@agilno-tech/rivet 0.1.0-alpha.0

package/src/adapters/jira.js

@@ -0,0 +1,195 @@
+import {
+  boundedString,
+  captureRecord,
+  createAdapter,
+  createProviderWriteGovernance,
+  createProviderWireBody,
+  createSourceEnvelope,
+  executeGovernedWrite,
+  executeTrustedConditionalMutation,
+  failProvider,
+  immutableRedactedJson,
+  providerTimestamp,
+  snapshotProviderJson,
+  validateTrustedConditionalMutationCapability,
+} from './contract.js';
+import { createProviderHttpClient } from './http.js';
+
+const READ = Object.freeze(['epic', 'issue']);
+const WRITE = Object.freeze(['comment', 'status']);
+const ID = /^[A-Z][A-Z0-9]{0,31}-[1-9][0-9]{0,15}$/;
+
+function remoteFailure() { failProvider('remote', { provider: 'jira', retryClassification: 'permanent' }); }
+
+function validateIssue(value, expectedId, full = false, expectedKind) {
+  try {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || value.key !== expectedId
+      || !value.fields || typeof value.fields !== 'object' || Array.isArray(value.fields)
+      || !value.fields.status || typeof value.fields.status.id !== 'string') remoteFailure();
+    if (full && (typeof value.id !== 'string' || !/^[1-9][0-9]*$/.test(value.id)
+      || typeof value.fields.summary !== 'string' || typeof value.fields.issuetype?.name !== 'string'
+      || typeof value.fields.status.name !== 'string'
+      || (value.fields.issuelinks !== undefined && !Array.isArray(value.fields.issuelinks))
+      || (value.fields.comment !== undefined && (!value.fields.comment || typeof value.fields.comment !== 'object'
+        || !Array.isArray(value.fields.comment.comments))))) remoteFailure();
+    if (full && value.fields.issuelinks?.some(link => {
+      const keys = [link?.outwardIssue?.key, link?.inwardIssue?.key].filter(key => typeof key === 'string');
+      return !link || typeof link !== 'object' || Array.isArray(link)
+        || typeof link.id !== 'string' || !/^[1-9][0-9]*$/.test(link.id) || typeof link.type?.name !== 'string'
+        || keys.length !== 1 || !ID.test(keys[0]);
+    })) remoteFailure();
+    if (expectedKind === 'epic' && value.fields.issuetype.name !== 'Epic') remoteFailure();
+    return value;
+  } catch (error) { if (error instanceof Error && error.code === 'ERR_PROVIDER_REMOTE') throw error; remoteFailure(); }
+}
+
+function validateComments(value) {
+  try {
+    if (!Array.isArray(value)) remoteFailure();
+    for (const comment of value) {
+      if (!comment || typeof comment !== 'object' || Array.isArray(comment)
+        || typeof comment.id !== 'string' || !/^[1-9][0-9]*$/.test(comment.id)
+        || (typeof comment.body !== 'string' && (!comment.body || typeof comment.body !== 'object' || Array.isArray(comment.body)))
+        || !comment.author || typeof comment.author !== 'object' || Array.isArray(comment.author)
+        || (typeof comment.author.displayName !== 'string' && typeof comment.author.accountId !== 'string')) remoteFailure();
+    }
+    return value;
+  } catch (error) { if (error instanceof Error && error.code === 'ERR_PROVIDER_REMOTE') throw error; remoteFailure(); }
+}
+
+function textFromDocument(value) {
+  if (typeof value === 'string') return value;
+  if (!value || typeof value !== 'object') return '';
+  if (typeof value.text === 'string') return value.text;
+  if (Array.isArray(value.content)) return value.content.map(textFromDocument).filter(Boolean).join('\n');
+  return '';
+}
+
+export function normalizeJira(raw) {
+  const source = snapshotProviderJson(raw);
+  const fields = source?.fields ?? {};
+  const description = textFromDocument(fields.description);
+  const namedCriteria = Object.entries(source?.names ?? {})
+    .filter(([, name]) => /acceptance criteria/i.test(String(name)))
+    .flatMap(([key]) => textFromDocument(fields[key]).split(/\r?\n/));
+  const acceptanceCriteria = [...description.split(/\r?\n/), ...namedCriteria].map(line => line.trim())
+    .filter(line => /^(?:AC\s*\d*|acceptance criteria)\s*[:.-]/i.test(line));
+  const links = Array.isArray(fields.issuelinks) ? fields.issuelinks.map(link => ({
+    id: String(link?.id ?? ''), type: String(link?.type?.name ?? ''),
+    issueId: String(link?.outwardIssue?.key ?? link?.inwardIssue?.key ?? ''),
+  })) : [];
+  const comments = Array.isArray(fields.comment?.comments) ? fields.comment.comments.map(comment => ({
+    id: String(comment?.id ?? ''), body: comment?.body ?? null,
+    author: String(comment?.author?.displayName ?? comment?.author?.accountId ?? ''),
+  })) : [];
+  return immutableRedactedJson({
+    id: String(source?.key ?? source?.id ?? ''), internalId: String(source?.id ?? ''),
+    kind: String(fields.issuetype?.name ?? ''), summary: String(fields.summary ?? ''),
+    epicId: String(fields.parent?.key ?? fields.epic?.key ?? ''),
+    status: { id: String(fields.status?.id ?? ''), name: String(fields.status?.name ?? '') },
+    description, acceptanceCriteria, links, comments, revision: String(fields.updated ?? ''),
+  });
+}
+
+function clock(configured) {
+  const read = configured ?? (() => new Date().toISOString());
+  if (typeof read !== 'function') failProvider('invalid-config', { provider: 'jira' });
+  return () => {
+    let value;
+    try { value = read(); } catch { failProvider('invalid-config', { provider: 'jira' }); }
+    return value;
+  };
+}
+
+export function createJiraAdapter(input) {
+  const config = captureRecord(input, new Set([
+    'transport', 'baseUrl', 'headers', 'timeoutMs', 'maxResponseBytes', 'maxPages', 'maxItems', 'clock', 'governance', 'conditionalMutation',
+  ]), ['transport', 'baseUrl'], 'invalid-config');
+  const now = clock(config.clock);
+  const governance = config.governance === undefined ? null : createProviderWriteGovernance(config.governance, 'jira');
+  const conditionalMutation = config.conditionalMutation;
+  if (governance && !validateTrustedConditionalMutationCapability(conditionalMutation, 'jira', WRITE)) failProvider('invalid-config', { provider: 'jira' });
+  const http = createProviderHttpClient({
+    provider: 'jira', baseUrl: config.baseUrl, transport: config.transport,
+    ...(config.headers === undefined ? {} : { headers: config.headers }),
+    ...(config.timeoutMs === undefined ? {} : { timeoutMs: config.timeoutMs }),
+    ...(config.maxResponseBytes === undefined ? {} : { maxResponseBytes: config.maxResponseBytes }),
+    ...(config.maxPages === undefined ? {} : { maxPages: config.maxPages }),
+    ...(config.maxItems === undefined ? {} : { maxItems: config.maxItems }),
+  });
+
+  async function read(inputRead) {
+    const request = captureRecord(inputRead, new Set(['kind', 'id', 'signal']), ['kind', 'id']);
+    const kind = boundedString(request.kind, 16, /^(?:epic|issue)$/);
+    const id = boundedString(request.id, 64, ID);
+    const response = await http.request({
+      method: 'GET', path: `/rest/api/3/issue/${encodeURIComponent(id)}?fields=*all&expand=names`,
+      ...(request.signal === undefined ? {} : { signal: request.signal }),
+    });
+    validateIssue(response.data, id, true, kind);
+    const comments = await http.paginate({
+      path: `/rest/api/3/issue/${encodeURIComponent(id)}/comment?startAt=0&maxResults=100`,
+      itemsKey: 'comments', identityKey: 'id', mode: 'jira-offset', ...(request.signal === undefined ? {} : { signal: request.signal }),
+    });
+    validateComments(comments);
+    const raw = immutableRedactedJson({
+      ...response.data,
+      fields: { ...response.data.fields, comment: { comments } },
+    });
+    return createSourceEnvelope({
+      provider: 'jira', sourceId: id, sourceUrl: http.urlFor(`/browse/${encodeURIComponent(id)}`),
+      fetchedAt: providerTimestamp(now, 'jira'), fixtureSource: false, raw,
+      normalized: { ...normalizeJira(raw), requestedKind: kind },
+      retryClassification: 'none', capabilities: { read: READ, write: WRITE },
+    });
+  }
+
+  function write(inputWrite) {
+    if (!governance) failProvider('approval-required', { provider: 'jira' });
+    return executeGovernedWrite(inputWrite, {
+      provider: 'jira', actions: new Set(WRITE), governance,
+      async preflight(writeRequest) {
+        const id = boundedString(writeRequest.resourceId, 64, ID);
+        const response = await http.request({ method: 'GET', path: `/rest/api/3/issue/${encodeURIComponent(id)}?fields=status` });
+        validateIssue(response.data, id);
+        return Object.freeze({
+          state: String(response.data?.fields?.status?.id ?? ''),
+          version: String(response.headers.etag ?? response.data?.version ?? ''),
+        });
+      },
+      prepare(writeRequest) {
+        const id = boundedString(writeRequest.resourceId, 64, ID);
+        if (writeRequest.action === 'comment') {
+          const payload = captureRecord(writeRequest.payload, new Set(['body']), ['body']);
+          const body = typeof payload.body === 'string'
+            ? boundedString(payload.body, 32_768)
+            : payload.body;
+          return Object.freeze({ method: 'POST', path: `/rest/api/3/issue/${encodeURIComponent(id)}/comment`, wireBody: createProviderWireBody(writeRequest) });
+        }
+        const payload = captureRecord(writeRequest.payload, new Set(['transitionId']), ['transitionId']);
+        const transitionId = boundedString(payload.transitionId, 64, /^[A-Za-z0-9._-]+$/);
+        return Object.freeze({
+          method: 'POST', path: `/rest/api/3/issue/${encodeURIComponent(id)}/transitions`,
+          wireBody: createProviderWireBody(writeRequest),
+        });
+      },
+      async mutate(writeRequest, _state, prepared) {
+        return executeTrustedConditionalMutation(conditionalMutation, {
+          provider: 'jira', action: writeRequest.action, resourceId: writeRequest.resourceId,
+          expectedState: writeRequest.expectedState, expectedVersion: writeRequest.expectedVersion,
+          idempotencyKey: writeRequest.idempotencyKey, wireBody: prepared.wireBody,
+          dispatch: async () => {
+            const data = (await http.request({ ...prepared, headers: { 'idempotency-key': writeRequest.idempotencyKey } })).data;
+            if (writeRequest.action === 'comment' && (!data || typeof data.id !== 'string' || !/^[1-9][0-9]*$/.test(data.id))) remoteFailure();
+            if (writeRequest.action === 'status' && data !== null) remoteFailure();
+            return data;
+          },
+        });
+      },
+    });
+  }
+
+  return createAdapter({
+    provider: 'jira', fixtureSource: false, capabilities: { read: READ, write: WRITE }, read, write,
+  });
+}

package/src/adapters/linear.js

@@ -0,0 +1,171 @@
+import { markdownAcceptanceCriteria } from '../work-request/local.js';
+import {
+  boundedString,
+  captureRecord,
+  createAdapter,
+  createProviderReadBody,
+  createSourceEnvelope,
+  failProvider,
+  immutableRedactedJson,
+  providerTimestamp,
+  readOnlyWrite,
+  snapshotProviderJson,
+} from './contract.js';
+import { createProviderHttpClient } from './http.js';
+
+const READ = Object.freeze(['issue']);
+const WRITE = Object.freeze([]);
+const ID = /^[A-Z][A-Z0-9]{0,31}-[1-9][0-9]{0,15}$/;
+const SAFE_REMOTE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
+const QUERY = `query AgilnoFeatureIssue($identifier: String!) {
+  issue(id: $identifier) {
+      id identifier title description updatedAt url
+      state { id name }
+      team { id key }
+      labels(first: 100) { nodes { id name } pageInfo { hasNextPage endCursor } }
+      relations(first: 100) { nodes { id type relatedIssue { identifier } } pageInfo { hasNextPage endCursor } }
+      comments(first: 100) { nodes { id body user { id name } } pageInfo { hasNextPage endCursor } }
+  }
+}`;
+
+function remoteFailure() { failProvider('remote', { provider: 'linear', retryClassification: 'permanent' }); }
+
+function array(value, maximum) {
+  if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype || value.length > maximum) remoteFailure();
+  return value;
+}
+
+function safeId(value) {
+  if (typeof value !== 'string' || !SAFE_REMOTE_ID.test(value)) remoteFailure();
+  return value;
+}
+
+function connection(value, maximum) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || !value.pageInfo || typeof value.pageInfo !== 'object' || Array.isArray(value.pageInfo)
+    || value.pageInfo.hasNextPage !== false) remoteFailure();
+  return array(value.nodes, maximum);
+}
+
+function validateIssue(raw, expectedId) {
+  try {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)
+      || raw.identifier !== expectedId || typeof raw.title !== 'string'
+      || (raw.description !== null && typeof raw.description !== 'string')
+      || typeof raw.updatedAt !== 'string' || typeof raw.url !== 'string'
+      || !raw.state || typeof raw.state !== 'object' || Array.isArray(raw.state)
+      || typeof raw.state.name !== 'string'
+      || !raw.team || typeof raw.team !== 'object' || Array.isArray(raw.team)
+      || typeof raw.team.key !== 'string') remoteFailure();
+    safeId(raw.id); safeId(raw.state.id); safeId(raw.team.id);
+    for (const label of connection(raw.labels, 100)) {
+      if (!label || typeof label !== 'object' || Array.isArray(label) || typeof label.name !== 'string') remoteFailure();
+      safeId(label.id);
+    }
+    for (const relation of connection(raw.relations, 100)) {
+      if (!relation || typeof relation !== 'object' || Array.isArray(relation)
+        || typeof relation.type !== 'string' || !relation.relatedIssue || typeof relation.relatedIssue !== 'object'
+        || Array.isArray(relation.relatedIssue) || !ID.test(relation.relatedIssue.identifier)) remoteFailure();
+      safeId(relation.id);
+    }
+    for (const comment of connection(raw.comments, 100)) {
+      if (!comment || typeof comment !== 'object' || Array.isArray(comment) || typeof comment.body !== 'string'
+        || !comment.user || typeof comment.user !== 'object' || Array.isArray(comment.user)
+        || typeof comment.user.name !== 'string') remoteFailure();
+      safeId(comment.id); safeId(comment.user.id);
+    }
+    return raw;
+  } catch (error) {
+    if (error instanceof Error && error.code === 'ERR_PROVIDER_REMOTE') throw error;
+    remoteFailure();
+  }
+}
+
+export function normalizeLinear(raw) {
+  const source = snapshotProviderJson(raw);
+  validateIssue(source, source.identifier);
+  const description = source.description ?? '';
+  const labeledCriteria = description.split(/\r?\n/).map(line => line.trim())
+    .filter(line => /^(?:AC\s*\d*|acceptance criteria)\s*[:.-]/i.test(line));
+  return immutableRedactedJson({
+    id: source.identifier,
+    internalId: source.id,
+    kind: 'Issue',
+    summary: source.title,
+    description,
+    acceptanceCriteria: labeledCriteria.length ? labeledCriteria : markdownAcceptanceCriteria(description),
+    status: { id: source.state.id, name: source.state.name },
+    team: { id: source.team.id, key: source.team.key },
+    labels: source.labels.nodes.map(label => ({ id: label.id, name: label.name })),
+    links: source.relations.nodes.map(relation => ({ id: relation.id, type: relation.type, issueId: relation.relatedIssue.identifier })),
+    comments: source.comments.nodes.map(comment => ({ id: comment.id, body: comment.body, author: comment.user.name })),
+    revision: source.updatedAt,
+    url: source.url,
+  });
+}
+
+function clock(configured) {
+  const read = configured ?? (() => new Date().toISOString());
+  if (typeof read !== 'function') failProvider('invalid-config', { provider: 'linear' });
+  return () => {
+    let value;
+    try { value = read(); } catch { failProvider('invalid-config', { provider: 'linear' }); }
+    return value;
+  };
+}
+
+export function createLinearAdapter(input) {
+  const config = captureRecord(input, new Set([
+    'transport', 'baseUrl', 'headers', 'timeoutMs', 'maxResponseBytes', 'clock',
+  ]), ['transport', 'baseUrl'], 'invalid-config');
+  const now = clock(config.clock);
+  const http = createProviderHttpClient({
+    provider: 'linear',
+    baseUrl: config.baseUrl,
+    transport: config.transport,
+    ...(config.headers === undefined ? {} : { headers: config.headers }),
+    ...(config.timeoutMs === undefined ? {} : { timeoutMs: config.timeoutMs }),
+    ...(config.maxResponseBytes === undefined ? {} : { maxResponseBytes: config.maxResponseBytes }),
+  });
+
+  async function read(inputRead) {
+    const request = captureRecord(inputRead, new Set(['kind', 'id', 'signal']), ['kind', 'id']);
+    const kind = boundedString(request.kind, 16, /^issue$/);
+    const id = boundedString(request.id, 64, ID);
+    const wireBody = createProviderReadBody({
+      provider: 'linear',
+      payload: { query: QUERY, variables: { identifier: id } },
+    });
+    const response = await http.request({
+      method: 'POST',
+      path: '/graphql',
+      wireBody,
+      ...(request.signal === undefined ? {} : { signal: request.signal }),
+    });
+    const rawResponse = snapshotProviderJson(response.data);
+    if (!rawResponse || typeof rawResponse !== 'object' || Array.isArray(rawResponse)
+      || Object.hasOwn(rawResponse, 'errors') || !rawResponse.data || typeof rawResponse.data !== 'object'
+      || !rawResponse.data.issue || typeof rawResponse.data.issue !== 'object') remoteFailure();
+    const raw = validateIssue(rawResponse.data.issue, id);
+    const normalized = normalizeLinear(raw);
+    return createSourceEnvelope({
+      provider: 'linear',
+      sourceId: id,
+      sourceUrl: normalized.url,
+      fetchedAt: providerTimestamp(now, 'linear'),
+      fixtureSource: false,
+      raw,
+      normalized: { ...normalized, requestedKind: kind },
+      retryClassification: 'none',
+      capabilities: { read: READ, write: WRITE },
+    });
+  }
+
+  return createAdapter({
+    provider: 'linear',
+    fixtureSource: false,
+    capabilities: { read: READ, write: WRITE },
+    read,
+    write: readOnlyWrite('linear'),
+  });
+}

package/src/adapters/node-transport.js

@@ -0,0 +1,59 @@
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+import { Readable } from 'node:stream';
+
+import { createTrustedProviderTransport } from './http.js';
+
+// The HTTP policy validates DNS answers before supplying these exact pins.
+// Retain the URL hostname for TLS certificate validation and SNI.
+export function createNodeProviderTransport({ lookup = dnsLookup, request = httpsRequest } = {}) {
+  return createTrustedProviderTransport({
+    async resolve(hostname) {
+      return (await lookup(hostname, { all: true })).map(item => item.address);
+    },
+    fetchPinned(url, init, pins) {
+      return new Promise((resolve, reject) => {
+        const target = new URL(url);
+        if (target.protocol !== 'https:' || target.hostname !== pins.hostname || !pins.addresses.length) {
+          reject(new Error('Invalid pinned destination.'));
+          return;
+        }
+        const addresses = pins.addresses.map(address => ({ address, family: isIP(address) }));
+        const outgoing = request(target, {
+          method: init.method,
+          headers: init.headers,
+          signal: init.signal,
+          agent: false,
+          servername: pins.hostname,
+          rejectUnauthorized: true,
+          lookup(hostname, options, callback) {
+            if (hostname !== pins.hostname) return callback(new Error('Unexpected hostname.'));
+            if (options?.all) return callback(null, addresses);
+            const selected = addresses.find(item => !options?.family || item.family === options.family);
+            if (!selected) return callback(new Error('No matching pinned address.'));
+            callback(null, selected.address, selected.family);
+          },
+        }, incoming => {
+          const status = incoming.statusCode;
+          if (!Number.isInteger(status) || (status >= 300 && status < 400)) {
+            incoming.destroy();
+            reject(new Error('Provider redirect or invalid response.'));
+            return;
+          }
+          try {
+            const headers = new Headers();
+            for (const [name, value] of Object.entries(incoming.headers)) {
+              if (value !== undefined) headers.set(name, Array.isArray(value) ? value.join(', ') : value);
+            }
+            const noBody = status === 204 || status === 205;
+            if (noBody) incoming.resume();
+            resolve(new Response(noBody ? null : Readable.toWeb(incoming), { status, headers }));
+          } catch (error) { incoming.destroy(); reject(error); }
+        });
+        outgoing.on('error', reject);
+        outgoing.end(init.body);
+      });
+    },
+  });
+}

package/src/cli/integration-setup-prompt.js

@@ -0,0 +1,32 @@
+import { createInterface } from 'node:readline/promises';
+
+// The guide asks only for local metadata and environment variable names. It has
+// no secret-input mode and never reads credentials or contacts a provider.
+export async function defaultIntegrationSetupPrompt(question) {
+  const readline = createInterface({ input: process.stdin, output: process.stdout });
+  let timer;
+  try {
+    let prompt = question.message;
+    if (question.type === 'select' || question.type === 'multi') {
+      prompt += '\n' + question.choices.map((choice, index) => `  ${index + 1}. ${choice.label}`).join('\n');
+      prompt += question.type === 'multi' ? '\nNumbers separated by commas (blank to cancel): ' : '\nNumber (blank to cancel): ';
+    } else if (question.type === 'confirm') prompt += ' [y/N] ';
+    else prompt += question.defaultValue ? ` [${question.defaultValue}] (q to cancel): ` : ' (blank to cancel): ';
+    const answer = String(await Promise.race([
+      readline.question(prompt, { signal: question.signal }),
+      new Promise(resolve => { timer = setTimeout(() => resolve('q'), 120000); }),
+    ])).trim();
+    if (answer.toLowerCase() === 'q') return null;
+    if (question.type === 'confirm') return /^(?:y|yes)$/i.test(answer);
+    if (question.type === 'input') return answer || question.defaultValue || null;
+    if (!answer) return null;
+    const parts = answer.split(',').map(value => value.trim());
+    if (parts.some(value => !/^[1-9][0-9]*$/.test(value))) return null;
+    const indexes = parts.map(value => Number(value) - 1);
+    if (indexes.some(index => !Number.isSafeInteger(index) || index >= question.choices.length)
+      || new Set(indexes).size !== indexes.length || (question.type === 'select' && indexes.length !== 1)) return null;
+    const selected = indexes.map(index => question.choices[index].value);
+    return question.type === 'select' ? selected[0] : selected;
+  } catch { return null; }
+  finally { clearTimeout(timer); readline.close(); }
+}

package/src/cli/interrupt.js

@@ -0,0 +1,25 @@
+import { CliError } from './output.js';
+
+function interrupted() {
+  return new CliError('Task interrupted. Inspect it with rivet task status before continuing.', 'REPOSITORY_CONFLICT');
+}
+
+export async function withTerminalInterruption(operation) {
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  process.on('SIGINT', abort);
+  process.on('SIGTERM', abort);
+  try {
+    let result;
+    try { result = await operation(controller.signal); }
+    catch (error) {
+      if (controller.signal.aborted) throw interrupted();
+      throw error;
+    }
+    if (controller.signal.aborted) throw interrupted();
+    return result;
+  } finally {
+    process.off('SIGINT', abort);
+    process.off('SIGTERM', abort);
+  }
+}