#489 release: sync test → main

Promotes test to main.

Included

• refactor(tasks): enhance PATCH /api/tasks with improved validation and access control (#486)
• feat(connectors): implement GET + POST /api/connectors/actions (#484)

🤖 Generated with Claude Code

---

Summary by cubic

Adds a new connectors actions API and strengthens task updates. GET/POST /api/connectors/actions expose and execute composable connector actions; PATCH /api/tasks now has strict validation and ownership checks.

• New Features

  • GET /api/connectors/actions: lists executable actions merged from customer → artist → shared toolkits with slug, description, parameters (JSON Schema), connectorSlug, and isConnected. Auth via x-api-key or Bearer; optional account_id with access check.
  • POST /api/connectors/actions: executes an action by actionSlug with parameters. Returns { success, result, executedAt }. 404 for unknown slug; other errors surface as 500. CORS OPTIONS supported.
  • Converts Zod input schemas to JSON Schema for responses, supporting both Zod v4 and v3 via zod and zod-to-json-schema.

• Refactors

  • PATCH /api/tasks: strict body (UUID id, unknown keys rejected), resolves account via auth (optional account_id), enforces task ownership, returns 403 on access denied, 404 on missing task, and the enriched task matching GET shape.
  • Extracted schemas to updateTaskSchemas; removed validateUpdateTaskBody.
  • MCP update_task tool uses resolved account context and clearer errors.
  • Dependency: added zod-to-json-schema.

Summary by CodeRabbit

• New Features

  • Added new API endpoints for managing connector actions: list available actions and execute specific actions.
  • Enhanced task update endpoint with stricter validation, improved error handling, and ownership verification.

• Documentation

  • Updated PATCH /api/tasks documentation with OpenAPI-aligned contract specifying authentication requirements, validation rules, and error responses.