feat: formatted text, a list view, ticket details, public proposals and votes

Formatted text
- Descriptions, comments, replies and release notes render Markdown,
  sanitised with DOMPurify (tested against scripts, handlers and
  javascript: links). A pasted image is uploaded and written as
  ![name](attachment:<id>); the web fetches it with the reader's session,
  so it works on private projects. Every text box has a preview. The
  attachment upload now answers its attachmentId.

List view
- /p/:key/list: every ticket as rows, sortable by any column, filtered by
  text, open/closed, type, priority and assignee; status, priority and
  assignee change in place; bulk edit (the backlog's bar, now shared).

Ticket details
- Reactions on comments (GitHub's eight), for members and viewers.
- Duplicate a ticket: what it says, not where it stands.
- blockedBy: open tickets it waits for (BLOCKS / DEPENDS_ON), worked out
  when reading with one query per board or page; shown on cards, list
  rows and the ticket.

Public proposals
- A public project can take bug reports and ideas from anyone
  (acceptsProposals): POST /api/explore/projects/{project}/proposals and
  the form at /p/:key/proponer. They become tickets labelled «propuesta»,
  opened by TaskStream; a honeypot field and 5 per address every 15
  minutes keep spam out. No e-mail is asked: it would be public.

Votes
- Anyone signed in votes on a public project's tickets, members on a
  private one (voteIssue, PUT/DELETE /api/issues/{issue}/vote): votes and
  voted on each ticket, buttons on the ticket and the roadmap, a column
  in the list. The showcase carries votes and the open proposals.

MCP: vote_issue, duplicate_issue, react_to_comment; listings show
blockers and votes. Docs, Word and PDF updated; chat notifications
(Discord, Slack, Telegram) noted for later.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/application/src/lib/commands/attach-file.command-handler.ts

@@ -2,8 +2,8 @@ import { randomUUID } from 'node:crypto';
 import { CommandHandler, ICommandHandler } from '@nestjs/cqrs';
 import { BusinessRuleError } from '@task-stream/api/shared/domain';
 import { AttachmentStorage, attachmentKey } from '../ports/attachment-storage';
-import { AttachFileCommand } from './attach-file.command';
-import { CommandResult, ack } from './command-result';
+import { AttachFileCommand, AttachmentResult } from './attach-file.command';
+import { ack } from './command-result';
 import { WriteAccess } from './write-access';
 
 /**
@@ -19,7 +19,7 @@ export class AttachFileCommandHandler
     private readonly storage: AttachmentStorage,
   ) {}
 
-  async execute(command: AttachFileCommand): Promise<CommandResult> {
+  async execute(command: AttachFileCommand): Promise<AttachmentResult> {
     const { issue } = await this.access.issueForContributor(
       command.issueId,
       command.actorId,
@@ -52,6 +52,7 @@ export class AttachFileCommandHandler
       await this.storage.remove(key);
       throw error;
     }
-    return ack(issue);
+    // The id lets a client point at the file, e.g. an image inside a comment.
+    return { ...ack(issue), attachmentId: id };
   }
 }

libs/api/tracker/application/src/lib/commands/attach-file.command.ts

@@ -7,7 +7,12 @@ export interface IncomingFile {
   content: Buffer;
 }
 
-export class AttachFileCommand extends Command<CommandResult> {
+/** The ticket's acknowledgement, and the id of the file now on it. */
+export interface AttachmentResult extends CommandResult {
+  attachmentId: string;
+}
+
+export class AttachFileCommand extends Command<AttachmentResult> {
   constructor(
     public readonly actorId: string,
     public readonly issueId: string,

libs/api/tracker/application/src/lib/commands/command-handlers.ts

@@ -1,3 +1,7 @@
+import { DuplicateIssueCommandHandler } from './duplicate-issue.command-handler';
+import { ReactToCommentCommandHandler } from './react-to-comment.command-handler';
+import { VoteIssueCommandHandler } from './vote-issue.command-handler';
+import { SubmitProposalCommandHandler } from './submit-proposal.command-handler';
 import { CreateProjectCommandHandler } from './create-project.command-handler';
 import { UpdateProjectCommandHandler } from './update-project.command-handler';
 import { UpdateProjectSettingsCommandHandler } from './update-project-settings.command-handler';
@@ -42,6 +46,10 @@ import {
 } from './change-checklist.command-handler';
 
 export const COMMAND_HANDLERS = [
+  SubmitProposalCommandHandler,
+  VoteIssueCommandHandler,
+  ReactToCommentCommandHandler,
+  DuplicateIssueCommandHandler,
   CreateProjectCommandHandler,
   UpdateProjectCommandHandler,
   UpdateProjectSettingsCommandHandler,

libs/api/tracker/application/src/lib/commands/commands.spec.ts

@@ -16,6 +16,7 @@ import {
   Issue,
   IssueStatus,
   Project,
+  IssuePriority,
   IssueType,
   ProjectRole,
   TRACKER_FACTORIES,
@@ -74,6 +75,11 @@ import { ReleaseNamesRepository } from '../ports/release-names.repository';
 import { UserDirectory } from '../ports/user-directory';
 import { AttachmentStorage } from '../ports/attachment-storage';
 import { AddCommentCommand } from './add-comment.command';
+import { DuplicateIssueCommand } from './duplicate-issue.command';
+import { ReactToCommentCommand } from './react-to-comment.command';
+import { UpdateProjectCommand } from './update-project.command';
+import { SubmitProposalCommand } from './submit-proposal.command';
+import { VoteIssueCommand } from './vote-issue.command';
 import { AddProjectMemberCommand } from './add-project-member.command';
 import { AssignIssueCommand } from './assign-issue.command';
 import { AttachFileCommand } from './attach-file.command';
@@ -97,6 +103,10 @@ import { FindProjectsRepository } from '../ports/find-projects.repository';
 
 async function setup() {
   const store = new InMemoryEventStore();
+  const projectViews = new Map<
+    string,
+    { id: string; key: string; isPublic: boolean; acceptsProposals: boolean }
+  >();
   // The project's Git repositories, as Mongo would keep them.
   const gitRepositories = new Map<string, GitRepositoryConfig[]>();
   const git: GitIntegrationsRepository = {
@@ -129,7 +139,13 @@ async function setup() {
       ReadAccess,
       {
         provide: FindProjectsRepository,
-        useValue: { findRole: async () => null, findById: async () => null },
+        // Read-model lookups: projects are added by the tests that need them.
+        useValue: {
+          findRole: async () => null,
+          findById: async (id: string) => projectViews.get(id) ?? null,
+          findByKey: async (key: string) =>
+            [...projectViews.values()].find((p) => p.key === key) ?? null,
+        },
       },
       { provide: GitIntegrationsRepository, useValue: git },
       AggregateRehydrator,
@@ -177,6 +193,7 @@ async function setup() {
     sprints,
     keys,
     git,
+    projectViews,
     run,
     rehydrator: moduleRef.get(AggregateRehydrator),
   };
@@ -832,6 +849,133 @@ describe('tracker commands (event sourced)', () => {
     expect(rebuilt.deleted).toBe(true);
   });
 
+  it('duplicates what a ticket says, not where it stands', async () => {
+    const { run, rehydrator } = await setup();
+    const projectId = await projectWithTeam(run);
+    const original = await run(
+      new CreateIssueCommand(
+        'dev',
+        projectId,
+        IssueType.BUG,
+        'Pago roto',
+        {
+          description: 'Falla en Safari',
+          priority: IssuePriority.HIGH,
+          labels: ['pagos'],
+          storyPoints: 3,
+        },
+        'qa',
+      ),
+    );
+    await run(new AddChecklistItemCommand('dev', original.id, 'Reproducir'));
+
+    const copy = await run(new DuplicateIssueCommand('qa', original.id));
+    expect(copy.key).not.toBe(original.key);
+    const issue = await rehydrator.rehydrate(copy.id, Issue);
+    expect(issue).toMatchObject({
+      title: 'Pago roto (copia)',
+      description: 'Falla en Safari',
+      priority: IssuePriority.HIGH,
+      labels: ['pagos'],
+      storyPoints: 3,
+      assigneeId: null,
+      reporterId: 'qa',
+    });
+    expect(issue.checklist.map((s) => [s.text, s.done])).toEqual([
+      ['Reproducir', false],
+    ]);
+    await expect(
+      run(new DuplicateIssueCommand('pm', original.id)),
+    ).rejects.toThrow(ForbiddenError);
+  });
+
+  it('takes reactions from members, once each, viewers included', async () => {
+    const { run, rehydrator } = await setup();
+    const projectId = await projectWithTeam(run);
+    const issue = await run(
+      new CreateIssueCommand('dev', projectId, IssueType.TASK, 'Spike', {}),
+    );
+    const comment = await run(new AddCommentCommand('dev', issue.id, 'Redis'));
+    await run(new ReactToCommentCommand('qa', comment.id, '👍', true));
+    await run(new ReactToCommentCommand('pm', comment.id, '👍', true));
+    await run(new ReactToCommentCommand('pm', comment.id, '👍', true));
+    await run(new ReactToCommentCommand('dev', comment.id, '🎉', true));
+    await run(new ReactToCommentCommand('dev', comment.id, '🎉', false));
+    expect((await rehydrator.rehydrate(comment.id, Comment)).reactions).toEqual(
+      { '👍': ['qa', 'pm'] },
+    );
+    await expect(
+      run(new ReactToCommentCommand('qa', comment.id, '💩', true)),
+    ).rejects.toThrow(ValidationError);
+    await expect(
+      run(new ReactToCommentCommand('stranger', comment.id, '👍', true)),
+    ).rejects.toThrow(ForbiddenError);
+  });
+
+  it('takes votes from members, and from anyone once it is public', async () => {
+    const { run, rehydrator } = await setup();
+    const projectId = await projectWithTeam(run);
+    const issue = await run(
+      new CreateIssueCommand(
+        'dev',
+        projectId,
+        IssueType.FEATURE,
+        'Modo oscuro',
+        {},
+      ),
+    );
+    await run(new VoteIssueCommand('pm', issue.id, true));
+    await run(new VoteIssueCommand('pm', issue.id, true));
+    await expect(
+      run(new VoteIssueCommand('stranger', issue.id, true)),
+    ).rejects.toThrow(ForbiddenError);
+
+    await run(new UpdateProjectCommand('owner', projectId, { isPublic: true }));
+    await run(new VoteIssueCommand('stranger', issue.id, true));
+    await run(new VoteIssueCommand('pm', issue.id, false));
+    expect((await rehydrator.rehydrate(issue.id, Issue)).voterIds).toEqual([
+      'stranger',
+    ]);
+  });
+
+  it('turns a proposal into a ticket, only where the project takes them', async () => {
+    const { run, rehydrator, projectViews } = await setup();
+    const projectId = await projectWithTeam(run);
+    const view = {
+      id: projectId,
+      key: 'TS',
+      isPublic: true,
+      acceptsProposals: false,
+    };
+    projectViews.set(projectId, view);
+    const propose = () =>
+      run(
+        new SubmitProposalCommand(
+          'ts',
+          'BUG',
+          'No carga en Firefox',
+          'Pantalla en blanco',
+          'Lucía',
+        ),
+      );
+    await expect(propose()).rejects.toThrow(ForbiddenError);
+
+    view.acceptsProposals = true;
+    const result = await propose();
+    const issue = await rehydrator.rehydrate(result.id, Issue);
+    expect(issue).toMatchObject({
+      title: 'No carga en Firefox',
+      type: IssueType.BUG,
+      labels: ['propuesta'],
+      reporterId: 'system',
+    });
+    expect(issue.description).toContain('Pantalla en blanco');
+    expect(issue.description).toContain('por Lucía');
+
+    view.isPublic = false;
+    await expect(propose()).rejects.toThrow(NotFoundError);
+  });
+
   it('answers comments one level deep, on the same ticket', async () => {
     const { run, rehydrator } = await setup();
     const projectId = await projectWithTeam(run);

libs/api/tracker/application/src/lib/commands/create-issue.command-handler.ts

@@ -1,6 +1,10 @@
 import { randomUUID } from 'node:crypto';
 import { CommandHandler, EventPublisher, ICommandHandler } from '@nestjs/cqrs';
-import { IssueFactory, assertCanNest } from '@task-stream/api/tracker/domain';
+import {
+  IssueFactory,
+  SYSTEM_ACTOR_ID,
+  assertCanNest,
+} from '@task-stream/api/tracker/domain';
 import { IssueNumbersRepository } from '../ports/issue-numbers.repository';
 import { CommandResult, ack } from './command-result';
 import { CreateIssueCommand } from './create-issue.command';
@@ -21,7 +25,10 @@ export class CreateIssueCommandHandler
 
   async execute(command: CreateIssueCommand): Promise<CommandResult> {
     const project = await this.access.project(command.projectId);
-    project.assertCanContribute(command.actorId);
+    // TaskStream itself (proposals from the public form) is no member; only
+    // internal commands act as it, never a request from outside.
+    if (command.actorId !== SYSTEM_ACTOR_ID)
+      project.assertCanContribute(command.actorId);
     // Before taking a number: an invalid type or area must not burn one.
     const workflow = project.workflow;
     workflow.assertActiveType(command.type);

libs/api/tracker/application/src/lib/commands/duplicate-issue.command-handler.ts

@@ -0,0 +1,61 @@
+import { CommandBus, CommandHandler, ICommandHandler } from '@nestjs/cqrs';
+import { AddChecklistItemCommand } from './change-checklist.command';
+import { CommandResult } from './command-result';
+import { CreateIssueCommand } from './create-issue.command';
+import { DuplicateIssueCommand } from './duplicate-issue.command';
+import { WriteAccess } from './write-access';
+
+/**
+ * Copies what a ticket says (type, title, description, area, priority,
+ * labels, Figma, estimate, dates, parent and checklist steps, unticked),
+ * not where it stands: the copy starts in the first status, unassigned,
+ * out of sprints and releases, without comments or files. Created through
+ * the usual command, so the same rules and events apply.
+ */
+@CommandHandler(DuplicateIssueCommand)
+export class DuplicateIssueCommandHandler
+  implements ICommandHandler<DuplicateIssueCommand>
+{
+  constructor(
+    private readonly access: WriteAccess,
+    private readonly commandBus: CommandBus,
+  ) {}
+
+  async execute(command: DuplicateIssueCommand): Promise<CommandResult> {
+    const { issue } = await this.access.issueForContributor(
+      command.issueId,
+      command.actorId,
+    );
+    const copy: CommandResult = await this.commandBus.execute(
+      new CreateIssueCommand(
+        command.actorId,
+        issue.projectId,
+        issue.type,
+        `${issue.title} (copia)`.slice(0, 255),
+        {
+          description: issue.description,
+          area: issue.area,
+          priority: issue.priority,
+          labels: issue.labels,
+          figmaUrl: issue.figmaUrl,
+          storyPoints: issue.storyPoints,
+          startDate: issue.startDate,
+          dueDate: issue.dueDate,
+        },
+        null,
+        null,
+        issue.parentId,
+        null,
+        // The original's text is the content, not the type's template.
+        false,
+      ),
+    );
+    let result = copy;
+    for (const step of issue.checklist) {
+      result = await this.commandBus.execute(
+        new AddChecklistItemCommand(command.actorId, copy.id, step.text),
+      );
+    }
+    return { ...result, key: copy.key };
+  }
+}

libs/api/tracker/application/src/lib/commands/duplicate-issue.command.ts

@@ -0,0 +1,12 @@
+import { Command } from '@nestjs/cqrs';
+import { CommandResult } from './command-result';
+
+/** A new ticket like this one, to start from: the copy's key in the result. */
+export class DuplicateIssueCommand extends Command<CommandResult> {
+  constructor(
+    public readonly actorId: string,
+    public readonly issueId: string,
+  ) {
+    super();
+  }
+}

libs/api/tracker/application/src/lib/commands/index.ts

@@ -6,6 +6,11 @@ export * from './assign-issue.command';
 export * from './change-issue-status.command';
 export * from './change-project-member-role.command';
 export * from './create-issue.command';
+export * from './duplicate-issue.command';
+export * from './react-to-comment.command';
+export * from './vote-issue.command';
+export * from './submit-proposal.command';
+export { PROPOSAL_LABEL } from './submit-proposal.command-handler';
 export * from './create-project.command';
 export * from './create-release.command';
 export * from './delete-comment.command';

libs/api/tracker/application/src/lib/commands/react-to-comment.command-handler.ts

@@ -0,0 +1,25 @@
+import { CommandHandler, ICommandHandler } from '@nestjs/cqrs';
+import { ForbiddenError } from '@task-stream/api/shared/domain';
+import { CommandResult, ack } from './command-result';
+import { ReactToCommentCommand } from './react-to-comment.command';
+import { WriteAccess } from './write-access';
+
+/** Reacting is for members, viewers included: reading is enough to agree. */
+@CommandHandler(ReactToCommentCommand)
+export class ReactToCommentCommandHandler
+  implements ICommandHandler<ReactToCommentCommand>
+{
+  constructor(private readonly access: WriteAccess) {}
+
+  async execute(command: ReactToCommentCommand): Promise<CommandResult> {
+    const comment = await this.access.comment(command.commentId);
+    const project = await this.access.project(comment.projectId);
+    if (!project.isMember(command.actorId))
+      throw new ForbiddenError(
+        `You are not a member of project ${project.key}`,
+      );
+    comment.react(command.actorId, command.emoji, command.on);
+    await comment.commitAndWait();
+    return ack(comment);
+  }
+}

libs/api/tracker/application/src/lib/commands/react-to-comment.command.ts

@@ -0,0 +1,14 @@
+import { Command } from '@nestjs/cqrs';
+import { CommandResult } from './command-result';
+
+/** Adds (`on`) or takes back one's reaction (👍…) on a comment. */
+export class ReactToCommentCommand extends Command<CommandResult> {
+  constructor(
+    public readonly actorId: string,
+    public readonly commentId: string,
+    public readonly emoji: string,
+    public readonly on: boolean,
+  ) {
+    super();
+  }
+}

libs/api/tracker/application/src/lib/commands/submit-proposal.command-handler.ts

@@ -0,0 +1,82 @@
+import { CommandBus, CommandHandler, ICommandHandler } from '@nestjs/cqrs';
+import {
+  ForbiddenError,
+  NotFoundError,
+  assertThat,
+} from '@task-stream/api/shared/domain';
+import {
+  IssuePriority,
+  SYSTEM_ACTOR_ID,
+} from '@task-stream/api/tracker/domain';
+import { FindProjectsRepository } from '../ports/find-projects.repository';
+import { CommandResult } from './command-result';
+import { CreateIssueCommand } from './create-issue.command';
+import { ProposalKind, SubmitProposalCommand } from './submit-proposal.command';
+import { WriteAccess } from './write-access';
+
+/** The label every proposal carries, for the team to find and sort them. */
+export const PROPOSAL_LABEL = 'propuesta';
+
+/** Preferred ticket type of each kind, when the project has it active. */
+const TYPE_OF: Record<ProposalKind, string> = { BUG: 'BUG', IDEA: 'FEATURE' };
+
+/**
+ * Only a public project that takes proposals accepts one. It is opened by
+ * TaskStream (nobody signed in), in the first status, as a Bug or a Feature
+ * (or the first active type if the project has neither), and signed with
+ * the name they gave, if any.
+ */
+@CommandHandler(SubmitProposalCommand)
+export class SubmitProposalCommandHandler
+  implements ICommandHandler<SubmitProposalCommand>
+{
+  constructor(
+    private readonly findProjects: FindProjectsRepository,
+    private readonly access: WriteAccess,
+    private readonly commandBus: CommandBus,
+  ) {}
+
+  async execute(command: SubmitProposalCommand): Promise<CommandResult> {
+    const found =
+      (await this.findProjects.findById(command.project)) ??
+      (await this.findProjects.findByKey(command.project.toUpperCase()));
+    if (!found?.isPublic) throw new NotFoundError('Project', command.project);
+    if (!found.acceptsProposals)
+      throw new ForbiddenError(`${found.key} does not take proposals`);
+
+    const title = command.title.trim();
+    assertThat(
+      title.length >= 3 && title.length <= 150,
+      'A proposal needs a title of 3 to 150 characters',
+    );
+    const text = command.description.trim();
+    assertThat(text.length <= 5000, 'A proposal is 5000 characters at most');
+
+    const project = await this.access.project(found.id);
+    const active = project.settings.issueTypes.filter((t) => !t.archived);
+    const type =
+      active.find((t) => t.id === TYPE_OF[command.kind])?.id ?? active[0]?.id;
+    const author = command.author?.trim().slice(0, 80);
+    const signature = `_Propuesta enviada desde el formulario público${author ? ` por ${author}` : ''}._`;
+
+    return this.commandBus.execute(
+      new CreateIssueCommand(
+        SYSTEM_ACTOR_ID,
+        project.id,
+        type,
+        title,
+        {
+          description: text ? `${text}\n\n${signature}` : signature,
+          labels: [PROPOSAL_LABEL],
+          priority: IssuePriority.MEDIUM,
+        },
+        null,
+        null,
+        null,
+        null,
+        // What they wrote is the content, not the type's template.
+        false,
+      ),
+    );
+  }
+}

libs/api/tracker/application/src/lib/commands/submit-proposal.command.ts

@@ -0,0 +1,22 @@
+import { Command } from '@nestjs/cqrs';
+import { CommandResult } from './command-result';
+
+export type ProposalKind = 'BUG' | 'IDEA';
+
+/**
+ * A bug report or an idea from anyone, through a public project's form:
+ * it becomes a ticket labelled `propuesta`, for the team to look at.
+ */
+export class SubmitProposalCommand extends Command<CommandResult> {
+  constructor(
+    /** Project id or key. */
+    public readonly project: string,
+    public readonly kind: ProposalKind,
+    public readonly title: string,
+    public readonly description: string,
+    /** How they sign it, if they want to: shown in the ticket. */
+    public readonly author: string | null,
+  ) {
+    super();
+  }
+}

libs/api/tracker/application/src/lib/commands/update-project.command.ts

@@ -9,6 +9,7 @@ export class UpdateProjectCommand extends Command<CommandResult> {
       name?: string;
       description?: string | null;
       isPublic?: boolean;
+      acceptsProposals?: boolean;
     },
   ) {
     super();

libs/api/tracker/application/src/lib/commands/vote-issue.command-handler.ts

@@ -0,0 +1,33 @@
+import { CommandHandler, ICommandHandler } from '@nestjs/cqrs';
+import {
+  BusinessRuleError,
+  ForbiddenError,
+} from '@task-stream/api/shared/domain';
+import { CommandResult, ack } from './command-result';
+import { VoteIssueCommand } from './vote-issue.command';
+import { WriteAccess } from './write-access';
+
+/**
+ * Anyone signed in votes on a public project's tickets (that is the point:
+ * the people it is for say what they want); on a private one, its members.
+ */
+@CommandHandler(VoteIssueCommand)
+export class VoteIssueCommandHandler
+  implements ICommandHandler<VoteIssueCommand>
+{
+  constructor(private readonly access: WriteAccess) {}
+
+  async execute(command: VoteIssueCommand): Promise<CommandResult> {
+    const issue = await this.access.issue(command.issueId);
+    const project = await this.access.project(issue.projectId);
+    if (!project.isPublic && !project.isMember(command.actorId))
+      throw new ForbiddenError(
+        `You are not a member of project ${project.key}`,
+      );
+    if (issue.trashedAt)
+      throw new BusinessRuleError(`${issue.key} is in the trash`);
+    issue.vote(command.actorId, command.on);
+    await issue.commitAndWait();
+    return ack(issue);
+  }
+}

libs/api/tracker/application/src/lib/commands/vote-issue.command.ts

@@ -0,0 +1,13 @@
+import { Command } from '@nestjs/cqrs';
+import { CommandResult } from './command-result';
+
+/** The actor votes for a ticket (`on`) or takes the vote back. */
+export class VoteIssueCommand extends Command<CommandResult> {
+  constructor(
+    public readonly actorId: string,
+    public readonly issueId: string,
+    public readonly on: boolean,
+  ) {
+    super();
+  }
+}