes', 'array'],
+            'status_replacements.*' => [
+                'required',
+                'integer',
+                Rule::exists('ticket_statuses', 'id')->where('project_id', $project->id),
+            ],
+        ];
+    }
+
+    /** @return array<int, callable(Validator): void> */
+    public function after(): array
+    {
+        return [
+            function (Validator $validator): void {
+                if ($validator->errors()->isNotEmpty()) {
+                    return;
+                }
+
+                /** @var Project $project */
+                $project = $this->route('project');
+                $validated = $validator->validated();
+                $areas = array_values(Arr::get(
+                    $validated,
+                    'areas',
+                    DuplicateProjectConfiguration::copyableAreas(),
+                ));
+
+                if (! in_array(DuplicateProjectConfiguration::COPY_TICKET_STATUSES, $areas, true)) {
+                    return;
+                }
+
+                $project->loadMissing('projectTemplate');
+                $configuration = app(DuplicateProjectConfiguration::class)->normalizeConfiguration(
+                    $project->projectTemplate?->configuration_snapshot ?? [],
+                );
+                $templateStatuses = Arr::get(
+                    $configuration,
+                    DuplicateProjectConfiguration::COPY_TICKET_STATUSES,
+                    [],
+                );
+                $statuses = $project->ticketStatuses()->withCount('tickets')->get()->values();
+                $allowedReplacementIds = $statuses->take(count($templateStatuses))->pluck('id');
+                $replacements = Arr::get($validated, 'status_replacements', []);
+
+                foreach ($statuses->slice(count($templateStatuses)) as $status) {
+                    if ($status->tickets_count === 0) {
+                        continue;
+                    }
+
+                    $replacementId = (int) Arr::get($replacements, (string) $status->id, 0);
+                    if (! $allowedReplacementIds->contains($replacementId)) {
+                        $validator->errors()->add(
+                            "status_replacements.{$status->id}",
+                            "Choose a replacement status for {$status->name}.",
+                        );
+                    }
+                }
+            },
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'confirmation_key.in' => 'Enter the exact project key to reset this project to its template baseline.',
+            'areas.*.in' => 'Choose a valid template area to reset.',
+        ];
+    }
+}

app/Http/Requests/StoreProjectRequest.php

@@ -2,6 +2,10 @@
 
 namespace App\Http\Requests;
 
+use App\Actions\Permissions\PermissionService;
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Enums\Permission;
+use App\Models\Project;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Support\Arr;
@@ -20,12 +24,21 @@ class StoreProjectRequest extends FormRequest
     protected function prepareForValidation(): void
     {
         $key = Arr::get($this->all(), 'key');
+        $creationMode = Arr::get($this->all(), 'creation_mode', 'scratch');
+        $copyAreas = Arr::get($this->all(), 'copy_areas', []);
 
         if ($key !== null) {
             $this->merge([
                 'key' => strtoupper(trim((string) $key)),
             ]);
         }
+
+        $this->merge([
+            'creation_mode' => is_string($creationMode) ? trim($creationMode) : 'scratch',
+            'copy_areas' => is_array($copyAreas)
+                ? array_values($copyAreas)
+                : ($copyAreas === null || $copyAreas === '' ? [] : [(string) $copyAreas]),
+        ]);
     }
 
     /**
@@ -36,6 +49,7 @@ class StoreProjectRequest extends FormRequest
     public function rules(): array
     {
         return [
+            'creation_mode' => ['required', 'string', Rule::in(['scratch', 'duplicate', 'template'])],
             'key' => [
                 'required',
                 'string',
@@ -44,6 +58,51 @@ class StoreProjectRequest extends FormRequest
                 Rule::unique('projects', 'key'),
             ],
             'name' => ['required', 'string', 'max:255'],
+            'source_project_id' => [
+                Rule::requiredIf(fn (): bool => $this->input('creation_mode') === 'duplicate'),
+                'nullable',
+                'integer',
+                Rule::exists('projects', 'id'),
+                function (string $attribute, mixed $value, \Closure $fail): void {
+                    if ($value === null || $value === '') {
+                        return;
+                    }
+
+                    $project = Project::query()->find($value);
+
+                    if ($project === null) {
+                        return;
+                    }
+
+                    $permissionService = app(PermissionService::class);
+
+                    if (! $permissionService->allows($this->user(), Permission::ProjectRead, $project)) {
+                        $fail('Select a project you can access as the duplication source.');
+                    }
+                },
+            ],
+            'source_template_id' => [
+                Rule::requiredIf(fn (): bool => $this->input('creation_mode') === 'template'),
+                'nullable',
+                'integer',
+                Rule::exists('project_templates', 'id')->where(fn ($query) => $query->where('is_published', true)),
+            ],
+            'copy_areas' => ['nullable', 'array'],
+            'copy_areas.*' => [
+                'string',
+                Rule::in(DuplicateProjectConfiguration::acceptedCopyAreas()),
+            ],
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'source_project_id.required' => 'Select a source project to duplicate from.',
+            'source_template_id.required' => 'Select a template to create the project from.',
         ];
     }
 }

app/Http/Requests/StoreProjectTemplateRequest.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+
+class StoreProjectTemplateRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->can('create-project') ?? false;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        if ($this->filled('slug')) {
+            $this->merge([
+                'slug' => Str::slug((string) $this->input('slug')),
+            ]);
+        }
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'slug' => ['required', 'string', 'max:255', 'alpha_dash', Rule::unique('project_templates', 'slug')],
+            'copy_areas' => ['required', 'array', 'min:1'],
+            'copy_areas.*' => ['string', Rule::in(DuplicateProjectConfiguration::acceptedCopyAreas())],
+        ];
+    }
+}

app/Http/Requests/StoreProjectTicketBranchRequest.php

@@ -2,8 +2,10 @@
 
 namespace App\Http\Requests;
 
+use App\Models\Project;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
 
 class StoreProjectTicketBranchRequest extends FormRequest
 {
@@ -22,9 +24,18 @@ class StoreProjectTicketBranchRequest extends FormRequest
      */
     public function rules(): array
     {
+        /** @var Project $project */
+        $project = $this->route('project');
+
         return [
             'branch_name' => ['required', 'string', 'max:255'],
-            'repository_connection_id' => ['required', 'integer', 'exists:repository_connections,id'],
+            'repository_connection_id' => [
+                'required',
+                'integer',
+                Rule::exists('repository_connections', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
+            ],
         ];
     }
 }

app/Http/Requests/StoreProjectTicketRequest.php

@@ -66,17 +66,23 @@ class StoreProjectTicketRequest extends FormRequest
             'ticket_priority_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_priorities', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_priorities', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
             'ticket_status_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_statuses', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_statuses', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
             'ticket_type_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_types', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_types', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
             'story_points' => ['nullable', 'integer', 'min:0'],
             'title' => ['required', 'string', 'max:255'],

app/Http/Requests/StoreTicketLinkRequest.php

@@ -38,8 +38,11 @@ class StoreTicketLinkRequest extends FormRequest
             'ticket_link_type_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_link_types', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_link_types', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
+            'link_direction' => ['sometimes', 'required', Rule::in(['source', 'counterpart'])],
         ];
     }
 

app/Http/Requests/StoreTicketStatusRequest.php

@@ -31,7 +31,9 @@ class StoreTicketStatusRequest extends FormRequest
             'board_column_id' => [
                 'nullable',
                 'integer',
-                Rule::exists('board_columns', 'id')->where('project_id', $project->id),
+                Rule::exists('board_columns', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
             'name' => ['required', 'string', 'max:255'],
         ];

app/Http/Requests/SwitchProjectTemplateRequest.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class SwitchProjectTemplateRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        /** @var Project $project */
+        $project = $this->route('project');
+
+        return [
+            'confirmation_key' => [
+                'required',
+                'string',
+                Rule::in([$project->key]),
+            ],
+            'source_template_id' => [
+                'required',
+                'integer',
+                Rule::exists(ProjectTemplate::class, 'id')->where('is_published', true),
+                Rule::notIn(array_filter([$project->project_template_id])),
+            ],
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'confirmation_key.in' => 'Enter the exact project key to confirm the template switch.',
+            'source_template_id.not_in' => 'Choose a different published template to switch this project.',
+        ];
+    }
+}

app/Http/Requests/UpdateProjectTemplateRequest.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Models\ProjectTemplate;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateProjectTemplateRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->can('create-project') ?? false;
+    }
+
+    /**
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        /** @var ProjectTemplate|null $projectTemplate */
+        $projectTemplate = $this->route('projectTemplate');
+        $requiresImpactConfirmation = $projectTemplate?->linkedProjects()->exists() ?? false;
+
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'copy_areas' => ['required', 'array', 'min:1'],
+            'copy_areas.*' => ['string', Rule::in(DuplicateProjectConfiguration::acceptedCopyAreas())],
+            'confirm_linked_projects_update' => [
+                Rule::excludeIf(! $requiresImpactConfirmation),
+                Rule::requiredIf($requiresImpactConfirmation),
+                'accepted',
+            ],
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'confirm_linked_projects_update.accepted' => 'Acknowledge the linked project warning before saving template changes.',
+        ];
+    }
+}

app/Http/Requests/UpdateProjectTicketRequest.php

@@ -68,7 +68,9 @@ class UpdateProjectTicketRequest extends FormRequest
             'field_values.*.ticket_field_definition_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_field_definitions', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_field_definitions', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
             'field_values.*.value_number' => ['nullable', 'numeric'],
             'field_values.*.value_user_id' => ['nullable', 'integer', Rule::exists('users', 'id')],
@@ -81,12 +83,16 @@ class UpdateProjectTicketRequest extends FormRequest
             'ticket_priority_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_priorities', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_priorities', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
             'ticket_type_id' => [
                 'required',
                 'integer',
-                Rule::exists('ticket_types', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_types', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
             'title' => ['required', 'string', 'max:255'],
             'story_points' => ['nullable', 'integer', 'min:0'],

app/Http/Requests/UpdateTicketStatusTransitionsRequest.php

@@ -34,7 +34,9 @@ class UpdateTicketStatusTransitionsRequest extends FormRequest
             'allowed_ticket_status_ids' => ['nullable', 'array'],
             'allowed_ticket_status_ids.*' => [
                 'integer',
-                Rule::exists('ticket_statuses', 'id')->where('project_id', $project->id),
+                Rule::exists('ticket_statuses', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
             ],
         ];
     }

app/Http/Requests/ValidateProjectTicketBranchRequest.php

@@ -2,8 +2,10 @@
 
 namespace App\Http\Requests;
 
+use App\Models\Project;
 use Illuminate\Contracts\Validation\ValidationRule;
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
 
 class ValidateProjectTicketBranchRequest extends FormRequest
 {
@@ -22,9 +24,18 @@ class ValidateProjectTicketBranchRequest extends FormRequest
      */
     public function rules(): array
     {
+        /** @var Project $project */
+        $project = $this->route('project');
+
         return [
             'branch_name' => ['required', 'string', 'max:255'],
-            'repository_connection_id' => ['required', 'integer', 'exists:repository_connections,id'],
+            'repository_connection_id' => [
+                'required',
+                'integer',
+                Rule::exists('repository_connections', 'id')->where(
+                    fn ($query) => $query->where('project_id', $project->id),
+                ),
+            ],
         ];
     }
 }

app/Http/Resources/ProjectResource.php

@@ -2,8 +2,10 @@
 
 namespace App\Http\Resources;
 
+use App\Actions\Projects\ResolveProjectTemplateState;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Support\Arr;
 
 class ProjectResource extends JsonResource
 {
@@ -14,10 +16,33 @@ class ProjectResource extends JsonResource
      */
     public function toArray(Request $request): array
     {
+        $this->resource->loadMissing('projectTemplate');
+
+        $templateState = app(ResolveProjectTemplateState::class)->handle($this->resource);
+
         return [
             'id' => $this->id,
             'name' => $this->name,
             'key' => $this->key,
+            'project_template_id' => $this->project_template_id,
+            'project_template' => $this->projectTemplate === null
+                ? null
+                : ProjectTemplateResource::make($this->projectTemplate)->resolve(),
+            'template_state' => $templateState === null
+                ? null
+                : [
+                    'effective_configuration' => Arr::get($templateState, 'effectiveConfiguration', []),
+                    'inherited_areas' => Arr::get($templateState, 'inheritedAreas', []),
+                    'inherited_configuration' => Arr::get($templateState, 'inheritedConfiguration', []),
+                    'inherits_from_template' => Arr::get($templateState, 'inheritsFromTemplate', false),
+                    'overridden_areas' => Arr::get($templateState, 'overriddenAreas', []),
+                    'overridden_configuration' => Arr::get($templateState, 'overriddenConfiguration', []),
+                    'reset_requirements' => Arr::get($templateState, 'resetRequirements', []),
+                    'template_configuration' => Arr::get($templateState, 'templateConfiguration', []),
+                    'template_id' => Arr::get($templateState, 'templateId'),
+                    'template_name' => Arr::get($templateState, 'templateName'),
+                    'template_slug' => Arr::get($templateState, 'templateSlug'),
+                ],
             'show_author' => $this->show_author,
             'show_story_points' => $this->show_story_points,
             'created_at' => $this->created_at?->toISOString(),

app/Http/Resources/ProjectTemplateResource.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Models\ProjectTemplate;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Support\Arr;
+
+class ProjectTemplateResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        if ($this->resource instanceof ProjectTemplate) {
+            $configuration = app(DuplicateProjectConfiguration::class);
+
+            return [
+                'id' => $this->id,
+                'project_id' => $this->project_id,
+                'source_project_id' => $this->source_project_id,
+                'source_project' => $this->relationLoaded('sourceProject') && $this->sourceProject !== null
+                    ? ProjectResource::make($this->sourceProject)->resolve()
+                    : null,
+                'name' => $this->name,
+                'slug' => $this->slug,
+                'is_published' => $this->is_published,
+                'copy_areas' => $configuration->normalizeCopyAreas($this->copy_areas ?? []),
+                'configuration_snapshot' => $configuration->normalizeConfiguration(
+                    $this->configuration_snapshot ?? [],
+                ),
+                'linked_project_count' => $this->whenCounted('linkedProjects'),
+                'created_at' => $this->created_at?->toISOString(),
+                'updated_at' => $this->updated_at?->toISOString(),
+            ];
+        }
+
+        return [
+            'id' => Arr::get($this->resource, 'id'),
+            'project_id' => Arr::get($this->resource, 'project_id'),
+            'source_project_id' => Arr::get($this->resource, 'source_project_id'),
+            'source_project' => Arr::get($this->resource, 'source_project'),
+            'name' => Arr::get($this->resource, 'name'),
+            'slug' => Arr::get($this->resource, 'slug'),
+            'is_published' => Arr::get($this->resource, 'is_published', true),
+            'copy_areas' => Arr::get($this->resource, 'copy_areas', []),
+            'configuration_snapshot' => Arr::get($this->resource, 'configuration_snapshot', []),
+            'linked_project_count' => Arr::get($this->resource, 'linked_project_count'),
+            'created_at' => Arr::get($this->resource, 'created_at'),
+            'updated_at' => Arr::get($this->resource, 'updated_at'),
+        ];
+    }
+}

app/Http/Resources/TicketFieldDefinitionResource.php

@@ -20,6 +20,7 @@ class TicketFieldDefinitionResource extends JsonResource
             'label' => $this->label,
             'position' => $this->position,
             'project_id' => $this->project_id,
+            'ticket_field_values_count' => $this->when(isset($this->ticket_field_values_count), (int) $this->ticket_field_values_count),
             'created_at' => $this->created_at?->toISOString(),
             'updated_at' => $this->updated_at?->toISOString(),
         ];

app/Http/Resources/TicketLinkTypeResource.php

@@ -20,6 +20,7 @@ class TicketLinkTypeResource extends JsonResource
             'counterpart_label' => $this->counterpart_label ?: $this->label,
             'position' => $this->position,
             'project_id' => $this->project_id,
+            'ticket_links_count' => $this->when(isset($this->ticket_links_count), (int) $this->ticket_links_count),
             'created_at' => $this->created_at?->toISOString(),
             'updated_at' => $this->updated_at?->toISOString(),
         ];

app/Mcp/Servers/KanbanGitServer.php

@@ -2,10 +2,16 @@
 
 namespace App\Mcp\Servers;
 
+use App\Mcp\Tools\CreateTicket;
+use App\Mcp\Tools\GetProjectConfiguration;
 use App\Mcp\Tools\GetTicket;
 use App\Mcp\Tools\ListMyAssignedTickets;
+use App\Mcp\Tools\ListProjects;
 use App\Mcp\Tools\ListTicketsByStatus;
+use App\Mcp\Tools\ListTicketTypes;
 use App\Mcp\Tools\MoveTicketStatus;
+use App\Mcp\Tools\SearchTickets;
+use App\Mcp\Tools\UpdateTicket;
 use App\Mcp\Tools\UpdateTicketAssignee;
 use App\Mcp\Tools\UpdateTicketDescription;
 use Laravel\Mcp\Server;
@@ -14,8 +20,8 @@ use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Attributes\Version;
 
 #[Name('KanbanGit MCP')]
-#[Version('0.1.0')]
-#[Instructions('Use these tools to read and update KanbanGit tickets with the authenticated application key owner permissions. Prefer stable IDs when available, especially ticket_id and ticket_status_id.')]
+#[Version('0.2.0')]
+#[Instructions('Use these tools to read, create, and update KanbanGit tickets with the authenticated application key owner permissions. Prefer stable IDs when available, especially project_id, ticket_id, ticket_type_id, and ticket_status_id. Use list_projects and get_project_configuration for compact current project metadata. Get tickets by exact ticket_key or ticket_id, or search_tickets with pagination. Use update_ticket for partial edits; omitted fields are preserved, nullable scalar null clears, and supplied lists replace the entire list. Use move_ticket_status for allowed workflow transitions. Use list_ticket_types to discover the available ticket types in a project. Use create_ticket with parent_ticket_id to create a child ticket.')]
 class KanbanGitServer extends Server
 {
     protected array $tools = [
@@ -25,6 +31,12 @@ class KanbanGitServer extends Server
         UpdateTicketDescription::class,
         UpdateTicketAssignee::class,
         MoveTicketStatus::class,
+        CreateTicket::class,
+        ListTicketTypes::class,
+        ListProjects::class,
+        GetProjectConfiguration::class,
+        SearchTickets::class,
+        UpdateTicket::class,
     ];
 
     protected array $resources = [

app/Mcp/Support/KanbanGitMcp.php

@@ -13,6 +13,7 @@ use App\Models\TicketStatus;
 use App\Models\User;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Auth\AuthenticationException;
+use Illuminate\Contracts\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Collection;
 use Illuminate\Validation\ValidationException;
 use Laravel\Mcp\Request;
@@ -78,6 +79,17 @@ class KanbanGitMcp
         return $ticket;
     }
 
+    public function ticketForKey(User $user, string $ticketKey): Ticket
+    {
+        $ticket = Ticket::query()->with('project')->where('ticket_key', $ticketKey)->first();
+        if ($ticket === null || $ticket->ticket_key !== $ticketKey) {
+            throw ValidationException::withMessages(['ticket_key' => 'Ticket was not found.']);
+        }
+        $this->ensureCanRead($user, $ticket->project);
+
+        return $ticket;
+    }
+
     /**
      * @throws AuthorizationException
      */
@@ -120,6 +132,24 @@ class KanbanGitMcp
         return $project;
     }
 
+    /**
+     * @throws AuthorizationException
+     */
+    public function projectForWrite(User $user, int $projectId): Project
+    {
+        $project = Project::query()->find($projectId);
+
+        if ($project === null) {
+            throw ValidationException::withMessages([
+                'project_id' => 'Project was not found.',
+            ]);
+        }
+
+        $this->ensureCanWrite($user, $project);
+
+        return $project;
+    }
+
     /**
      * @param  array<string, mixed>  $validated
      * @return Collection<int, TicketStatus>|Response
@@ -183,16 +213,30 @@ class KanbanGitMcp
         ));
     }
 
+    /** @return array{current_page: int, per_page: int, total: int, last_page: int, has_more_pages: bool} */
+    public function paginationPayload(LengthAwarePaginator $paginator): array
+    {
+        return [
+            'current_page' => $paginator->currentPage(),
+            'per_page' => $paginator->perPage(),
+            'total' => $paginator->total(),
+            'last_page' => $paginator->lastPage(),
+            'has_more_pages' => $paginator->hasMorePages(),
+        ];
+    }
+
     /**
      * @return array<string, mixed>
      */
     public function ticketPayload(Ticket $ticket): array
     {
         $ticket->load([
+            'acceptanceCriteria',
             'assignee',
             'author',
             'fieldValues.ticketFieldDefinition',
             'fieldValues.userValue',
+            'parentTicket',
             'project',
             'ticketPriority',
             'ticketStatus.boardColumn',

app/Mcp/Support/TicketUpdateInput.php

@@ -0,0 +1,108 @@
+<?php
+
+namespace App\Mcp\Support;
+
+use App\Actions\Tickets\Support\AcceptanceCriteriaChecklistMapper;
+use App\Http\Requests\UpdateProjectTicketRequest;
+use App\Models\Ticket;
+use App\Models\TicketFieldDefinition;
+use App\Models\User;
+use Illuminate\Routing\Route;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Mcp\Request;
+
+class TicketUpdateInput
+{
+    public function __construct(private readonly KanbanGitMcp $kanbanGitMcp) {}
+
+    /** @return array<string, mixed> */
+    public function validate(Request $request, Ticket $ticket, User $user): array
+    {
+        $form = new UpdateProjectTicketRequest;
+        $route = new Route('PUT', '/', fn () => null);
+        $route->bind(\Illuminate\Http\Request::create('/', 'PUT'));
+        $route->setParameter('project', $ticket->project);
+        $route->setParameter('ticket', $ticket);
+        $form->setRouteResolver(fn () => $route);
+        $form->setUserResolver(fn () => $user);
+        $rules = $form->rules();
+        foreach ($rules as $key => &$rule) {
+            if (! str_contains($key, '.')) {
+                $rule = ['sometimes', ...$rule];
+            }
+        }
+        unset($rule);
+        $rules['acceptance_criteria'] = ['sometimes', 'array', 'list'];
+        $rules['acceptance_criteria.*'] = ['array:id,text,checked,indent'];
+        $rules['acceptance_criteria.*.id'] = ['sometimes', 'integer', 'min:1', 'distinct', Rule::exists('acceptance_criteria', 'id')->where('ticket_id', $ticket->id)];
+        $rules['acceptance_criteria.*.checked'] = ['sometimes', 'boolean'];
+        $rules['acceptance_criteria.*.indent'] = ['sometimes', 'integer', 'min:0', 'max:'.AcceptanceCriteriaChecklistMapper::MAX_INDENT_LEVEL];
+        $rules['field_values'] = ['sometimes', 'array', 'list'];
+        $rules['field_values.*'] = ['array:ticket_field_definition_id,value_number,value_user_id'];
+        $rules['field_values.*.ticket_field_definition_id'][] = 'distinct';
+        $rules['ticket_status_id'] = ['prohibited'];
+        $rules['acceptance_criteria.*.text'][] = function (string $attribute, mixed $value, \Closure $fail): void {
+            if (is_string($value) && trim($value) === '') {
+                $fail('Criterion text must not be blank.');
+            }
+        };
+        $input = $request->validate($rules);
+        $previousIndent = -1;
+        foreach (Arr::get($input, 'acceptance_criteria', []) as $index => $item) {
+            $indent = Arr::get($item, 'indent', 0);
+            if ($indent > $previousIndent + 1) {
+                throw ValidationException::withMessages(["acceptance_criteria.{$index}.indent" => 'Indentation cannot skip a level; the first item must have indent 0.']);
+            }
+            $previousIndent = $indent;
+        }
+        $merged = array_replace($this->kanbanGitMcp->updatePayload($ticket), $input);
+        $merged['acceptance_criteria'] = Arr::exists($input, 'acceptance_criteria')
+            ? AcceptanceCriteriaChecklistMapper::normalize($input['acceptance_criteria'])
+            : AcceptanceCriteriaChecklistMapper::fromModelsWithIds($ticket->acceptanceCriteria()->get());
+
+        $validator = Validator::make($merged, $form->rules());
+        $form->setValidator($validator);
+        $validator->validate();
+        foreach ($form->after() as $callback) {
+            $callback($validator);
+        }
+
+        $people = User::query()->visibleToProject($ticket->project)->pluck('id')->all();
+        foreach (['assignee_user_id', 'author_user_id'] as $field) {
+            if (Arr::exists($input, $field) && $input[$field] !== null && ! in_array((int) $input[$field], $people, true)) {
+                $validator->errors()->add($field, 'The person must be able to view this project.');
+            }
+        }
+        $definitions = $ticket->project->ticketFieldDefinitions()->get()->keyBy('id');
+        foreach (Arr::get($input, 'field_values', []) as $index => $value) {
+            $definition = $definitions->get($value['ticket_field_definition_id']);
+            $incompatible = $definition->field_type === 'user' ? 'value_number' : 'value_user_id';
+            if (Arr::get($value, $incompatible) !== null) {
+                $validator->errors()->add("field_values.{$index}.{$incompatible}", 'The value must match the custom field type.');
+            }
+            if (Arr::get($value, 'value_user_id') !== null && ! in_array((int) $value['value_user_id'], $people, true)) {
+                $validator->errors()->add("field_values.{$index}.value_user_id", 'The person must be able to view this project.');
+            }
+        }
+        if ($validator->errors()->isNotEmpty()) {
+            throw new ValidationException($validator);
+        }
+
+        if (Arr::exists($input, 'field_values')) {
+            $replacement = $definitions->map(fn (TicketFieldDefinition $definition): array => [
+                'ticket_field_definition_id' => $definition->id,
+                'value_number' => null,
+                'value_user_id' => null,
+            ])->all();
+            foreach ($input['field_values'] as $value) {
+                $replacement[$value['ticket_field_definition_id']] = $value;
+            }
+            $merged['field_values'] = array_values($replacement);
+        }
+
+        return $merged;
+    }
+}

app/Mcp/Tools/CreateTicket.php

@@ -0,0 +1,169 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Actions\Permissions\PermissionService;
+use App\Actions\Tickets\CreateProjectTicket;
+use App\Actions\Tickets\Support\AcceptanceCriteriaChecklistMapper;
+use App\Enums\Permission;
+use App\Mcp\Support\KanbanGitMcp;
+use App\Models\Project;
+use App\Models\Ticket;
+use App\Models\User;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\JsonSchema\Types\Type;
+use Illuminate\Support\Arr;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\ResponseFactory;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+
+#[Name('create_ticket')]
+#[Description('Create a ticket with all editable ticket fields, including its type, initial status, priority, assignee, author, description, story points, acceptance criteria, blocked state, and custom field values. Set parent_ticket_id to create a child of an existing ticket in the same project whose type allows children. Requires project write permission; overriding the author requires project admin permission. Ticket IDs, keys, sequence numbers, timestamps, and worklog entries are generated automatically.')]
+#[IsDestructive(false)]
+class CreateTicket extends Tool
+{
+    public function __construct(
+        private readonly KanbanGitMcp $kanbanGitMcp,
+        private readonly CreateProjectTicket $createProjectTicket,
+        private readonly PermissionService $permissionService,
+    ) {}
+
+    public function handle(Request $request): Response|ResponseFactory
+    {
+        $projectInput = $request->validate([
+            'project_id' => ['required', 'integer'],
+        ]);
+
+        $user = $this->kanbanGitMcp->user($request);
+        $project = $this->kanbanGitMcp->projectForWrite($user, (int) Arr::get($projectInput, 'project_id'));
+        $validated = $request->validate([
+            'title' => ['required', 'string', 'max:255'],
+            'description' => ['nullable', 'string'],
+            'ticket_type_id' => ['required', 'integer', Rule::exists('ticket_types', 'id')->where('project_id', $project->id)],
+            'ticket_status_id' => ['required', 'integer', Rule::exists('ticket_statuses', 'id')->where('project_id', $project->id)],
+            'ticket_priority_id' => ['required', 'integer', Rule::exists('ticket_priorities', 'id')->where('project_id', $project->id)],
+            'parent_ticket_id' => ['nullable', 'integer', Rule::exists('tickets', 'id')->where('project_id', $project->id)],
+            'assignee_user_id' => ['nullable', 'integer', Rule::exists('users', 'id')],
+            'author_user_id' => ['nullable', 'integer', Rule::exists('users', 'id')],
+            'story_points' => ['nullable', 'integer', 'min:0'],
+            'is_blocked' => ['sometimes', 'boolean'],
+            'blocked_comment' => ['nullable', 'string'],
+            'acceptance_criteria' => ['nullable', 'array', 'list'],
+            'acceptance_criteria.*' => ['array:text,checked,indent'],
+            'acceptance_criteria.*.text' => ['required', 'string'],
+            'acceptance_criteria.*.checked' => ['sometimes', 'boolean'],
+            'acceptance_criteria.*.indent' => ['sometimes', 'integer', 'min:0', 'max:'.AcceptanceCriteriaChecklistMapper::MAX_INDENT_LEVEL],
+            'field_values' => ['sometimes', 'array', 'list'],
+            'field_values.*' => ['array:ticket_field_definition_id,value_number,value_user_id'],
+            'field_values.*.ticket_field_definition_id' => [
+                'required', 'integer', 'distinct',
+                Rule::exists('ticket_field_definitions', 'id')->where('project_id', $project->id),
+            ],
+            'field_values.*.value_number' => ['nullable', 'numeric'],
+            'field_values.*.value_user_id' => ['nullable', 'integer', Rule::exists('users', 'id')],
+        ]);
+
+        $this->validateTicketConstraints($project, $user, $validated);
+
+        $ticket = $this->createProjectTicket->handle($project, $validated, $user);
+
+        return Response::structured([
+            'data' => $this->kanbanGitMcp->ticketPayload($ticket->fresh()),
+            'meta' => [
+                'message' => "{$ticket->ticket_key} was created.",
+            ],
+        ]);
+    }
+
+    /**
+     * @param  array<string, mixed>  $validated
+     */
+    private function validateTicketConstraints(Project $project, User $user, array $validated): void
+    {
+        $errors = [];
+        $parentTicketId = Arr::get($validated, 'parent_ticket_id');
+
+        if ($parentTicketId !== null) {
+            $parentTicket = Ticket::query()
+                ->where('project_id', $project->id)
+                ->with('ticketType')
+                ->find($parentTicketId);
+
+            if (! $parentTicket?->ticketType?->is_parent) {
+                $errors['parent_ticket_id'] = 'Only tickets with a parent-enabled type can be selected as a parent.';
+            }
+        }
+
+        if (Arr::get($validated, 'is_blocked', false) && blank(Arr::get($validated, 'blocked_comment'))) {
+            $errors['blocked_comment'] = 'Blocked tickets require a blocker comment.';
+        }
+
+        if (
+            Arr::exists($validated, 'author_user_id')
+            && (int) Arr::get($validated, 'author_user_id') !== $user->id
+            && ! $this->permissionService->allows($user, Permission::ProjectAdmin, $project)
+        ) {
+            $errors['author_user_id'] = 'Only project admins can change the author.';
+        }
+
+        $fieldValues = Arr::get($validated, 'field_values', []);
+
+        if ($fieldValues !== []) {
+            $fieldDefinitions = $project->ticketFieldDefinitions()->get()->keyBy('id');
+
+            foreach ($fieldValues as $index => $fieldValue) {
+                $fieldDefinition = $fieldDefinitions->get((int) Arr::get($fieldValue, 'ticket_field_definition_id'));
+                $incompatibleValue = $fieldDefinition->field_type === 'user' ? 'value_number' : 'value_user_id';
+
+                if (Arr::get($fieldValue, $incompatibleValue) !== null) {
+                    $errors["field_values.{$index}.{$incompatibleValue}"] = 'The value must match the custom field type.';
+                }
+            }
+        }
+
+        if ($errors !== []) {
+            throw ValidationException::withMessages($errors);
+        }
+    }
+
+    /**
+     * @return array<string, Type>
+     */
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'project_id' => $schema->integer()->description('Project ID.')->required(),
+            'title' => $schema->string()->max(255)->description('Ticket title.')->required(),
+            'description' => $schema->string()->nullable()->description('Ticket description.'),
+            'ticket_type_id' => $schema->integer()->description('Ticket type ID belonging to the project. Explicitly selects the type, including types that allow child tickets.')->required(),
+            'ticket_status_id' => $schema->integer()->description('Initial ticket status ID belonging to the project.')->required(),
+            'ticket_priority_id' => $schema->integer()->description('Ticket priority ID belonging to the project.')->required(),
+            'parent_ticket_id' => $schema->integer()->nullable()->description('Existing parent ticket ID in the same project. Its type must allow children. Omit or pass null for a top-level ticket.'),
+            'assignee_user_id' => $schema->integer()->nullable()->description('User ID to assign. Omit or pass null to leave unassigned.'),
+            'author_user_id' => $schema->integer()->nullable()->description('Defaults to the application key owner when omitted. Only project admins may choose another author or pass null for no author.'),
+            'story_points' => $schema->integer()->min(0)->nullable()->description('Non-negative story point estimate.'),
+            'is_blocked' => $schema->boolean()->default(false)->description('Whether the ticket is blocked. Requires a nonblank blocked_comment when true.'),
+            'blocked_comment' => $schema->string()->nullable()->description('Blocker reason. Stored only when is_blocked is true.'),
+            'acceptance_criteria' => $schema->array()->nullable()
+                ->items($schema->object([
+                    'text' => $schema->string()->description('Checklist item text.')->required(),
+                    'checked' => $schema->boolean()->default(false),
+                    'indent' => $schema->integer()->min(0)->max(AcceptanceCriteriaChecklistMapper::MAX_INDENT_LEVEL)->default(0),
+                ])->withoutAdditionalProperties())
+                ->description('Ordered acceptance checklist. Indent 0 is a root item; larger values nest under preceding items.'),
+            'field_values' => $schema->array()
+                ->items($schema->object([
+                    'ticket_field_definition_id' => $schema->integer()->description('Custom field definition ID belonging to the project. Each definition may appear once.')->required(),
+                    'value_number' => $schema->number()->nullable()->description('Value for a numeric field.'),
+                    'value_user_id' => $schema->integer()->nullable()->description('User ID for a user field.'),
+                ])->withoutAdditionalProperties())
+                ->description('Custom field values. Supply the value matching each definition type; omit or pass null for an empty value.'),
+        ];
+    }
+}

app/Mcp/Tools/GetProjectConfiguration.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Actions\Permissions\PermissionService;
+use App\Enums\Permission;
+use App\Mcp\Support\KanbanGitMcp;
+use App\Models\TicketStatus;
+use App\Models\User;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\JsonSchema\Types\Type;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\ResponseFactory;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[Name('get_project_configuration')]
+#[Description('Get compact current configuration for a visible project: ordered columns, statuses with IDs/slugs/column assignment and allowed target status IDs, types, priorities, custom field definitions, and permitted people IDs/names. Reads live effective configuration, without template snapshots or full user/project objects. People are paginated (default 25, maximum 100); use people_page for subsequent pages. Author changes require project admin permission, reported in permissions.')]
+#[IsReadOnly]
+class GetProjectConfiguration extends Tool
+{
+    public function __construct(private readonly KanbanGitMcp $kanbanGitMcp, private readonly PermissionService $permissionService) {}
+
+    public function handle(Request $request): Response|ResponseFactory
+    {
+        $input = $request->validate([
+            'project_id' => ['required', 'integer'],
+            'people_page' => ['sometimes', 'integer', 'min:1'],
+            'people_per_page' => ['sometimes', 'integer', 'min:1', 'max:100'],
+        ]);
+        $user = $this->kanbanGitMcp->user($request);
+        $project = $this->kanbanGitMcp->projectForRead($user, $input['project_id']);
+        $people = User::query()->visibleToProject($project)->orderBy('id')->paginate($input['people_per_page'] ?? 25, ['id', 'name'], 'people_page', $input['people_page'] ?? 1);
+
+        $columns = $project->boardColumns()->orderBy('id')->get(['id', 'name', 'position']);
+        $columnPositions = $columns->pluck('position', 'id');
+        $statuses = $project->ticketStatuses()->with('allowedTargetStatuses')->get()->sortBy(
+            fn (TicketStatus $status): array => [$columnPositions->get($status->board_column_id, 0), $status->position, $status->id],
+        )->values();
+
+        return Response::structured([
+            'data' => [
+                'project' => ['id' => $project->id, 'key' => $project->key, 'name' => $project->name],
+                'permissions' => [
+                    'can_write' => $this->permissionService->allows($user, Permission::ProjectWrite, $project),
+                    'can_change_author' => $this->permissionService->allows($user, Permission::ProjectAdmin, $project),
+                ],
+                'board_columns' => $columns->toArray(),
+                'ticket_statuses' => $statuses->map(fn (TicketStatus $status): array => [
+                    'id' => $status->id, 'name' => $status->name, 'slug' => $status->slug,
+                    'position' => $status->position, 'board_column_id' => $status->board_column_id,
+                    'allowed_target_status_ids' => $status->allowedTargetStatuses->pluck('id')->all(),
+                ])->all(),
+                'ticket_types' => $project->ticketTypes()->orderBy('id')->get(['id', 'name', 'position', 'is_parent'])->toArray(),
+                'ticket_priorities' => $project->ticketPriorities()->orderBy('id')->get(['id', 'name', 'position'])->toArray(),
+                'ticket_field_definitions' => $project->ticketFieldDefinitions()->orderBy('id')->get(['id', 'label', 'field_type', 'position'])->toArray(),
+                'people' => $people->getCollection()->map(fn (User $person): array => ['id' => $person->id, 'name' => $person->name])->all(),
+            ],
+            'meta' => ['people' => $this->kanbanGitMcp->paginationPayload($people)],
+        ]);
+    }
+
+    /** @return array<string, Type> */
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'project_id' => $schema->integer()->description('Visible project ID from list_projects.')->required(),
+            'people_page' => $schema->integer()->min(1)->description('People page number, defaults to 1.'),
+            'people_per_page' => $schema->integer()->min(1)->max(100)->description('People page size, defaults to 25; maximum 100.'),
+        ];
+    }
+}

app/Mcp/Tools/GetTicket.php

@@ -14,7 +14,7 @@ use Laravel\Mcp\Server\Tool;
 use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
 
 #[Name('get_ticket')]
-#[Description('Get a visible ticket with project, status, type, priority, assignee, author, field values, and worklog data.')]
+#[Description('Get a visible ticket by exactly one of numeric ticket_id or exact full ticket_key (e.g. KAN-67), with project, status, type, priority, assignee, author, field values, and worklog data.')]
 #[IsReadOnly]
 class GetTicket extends Tool
 {
@@ -25,11 +25,14 @@ class GetTicket extends Tool
     public function handle(Request $request): Response|ResponseFactory
     {
         $validated = $request->validate([
-            'ticket_id' => ['required', 'integer'],
+            'ticket_id' => ['required_without:ticket_key', 'prohibits:ticket_key', 'integer'],
+            'ticket_key' => ['required_without:ticket_id', 'prohibits:ticket_id', 'string', 'regex:/^[A-Z0-9]+-[1-9][0-9]*$/'],
         ]);
 
         $user = $this->kanbanGitMcp->user($request);
-        $ticket = $this->kanbanGitMcp->ticketForRead($user, (int) $validated['ticket_id']);
+        $ticket = isset($validated['ticket_id'])
+            ? $this->kanbanGitMcp->ticketForRead($user, (int) $validated['ticket_id'])
+            : $this->kanbanGitMcp->ticketForKey($user, $validated['ticket_key']);
 
         return Response::structured([
             'data' => $this->kanbanGitMcp->ticketPayload($ticket),
@@ -43,8 +46,8 @@ class GetTicket extends Tool
     {
         return [
             'ticket_id' => $schema->integer()
-                ->description('Ticket ID.')
-                ->required(),
+                ->description('Ticket ID. Supply exactly one of ticket_id or ticket_key.'),
+            'ticket_key' => $schema->string()->description('Exact full ticket key, e.g. KAN-67. Supply exactly one of ticket_id or ticket_key.'),
         ];
     }
 }

app/Mcp/Tools/ListProjects.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Actions\Permissions\PermissionService;
+use App\Mcp\Support\KanbanGitMcp;
+use App\Models\Project;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\JsonSchema\Types\Type;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\ResponseFactory;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[Name('list_projects')]
+#[Description('List visible projects independently of assigned tickets. Returns only ID, key and name, ordered by ID, with bounded pagination. page starts at 1; per_page defaults to 25 and may not exceed 100.')]
+#[IsReadOnly]
+class ListProjects extends Tool
+{
+    public function __construct(private readonly KanbanGitMcp $kanbanGitMcp, private readonly PermissionService $permissionService) {}
+
+    public function handle(Request $request): Response|ResponseFactory
+    {
+        $input = $request->validate(['page' => ['sometimes', 'integer', 'min:1'], 'per_page' => ['sometimes', 'integer', 'min:1', 'max:100']]);
+        $user = $this->kanbanGitMcp->user($request);
+        $projects = Project::query()->whereIn('id', $this->permissionService->viewableProjectIds($user))
+            ->orderBy('id')->paginate($input['per_page'] ?? 25, ['id', 'key', 'name'], 'page', $input['page'] ?? 1);
+
+        return Response::structured([
+            'data' => $projects->getCollection()->map(fn (Project $project): array => ['id' => $project->id, 'key' => $project->key, 'name' => $project->name])->all(),
+            'meta' => $this->kanbanGitMcp->paginationPayload($projects),
+        ]);
+    }
+
+    /** @return array<string, Type> */
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'page' => $schema->integer()->min(1)->description('Page number, defaults to 1.'),
+            'per_page' => $schema->integer()->min(1)->max(100)->description('Page size, defaults to 25; maximum 100.'),
+        ];
+    }
+}

app/Mcp/Tools/ListTicketTypes.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Http\Resources\ProjectResource;
+use App\Http\Resources\TicketTypeResource;
+use App\Mcp\Support\KanbanGitMcp;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\JsonSchema\Types\Type;
+use Illuminate\Support\Arr;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\ResponseFactory;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[Name('list_ticket_types')]
+#[Description('List all ticket types in a visible project in their configured order, including IDs, names, and is_parent. Use a returned ID as ticket_type_id when creating a ticket. Types with is_parent=true allow tickets of that type to have child tickets; set parent_ticket_id on create_ticket to attach a child to an existing parent ticket.')]
+#[IsReadOnly]
+class ListTicketTypes extends Tool
+{
+    public function __construct(
+        private readonly KanbanGitMcp $kanbanGitMcp,
+    ) {}
+
+    public function handle(Request $request): Response|ResponseFactory
+    {
+        $validated = $request->validate([
+            'project_id' => ['required', 'integer'],
+        ]);
+
+        $user = $this->kanbanGitMcp->user($request);
+        $project = $this->kanbanGitMcp->projectForRead($user, (int) Arr::get($validated, 'project_id'));
+
+        return Response::structured([
+            'data' => [
+                'project' => ProjectResource::make($project)->resolve(),
+                'ticket_types' => TicketTypeResource::collection($project->ticketTypes()->get())->resolve(),
+            ],
+        ]);
+    }
+
+    /**
+     * @return array<string, Type>
+     */
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'project_id' => $schema->integer()
+                ->description('Project ID. Requires permission to view this project.')
+                ->required(),
+        ];
+    }
+}

app/Mcp/Tools/SearchTickets.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Actions\Permissions\PermissionService;
+use App\Mcp\Support\KanbanGitMcp;
+use App\Models\Ticket;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\JsonSchema\Types\Type;
+use Illuminate\Support\Arr;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\ResponseFactory;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
+
+#[Name('search_tickets')]
+#[Description('Search visible tickets with combined filters: exact full ticket key, literal text in title/description, project, status, type, assignee and parent. Omitted filters do not restrict results; assignee_user_id/parent_ticket_id null selects unassigned/top-level tickets. Returns compact ID, key, title, project ID and status with deterministic ID order and bounded pagination (default 25, maximum 100).')]
+#[IsReadOnly]
+class SearchTickets extends Tool
+{
+    public function __construct(private readonly KanbanGitMcp $kanbanGitMcp, private readonly PermissionService $permissionService) {}
+
+    public function handle(Request $request): Response|ResponseFactory
+    {
+        $input = $request->validate([
+            'ticket_key' => ['sometimes', 'string', 'regex:/^[A-Z0-9]+-[1-9][0-9]*$/'],
+            'query' => ['sometimes', 'string', 'max:255'],
+            'project_id' => ['sometimes', 'integer'],
+            'ticket_status_id' => ['sometimes', 'integer'],
+            'ticket_type_id' => ['sometimes', 'integer'],
+            'assignee_user_id' => ['sometimes', 'nullable', 'integer'],
+            'parent_ticket_id' => ['sometimes', 'nullable', 'integer'],
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'per_page' => ['sometimes', 'integer', 'min:1', 'max:100'],
+        ]);
+        $user = $this->kanbanGitMcp->user($request);
+        $this->kanbanGitMcp->projectForRead($user, $input['project_id'] ?? null);
+        $query = Ticket::query()->whereIn('project_id', $this->permissionService->viewableProjectIds($user));
+        foreach (['ticket_key', 'project_id', 'ticket_status_id', 'ticket_type_id', 'assignee_user_id', 'parent_ticket_id'] as $filter) {
+            if (Arr::exists($input, $filter)) {
+                $query->where($filter, $input[$filter]);
+            }
+        }
+        if (Arr::exists($input, 'query')) {
+            $pattern = '%'.str_replace(['!', '%', '_'], ['!!', '!%', '!_'], $input['query']).'%';
+            $query->where(fn (Builder $q) => $q->whereRaw("title LIKE ? ESCAPE '!'", [$pattern])->orWhereRaw("description LIKE ? ESCAPE '!'", [$pattern]));
+        }
+        $tickets = $query->with('ticketStatus:id,name,slug,board_column_id')->orderBy('id')
+            ->paginate($input['per_page'] ?? 25, ['id', 'ticket_key', 'title', 'project_id', 'ticket_status_id'], 'page', $input['page'] ?? 1);
+
+        return Response::structured([
+            'data' => $tickets->getCollection()->map(fn (Ticket $ticket): array => [
+                'id' => $ticket->id,
+                'ticket_key' => $ticket->ticket_key,
+                'title' => $ticket->title,
+                'project_id' => $ticket->project_id,
+                'ticket_status_id' => $ticket->ticket_status_id,
+                'status' => $ticket->ticketStatus === null ? null : ['id' => $ticket->ticketStatus->id, 'name' => $ticket->ticketStatus->name, 'slug' => $ticket->ticketStatus->slug],
+            ])->all(),
+            'meta' => $this->kanbanGitMcp->paginationPayload($tickets),
+        ]);
+    }
+
+    /** @return array<string, Type> */
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'ticket_key' => $schema->string()->description('Exact full key, e.g. KAN-67.'),
+            'query' => $schema->string()->max(255)->description('Literal substring in title or description.'),
+            'project_id' => $schema->integer()->description('Visible project ID.'),
+            'ticket_status_id' => $schema->integer()->description('Status ID from get_project_configuration.'),
+            'ticket_type_id' => $schema->integer()->description('Type ID from get_project_configuration.'),
+            'assignee_user_id' => $schema->integer()->nullable()->description('Assignee ID; null selects unassigned tickets.'),
+            'parent_ticket_id' => $schema->integer()->nullable()->description('Parent ID; null selects top-level tickets.'),
+            'page' => $schema->integer()->min(1)->description('Page number, defaults to 1.'),
+            'per_page' => $schema->integer()->min(1)->max(100)->description('Page size, defaults to 25; maximum 100.'),
+        ];
+    }
+}

app/Mcp/Tools/UpdateTicket.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Mcp\Tools;
+
+use App\Actions\Tickets\UpdateProjectTicket;
+use App\Mcp\Support\KanbanGitMcp;
+use App\Mcp\Support\TicketUpdateInput;
+use Illuminate\Contracts\JsonSchema\JsonSchema;
+use Illuminate\JsonSchema\Types\Type;
+use Laravel\Mcp\Request;
+use Laravel\Mcp\Response;
+use Laravel\Mcp\ResponseFactory;
+use Laravel\Mcp\Server\Attributes\Description;
+use Laravel\Mcp\Server\Attributes\Name;
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Tools\Annotations\IsDestructive;
+
+#[Name('update_ticket')]
+#[Description('Partially update a ticket by ID using existing project permissions and ticket rules. Omitted fields stay unchanged. Explicit null clears nullable scalar fields only. acceptance_criteria and field_values replace their entire lists; [] clears a list and null is rejected. Checklist items with an existing ID retain their identity; omit id for a new item. Use move_ticket_status separately for workflow transitions. Author changes require project admin permission; people must be visible to the project.')]
+#[IsDestructive(false)]
+class UpdateTicket extends Tool
+{
+    public function __construct(
+        private readonly KanbanGitMcp $kanbanGitMcp,
+        private readonly TicketUpdateInput $ticketUpdateInput,
+        private readonly UpdateProjectTicket $updateProjectTicket,
+    ) {}
+
+    public function handle(Request $request): Response|ResponseFactory
+    {
+        $selector = $request->validate(['ticket_id' => ['required', 'integer']]);
+        $user = $this->kanbanGitMcp->user($request);
+        $ticket = $this->kanbanGitMcp->ticketForWrite($user, (int) $selector['ticket_id']);
+        $validated = $this->ticketUpdateInput->validate($request, $ticket, $user);
+        $updated = $this->updateProjectTicket->handle($ticket, $user, $validated, true);
+
+        return Response::structured([
+            'data' => $this->kanbanGitMcp->ticketPayload($ticket->fresh()),
+            'meta' => ['updated' => $updated],
+        ]);
+    }
+
+    /** @return array<string, Type> */
+    public function schema(JsonSchema $schema): array
+    {
+        return [
+            'ticket_id' => $schema->integer()->description('Existing ticket ID.')->required(),
+            'title' => $schema->string()->max(255)->description('Nonblank title; omit to preserve.'),
+            'description' => $schema->string()->nullable()->description('Description; null clears it.'),
+            'ticket_type_id' => $schema->integer()->description('Type ID from get_project_configuration.'),
+            'ticket_priority_id' => $schema->integer()->description('Priority ID from get_project_configuration.'),
+            'parent_ticket_id' => $schema->integer()->nullable()->description('Parent-enabled ticket in this project; null removes the parent. Cycles are forbidden.'),
+            'assignee_user_id' => $schema->integer()->nullable()->description('Allowed person ID; null unassigns.'),
+            'author_user_id' => $schema->integer()->nullable()->description('Author ID; null clears. Changes require project admin permission.'),
+            'story_points' => $schema->integer()->min(0)->nullable()->description('Nonnegative estimate; null clears.'),
+            'is_blocked' => $schema->boolean()->description('Blocked state; true requires a nonblank blocker comment. Omit to preserve.'),
+            'blocked_comment' => $schema->string()->nullable()->description('Blocker reason; null clears only when the ticket is unblocked.'),
+            'acceptance_criteria' => $schema->array()->items($schema->object([
+                'id' => $schema->integer()->min(1)->description('Existing criterion ID belonging to this ticket. Omit for a new item. IDs must be unique.'),
+                'text' => $schema->string()->description('Nonblank criterion text.')->required(),
+                'checked' => $schema->boolean()->description('Checked state, defaults to false for supplied items.'),
+                'indent' => $schema->integer()->min(0)->max(8)->description('Indent level, defaults to 0; cannot skip a level.'),
+            ])->withoutAdditionalProperties())->description('Ordered replacement checklist. Omitted items are removed. [] clears; omit field to preserve; null is invalid.'),
+            'field_values' => $schema->array()->items($schema->object([
+                'ticket_field_definition_id' => $schema->integer()->description('Project field ID, supplied once.')->required(),
+                'value_number' => $schema->number()->nullable()->description('Value for a numeric field; null clears.'),
+                'value_user_id' => $schema->integer()->nullable()->description('Allowed person ID for a user field; null clears.'),
+            ])->withoutAdditionalProperties())->description('Replacement custom-field list. Omitted definitions are cleared. [] clears all; omit field to preserve; null is invalid.'),
+        ];
+    }
+}

app/Models/BoardColumn.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Models\Concerns\SyncsProjectTemplateOwnership;
 use Database\Factories\BoardColumnFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -10,12 +11,21 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\HasManyThrough;
 
-#[Fillable(['name', 'position', 'project_id'])]
+#[Fillable(['name', 'position', 'project_id', 'project_template_id'])]
 class BoardColumn extends Model
 {
     /** @use HasFactory<BoardColumnFactory> */
     use HasFactory;
 
+    use SyncsProjectTemplateOwnership;
+
+    protected static function booted(): void
+    {
+        static::saving(function (self $boardColumn): void {
+            $boardColumn->syncProjectTemplateOwnership();
+        });
+    }
+
     public function project(): BelongsTo
     {
         return $this->belongsTo(Project::class);

app/Models/Concerns/SyncsProjectTemplateOwnership.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Models\Concerns;
+
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+trait SyncsProjectTemplateOwnership
+{
+    protected function syncProjectTemplateOwnership(): void
+    {
+        $projectTemplateId = $this->getAttribute('project_template_id');
+        $projectId = $this->getAttribute('project_id');
+
+        if ($projectTemplateId === null && $projectId !== null) {
+            $projectTemplateId = Project::query()
+                ->whereKey($projectId)
+                ->value('project_template_id');
+
+            if ($projectTemplateId !== null) {
+                $this->setAttribute('project_template_id', $projectTemplateId);
+            }
+        }
+
+        if ($projectId === null && $projectTemplateId !== null) {
+            $projectId = ProjectTemplate::query()
+                ->whereKey($projectTemplateId)
+                ->value('project_id');
+
+            if ($projectId !== null) {
+                $this->setAttribute('project_id', $projectId);
+            }
+        }
+    }
+
+    public function projectTemplate(): BelongsTo
+    {
+        return $this->belongsTo(ProjectTemplate::class);
+    }
+}

app/Models/NotificationAction.php

@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Enums\NotificationChannel;
 use App\Enums\NotificationEventType;
+use App\Models\Concerns\SyncsProjectTemplateOwnership;
 use Database\Factories\NotificationActionFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
@@ -23,6 +24,7 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
     'message_template',
     'name',
     'project_id',
+    'project_template_id',
 ])]
 #[Hidden(['delivery_url'])]
 class NotificationAction extends Model
@@ -30,6 +32,8 @@ class NotificationAction extends Model
     /** @use HasFactory<NotificationActionFactory> */
     use HasFactory;
 
+    use SyncsProjectTemplateOwnership;
+
     /**
      * @return array<string, string>
      */
@@ -45,6 +49,13 @@ class NotificationAction extends Model
         ];
     }
 
+    protected static function booted(): void
+    {
+        static::saving(function (self $notificationAction): void {
+            $notificationAction->syncProjectTemplateOwnership();
+        });
+    }
+
     public function scopeEnabled(Builder $query): Builder
     {
         return $query->where('enabled', true);

app/Models/Project.php

@@ -7,11 +7,13 @@ use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Database\Eloquent\Relations\MorphMany;
 use Illuminate\Support\Str;
 
-#[Fillable(['name', 'key', 'show_author', 'show_story_points'])]
+#[Fillable(['name', 'key', 'project_template_id', 'show_author', 'show_story_points', 'template_overrides'])]
 class Project extends Model
 {
     /** @use HasFactory<ProjectFactory> */
@@ -22,6 +24,7 @@ class Project extends Model
         return [
             'show_author' => 'boolean',
             'show_story_points' => 'boolean',
+            'template_overrides' => 'array',
         ];
     }
 
@@ -44,6 +47,17 @@ class Project extends Model
         return $this->morphMany(PermissionAssignment::class, 'scope');
     }
 
+    public function projectTemplate(): BelongsTo
+    {
+        return $this->belongsTo(ProjectTemplate::class, 'project_template_id');
+    }
+
+    public function baseTemplate(): HasOne
+    {
+        return $this->hasOne(ProjectTemplate::class)
+            ->where('is_published', false);
+    }
+
     public function boardColumns(): HasMany
     {
         return $this->hasMany(BoardColumn::class)
@@ -95,6 +109,21 @@ class Project extends Model
             ->orderBy('id');
     }
 
+    /** @return list<string> */
+    public function configurationRelations(): array
+    {
+        return [
+            'boardColumns',
+            'notificationActions',
+            'repositoryConnections',
+            'ticketFieldDefinitions',
+            'ticketLinkTypes',
+            'ticketPriorities',
+            'ticketStatuses',
+            'ticketTypes',
+        ];
+    }
+
     public function tickets(): HasMany
     {
         return $this->hasMany(Ticket::class)

app/Models/ProjectTemplate.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Models;
+
+use Database\Factories\ProjectTemplateFactory;
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+#[Fillable(['project_id', 'source_project_id', 'name', 'slug', 'is_published', 'copy_areas', 'configuration_snapshot'])]
+class ProjectTemplate extends Model
+{
+    /** @use HasFactory<ProjectTemplateFactory> */
+    use HasFactory;
+
+    protected function casts(): array
+    {
+        return [
+            'copy_areas' => 'array',
+            'configuration_snapshot' => 'array',
+            'is_published' => 'boolean',
+        ];
+    }
+
+    public function scopePublished(Builder $query): Builder
+    {
+        return $query->where('is_published', true);
+    }
+
+    public function project(): BelongsTo
+    {
+        return $this->belongsTo(Project::class);
+    }
+
+    public function sourceProject(): BelongsTo
+    {
+        return $this->belongsTo(Project::class, 'source_project_id');
+    }
+
+    public function linkedProjects(): HasMany
+    {
+        return $this->hasMany(Project::class, 'project_template_id');
+    }
+}

app/Models/RepositoryConnection.php

@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Actions\Git\Data\GitRepository;
 use App\Actions\Git\GitProviderKey;
+use App\Models\Concerns\SyncsProjectTemplateOwnership;
 use Database\Factories\RepositoryConnectionFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -14,6 +15,7 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
     'base_url',
     'owner_name',
     'project_id',
+    'project_template_id',
     'provider',
     'provider_repository_id',
     'repository_full_name',
@@ -25,6 +27,8 @@ class RepositoryConnection extends Model
     /** @use HasFactory<RepositoryConnectionFactory> */
     use HasFactory;
 
+    use SyncsProjectTemplateOwnership;
+
     /**
      * @return array<string, string>
      */
@@ -35,6 +39,13 @@ class RepositoryConnection extends Model
         ];
     }
 
+    protected static function booted(): void
+    {
+        static::saving(function (self $repositoryConnection): void {
+            $repositoryConnection->syncProjectTemplateOwnership();
+        });
+    }
+
     public function project(): BelongsTo
     {
         return $this->belongsTo(Project::class);

app/Models/TicketFieldDefinition.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Models\Concerns\SyncsProjectTemplateOwnership;
 use Database\Factories\TicketFieldDefinitionFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -9,7 +10,7 @@ use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 
-#[Fillable(['field_type', 'label', 'position', 'project_id'])]
+#[Fillable(['field_type', 'label', 'position', 'project_id', 'project_template_id'])]
 class TicketFieldDefinition extends Model
 {
     /**
@@ -23,6 +24,15 @@ class TicketFieldDefinition extends Model
     /** @use HasFactory<TicketFieldDefinitionFactory> */
     use HasFactory;
 
+    use SyncsProjectTemplateOwnership;
+
+    protected static function booted(): void
+    {
+        static::saving(function (self $ticketFieldDefinition): void {
+            $ticketFieldDefinition->syncProjectTemplateOwnership();
+        });
+    }
+
     public function project(): BelongsTo
     {
         return $this->belongsTo(Project::class);

app/Models/TicketLinkType.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Models\Concerns\SyncsProjectTemplateOwnership;
 use Database\Factories\TicketLinkTypeFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -9,12 +10,21 @@ use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 
-#[Fillable(['label', 'counterpart_label', 'position', 'project_id'])]
+#[Fillable(['label', 'counterpart_label', 'position', 'project_id', 'project_template_id'])]
 class TicketLinkType extends Model
 {
     /** @use HasFactory<TicketLinkTypeFactory> */
     use HasFactory;
 
+    use SyncsProjectTemplateOwnership;
+
+    protected static function booted(): void
+    {
+        static::saving(function (self $ticketLinkType): void {
+            $ticketLinkType->syncProjectTemplateOwnership();
+        });
+    }
+
     public function counterpartLabel(): string
     {
         return $this->counterpart_label ?: $this->label;

app/Models/TicketPriority.php

@@ -2,20 +2,36 @@
 
 namespace App\Models;
 
+use App\Models\Concerns\SyncsProjectTemplateOwnership;
 use Database\Factories\TicketPriorityFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
-#[Fillable(['name', 'position', 'project_id'])]
+#[Fillable(['name', 'position', 'project_id', 'project_template_id'])]
 class TicketPriority extends Model
 {
     /** @use HasFactory<TicketPriorityFactory> */
     use HasFactory;
 
+    use SyncsProjectTemplateOwnership;
+
+    protected static function booted(): void
+    {
+        static::saving(function (self $ticketPriority): void {
+            $ticketPriority->syncProjectTemplateOwnership();
+        });
+    }
+
     public function project(): BelongsTo
     {
         return $this->belongsTo(Project::class);
     }
+
+    public function tickets(): HasMany
+    {
+        return $this->hasMany(Ticket::class);
+    }
 }

app/Models/TicketStatus.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Models\Concerns\SyncsProjectTemplateOwnership;
 use Database\Factories\TicketStatusFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -11,15 +12,24 @@ use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Support\Str;
 
-#[Fillable(['board_column_id', 'name', 'position', 'project_id', 'slug'])]
+#[Fillable(['board_column_id', 'name', 'position', 'project_id', 'project_template_id', 'slug'])]
 class TicketStatus extends Model
 {
     /** @use HasFactory<TicketStatusFactory> */
     use HasFactory;
 
+    use SyncsProjectTemplateOwnership;
+
     protected static function booted(): void
     {
         static::saving(function (self $ticketStatus): void {
+            if ($ticketStatus->project_template_id === null && $ticketStatus->board_column_id !== null) {
+                $ticketStatus->project_template_id = BoardColumn::query()
+                    ->whereKey($ticketStatus->board_column_id)
+                    ->value('project_template_id');
+            }
+
+            $ticketStatus->syncProjectTemplateOwnership();
             $ticketStatus->slug = Str::slug($ticketStatus->name);
         });
     }

app/Models/TicketType.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Models\Concerns\SyncsProjectTemplateOwnership;
 use Database\Factories\TicketTypeFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -9,12 +10,21 @@ use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 
-#[Fillable(['name', 'position', 'project_id', 'is_parent'])]
+#[Fillable(['name', 'position', 'project_id', 'project_template_id', 'is_parent'])]
 class TicketType extends Model
 {
     /** @use HasFactory<TicketTypeFactory> */
     use HasFactory;
 
+    use SyncsProjectTemplateOwnership;
+
+    protected static function booted(): void
+    {
+        static::saving(function (self $ticketType): void {
+            $ticketType->syncProjectTemplateOwnership();
+        });
+    }
+
     protected function casts(): array
     {
         return [

app/Observers/ProjectConfigurationObserver.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Observers;
+
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Actions\Projects\ProjectTemplateOverrideManager;
+use App\Actions\Projects\RefreshProjectBaseTemplate;
+use App\Models\BoardColumn;
+use App\Models\NotificationAction;
+use App\Models\RepositoryConnection;
+use App\Models\TicketFieldDefinition;
+use App\Models\TicketLinkType;
+use App\Models\TicketPriority;
+use App\Models\TicketStatus;
+use App\Models\TicketType;
+use Illuminate\Database\Eloquent\Model;
+
+class ProjectConfigurationObserver
+{
+    public function __construct(
+        private readonly ProjectTemplateOverrideManager $projectTemplateOverrideManager,
+        private readonly RefreshProjectBaseTemplate $refreshProjectBaseTemplate,
+    ) {}
+
+    public function saved(Model $model): void
+    {
+        $this->markOverride($model);
+    }
+
+    public function deleted(Model $model): void
+    {
+        $this->markOverride($model);
+    }
+
+    private function markOverride(Model $model): void
+    {
+        if (! $this->projectTemplateOverrideManager->isRecording()) {
+            return;
+        }
+
+        $project = $model->project()->first();
+
+        if ($project === null) {
+            return;
+        }
+
+        $area = match (true) {
+            $model instanceof BoardColumn => DuplicateProjectConfiguration::COPY_BOARD_COLUMNS,
+            $model instanceof TicketStatus => DuplicateProjectConfiguration::COPY_TICKET_STATUSES,
+            $model instanceof TicketType => DuplicateProjectConfiguration::COPY_TICKET_TYPES,
+            $model instanceof TicketPriority => DuplicateProjectConfiguration::COPY_TICKET_PRIORITIES,
+            $model instanceof TicketFieldDefinition => DuplicateProjectConfiguration::COPY_TICKET_FIELDS,
+            $model instanceof TicketLinkType => DuplicateProjectConfiguration::COPY_TICKET_LINK_TYPES,
+            $model instanceof RepositoryConnection => DuplicateProjectConfiguration::COPY_REPOSITORY_CONNECTIONS,
+            $model instanceof NotificationAction => DuplicateProjectConfiguration::COPY_NOTIFICATION_ACTIONS,
+            default => null,
+        };
+
+        if ($area === null) {
+            return;
+        }
+
+        $this->refreshProjectBaseTemplate->handle($project, $area);
+        $this->projectTemplateOverrideManager->mark($project, $area);
+    }
+}

app/Providers/AppServiceProvider.php

@@ -8,9 +8,18 @@ use App\Actions\Notifications\TicketCreated;
 use App\Actions\Notifications\TicketStatusChanged;
 use App\Actions\Permissions\PermissionService;
 use App\Enums\Permission;
+use App\Models\BoardColumn;
+use App\Models\NotificationAction;
 use App\Models\Project;
+use App\Models\RepositoryConnection;
 use App\Models\Team;
+use App\Models\TicketFieldDefinition;
+use App\Models\TicketLinkType;
+use App\Models\TicketPriority;
+use App\Models\TicketStatus;
+use App\Models\TicketType;
 use App\Models\User;
+use App\Observers\ProjectConfigurationObserver;
 use Carbon\CarbonImmutable;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Support\Facades\Date;
@@ -36,6 +45,18 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
+        foreach ([
+            BoardColumn::class,
+            NotificationAction::class,
+            RepositoryConnection::class,
+            TicketFieldDefinition::class,
+            TicketLinkType::class,
+            TicketPriority::class,
+            TicketStatus::class,
+            TicketType::class,
+        ] as $model) {
+            $model::observe(ProjectConfigurationObserver::class);
+        }
 
         if ($this->app->environment() !== 'local') {
             URL::forceScheme('https');

boost.json

@@ -10,8 +10,6 @@
         "fortify-development",
         "laravel-best-practices",
         "mcp-development",
-        "wayfinder-development",
-        "inertia-vue-development",
-        "tailwindcss-development"
+        "wayfinder-development"
     ]
 }

bootstrap/app.php

@@ -33,5 +33,5 @@ return Application::configure(basePath: dirname(__DIR__))
         ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
-        //
+        $exceptions->dontFlash(['api_token']);
     })->create();

composer.json

@@ -20,6 +20,7 @@
         "scalar/laravel": "^0.2.1"
     },
     "require-dev": {
+        "brianium/paratest": "^7.20",
         "fakerphp/faker": "^1.24",
         "laravel/boost": "^2.0",
         "laravel/pail": "^1.2.5",
@@ -47,15 +48,15 @@
             "@php -r \"file_exists('.env') || copy('.env.example', '.env');\"",
             "@php artisan key:generate",
             "@php artisan migrate --force",
-            "npm install",
-            "npm run build"
+            "pnpm install",
+            "pnpm run build"
         ],
         "dev": [
             "Composer\\Config::disableProcessTimeout",
             "@php artisan dev"
         ],
         "dev:ssr": [
-            "npm run build:ssr",
+            "pnpm run build:ssr",
             "Composer\\Config::disableProcessTimeout",
             "npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1\" \"php artisan pail --timeout=0\" \"php artisan inertia:start-ssr\" --names=server,queue,logs,ssr --kill-others"
         ],
@@ -67,15 +68,27 @@
         ],
         "ci:check": [
             "Composer\\Config::disableProcessTimeout",
-            "npm audit --audit-level=high",
-            "npm run lint:check",
-            "npm run types:check",
-            "@test"
+            "@ci:frontend",
+            "@ci:backend",
+            "@ci:test"
+        ],
+        "ci:frontend": [
+            "pnpm audit --audit-level=high",
+            "pnpm run lint:check",
+            "pnpm run types:check",
+            "pnpm run build"
+        ],
+        "ci:backend": [
+            "@lint:check"
+        ],
+        "ci:test": [
+            "@php artisan config:clear --ansi",
+            "@php artisan test --parallel --processes=2"
         ],
         "test": [
             "@php artisan config:clear --ansi",
             "@lint:check",
-            "@php artisan test"
+            "@php artisan test --parallel --processes=2"
         ],
         "post-autoload-dump": [
             "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "7d965721310f81816807d6b78c5f9654",
+    "content-hash": "4d18577105a240f2d8cce1c098398730",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -1451,20 +1451,20 @@
         },
         {
             "name": "laravel/framework",
-            "version": "v13.26.1",
+            "version": "v13.34.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/framework.git",
-                "reference": "e4a1bc52ef551d52e60244bb004256d6861da7ab"
+                "reference": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/e4a1bc52ef551d52e60244bb004256d6861da7ab",
-                "reference": "e4a1bc52ef551d52e60244bb004256d6861da7ab",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4",
+                "reference": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19",
+                "brick/math": "^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0",
                 "composer-runtime-api": "^2.2",
                 "doctrine/inflector": "^2.0.5",
                 "dragonmantank/cron-expression": "^3.4",
@@ -1576,18 +1576,20 @@
                 "league/flysystem-sftp-v3": "^3.25.1",
                 "mockery/mockery": "^1.6.10",
                 "opis/json-schema": "^2.4.1",
-                "orchestra/testbench-core": "^11.0.0",
+                "orchestra/testbench-core": "^11.5.0",
                 "pda/pheanstalk": "^7.0.0 || ^8.0.0",
                 "php-http/discovery": "^1.15",
-                "phpstan/phpstan": "^2.0",
+                "phpstan/phpstan": "2.2.15",
                 "phpunit/phpunit": "^11.5.50 || ^12.5.8 || ^13.0.3",
                 "predis/predis": "^2.3 || ^3.0",
-                "rector/rector": "^2.3",
+                "rector/rector": "2.6.3",
                 "resend/resend-php": "^1.0",
                 "symfony/cache": "^7.4.0 || ^8.0.0",
                 "symfony/http-client": "^7.4.0 || ^8.0.0",
+                "symfony/mercure": "^0.8.0",
                 "symfony/psr-http-message-bridge": "^7.4.0 || ^8.0.0",
-                "symfony/translation": "^7.4.0 || ^8.0.0"
+                "symfony/translation": "^7.4.0 || ^8.0.0",
+                "web-token/jwt-library": "^4.1"
             },
             "suggest": {
                 "ably/ably-php": "Required to use the Ably broadcast driver (^1.0).",
@@ -1623,8 +1625,10 @@
                 "symfony/filesystem": "Required to enable support for relative symbolic links (^7.4 || ^8.0).",
                 "symfony/http-client": "Required to enable support for the Symfony API mail transports (^7.4 || ^8.0).",
                 "symfony/mailgun-mailer": "Required to enable support for the Mailgun mail transport (^7.4 || ^8.0).",
+                "symfony/mercure": "Required to use the Mercure broadcast driver (^0.8).",
                 "symfony/postmark-mailer": "Required to enable support for the Postmark mail transport (^7.4 || ^8.0).",
-                "symfony/psr-http-message-bridge": "Required to use PSR-7 bridging features (^7.4 || ^8.0)."
+                "symfony/psr-http-message-bridge": "Required to use PSR-7 bridging features (^7.4 || ^8.0).",
+                "web-token/jwt-library": "Required to sign Mercure JWTs and use end-to-end encrypted channels (^4.1)."
             },
             "type": "library",
             "extra": {
@@ -1674,7 +1678,7 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2026-08-18T20:31:28+00:00"
+            "time": "2026-09-29T12:46:21+00:00"
         },
         {
             "name": "laravel/mcp",
@@ -2003,16 +2007,16 @@
         },
         {
             "name": "league/commonmark",
-            "version": "2.10.0",
+            "version": "2.10.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/commonmark.git",
-                "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4"
+                "reference": "6efbd9c472b91db0a3350fcd601c8332c2382e1f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/d2d1aa8b35e072966c89bc0c66cf926e56767dc4",
-                "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4",
+                "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/6efbd9c472b91db0a3350fcd601c8332c2382e1f",
+                "reference": "6efbd9c472b91db0a3350fcd601c8332c2382e1f",
                 "shasum": ""
             },
             "require": {
@@ -2106,7 +2110,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-08-11T16:06:25+00:00"
+            "time": "2026-09-21T13:07:34+00:00"
         },
         {
             "name": "league/config",
@@ -2192,16 +2196,16 @@
         },
         {
             "name": "league/flysystem",
-            "version": "3.35.2",
+            "version": "3.36.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/thephpleague/flysystem.git",
-                "reference": "b277b5dc3d56650b68904117124e79c851e12376"
+                "reference": "f7fb152932f30072d573510cbd4dd657d6475b25"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/thephpleague/flysystem/zipball/b277b5dc3d56650b68904117124e79c851e12376",
-                "reference": "b277b5dc3d56650b68904117124e79c851e12376",
+                "url": "https://api.github.com/repos/thephpleague/flysystem/zipball/f7fb152932f30072d573510cbd4dd657d6475b25",
+                "reference": "f7fb152932f30072d573510cbd4dd657d6475b25",
                 "shasum": ""
             },
             "require": {
@@ -2269,9 +2273,9 @@
             ],
             "support": {
                 "issues": "https://github.com/thephpleague/flysystem/issues",
-                "source": "https://github.com/thephpleague/flysystem/tree/3.35.2"
+                "source": "https://github.com/thephpleague/flysystem/tree/3.36.0"
             },
-            "time": "2026-07-06T14:42:07+00:00"
+            "time": "2026-09-02T08:00:27+00:00"
         },
         {
             "name": "league/flysystem-aws-s3-v3",
@@ -7020,6 +7024,99 @@
         }
     ],
     "packages-dev": [
+        {
+            "name": "brianium/paratest",
+            "version": "v7.20.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/paratestphp/paratest.git",
+                "reference": "81c80677c9ec0ed4ef16b246167f11dec81a6e3d"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/paratestphp/paratest/zipball/81c80677c9ec0ed4ef16b246167f11dec81a6e3d",
+                "reference": "81c80677c9ec0ed4ef16b246167f11dec81a6e3d",
+                "shasum": ""
+            },
+            "require": {
+                "ext-dom": "*",
+                "ext-pcre": "*",
+                "ext-reflection": "*",
+                "ext-simplexml": "*",
+                "fidry/cpu-core-counter": "^1.3.0",
+                "jean85/pretty-package-versions": "^2.1.1",
+                "php": "~8.3.0 || ~8.4.0 || ~8.5.0",
+                "phpunit/php-code-coverage": "^12.5.3 || ^13.0.1",
+                "phpunit/php-file-iterator": "^6.0.1 || ^7",
+                "phpunit/php-timer": "^8 || ^9",
+                "phpunit/phpunit": "^12.5.14 || ^13.0.5",
+                "sebastian/environment": "^8.0.3 || ^9",
+                "symfony/console": "^7.4.7 || ^8.0.7",
+                "symfony/process": "^7.4.5 || ^8.0.5"
+            },
+            "require-dev": {
+                "doctrine/coding-standard": "^14.0.0",
+                "ext-pcntl": "*",
+                "ext-pcov": "*",
+                "ext-posix": "*",
+                "phpstan/phpstan": "^2.1.44",
+                "phpstan/phpstan-deprecation-rules": "^2.0.4",
+                "phpstan/phpstan-phpunit": "^2.0.16",
+                "phpstan/phpstan-strict-rules": "^2.0.10",
+                "symfony/filesystem": "^7.4.6 || ^8.0.6"
+            },
+            "bin": [
+                "bin/paratest",
+                "bin/paratest_for_phpstorm"
+            ],
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "ParaTest\\": [
+                        "src/"
+                    ]
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Brian Scaturro",
+                    "email": "scaturrob@gmail.com",
+                    "role": "Developer"
+                },
+                {
+                    "name": "Filippo Tessarotto",
+                    "email": "zoeslam@gmail.com",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Parallel testing for PHP",
+            "homepage": "https://github.com/paratestphp/paratest",
+            "keywords": [
+                "concurrent",
+                "parallel",
+                "phpunit",
+                "testing"
+            ],
+            "support": {
+                "issues": "https://github.com/paratestphp/paratest/issues",
+                "source": "https://github.com/paratestphp/paratest/tree/v7.20.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sponsors/Slamdunk",
+                    "type": "github"
+                },
+                {
+                    "url": "https://paypal.me/filippotessarotto",
+                    "type": "paypal"
+                }
+            ],
+            "time": "2026-03-29T15:46:14+00:00"
+        },
         {
             "name": "fakerphp/faker",
             "version": "v1.24.1",
@@ -7083,6 +7180,67 @@
             },
             "time": "2024-11-21T13:46:39+00:00"
         },
+        {
+            "name": "fidry/cpu-core-counter",
+            "version": "1.3.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/theofidry/cpu-core-counter.git",
+                "reference": "db9508f7b1474469d9d3c53b86f817e344732678"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/theofidry/cpu-core-counter/zipball/db9508f7b1474469d9d3c53b86f817e344732678",
+                "reference": "db9508f7b1474469d9d3c53b86f817e344732678",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2 || ^8.0"
+            },
+            "require-dev": {
+                "fidry/makefile": "^0.2.0",
+                "fidry/php-cs-fixer-config": "^1.1.2",
+                "phpstan/extension-installer": "^1.2.0",
+                "phpstan/phpstan": "^2.0",
+                "phpstan/phpstan-deprecation-rules": "^2.0.0",
+                "phpstan/phpstan-phpunit": "^2.0",
+                "phpstan/phpstan-strict-rules": "^2.0",
+                "phpunit/phpunit": "^8.5.31 || ^9.5.26",
+                "webmozarts/strict-phpunit": "^7.5"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Fidry\\CpuCoreCounter\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Théo FIDRY",
+                    "email": "theo.fidry@gmail.com"
+                }
+            ],
+            "description": "Tiny utility to get the number of CPU cores.",
+            "keywords": [
+                "CPU",
+                "core"
+            ],
+            "support": {
+                "issues": "https://github.com/theofidry/cpu-core-counter/issues",
+                "source": "https://github.com/theofidry/cpu-core-counter/tree/1.3.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/theofidry",
+                    "type": "github"
+                }
+            ],
+            "time": "2025-08-14T07:29:31+00:00"
+        },
         {
             "name": "filp/whoops",
             "version": "2.18.4",
@@ -7205,6 +7363,66 @@
             },
             "time": "2025-04-30T06:54:44+00:00"
         },
+        {
+            "name": "jean85/pretty-package-versions",
+            "version": "2.1.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Jean85/pretty-package-versions.git",
+                "reference": "4d7aa5dab42e2a76d99559706022885de0e18e1a"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Jean85/pretty-package-versions/zipball/4d7aa5dab42e2a76d99559706022885de0e18e1a",
+                "reference": "4d7aa5dab42e2a76d99559706022885de0e18e1a",
+                "shasum": ""
+            },
+            "require": {
+                "composer-runtime-api": "^2.1.0",
+                "php": "^7.4|^8.0"
+            },
+            "require-dev": {
+                "friendsofphp/php-cs-fixer": "^3.2",
+                "jean85/composer-provided-replaced-stub-package": "^1.0",
+                "phpstan/phpstan": "^2.0",
+                "phpunit/phpunit": "^7.5|^8.5|^9.6",
+                "rector/rector": "^2.0",
+                "vimeo/psalm": "^4.3 || ^5.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Jean85\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Alessandro Lai",
+                    "email": "alessandro.lai85@gmail.com"
+                }
+            ],
+            "description": "A library to get pretty versions strings of installed dependencies",
+            "keywords": [
+                "composer",
+                "package",
+                "release",
+                "versions"
+            ],
+            "support": {
+                "issues": "https://github.com/Jean85/pretty-package-versions/issues",
+                "source": "https://github.com/Jean85/pretty-package-versions/tree/2.1.1"
+            },
+            "time": "2025-03-19T14:43:43+00:00"
+        },
         {
             "name": "laravel/boost",
             "version": "v2.4.3",

database/factories/ProjectFactory.php

@@ -23,6 +23,7 @@ class ProjectFactory extends Factory
             'key' => Str::upper(fake()->unique()->lexify('?????')),
             'show_author' => true,
             'show_story_points' => true,
+            'template_overrides' => [],
         ];
     }
 }

database/factories/ProjectTemplateFactory.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Str;
+
+/**
+ * @extends Factory<ProjectTemplate>
+ */
+class ProjectTemplateFactory extends Factory
+{
+    /**
+     * Define the model's default state.
+     *
+     * @return array<string, mixed>
+     */
+    public function definition(): array
+    {
+        return [
+            'source_project_id' => Project::factory(),
+            'name' => Str::title(fake()->unique()->words(3, true)),
+            'slug' => fake()->unique()->slug(),
+            'copy_areas' => [DuplicateProjectConfiguration::COPY_PROJECT_SETTINGS],
+            'configuration_snapshot' => [
+                DuplicateProjectConfiguration::COPY_PROJECT_SETTINGS => [
+                    'show_author' => true,
+                    'show_story_points' => true,
+                ],
+            ],
+        ];
+    }
+}

database/migrations/2026_05_25_011500_create_project_templates_table.php

@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('project_templates', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('source_project_id')->nullable()->constrained('projects')->nullOnDelete();
+            $table->string('name');
+            $table->string('slug')->unique();
+            $table->json('copy_areas');
+            $table->json('configuration_snapshot');
+            $table->timestamps();
+
+            $table->index(['source_project_id', 'name']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('project_templates');
+    }
+};

database/migrations/2026_05_25_013000_project_templates_as_project_baselines.php

@@ -0,0 +1,54 @@
+<?php
+
+use App\Actions\Projects\CreateProjectBaseTemplate;
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('project_templates', function (Blueprint $table): void {
+            $table->foreignId('project_id')->nullable()->after('id')->constrained('projects')->nullOnDelete();
+            $table->boolean('is_published')->default(true)->after('slug');
+        });
+
+        Schema::table('projects', function (Blueprint $table): void {
+            $table->foreignId('project_template_id')->nullable()->after('key')->constrained('project_templates')->nullOnDelete();
+        });
+
+        $projects = Project::query()->whereNull('project_template_id')->get();
+        $createProjectBaseTemplate = app(CreateProjectBaseTemplate::class);
+
+        foreach ($projects as $project) {
+            $baseTemplate = $createProjectBaseTemplate->handle($project);
+
+            $project->forceFill([
+                'project_template_id' => $baseTemplate->id,
+            ])->save();
+        }
+
+        ProjectTemplate::query()
+            ->whereNull('project_id')
+            ->update(['is_published' => true]);
+    }
+
+    public function down(): void
+    {
+        Project::query()->update(['project_template_id' => null]);
+
+        ProjectTemplate::query()->where('is_published', false)->delete();
+
+        Schema::table('projects', function (Blueprint $table): void {
+            $table->dropConstrainedForeignId('project_template_id');
+        });
+
+        Schema::table('project_templates', function (Blueprint $table): void {
+            $table->dropConstrainedForeignId('project_id');
+            $table->dropColumn('is_published');
+        });
+    }
+};

database/migrations/2026_06_05_161500_move_project_metadata_to_project_templates.php

@@ -0,0 +1,120 @@
+<?php
+
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Models\Project;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Str;
+
+return new class extends Migration
+{
+    /**
+     * @var list<string>
+     */
+    private array $tables = [
+        'board_columns',
+        'ticket_field_definitions',
+        'ticket_link_types',
+        'ticket_priorities',
+        'ticket_statuses',
+        'ticket_types',
+        'repository_connections',
+        'notification_actions',
+    ];
+
+    public function up(): void
+    {
+        foreach ($this->tables as $table) {
+            Schema::table($table, function (Blueprint $table): void {
+                $table->foreignId('project_template_id')
+                    ->nullable()
+                    ->after('project_id')
+                    ->constrained('project_templates')
+                    ->nullOnDelete();
+            });
+        }
+
+        $projects = DB::table('projects')
+            ->leftJoin('project_templates', 'project_templates.id', '=', 'projects.project_template_id')
+            ->select([
+                'projects.id',
+                'projects.key',
+                'projects.name',
+                'projects.project_template_id',
+                'project_templates.project_id as template_project_id',
+                'project_templates.is_published as template_is_published',
+            ])
+            ->get();
+
+        foreach ($projects as $project) {
+            $projectTemplateId = $project->project_template_id;
+
+            if ($projectTemplateId === null || (
+                ! (bool) $project->template_is_published
+                && (int) ($project->template_project_id ?? 0) !== (int) $project->id
+            )) {
+                $projectTemplateId = DB::table('project_templates')->insertGetId([
+                    'project_id' => $project->id,
+                    'source_project_id' => $project->id,
+                    'name' => $project->name.' base template',
+                    'slug' => Str::lower($project->key).'-base-template',
+                    'is_published' => false,
+                    'copy_areas' => json_encode([
+                        'project_settings',
+                        'board_workflow',
+                        'ticket_types',
+                        'ticket_priorities',
+                        'ticket_fields',
+                        'ticket_link_types',
+                        'repository_connections',
+                        'notification_actions',
+                    ], JSON_THROW_ON_ERROR),
+                    'configuration_snapshot' => json_encode([], JSON_THROW_ON_ERROR),
+                    'created_at' => now(),
+                    'updated_at' => now(),
+                ]);
+
+                DB::table('projects')
+                    ->where('id', $project->id)
+                    ->update([
+                        'project_template_id' => $projectTemplateId,
+                        'updated_at' => now(),
+                    ]);
+            }
+
+            foreach ($this->tables as $table) {
+                DB::table($table)
+                    ->where('project_id', $project->id)
+                    ->update(['project_template_id' => $projectTemplateId]);
+            }
+
+            $projectModel = Project::query()->find($project->id);
+
+            if ($projectModel !== null && ! (bool) $project->template_is_published) {
+                DB::table('project_templates')
+                    ->where('id', $projectTemplateId)
+                    ->update([
+                        'configuration_snapshot' => json_encode(
+                            app(DuplicateProjectConfiguration::class)->export(
+                                $projectModel,
+                                DuplicateProjectConfiguration::copyableAreas(),
+                            ),
+                            JSON_THROW_ON_ERROR,
+                        ),
+                        'updated_at' => now(),
+                    ]);
+            }
+        }
+    }
+
+    public function down(): void
+    {
+        foreach (array_reverse($this->tables) as $table) {
+            Schema::table($table, function (Blueprint $table): void {
+                $table->dropConstrainedForeignId('project_template_id');
+            });
+        }
+    }
+};

database/migrations/2026_09_08_091101_add_template_override_tracking_to_projects_table.php

@@ -0,0 +1,63 @@
+<?php
+
+use App\Actions\Projects\DuplicateProjectConfiguration;
+use App\Models\Project;
+use App\Models\ProjectTemplate;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('projects', function (Blueprint $table): void {
+            $table->json('template_overrides')->default('[]')->after('project_template_id');
+        });
+
+        $configuration = app(DuplicateProjectConfiguration::class);
+
+        ProjectTemplate::query()->eachById(function (ProjectTemplate $template) use ($configuration): void {
+            $template->forceFill([
+                'copy_areas' => $configuration->normalizeCopyAreas($template->copy_areas ?? []),
+                'configuration_snapshot' => $configuration->normalizeConfiguration(
+                    $template->configuration_snapshot ?? [],
+                ),
+            ])->saveQuietly();
+        });
+
+        Project::query()
+            ->whereHas('projectTemplate', fn ($query) => $query->where('is_published', true))
+            ->with('projectTemplate')
+            ->eachById(function (Project $project) use ($configuration): void {
+                $templateConfiguration = $configuration->normalizeConfiguration(
+                    $project->projectTemplate?->configuration_snapshot ?? [],
+                );
+                $areas = array_values(array_unique([
+                    ...array_keys($templateConfiguration),
+                    ...DuplicateProjectConfiguration::copyableAreas(),
+                ]));
+                $currentConfiguration = $configuration->export($project, $areas);
+                $overrides = collect($areas)
+                    ->filter(fn (string $area): bool => ! array_key_exists($area, $templateConfiguration)
+                        || ($currentConfiguration[$area] ?? null) !== $templateConfiguration[$area])
+                    ->values()
+                    ->all();
+
+                $project->forceFill(['template_overrides' => $overrides])->saveQuietly();
+            });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('projects', function (Blueprint $table): void {
+            $table->dropColumn('template_overrides');
+        });
+    }
+};

eslint.config.mjs

@@ -25,8 +25,11 @@ const prettierOptions = {
 const eslintConfig = [
     {
         ignores: [
+            'bootstrap/ssr/**',
             '**/dist/**',
-            'node_modules/**',
+            '**/node_modules/**',
+            'native/src-tauri/target/**',
+            'native/src-tauri/gen/**',
             '.github/**',
             '**/*.yml',
             '**/*.yaml',

native/build-ios.mjs

@@ -0,0 +1,509 @@
+import { Buffer } from 'node:buffer';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+    copyFileSync,
+    existsSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    realpathSync,
+    renameSync,
+    rmSync,
+    writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, relative } from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { parseArgs } from 'node:util';
+
+export const appleTeamId = 'ZZX2KZGTHU';
+export const bundleIdentifier = 'de.kanbangit.ios';
+
+const plistReader = `import base64, datetime, json, plistlib, sys
+def encode(value):
+    if isinstance(value, bytes): return base64.b64encode(value).decode()
+    if isinstance(value, datetime.datetime): return value.isoformat() + 'Z'
+    raise TypeError(type(value).__name__)
+print(json.dumps(plistlib.loads(sys.stdin.buffer.read()), default=encode))`;
+
+function execute(command, args, options) {
+    const result = spawnSync(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        input: options.input,
+        encoding: 'utf8',
+        maxBuffer: 32 * 1024 * 1024,
+        stdio: options.inherit ? 'inherit' : 'pipe',
+    });
+    if (result.error || result.status !== 0) {
+        throw new Error(
+            `${options.step} failed: ${result.error?.message || result.stderr?.trim() || `exit ${result.status ?? result.signal}`}`,
+        );
+    }
+    return result.stdout?.trim() || '';
+}
+
+export function validateProfile(profile, mode, now = new Date()) {
+    const entitlements = profile.Entitlements ?? {};
+    if (
+        profile.TeamIdentifier?.length !== 1 ||
+        profile.TeamIdentifier[0] !== appleTeamId ||
+        entitlements['com.apple.developer.team-identifier'] !== appleTeamId ||
+        entitlements['application-identifier'] !==
+            `${appleTeamId}.${bundleIdentifier}`
+    ) {
+        throw new Error(
+            `The profile must explicitly match ${bundleIdentifier} in team ${appleTeamId}.`,
+        );
+    }
+    if (
+        !/^[a-f\d]{8}-(?:[a-f\d]{4}-){3}[a-f\d]{12}$/i.test(profile.UUID) ||
+        !(new Date(profile.ExpirationDate) > now) ||
+        !profile.DeveloperCertificates?.length ||
+        !profile.Platform?.includes('iOS')
+    ) {
+        throw new Error(
+            'The iOS profile is invalid or expired. Download a current profile from your Apple account.',
+        );
+    }
+    if (mode === 'testflight') {
+        if (
+            entitlements['get-task-allow'] !== false ||
+            entitlements['beta-reports-active'] !== true ||
+            'ProvisionedDevices' in profile ||
+            profile.ProvisionsAllDevices
+        ) {
+            throw new Error(
+                'TestFlight requires an App Store Connect profile, not a development, Ad Hoc or enterprise profile.',
+            );
+        }
+    } else if (
+        entitlements['get-task-allow'] !== true ||
+        !profile.ProvisionedDevices?.length ||
+        profile.ProvisionsAllDevices
+    ) {
+        throw new Error(
+            'Device development requires an iOS App Development profile containing your registered device.',
+        );
+    }
+    return profile;
+}
+
+export function selectIdentity(profile, identities, mode) {
+    const fingerprints = profile.DeveloperCertificates.map((certificate) =>
+        createHash('sha1')
+            .update(Buffer.from(certificate, 'base64'))
+            .digest('hex')
+            .toUpperCase(),
+    );
+    const prefix =
+        mode === 'testflight' ? 'Apple Distribution: ' : 'Apple Development: ';
+    const matches = [
+        ...identities.matchAll(/\) ([A-Fa-f\d]{40}) "([^"]+)"/g),
+    ].filter(
+        ([, fingerprint, name]) =>
+            fingerprints.includes(fingerprint.toUpperCase()) &&
+            name.startsWith(prefix),
+    );
+    if (matches.length !== 1) {
+        throw new Error(
+            `The profile must match exactly one usable ${prefix.replace(': ', '')} certificate with its private key in your local keychain. Select a profile containing the intended certificate.`,
+        );
+    }
+    return matches[0][1].toUpperCase();
+}
+
+export function buildIos({
+    mode = 'testflight',
+    env = process.env,
+    platform = process.platform,
+    directory = dirname(fileURLToPath(import.meta.url)),
+    home = homedir(),
+    run = execute,
+    log = console.log,
+    now = new Date(),
+} = {}) {
+    if (!['testflight', 'development', 'simulator'].includes(mode)) {
+        throw new Error('Choose --mode testflight, development or simulator.');
+    }
+    if (platform !== 'darwin') {
+        throw new Error(
+            'iOS builds require a Mac with Xcode, XcodeGen and the matching Rust target installed permanently.',
+        );
+    }
+    if (
+        env.APPLE_DEVELOPMENT_TEAM &&
+        env.APPLE_DEVELOPMENT_TEAM !== appleTeamId
+    ) {
+        throw new Error(`APPLE_DEVELOPMENT_TEAM must be ${appleTeamId}.`);
+    }
+    if (env.TAURI_CONFIG) {
+        throw new Error(
+            'Remove TAURI_CONFIG overrides before building the configured iOS app.',
+        );
+    }
+    const config = JSON.parse(
+        readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
+    );
+    const ios = JSON.parse(
+        readFileSync(join(directory, 'src-tauri/tauri.ios.conf.json'), 'utf8'),
+    );
+    const version = config.version;
+    const buildNumber = ios.bundle?.iOS?.bundleVersion;
+    if (
+        ios.identifier !== bundleIdentifier ||
+        ios.bundle?.iOS?.developmentTeam !== appleTeamId ||
+        config.identifier !== 'de.kanbangit.desktop' ||
+        config.productName !== 'KanbanGit' ||
+        !/^\d+\.\d+\.\d+$/.test(version) ||
+        !/^[1-9]\d*$/.test(buildNumber)
+    ) {
+        throw new Error(
+            'Check the iOS team, bundle identifier, version and positive integer bundleVersion in the Tauri configuration.',
+        );
+    }
+    const simulator = mode === 'simulator';
+    const configuration = mode === 'testflight' ? 'release' : 'debug';
+    const target = simulator ? 'aarch64-apple-ios-sim' : 'aarch64-apple-ios';
+    const sdk = simulator ? 'iphonesimulator' : 'iphoneos';
+    const project = join(directory, 'src-tauri/gen/apple');
+    const targetDirectory = join(directory, 'src-tauri/target');
+    const outputRoot = join(targetDirectory, `ios-${mode}`);
+    const destination = join(outputRoot, `${version}-${buildNumber}`);
+    if (mode === 'testflight' && existsSync(destination)) {
+        throw new Error(
+            `Build output already exists: ${destination}. Move it aside, or increment bundle.iOS.bundleVersion for a new TestFlight upload.`,
+        );
+    }
+    const buildEnv = Object.fromEntries(
+        Object.entries(env).filter(
+            ([key]) =>
+                !key.startsWith('APPLE_') &&
+                !key.startsWith('IOS_') &&
+                !key.startsWith('TAURI_') &&
+                ![
+                    'SDKROOT',
+                    'CARGO_ENCODED_RUSTFLAGS',
+                    'RUSTFLAGS',
+                    'RUSTC_WRAPPER',
+                    'RUSTC_WORKSPACE_WRAPPER',
+                    'XCODE_XCCONFIG_FILE',
+                ].includes(key),
+        ),
+    );
+    function step(label, command, args, options = {}) {
+        log(label);
+        return run(command, args, {
+            cwd: directory,
+            env: buildEnv,
+            step: label,
+            ...options,
+        });
+    }
+    function parsePlist(xml) {
+        return JSON.parse(
+            step(
+                'Reading local plist metadata',
+                'python3',
+                ['-c', plistReader],
+                { input: xml },
+            ),
+        );
+    }
+    function readProfile(path) {
+        return validateProfile(
+            parsePlist(
+                step('Reading provisioning profile', 'security', [
+                    'cms',
+                    '-D',
+                    '-i',
+                    path,
+                ]),
+            ),
+            mode,
+            now,
+        );
+    }
+    step(
+        'Checking XcodeGen (install permanently with brew install xcodegen if missing)',
+        'xcodegen',
+        ['--version'],
+    );
+    step('Checking Xcode', 'xcodebuild', ['-version']);
+    const installedTargets = step('Checking installed Rust targets', 'rustup', [
+        'target',
+        'list',
+        '--installed',
+    ]);
+    if (!installedTargets.split(/\s+/).includes(target)) {
+        throw new Error(
+            `Install the missing target permanently with rustup target add ${target}, then retry.`,
+        );
+    }
+    const cargo = step('Selecting the rustup Cargo toolchain', 'rustup', [
+        'which',
+        'cargo',
+    ]);
+    buildEnv.RUSTC = step('Selecting the matching Rust compiler', 'rustup', [
+        'which',
+        'rustc',
+    ]);
+    buildEnv.PATH = `${dirname(cargo)}:${buildEnv.PATH ?? ''}`;
+    buildEnv.SDKROOT = step('Checking the iOS SDK', 'xcrun', [
+        '--sdk',
+        sdk,
+        '--show-sdk-path',
+    ]);
+    buildEnv.IPHONEOS_DEPLOYMENT_TARGET = ios.bundle.iOS.minimumSystemVersion;
+    buildEnv.CARGO_TARGET_DIR = targetDirectory;
+    let profile;
+    let profilePath;
+    let identity;
+    if (!simulator) {
+        if (
+            !env.IOS_PROVISIONING_PROFILE ||
+            !existsSync(env.IOS_PROVISIONING_PROFILE)
+        ) {
+            throw new Error(
+                'Set IOS_PROVISIONING_PROFILE to your downloaded .mobileprovision file outside the repository. Apple account setup is manual; this command never creates or downloads profiles.',
+            );
+        }
+        profilePath = realpathSync(env.IOS_PROVISIONING_PROFILE);
+        const withinProject = relative(
+            realpathSync(join(directory, '..')),
+            profilePath,
+        );
+        if (
+            !withinProject.startsWith(
+                `..${process.platform === 'win32' ? '\\' : '/'}`,
+            ) &&
+            !isAbsolute(withinProject)
+        ) {
+            throw new Error(
+                'Keep provisioning profiles outside the repository.',
+            );
+        }
+        profile = readProfile(profilePath);
+        identity = selectIdentity(
+            profile,
+            step('Checking local signing identities', 'security', [
+                'find-identity',
+                '-v',
+                '-p',
+                'codesigning',
+            ]),
+            mode,
+        );
+    }
+    mkdirSync(outputRoot, { recursive: true });
+    const working = mkdtempSync(join(outputRoot, '.building-'));
+    let installedProfile;
+    try {
+        if (profile) {
+            const installedPath = join(
+                home,
+                'Library/Developer/Xcode/UserData/Provisioning Profiles',
+                `${profile.UUID}.mobileprovision`,
+            );
+            mkdirSync(dirname(installedPath), { recursive: true });
+            if (existsSync(installedPath)) {
+                if (
+                    !readFileSync(installedPath).equals(
+                        readFileSync(profilePath),
+                    )
+                ) {
+                    throw new Error(
+                        'A different provisioning profile already exists with the same UUID. Resolve it in Xcode before retrying.',
+                    );
+                }
+            } else {
+                copyFileSync(profilePath, installedPath);
+                installedProfile = installedPath;
+            }
+        }
+        step('Generating the Xcode project', 'xcodegen', [
+            'generate',
+            '--spec',
+            join(project, 'project.yml'),
+        ]);
+        step(
+            'Building the iOS Rust library',
+            cargo,
+            [
+                'build',
+                '--manifest-path',
+                join(directory, 'src-tauri/Cargo.toml'),
+                '--lib',
+                '--locked',
+                '--target',
+                target,
+                '--features',
+                'custom-protocol',
+                ...(configuration === 'release' ? ['--release'] : []),
+            ],
+            { inherit: true },
+        );
+        const library = join(
+            targetDirectory,
+            target,
+            configuration,
+            'libkanbangit_native.a',
+        );
+        if (!existsSync(library)) {
+            throw new Error(
+                `The iOS Rust library was not produced: ${library}`,
+            );
+        }
+        buildEnv.KANBANGIT_IOS_LIBRARY = library;
+        const archive = join(working, 'KanbanGit.xcarchive');
+        step(
+            'Archiving locally without Apple provisioning updates',
+            'xcodebuild',
+            [
+                '-project',
+                join(project, 'kanbangit-native.xcodeproj'),
+                '-scheme',
+                'kanbangit-native_iOS',
+                '-configuration',
+                configuration,
+                '-sdk',
+                sdk,
+                '-destination',
+                `generic/platform=${simulator ? 'iOS Simulator' : 'iOS'}`,
+                '-archivePath',
+                archive,
+                '-derivedDataPath',
+                join(targetDirectory, `ios-derived-${mode}`),
+                'archive',
+                `MARKETING_VERSION=${version}`,
+                `CURRENT_PROJECT_VERSION=${buildNumber}`,
+                `DEVELOPMENT_TEAM=${appleTeamId}`,
+                `PRODUCT_BUNDLE_IDENTIFIER=${bundleIdentifier}`,
+                'CODE_SIGN_STYLE=Manual',
+                'ARCHS=arm64',
+                ...(simulator
+                    ? ['CODE_SIGNING_ALLOWED=NO', 'CODE_SIGNING_REQUIRED=NO']
+                    : [
+                          `CODE_SIGN_IDENTITY=${identity}`,
+                          `PROVISIONING_PROFILE_SPECIFIER=${profile.UUID}`,
+                      ]),
+            ],
+            { inherit: true },
+        );
+        function verifyApp(app) {
+            const info = parsePlist(readFileSync(join(app, 'Info.plist')));
+            if (
+                info.CFBundleIdentifier !== bundleIdentifier ||
+                info.CFBundleShortVersionString !== version ||
+                info.CFBundleVersion !== buildNumber
+            ) {
+                throw new Error(
+                    'The built app has an unexpected identifier, version or build number.',
+                );
+            }
+            if (!simulator) {
+                step('Verifying the Apple signature and team', 'codesign', [
+                    '--verify',
+                    '--deep',
+                    '--strict',
+                    '-R',
+                    `=anchor apple generic and identifier "${bundleIdentifier}" and certificate leaf[subject.OU] = "${appleTeamId}" and certificate leaf = H"${identity}" and entitlement["application-identifier"] = "${appleTeamId}.${bundleIdentifier}" and entitlement["com.apple.developer.team-identifier"] = "${appleTeamId}" and ${mode === 'testflight' ? '! ' : ''}entitlement["get-task-allow"] exists${mode === 'testflight' ? ' and entitlement["beta-reports-active"] exists' : ''}`,
+                    app,
+                ]);
+                if (
+                    readProfile(join(app, 'embedded.mobileprovision')).UUID !==
+                    profile.UUID
+                ) {
+                    throw new Error(
+                        'The app was signed with an unexpected provisioning profile.',
+                    );
+                }
+            }
+        }
+        verifyApp(join(archive, 'Products/Applications/KanbanGit.app'));
+        if (!simulator) {
+            const exportOptions = join(working, 'ExportOptions.plist');
+            writeFileSync(
+                exportOptions,
+                JSON.stringify({
+                    method:
+                        mode === 'testflight'
+                            ? 'app-store-connect'
+                            : 'debugging',
+                    destination: 'export',
+                    signingStyle: 'manual',
+                    teamID: appleTeamId,
+                    signingCertificate: identity,
+                    provisioningProfiles: { [bundleIdentifier]: profile.UUID },
+                    manageAppVersionAndBuildNumber: false,
+                }),
+            );
+            step('Preparing local export options', 'plutil', [
+                '-convert',
+                'xml1',
+                exportOptions,
+            ]);
+            step(
+                'Exporting the signed IPA locally (no upload)',
+                'xcodebuild',
+                [
+                    '-exportArchive',
+                    '-archivePath',
+                    archive,
+                    '-exportPath',
+                    join(working, 'export'),
+                    '-exportOptionsPlist',
+                    exportOptions,
+                ],
+                { inherit: true },
+            );
+            const ipa = join(working, 'export/KanbanGit.ipa');
+            if (!existsSync(ipa)) {
+                throw new Error('Xcode did not produce the signed IPA.');
+            }
+            const extracted = join(working, 'verify');
+            step('Verifying the exported IPA contents', 'ditto', [
+                '-x',
+                '-k',
+                ipa,
+                extracted,
+            ]);
+            verifyApp(join(extracted, 'Payload/KanbanGit.app'));
+            rmSync(extracted, { recursive: true, force: true });
+            writeFileSync(
+                `${ipa}.sha256`,
+                `${createHash('sha256').update(readFileSync(ipa)).digest('hex')}  KanbanGit.ipa\n`,
+            );
+        }
+        if (mode !== 'testflight') {
+            rmSync(destination, { recursive: true, force: true });
+        }
+        renameSync(working, destination);
+        log(`Verified local ${mode} build: ${destination}`);
+        return destination;
+    } catch (error) {
+        log(`Build did not complete. Diagnostic output remains in ${working}`);
+        throw error;
+    } finally {
+        if (installedProfile) {
+            rmSync(installedProfile);
+        }
+    }
+}
+
+if (
+    process.argv[1] &&
+    import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+    try {
+        const { values } = parseArgs({
+            options: { mode: { type: 'string', default: 'testflight' } },
+        });
+        buildIos({ mode: values.mode });
+    } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+    }
+}

native/macos-ci.mjs

@@ -0,0 +1,267 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+    appendFileSync,
+    copyFileSync,
+    readlinkSync,
+    existsSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    renameSync,
+    rmSync,
+    writeFileSync,
+} from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import process from 'node:process';
+import { updateSource } from './update-manifest.mjs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import {
+    appleTeamId,
+    bundleIdentifier,
+    verifySignedMacosApp,
+} from './release-macos.mjs';
+
+const nativeDirectory = dirname(fileURLToPath(import.meta.url));
+
+export function releaseMetadata(
+    env = process.env,
+    directory = nativeDirectory,
+) {
+    const config = JSON.parse(
+        readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
+    );
+    const nativePackage = JSON.parse(
+        readFileSync(join(directory, 'package.json'), 'utf8'),
+    );
+    const packageVersion = nativePackage.version;
+    const cargoVersion = readFileSync(
+        join(directory, 'src-tauri/Cargo.toml'),
+        'utf8',
+    )
+        .match(/\[package\]([\s\S]*?)(?:\n\[|$)/)?.[1]
+        .match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+    if (
+        !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(config.version) ||
+        config.version !== packageVersion ||
+        config.version !== cargoVersion
+    ) {
+        throw new Error(
+            'Tauri, package.json and Cargo.toml must have the same stable release version.',
+        );
+    }
+    if (env.RELEASE_TAG !== `macos-v${config.version}`) {
+        throw new Error(
+            'Release tag must be macos-vMAJOR.MINOR.PATCH and match the app version.',
+        );
+    }
+    if (
+        config.identifier !== bundleIdentifier ||
+        config.productName !== 'KanbanGit'
+    ) {
+        throw new Error(
+            'The macOS product name and bundle identifier must stay unchanged.',
+        );
+    }
+    if (config.plugins?.updater?.pubkey !== updateSource.publicKey) {
+        throw new Error(
+            'The app updater key must match the permanent release key.',
+        );
+    }
+    if (
+        !/^\d+(?:\.\d+){0,2}$/.test(config.bundle?.macOS?.bundleVersion || '')
+    ) {
+        throw new Error(
+            'Set a numeric macOS bundleVersion for the About build number.',
+        );
+    }
+    if (!nativePackage.releaseNotes?.trim()) {
+        throw new Error(
+            'Add releaseNotes to native/package.json before publishing.',
+        );
+    }
+    const target = env.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin';
+    const arch = {
+        'aarch64-apple-darwin': 'arm64',
+        'x86_64-apple-darwin': 'x86_64',
+    }[target];
+    if (!arch) {
+        throw new Error(
+            'MACOS_RELEASE_TARGET must select Apple Silicon or Intel macOS.',
+        );
+    }
+    const identity = env.APPLE_SIGNING_IDENTITY;
+    if (
+        !identity?.startsWith('Developer ID Application: ') ||
+        !identity.endsWith(` (${appleTeamId})`) ||
+        /[\r\n"]/.test(identity)
+    ) {
+        throw new Error(
+            `A Developer ID Application identity for ${appleTeamId} is required.`,
+        );
+    }
+    return {
+        version: config.version,
+        notes: nativePackage.releaseNotes,
+        target,
+        arch,
+        filename: `KanbanGit-${config.version}-${target}.dmg`,
+        updaterFilename: `KanbanGit-${config.version}-${target}.app.tar.gz`,
+    };
+}
+
+export function execute(command, args) {
+    const result = spawnSync(command, args, {
+        encoding: 'utf8',
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    if (result.error || result.status !== 0) {
+        throw new Error(
+            `${command} failed (exit ${result.status ?? 'unknown'}). ${result.stderr || ''}`,
+        );
+    }
+    return result.stdout?.trim() || result.stderr?.trim() || '';
+}
+
+export function verifyNotarizedApp(app, metadata, run = execute) {
+    verifySignedMacosApp({
+        app,
+        version: metadata.version,
+        step: (_label, command, args) => run(command, args),
+    });
+    const arch = run('lipo', [
+        '-archs',
+        join(app, 'Contents/MacOS/kanbangit-native'),
+    ]).trim();
+    if (arch !== metadata.arch) {
+        throw new Error(
+            'The app architecture does not match its download path.',
+        );
+    }
+    run('xcrun', ['stapler', 'validate', app]);
+    run('spctl', ['--assess', '--type', 'execute', '--verbose=2', app]);
+}
+
+export function packageNotarizedApp({
+    env = process.env,
+    directory = nativeDirectory,
+    run = execute,
+} = {}) {
+    const metadata = releaseMetadata(env, directory);
+    const root = join(directory, 'src-tauri/target');
+    const app = join(
+        root,
+        metadata.target,
+        'release/bundle/macos/KanbanGit.app',
+    );
+    verifyNotarizedApp(app, metadata, run);
+    const releaseRoot = join(root, 'macos-release');
+    const destination = join(
+        releaseRoot,
+        `${metadata.version}-${metadata.target}`,
+    );
+    if (existsSync(destination)) {
+        throw new Error(
+            'Release output already exists; start from a clean checkout.',
+        );
+    }
+    mkdirSync(releaseRoot, { recursive: true });
+    const staging = mkdtempSync(join(releaseRoot, '.pending-'));
+    try {
+        const archive = join(staging, metadata.filename);
+        const bundle = join(root, metadata.target, 'release/bundle');
+        copyFileSync(
+            join(
+                bundle,
+                'dmg',
+                `KanbanGit_${metadata.version}_${metadata.arch === 'arm64' ? 'aarch64' : 'x64'}.dmg`,
+            ),
+            archive,
+        );
+        const mounted = join(staging, 'mounted');
+        mkdirSync(mounted);
+        run('hdiutil', ['verify', archive]);
+        run('hdiutil', [
+            'attach',
+            archive,
+            '-readonly',
+            '-nobrowse',
+            '-mountpoint',
+            mounted,
+        ]);
+        try {
+            if (
+                readlinkSync(join(mounted, 'Applications')) !== '/Applications'
+            ) {
+                throw new Error(
+                    'DMG must contain the Applications installation link.',
+                );
+            }
+            verifyNotarizedApp(join(mounted, 'KanbanGit.app'), metadata, run);
+        } finally {
+            run('hdiutil', ['detach', mounted]);
+        }
+        rmSync(mounted, { recursive: true, force: true });
+        const updateArchive = join(staging, metadata.updaterFilename);
+        copyFileSync(join(bundle, 'macos/KanbanGit.app.tar.gz'), updateArchive);
+        copyFileSync(
+            join(bundle, 'macos/KanbanGit.app.tar.gz.sig'),
+            `${updateArchive}.sig`,
+        );
+        if (!readFileSync(`${updateArchive}.sig`, 'utf8').trim()) {
+            throw new Error('The updater signature is missing.');
+        }
+        const extracted = join(staging, 'extracted');
+        mkdirSync(extracted);
+        run('tar', ['-xzf', updateArchive, '-C', extracted]);
+        verifyNotarizedApp(join(extracted, 'KanbanGit.app'), metadata, run);
+        rmSync(extracted, { recursive: true, force: true });
+        const checksum = createHash('sha256')
+            .update(readFileSync(archive))
+            .digest('hex');
+        for (const name of [metadata.filename, metadata.updaterFilename]) {
+            const hash = createHash('sha256')
+                .update(readFileSync(join(staging, name)))
+                .digest('hex');
+            writeFileSync(
+                join(staging, `${name}.sha256`),
+                `${hash}  ${name}\n`,
+            );
+        }
+        renameSync(staging, destination);
+        return { ...metadata, directory: destination, checksum };
+    } finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+}
+
+if (
+    process.argv[1] &&
+    import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+    try {
+        let output;
+        if (process.argv[2] === 'metadata') {
+            output = releaseMetadata();
+        } else if (process.argv[2] === 'package') {
+            output = packageNotarizedApp();
+        } else {
+            throw new Error(
+                'Use metadata or package. Building and notarizing are handled by tauri-action.',
+            );
+        }
+        if (process.env.GITHUB_OUTPUT) {
+            appendFileSync(
+                process.env.GITHUB_OUTPUT,
+                Object.entries(output)
+                    .filter(([key]) => key !== 'notes')
+                    .map(([key, value]) => `${key}=${value}\n`)
+                    .join(''),
+            );
+        }
+        console.log(JSON.stringify(output));
+    } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+    }
+}