@aligndottech/cli 0.49.0 → 0.50.0

package/dist/lib/scope-choices.d.ts

@@ -0,0 +1,51 @@
+/**
+ * L4: what a saved token can SEE, to offer as a choice or to check one against: Jira projects, Confluence spaces, Linear
+ * teams, whether a GitHub repo or GitLab project is visible at all.
+ *
+ * These run inside the CLI process with the token the person already saved. The token is sent only to the vendor's own host,
+ * built from the connector's stored fields and checked to be a plain hostname first (the SDK's addendum 1, applied here:
+ * a host never comes from a flag, a tool argument or a URL). Redirects are never followed with the credential. Results are
+ * keys and names. An error says what failed and never carries the token or a response body.
+ *
+ * Every function takes the `fetch` to use, so a test runs against scripted responses and nothing here touches a network
+ * it was not handed.
+ */
+export type FetchLike = typeof fetch;
+export declare class ScopeLookupError extends Error {
+    readonly kind: 'auth' | 'unreachable' | 'unsupported';
+    constructor(message: string, kind: 'auth' | 'unreachable' | 'unsupported');
+}
+export type Visibility = 'visible' | 'invisible' | 'unknown';
+export interface Listed<T> {
+    items: T[];
+    /** True when the vendor had more than was read. A key missing from a truncated list is NOT known to be invisible: look it up directly. */
+    truncated: boolean;
+}
+export declare function listJiraProjects(fields: Record<string, string>, f: FetchLike, o?: {
+    max?: number;
+}): Promise<Listed<{
+    key: string;
+    name: string;
+}>>;
+export declare function listConfluenceSpaces(fields: Record<string, string>, f: FetchLike, o?: {
+    max?: number;
+}): Promise<Listed<{
+    key: string;
+    name: string;
+}>>;
+type LinearTeam = {
+    id: string;
+    key: string;
+    name: string;
+};
+export declare function listLinearTeams(fields: Record<string, string>, f: FetchLike): Promise<Listed<LinearTeam>>;
+/** One team by key, for a key a truncated list did not show. */
+export declare function findLinearTeam(fields: Record<string, string>, key: string, f: FetchLike): Promise<LinearTeam | undefined>;
+/** Is this one project visible? Asked directly, for a key a truncated list did not show. A refused token is an error, not "no". */
+export declare function findJiraProject(fields: Record<string, string>, key: string, f: FetchLike): Promise<boolean>;
+export declare function findConfluenceSpace(fields: Record<string, string>, key: string, f: FetchLike): Promise<boolean>;
+/** Can this token search `repo:o/r`? P0 measured GitHub answering 422 "cannot be searched" for a private repo the token has no access to. */
+export declare function githubRepoVisibility(token: string, repo: string, f: FetchLike): Promise<Visibility>;
+export declare function gitlabProjectVisibility(fields: Record<string, string>, project: string, f: FetchLike): Promise<Visibility>;
+export {};
+//# sourceMappingURL=scope-choices.d.ts.map

package/dist/lib/scope-choices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-choices.d.ts","sourceRoot":"","sources":["../../src/lib/scope-choices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAGrC,qBAAa,gBAAiB,SAAQ,KAAK;IACZ,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa;gBAAtE,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa;CAInF;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAuD7D,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,0IAA0I;IAC1I,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAkB7J;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAqBjK;AASD,KAAK,UAAU,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAW5D,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAK/G;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAK/H;AAED,mIAAmI;AACnI,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjH;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAIrH;AAYD,6IAA6I;AAC7I,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAQzG;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAMhI"}

package/dist/lib/scope-choices.js

@@ -0,0 +1,193 @@
+export class ScopeLookupError extends Error {
+    kind;
+    constructor(message, kind) {
+        super(message);
+        this.kind = kind;
+        this.name = 'ScopeLookupError';
+    }
+}
+const HOSTNAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$/;
+const TIMEOUT_MS = 10_000;
+const MAX_LISTED = 1000;
+/** A vendor cannot make this process read more than this much of one answer, or page through more than MAX_PAGES. */
+const MAX_BODY_BYTES = 2_000_000;
+const MAX_PAGES = 50;
+async function readCapped(res, max) {
+    const reader = res.body?.getReader();
+    if (!reader)
+        return res.text();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > max) {
+            await reader.cancel().catch(() => undefined);
+            throw new Error('too large');
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+function hostOf(vendor, domain) {
+    if (domain === undefined || !HOSTNAME.test(domain)) {
+        throw new ScopeLookupError(`The ${vendor} connection has no usable site saved, so its list cannot be read. Reconnect: align connect ${vendor.toLowerCase()}`, 'unsupported');
+    }
+    return domain;
+}
+async function get(vendor, url, headers, f, init = {}) {
+    let res;
+    try {
+        res = await f(url, { ...init, headers, redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT_MS) });
+    }
+    catch {
+        throw new ScopeLookupError(`Could not reach ${vendor} to read the list.`, 'unreachable');
+    }
+    if (res.status === 401 || res.status === 403) {
+        throw new ScopeLookupError(`${vendor} refused the saved token. Reconnect: align connect ${vendor.toLowerCase()}`, 'auth');
+    }
+    if (!res.ok)
+        throw new ScopeLookupError(`${vendor} answered ${res.status} when reading the list.`, 'unreachable');
+    try {
+        return JSON.parse(await readCapped(res, MAX_BODY_BYTES));
+    }
+    catch {
+        throw new ScopeLookupError(`${vendor} sent a list this CLI could not read.`, 'unreachable');
+    }
+}
+const asRecord = (v) => (typeof v === 'object' && v !== null ? v : {});
+const text = (v) => (typeof v === 'string' && v !== '' ? v : undefined);
+function atlassianHeaders(fields) {
+    const token = fields['token'];
+    const email = fields['email'];
+    if (!token || !email)
+        throw new ScopeLookupError('The Atlassian connection has no email saved, so its list cannot be read. Reconnect with: align connect <jira|confluence>', 'unsupported');
+    return { Authorization: `Basic ${Buffer.from(`${email}:${token}`).toString('base64')}`, Accept: 'application/json' };
+}
+export async function listJiraProjects(fields, f, o = {}) {
+    const max = o.max ?? MAX_LISTED;
+    const host = hostOf('Jira', fields['domain']);
+    const headers = atlassianHeaders(fields);
+    const items = [];
+    let truncated = false;
+    for (let startAt = 0; items.length < max;) {
+        const page = asRecord(await get('Jira', `https://${host}/rest/api/3/project/search?maxResults=100&startAt=${startAt}`, headers, f));
+        const values = Array.isArray(page['values']) ? page['values'] : [];
+        for (const v of values) {
+            const key = text(asRecord(v)['key']);
+            if (key !== undefined)
+                items.push({ key, name: text(asRecord(v)['name']) ?? key });
+        }
+        if (page['isLast'] !== false || values.length === 0)
+            break;
+        startAt += values.length;
+        if (items.length >= max)
+            truncated = true;
+    }
+    return { items, truncated };
+}
+export async function listConfluenceSpaces(fields, f, o = {}) {
+    const max = o.max ?? MAX_LISTED;
+    const host = hostOf('Confluence', fields['domain']);
+    const headers = atlassianHeaders(fields);
+    const base = `https://${host}`;
+    const items = [];
+    let truncated = false;
+    let next = '/wiki/api/v2/spaces?limit=250';
+    for (let pages = 0; next !== undefined; pages++) {
+        if (pages >= MAX_PAGES) {
+            truncated = true;
+            break;
+        }
+        const page = asRecord(await get('Confluence', `${base}${next}`, headers, f));
+        for (const v of Array.isArray(page['results']) ? page['results'] : []) {
+            const key = text(asRecord(v)['key']);
+            if (key !== undefined)
+                items.push({ key, name: text(asRecord(v)['name']) ?? key });
+        }
+        // Only a path on the same site is followed: an absolute link elsewhere would carry the credential to another host.
+        const link = text(asRecord(page['_links'])['next']);
+        next = link !== undefined && link.startsWith('/') && !link.startsWith('//') ? link : undefined;
+        if (next !== undefined && items.length >= max) {
+            truncated = true;
+            break;
+        }
+    }
+    return { items, truncated };
+}
+function linearHeaders(fields) {
+    const token = fields['token'];
+    if (!token)
+        throw new ScopeLookupError('The Linear connection has no token saved. Reconnect: align connect linear', 'unsupported');
+    // A personal API key goes bare and an OAuth token as Bearer; Linear refuses the other way round with a 400 (connector-core).
+    return { Authorization: token.startsWith('lin_api_') ? token : `Bearer ${token}`, 'Content-Type': 'application/json' };
+}
+const toTeams = (nodes) => {
+    const out = [];
+    for (const n of Array.isArray(nodes) ? nodes : []) {
+        const id = text(asRecord(n)['id']);
+        const key = text(asRecord(n)['key']);
+        if (id !== undefined && key !== undefined)
+            out.push({ id, key, name: text(asRecord(n)['name']) ?? key });
+    }
+    return out;
+};
+export async function listLinearTeams(fields, f) {
+    const body = await get('Linear', 'https://api.linear.app/graphql', linearHeaders(fields), f, { method: 'POST', body: JSON.stringify({ query: 'query { teams(first: 100) { nodes { id key name } pageInfo { hasNextPage } } }' }) });
+    const teams = asRecord(asRecord(asRecord(body)['data'])['teams']);
+    if (!Array.isArray(teams['nodes']))
+        throw new ScopeLookupError('Linear did not return a team list.', 'unreachable');
+    return { items: toTeams(teams['nodes']), truncated: asRecord(teams['pageInfo'])['hasNextPage'] === true };
+}
+/** One team by key, for a key a truncated list did not show. */
+export async function findLinearTeam(fields, key, f) {
+    // The key travels as a GraphQL variable, never spliced into the query text.
+    const query = 'query($key: String!) { teams(first: 1, filter: { key: { eq: $key } }) { nodes { id key name } } }';
+    const body = await get('Linear', 'https://api.linear.app/graphql', linearHeaders(fields), f, { method: 'POST', body: JSON.stringify({ query, variables: { key } }) });
+    return toTeams(asRecord(asRecord(asRecord(body)['data'])['teams'])['nodes'])[0];
+}
+/** Is this one project visible? Asked directly, for a key a truncated list did not show. A refused token is an error, not "no". */
+export async function findJiraProject(fields, key, f) {
+    const host = hostOf('Jira', fields['domain']);
+    const headers = atlassianHeaders(fields);
+    const code = await status(`https://${host}/rest/api/3/project/${encodeURIComponent(key)}`, headers, f);
+    if (code === 200)
+        return true;
+    if (code === 404)
+        return false;
+    if (code === 401 || code === 403)
+        throw new ScopeLookupError('Jira refused the saved token. Reconnect: align connect jira', 'auth');
+    throw new ScopeLookupError(`Could not check a Jira project (Jira answered ${code ?? 'nothing'}).`, 'unreachable');
+}
+export async function findConfluenceSpace(fields, key, f) {
+    const host = hostOf('Confluence', fields['domain']);
+    const page = asRecord(await get('Confluence', `https://${host}/wiki/api/v2/spaces?keys=${encodeURIComponent(key)}&limit=1`, atlassianHeaders(fields), f));
+    return (Array.isArray(page['results']) ? page['results'] : []).some((v) => asRecord(v)['key'] === key);
+}
+async function status(url, headers, f) {
+    try {
+        return (await f(url, { headers, redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT_MS) })).status;
+    }
+    catch {
+        return undefined;
+    }
+}
+const REPO = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/;
+/** Can this token search `repo:o/r`? P0 measured GitHub answering 422 "cannot be searched" for a private repo the token has no access to. */
+export async function githubRepoVisibility(token, repo, f) {
+    if (!REPO.test(repo) || repo.split('/').some((seg) => /^\.+$/.test(seg)))
+        return 'unknown';
+    const code = await status(`https://api.github.com/search/issues?q=${encodeURIComponent(`repo:${repo}`)}&per_page=1`, { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'User-Agent': 'align-cli' }, f);
+    return code === 200 ? 'visible' : code === 422 ? 'invisible' : 'unknown';
+}
+export async function gitlabProjectVisibility(fields, project, f) {
+    const token = fields['token'];
+    const domain = fields['domain'] || 'gitlab.com';
+    if (!token || !HOSTNAME.test(domain))
+        return 'unknown';
+    const code = await status(`https://${domain}/api/v4/projects/${encodeURIComponent(project)}`, { Authorization: `Bearer ${token}` }, f);
+    return code === 200 ? 'visible' : code === 404 ? 'invisible' : 'unknown';
+}
+//# sourceMappingURL=scope-choices.js.map

package/dist/lib/scope-choices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-choices.js","sourceRoot":"","sources":["../../src/lib/scope-choices.ts"],"names":[],"mappings":"AAeA,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACH;IAAtC,YAAY,OAAe,EAAW,IAA4C;QAChF,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,SAAI,GAAJ,IAAI,CAAwC;QAEhF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAID,MAAM,QAAQ,GAAG,qGAAqG,CAAC;AACvH,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,qHAAqH;AACrH,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAChG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,MAA0B;IACxD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,gBAAgB,CAAC,OAAO,MAAM,8FAA8F,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IAC/K,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,OAA+B,EAAE,CAAY,EAAE,OAAa,EAAE;IAC5G,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,MAAM,oBAAoB,EAAE,aAAa,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,gBAAgB,CAAC,GAAG,MAAM,sDAAsD,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,MAAM,aAAa,GAAG,CAAC,MAAM,yBAAyB,EAAE,aAAa,CAAC,CAAC;IAClH,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,gBAAgB,CAAC,GAAG,MAAM,uCAAuC,EAAE,aAAa,CAAC,CAAC;IAAC,CAAC;AAC1K,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAU,EAA2B,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACtI,MAAM,IAAI,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAErG,SAAS,gBAAgB,CAAC,MAA8B;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,0HAA0H,EAAE,aAAa,CAAC,CAAC;IAC5L,OAAO,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AACvH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAA8B,EAAE,CAAY,EAAE,IAAsB,EAAE;IAC3G,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,qDAAqD,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACpI,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAC3D,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;YAAE,SAAS,GAAG,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAA8B,EAAE,CAAY,EAAE,IAAsB,EAAE;IAC/G,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,WAAW,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,IAAI,GAAuB,+BAA+B,CAAC;IAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,IAAI,KAAK,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,YAAY,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,mHAAmH;QACnH,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,2EAA2E,EAAE,aAAa,CAAC,CAAC;IACnI,6HAA6H;IAC7H,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;AACzH,CAAC;AAGD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAgB,EAAE;IAC/C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,IAAI,EAAE,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAA8B,EAAE,CAAY;IAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,gCAAgC,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gFAAgF,EAAE,CAAC,EAAE,CAAC,CAAC;IACpO,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;IACpH,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;AAC5G,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAA8B,EAAE,GAAW,EAAE,CAAY;IAC5F,4EAA4E;IAC5E,MAAM,KAAK,GAAG,mGAAmG,CAAC;IAClH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,gCAAgC,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACtK,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,mIAAmI;AACnI,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAA8B,EAAE,GAAW,EAAE,CAAY;IAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,IAAI,uBAAuB,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACvG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,gBAAgB,CAAC,6DAA6D,EAAE,MAAM,CAAC,CAAC;IACpI,MAAM,IAAI,gBAAgB,CAAC,iDAAiD,IAAI,IAAI,SAAS,IAAI,EAAE,aAAa,CAAC,CAAC;AACpH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAA8B,EAAE,GAAW,EAAE,CAAY;IACjG,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,YAAY,EAAE,WAAW,IAAI,4BAA4B,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1J,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;AACzG,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,OAA+B,EAAE,CAAY;IAC9E,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAG,gDAAgD,CAAC;AAE9D,6IAA6I;AAC7I,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAY,EAAE,CAAY;IAClF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,0CAA0C,kBAAkB,CAAC,QAAQ,IAAI,EAAE,CAAC,aAAa,EACzF,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,YAAY,EAAE,WAAW,EAAE,EACtG,CAAC,CACF,CAAC;IACF,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAA8B,EAAE,OAAe,EAAE,CAAY;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,MAAM,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACvI,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC"}

package/dist/lib/scope-connect.d.ts

@@ -0,0 +1,82 @@
+import type { createConfigStore } from './config.js';
+import type { CaptureFetchResult } from './fetchers/capture.js';
+import { type ChangedBy, type ScopeDeps } from './scope.js';
+import type { FetchExtras, SyncWindow } from './since.js';
+export interface ScopeFlags {
+    scope?: string;
+    repo?: string;
+    projects?: string;
+    teams?: string;
+    gitlabProject?: string;
+    spaces?: string;
+    /** The `--since` the person actually gave, as the lower bound it read back to (null: `all`). Not a scope flag: it only sets a NEW scope row's window. */
+    windowSince?: string | null;
+}
+export interface PickOption {
+    value: string;
+    label: string;
+    hint?: string;
+}
+export interface ScopePrompts {
+    /** The values the person chose, or null when they cancelled. */
+    multiselect(message: string, options: PickOption[], initial: string[], o: {
+        required: boolean;
+    }): Promise<string[] | null>;
+    /** A yes/no question whose default is No. A cancel, or a closed stdin, is No. */
+    confirm(message: string): Promise<boolean>;
+}
+export interface ConnectScopeCtx {
+    /** The store, graph and network the scope code uses. `store.fields` is overlaid with the in-flight fields per source. */
+    deps: ScopeDeps;
+    interactive: boolean;
+    /** `--json`: print nothing, and do not mark the disclosure told. */
+    quiet: boolean;
+    flags: ScopeFlags;
+    prompts: ScopePrompts;
+    /** Who the choices are attributed to. Absent: the person at this command line. A child `align_backfill` started is an agent's: its choices wait. */
+    by?: ChangedBy;
+    /** Ticket prefixes local decisions cite (scope-defaults.ts), to preselect. */
+    citedKeys(): string[];
+    say(line: string): void;
+}
+export interface ScopeDecision {
+    /** Handed to the source's fetch. */
+    extras: FetchExtras;
+    scope: 'yours' | 'team';
+    label: string;
+    /** True when this is a team read the person could not be told about (quiet): the disclosure is still owed. */
+    readonly disclosurePending?: boolean;
+    /** Write the choice. Called once, after the fetch succeeded. */
+    commit(): void;
+}
+/** Checked before any prompt or request. Returns the sentence to print with exit 2, or undefined when the flags are usable. */
+export declare function checkScopeFlags(source: string | undefined, flags: ScopeFlags): string | undefined;
+/** Decide the scope of one source being connected, with the in-flight `tokens`. May print (disclosure, notes). Throws to refuse. */
+export declare function decideConnectScope(source: string, tokens: Record<string, string>, ctx: ConnectScopeCtx): Promise<ScopeDecision>;
+/**
+ * The connect loop's one call: decide the scope, fetch under it, and write the choice only once the fetch succeeded. A team read says
+ * whose items it covered in the report, unless the fetcher already did (GitHub names the repo itself).
+ */
+export declare function fetchUnderScope(source: {
+    id: string;
+    fetch: (tokens: Record<string, string>, window?: SyncWindow, opts?: FetchExtras) => Promise<CaptureFetchResult>;
+}, tokens: Record<string, string>, window: SyncWindow | undefined, ctx: ConnectScopeCtx, 
+/** Starts the caller's spinner. Called AFTER the questions and notes (a spinner redraws and listens to the keyboard, which garbles a picker),
+ *  and also before a refusal is thrown, so the caller's stop line has a spinner to stop. */
+startSpinner?: () => void): Promise<CaptureFetchResult>;
+/** The real prompts: a clack multiselect. A cancel is null. Tests inject their own. */
+export declare function clackScopePrompts(): ScopePrompts;
+/**
+ * Was this process started by an agent's tool call (`align_backfill`, `align_sync run`)? Those children carry the marker, so any scope
+ * they would write is attributed to the agent and waits for a person, exactly like `align_scope set`.
+ */
+export declare function startedByAgent(env?: Record<string, string | undefined>): boolean;
+/** The production wiring of `ConnectScopeCtx` for `align connect` and `align setup`: the real store, graph, folder, network and prompts. */
+export declare function connectScopeCtx(o: {
+    config: ReturnType<typeof createConfigStore>;
+    dbPath: string | undefined;
+    interactive: boolean;
+    quiet: boolean;
+    flags?: ScopeFlags;
+}): ConnectScopeCtx;
+//# sourceMappingURL=scope-connect.d.ts.map

package/dist/lib/scope-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-connect.d.ts","sourceRoot":"","sources":["../../src/lib/scope-connect.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAA8G,KAAK,SAAS,EAAiB,MAAM,YAAY,CAAC;AAMvL,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAC1G,yJAAyJ;IACzJ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AACD,MAAM,WAAW,UAAU;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AAC3E,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3H,iFAAiF;IACjF,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AACD,MAAM,WAAW,eAAe;IAC9B,yHAAyH;IACzH,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,oEAAoE;IACpE,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;IACtB,oJAAoJ;IACpJ,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,8EAA8E;IAC9E,SAAS,IAAI,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AACD,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,8GAA8G;IAC9G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,gEAAgE;IAChE,MAAM,IAAI,IAAI,CAAC;CAChB;AASD,+HAA+H;AAC/H,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAcjG;AAeD,oIAAoI;AACpI,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAiHrI;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAAE,EACvI,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,GAAG,EAAE,eAAe;AACpB;4FAC4F;AAC5F,YAAY,GAAE,MAAM,IAAe,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAW7B;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,IAAI,YAAY,CAUhD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO,CAE7F;AAED,4IAA4I;AAC5I,wBAAgB,eAAe,CAAC,CAAC,EAAE;IAAE,MAAM,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,UAAU,CAAA;CAAE,GAAG,eAAe,CAO1L"}

package/dist/lib/scope-connect.js

@@ -0,0 +1,258 @@
+/**
+ * L4: choosing a scope while a source is being connected (`align connect --source <x>`, `align setup`).
+ *
+ * `decideConnectScope` runs BEFORE the fetch and returns what to fetch under; `fetchUnderScope` is the one call the connect loop makes:
+ * decide, fetch, and only then write the choice. A fetch that fails writes nothing, and the token is still saved by the caller only
+ * after the fetch succeeded, so a first connect has no saved token yet: every check here uses the IN-FLIGHT fields.
+ *
+ * What it decides, in order (a flag always wins, and a flag is checked against what the token can see before anything is fetched):
+ * - GitHub and GitLab: the folder's remote decides, with no question (resolveScope). A repo the token cannot see is yours, said so.
+ * - Jira and Linear: a picker on a terminal (cited keys preselected); otherwise the stored choice, else the cited keys the token can
+ *   see, else yours with how to widen. A list that cannot be read never blocks: yours, and the reason is said.
+ * - Confluence: spaces, picked, flagged or stored. With none, refused with the command (there is no "yours" to fall back to).
+ * - Zoom: only yours, and it says why. Slack, Notion and Teams already read all the token can see: nothing to say.
+ *
+ * The team-scope disclosure is printed here, before the fetch, once per source. `quiet` (`--json`) prints nothing and does not mark
+ * it told, so the next foreground run still tells the person.
+ */
+import { askWithTimeout } from './confirm-timeout.js';
+import * as p from '@clack/prompts';
+import { STARTED_BY_AGENT_ENV } from './backfill-state.js';
+import { chooseScope, commitScope, CONFLUENCE_NEEDS_SPACES, markTold, resolveScope } from './scope.js';
+import { citedProjectKeys } from './scope-defaults.js';
+import { realScopeDeps } from './scope-real.js';
+import { listConfluenceSpaces, listJiraProjects, listLinearTeams, ScopeLookupError } from './scope-choices.js';
+import { describeScopeKey, disclosureText, fetchOptsFor, FIXED_SCOPES, SCOPED_SOURCES, scopeKeyOf } from './scope-values.js';
+import { CAPTURE_SOURCES } from './capture-sources.js';
+const labelOf = (source) => CAPTURE_SOURCES[source]?.label ?? source;
+const isScoped = (source) => SCOPED_SOURCES.includes(source);
+const VALUE_FLAG = { github: 'repo', jira: 'projects', linear: 'teams', gitlab: 'gitlabProject', confluence: 'spaces' };
+const FLAG_NAME = { repo: '--repo', projects: '--projects', teams: '--teams', gitlabProject: '--gitlab-project', spaces: '--spaces' };
+const FLAG_FOR = { repo: 'GitHub', projects: 'Jira', teams: 'Linear', gitlabProject: 'GitLab', spaces: 'Confluence' };
+const WHAT = { jira: 'Jira projects', linear: 'Linear teams', confluence: 'Confluence spaces' };
+/** Checked before any prompt or request. Returns the sentence to print with exit 2, or undefined when the flags are usable. */
+export function checkScopeFlags(source, flags) {
+    const valueFlags = Object.keys(FLAG_NAME).filter((k) => flags[k] !== undefined);
+    if (flags.scope === undefined && valueFlags.length === 0)
+        return undefined;
+    if (source === undefined)
+        return 'Scope flags (--scope, --repo, --projects, --teams, --gitlab-project, --spaces) need --source <id> to say which source they are for.';
+    const fixed = FIXED_SCOPES[source];
+    if (fixed)
+        return `${labelOf(source)} reads ${fixed.text}. There is no scope to choose for it.`;
+    if (!isScoped(source))
+        return 'That source has no scope to choose.';
+    if (flags.scope !== undefined && flags.scope !== 'yours' && flags.scope !== 'team')
+        return '--scope takes yours or team.';
+    const wrong = valueFlags.find((k) => VALUE_FLAG[source] !== k);
+    if (wrong !== undefined)
+        return `${FLAG_NAME[wrong]} is for ${FLAG_FOR[wrong]}; ${labelOf(source)} takes ${FLAG_NAME[VALUE_FLAG[source]]}.`;
+    const given = valueFlags.length > 0;
+    if (flags.scope === 'yours' && given)
+        return `Pass either --scope yours or ${FLAG_NAME[VALUE_FLAG[source]]}, not both.`;
+    if (flags.scope === 'team' && !given && source !== 'github' && source !== 'gitlab')
+        return `--scope team needs ${FLAG_NAME[VALUE_FLAG[source]]} to say which ${source === 'confluence' ? 'spaces' : source === 'jira' ? 'projects' : 'teams'}.`;
+    return undefined;
+}
+function flagInput(source, flags) {
+    if (flags.scope === 'yours')
+        return { scope: 'yours' };
+    const value = flags[VALUE_FLAG[source]];
+    return value !== undefined ? { scope: 'team', values: value } : undefined;
+}
+const LISTERS = {
+    jira: listJiraProjects,
+    confluence: listConfluenceSpaces,
+    linear: async (t, f) => { const r = await listLinearTeams(t, f); return { items: r.items.map(({ key, name }) => ({ key, name })), truncated: r.truncated }; },
+};
+/** Decide the scope of one source being connected, with the in-flight `tokens`. May print (disclosure, notes). Throws to refuse. */
+export async function decideConnectScope(source, tokens, ctx) {
+    const tell = (line) => { if (!ctx.quiet)
+        ctx.say(line); };
+    const fixed = FIXED_SCOPES[source];
+    if (!isScoped(source)) {
+        if (source === 'zoom' && fixed)
+            tell(`${labelOf(source)} reads ${fixed.text}.`);
+        return { extras: {}, scope: 'yours', label: 'your own items', commit() { } };
+    }
+    // A person is someone at a terminal who can be shown the disclosure and asked: a TTY, and not --json. Everything else (a script, an agent's
+    // shell, a child `align_backfill` started) is UNATTENDED: it reads yours, it never widens from the folder or from cited keys, and a
+    // widening it is asked for is saved as PENDING for a person to confirm.
+    const person = ctx.interactive && !ctx.quiet;
+    // The store, with this source's fields replaced by the ones in hand: a first connect has nothing saved to read.
+    const deps = { ...ctx.deps, isTty: () => person, store: { ...ctx.deps.store, fields: (s) => (s === source ? tokens : ctx.deps.store.fields(s)) } };
+    const by = ctx.by ?? { via: 'cli', unattended: !person };
+    // A team read whose disclosure could not be shown (--json): the result says so, and it stays un-marked for the next foreground run.
+    let disclosurePending = false;
+    const blocked = (reason) => new Error(reason);
+    const told = (scopeKey, text) => {
+        if (deps.store.isDisclosed(source, scopeKey))
+            return;
+        if (ctx.quiet) {
+            disclosurePending = true;
+            return;
+        }
+        tell(text);
+        markTold(deps.store, source, scopeKey);
+    };
+    const decision = (extras, scope, label, commit) => ({ extras, scope, label, get disclosurePending() { return disclosurePending; }, commit });
+    const fromChoice = (c) => {
+        if (c.scope === 'team')
+            told(c.scopeKey, disclosureText(source, c.labels));
+        const extras = c.scope === 'yours'
+            ? { resolved: true }
+            : { resolved: true, ...(source === 'github' ? { repo: c.values[0], team: true } : fetchOptsFor(source, c.values)) };
+        return decision(extras, c.scope, c.label, () => { commitScope(deps, source, c, by, ctx.flags.windowSince); });
+    };
+    /** What is in force without the agent's waiting choice: the same answer a background run gets. */
+    const kept = () => resolveScope(source, { ...deps, isTty: () => false }, { foreground: false });
+    const fromResolved = async (r, o = {}) => {
+        if (r.blocked !== undefined)
+            throw blocked(r.blocked);
+        if (r.activates) {
+            // An agent's waiting scope, offered to a person: the disclosure every time, and only an explicit Yes makes it active.
+            tell(r.disclosure);
+            const yes = await ctx.prompts.confirm(`Read ${r.label} now? No keeps your current scope.`);
+            if (!yes)
+                return fromResolved(await kept());
+            markTold(deps.store, source, r.scopeKey);
+        }
+        else if (r.disclosure !== undefined)
+            told(r.scopeKey, r.disclosure);
+        if (r.note !== undefined && o.note !== false)
+            tell(r.note);
+        // A team scope read with nobody to tell (--json, no terminal) that was never told for this scope: the disclosure is still owed.
+        if (r.scope === 'team' && !person && !deps.store.isDisclosed(source, r.scopeKey))
+            disclosurePending = true;
+        return decision({ resolved: true, ...(r.repo ? { repo: r.repo, team: true } : {}), ...r.extras }, r.scope, r.label, () => { });
+    };
+    const resolved = async (o = {}) => fromResolved(await resolveScope(source, deps, { foreground: true }), o);
+    const list = async () => {
+        try {
+            const r = await LISTERS[source](tokens, deps.fetch, deps.listMax !== undefined ? { max: deps.listMax } : {});
+            if (r.truncated)
+                tell(`Only the first ${r.items.length} ${WHAT[source]} are listed. To pick one that is not shown: align connect --source ${source} ${source === 'jira' ? '--projects' : source === 'linear' ? '--teams' : '--spaces'} KEYS`);
+            return r.items;
+        }
+        catch (e) {
+            if (!(e instanceof ScopeLookupError))
+                throw e;
+            if (source === 'confluence')
+                throw blocked(`${e.message} Confluence reads only the spaces you choose, so nothing was read. Pick them: align connect --source confluence --spaces ENG,OPS`);
+            tell(`Could not list your ${WHAT[source]}: ${e.message}`);
+            return undefined;
+        }
+    };
+    const input = flagInput(source, ctx.flags);
+    if (input) {
+        const c = await chooseScope(deps, source, input, tokens);
+        if (c.scope === 'yours' || person)
+            return fromChoice(c);
+        // Unattended widening: read what is in force now, and save the request for a person to confirm at a terminal.
+        let k;
+        // One line for the person, not two: the "will read ... once you confirm" line below replaces the default scope's own hint.
+        try {
+            k = await resolved({ note: false });
+        }
+        catch (e) {
+            // Confluence with nothing chosen yet: the request is still saved for the person, and the refusal says so.
+            commitScope(deps, source, c, by, ctx.flags.windowSince);
+            throw new Error(`${e.message} Your request for ${c.label} is saved and waiting for you to confirm: run \`align sync ${source}\` at a terminal.`);
+        }
+        tell(`${labelOf(source)} will read ${c.label} once you confirm it: run \`align sync ${source}\` at a terminal (it will show what it reads).`);
+        return decision(k.extras, k.scope, k.label, () => { commitScope(deps, source, c, by, ctx.flags.windowSince); });
+    }
+    if (source === 'github' || source === 'gitlab') {
+        const d = await resolved();
+        if (ctx.flags.scope === 'team' && d.scope === 'yours') {
+            throw blocked(`--scope team needs a ${source === 'github' ? 'repo' : 'project'}: this folder is not one. Pass ${source === 'github' ? '--repo owner/repo' : '--gitlab-project group/project'}.`);
+        }
+        return d;
+    }
+    const stored = deps.store.getScope(source);
+    const confluence = source === 'confluence';
+    // Without a person there is no picker and no guess from cited keys: the stored choice, else yours (with how to widen).
+    if (!person)
+        return resolved();
+    const listed = await list();
+    if (listed === undefined)
+        return resolved();
+    const keys = listed.map((x) => x.key);
+    const waitingLabels = stored?.kind === 'team' && stored.pending ? stored.labels : [];
+    const inForce = stored?.kind === 'team' && stored.pending ? stored.pending.previous : stored;
+    // What is preselected is what is already in force, or what local decisions cite. An agent's WAITING choice is never preselected:
+    // it is said, and picking it here is the explicit confirmation.
+    if (waitingLabels.length > 0)
+        tell(`Your agent proposed ${source} scope ${describeScopeKey(source, scopeKeyOf(source, waitingLabels), 'team')}. It is not read until you pick it here.`);
+    const initial = inForce?.kind === 'team' ? inForce.labels.filter((k) => keys.includes(k)) : inForce?.kind === 'yours' ? [] : ctx.citedKeys().filter((k) => keys.includes(k));
+    const message = confluence
+        ? 'Which Confluence spaces should Align read? Pick at least one.'
+        : `Which ${WHAT[source]} should Align read everything from? Leave all unselected to read only the items you are involved in.`;
+    const picked = await ctx.prompts.multiselect(message, listed.map((x) => ({ value: x.key, label: `${x.key}  ${x.name}` })), initial, { required: confluence });
+    // Cancelled: nothing changes, and an agent's waiting scope stays waiting (it is not promoted, and not read).
+    if (picked === null) {
+        const k = await kept();
+        if (k.blocked !== undefined)
+            throw blocked(k.blocked);
+        return fromResolved(k);
+    }
+    if (confluence && picked.length === 0)
+        throw blocked(CONFLUENCE_NEEDS_SPACES);
+    return fromChoice(await chooseScope(deps, source, picked.length === 0 ? { scope: 'yours' } : { scope: 'team', values: picked }, tokens));
+}
+/**
+ * The connect loop's one call: decide the scope, fetch under it, and write the choice only once the fetch succeeded. A team read says
+ * whose items it covered in the report, unless the fetcher already did (GitHub names the repo itself).
+ */
+export async function fetchUnderScope(source, tokens, window, ctx, 
+/** Starts the caller's spinner. Called AFTER the questions and notes (a spinner redraws and listens to the keyboard, which garbles a picker),
+ *  and also before a refusal is thrown, so the caller's stop line has a spinner to stop. */
+startSpinner = () => { }) {
+    let decision;
+    try {
+        decision = await decideConnectScope(source.id, tokens, ctx);
+    }
+    catch (e) {
+        startSpinner();
+        throw e;
+    }
+    startSpinner();
+    const fetched = await source.fetch(tokens, window, decision.extras);
+    decision.commit();
+    // A copy, never an edit of what the fetcher returned.
+    const report = { ...fetched.report };
+    if (decision.scope === 'team' && report.scopeNote === undefined)
+        report.scopeNote = `${decision.label}, as far as your token can see`;
+    if (decision.disclosurePending)
+        report.disclosurePending = true;
+    return { ...fetched, report };
+}
+/** The real prompts: a clack multiselect. A cancel is null. Tests inject their own. */
+export function clackScopePrompts() {
+    return {
+        async multiselect(message, options, initial, o) {
+            const answer = await p.multiselect({ message, options: options.map((x) => ({ value: x.value, label: x.label, ...(x.hint !== undefined ? { hint: x.hint } : {}) })), initialValues: initial, required: o.required, maxItems: 12 });
+            return p.isCancel(answer) ? null : answer;
+        },
+        async confirm(message) {
+            return askWithTimeout(async () => (await p.confirm({ message, initialValue: false })) === true);
+        },
+    };
+}
+/**
+ * Was this process started by an agent's tool call (`align_backfill`, `align_sync run`)? Those children carry the marker, so any scope
+ * they would write is attributed to the agent and waits for a person, exactly like `align_scope set`.
+ */
+export function startedByAgent(env = process.env) {
+    return env[STARTED_BY_AGENT_ENV] === 'mcp';
+}
+/** The production wiring of `ConnectScopeCtx` for `align connect` and `align setup`: the real store, graph, folder, network and prompts. */
+export function connectScopeCtx(o) {
+    const dbPath = o.dbPath;
+    return {
+        deps: realScopeDeps(dbPath, { config: o.config }), interactive: o.interactive, quiet: o.quiet, flags: o.flags ?? {}, prompts: clackScopePrompts(),
+        ...(startedByAgent() ? { by: { via: 'mcp', agent: 'unknown' } } : {}),
+        citedKeys: () => (dbPath === undefined ? [] : citedProjectKeys(dbPath)), say: (line) => p.log.info(line),
+    };
+}
+//# sourceMappingURL=scope-connect.js.map