# Conflicts:
#	tests/ArchTest.php

…tests

- Fix middleware priority: SetApiTeamContext runs before SubstituteBindings
- Add Gate::authorize() to show() methods for defense-in-depth
- Scope exists validation rules to prevent cross-tenant references
- Remove duplicate throttle middleware from API routes
- Return 201 status for store() endpoints
- Integrate spatie/laravel-query-builder for declarative filtering/sorting
- Add sort column allowlists via allowedSorts()
- Update MCP tools for new List action signatures
- Improve tests with fluent AssertableJson, assertInvalid(), whereType()
- Add missing() assertions to verify no sensitive data leaks
- Add cross-tenant isolation tests for all 5 resources
- Simplify FormatsCustomFields with mapWithKeys()
- Remove dead class_exists guard in UpdateTask

- Remove unnecessary parentheses around new Resource() calls in store methods
- Use explicit instanceof Team check in SetApiTeamContext middleware
- Add return type to arrow function in FormatsCustomFields trait

Move all user-facing 'API Token' strings to lang/en/access-tokens.php
and rename to 'Access Tokens' throughout. Covers Filament page,
Livewire components, Blade templates, and user menu.

- Clamp per_page to minimum of 1 in all List actions to prevent invalid pagination
- Use Js::from() for clipboard JS string escaping in View pages
- Fix entity_type 'person' to 'people' in CustomFieldsApiTest to match morph map
- Add PersonalAccessToken to arch test ignore list (Sanctum mocks prevent final)

…thods for consistent authorization

…r creating() methods

…ureTokenHasAbility

…n Note and Task

…copes

Covers 5 targeted refactors from PR #136 code review:
- Remove redundant Gate::authorize() from controllers
- Move eager-loading into actions
- Create IndexRequest for per_page validation
- Fix FormatsCustomFields return type consistency

The ValidatesCustomFields trait called toRules() with raw request input
during rule construction, before validation could reject non-array types.
Sending custom_fields as a string or integer caused a TypeError crash
(500) instead of a validation error (422).

Guard with is_array() check and change nullable to sometimes.

Layered rate limiting: per-team ceiling (600/min), per-token
reads (300/min) and writes (60/min). Currently the api/mcp
rate limiters are defined but never applied.

6 tasks covering authorization cleanup, eager-loading, IndexRequest,
FormatsCustomFields return type, and layered rate limiting.

…idation, rate limiting

- Remove redundant Gate::authorize() from controllers (actions self-authorize)
- Move customFieldValues eager-loading from controllers into actions
- Create IndexRequest for per_page validation (replaces manual clamping)
- Fix FormatsCustomFields to always return stdClass
- Apply layered rate limiting: 600/min per team, 300/min reads, 60/min writes
- Move throttle middleware after auth:sanctum for token-based keying

Phone, email, and link fields define per-item validation rules
(phone:AUTO, email, url regex) via getItemValidationRules() but
toRules() never included them. Invalid items in arrays passed
validation silently.

…om fields

Replace broken link tests that passed for the wrong reason (field didn't
exist, so "unknown field" rejection matched). New tests create the custom
field first, then verify item-level validation rules reject invalid
values (bad domain, bad email, bad phone) and accept valid ones.

…essTokens

- Eliminate ValidatesCustomFields traits (API + MCP) by consolidating
  custom field rule generation into ValidCustomFields::toRules()
- Rename ApiTokens -> AccessTokens across classes, views, and tests
  to match user-facing "Access Tokens" terminology
- Add @property-read Team|null $currentTeam to User model, removing
  stale @phpstan-ignore and redundant @var annotations
- Remove dead code: redundant casts() in PersonalAccessToken, unused
  navigation properties in AccessTokens page, authorize() in
  ContactRequest, per_page clamping in CustomFieldsController

…closure return types

- Add section on using actions for write operations to ensure single-source-of-truth for business logic and side effects.
- Include notes on Filament CRUD usage and best practices for extracting inline logic.
- Add `laravel-best-practices` skill to guide adherence to Laravel coding patterns and refactoring standards.

…handling

- Sanitize top-level string fields (name, title) in HtmlSanitizer,
  not just custom_fields, preventing stored XSS via API input
- Cache known custom field codes in ValidCustomFields to eliminate
  duplicate DB query on every create/update request
- Replace allUsers()->pluck('id') with direct DB query in Task
  requests to avoid hydrating full User models for ID collection
- Wrap NotifyTaskAssignees in defer() to send DB notifications
  post-response instead of blocking the API caller
- Replace whereHas with whereIn subqueries in User tenant scope
  for better index usage on team membership queries
- Add shouldRenderJsonWhen to bootstrap/app.php so exceptions
  outside middleware pipeline still return JSON for API routes
- Validate team ownership on PersonalAccessToken updating event
  (team_id is set post-creation via fill/save, bypassing creating)

… coverage

- Enforce read ability on MCP resources/prompts via native shouldRegister() hook
- Fix HtmlSanitizer XSS: recurse into nested array values in custom fields
- Add team-scoped Rule::exists() validation to MCP detach tools
- Redact available field list from custom field validation error messages
- Add null guard to TeamScope with whereRaw('1 = 0') to prevent data leaks
- Use $request->safe()->integer() for type-safe validated pagination params
- Make HtmlSanitizer and CustomFieldMerger readonly (fix arch test)
- Fix domains custom field unique constraint in CompaniesApiTest
- Exclude api/* from smoke tests (dedicated API test suite covers them)
- Remove redundant RefreshDatabase uses from 3 test files
- Add mutates() declarations, cursor pagination, PATCH, and unauth tests

…rs in AI agent preview

- Reorder hero tabs: Pipeline > AI Agent > Companies > Custom Fields
- Pipeline is now the default tab on page load
- Add visible MCP tool call indicators (create-people-tool, list-opportunities-tool) to AI agent preview
- Replace generic company names with distinctive ones (Kovra Systems, Meridian Health, Trellis Labs)
- Redesign deal cards as a single unified card with divide-y rows for consistency
- Add contact avatar with colored initials gradient
- Fix animation flash by hiding elements via CSS before JS animation fires
- Refine staggered animation sequence: avatar → tool call → text → card

Clean chat style matching Claude/ChatGPT — user messages are plain text,
only agent responses show the sparkle avatar.

…view

Add "You" and "Relaticle" labels with avatars to clearly show the
conversation between user and AI agent, matching Claude/ChatGPT patterns.

Show ChatGPT as the AI assistant calling relaticle/ MCP tools, making it
clear Relaticle is the tool provider — not a built-in chatbot.

The Symfony HtmlSanitizer was designed for rich HTML content but was
applied to all string attributes including name/title fields. This
caused data corruption: apostrophes became ', ampersands became
&, and script tags produced empty names bypassing validation.

Following Filament's standard approach: store raw data, escape on
output. Blade {{ }} and Filament TextColumn handle XSS protection
at render time. The API returns JSON which clients escape themselves.

Merge origin/main into feat/rest-api-mcp-server, keeping both:
- API middleware priority (SetApiTeamContext) from feature branch
- Guest redirect logic (team invitation flow) from main

Escape backslashes before % and _ to prevent double-escaping
when input contains literal wildcard characters.