@cat-factory/integrations 0.6.0

package/dist/modules/slack/SlackSettingsService.js

@@ -0,0 +1,41 @@
+import { requireWorkspace } from '@cat-factory/kernel';
+import { defaultSlackSettings } from './slack.logic.js';
+function toSettings(record) {
+    let routes = {};
+    try {
+        const parsed = JSON.parse(record.routesJson);
+        if (parsed && typeof parsed === 'object') {
+            routes = parsed;
+        }
+    }
+    catch {
+        routes = {};
+    }
+    return { routes, mentionsEnabled: record.mentionsEnabled, updatedAt: record.updatedAt };
+}
+export class SlackSettingsService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** A workspace's settings, falling back to the (no-op) defaults. */
+    async get(workspaceId) {
+        await requireWorkspace(this.deps.workspaceRepository, workspaceId);
+        const record = await this.deps.slackSettingsRepository.getByWorkspace(workspaceId);
+        return record ? toSettings(record) : defaultSlackSettings(this.deps.clock.now());
+    }
+    /** Replace a workspace's routing settings. */
+    async update(workspaceId, input) {
+        await requireWorkspace(this.deps.workspaceRepository, workspaceId);
+        const updatedAt = this.deps.clock.now();
+        const record = {
+            workspaceId,
+            routesJson: JSON.stringify(input.routes),
+            mentionsEnabled: input.mentionsEnabled,
+            updatedAt,
+        };
+        await this.deps.slackSettingsRepository.upsert(record);
+        return { routes: input.routes, mentionsEnabled: input.mentionsEnabled, updatedAt };
+    }
+}
+//# sourceMappingURL=SlackSettingsService.js.map

package/dist/modules/slack/SlackSettingsService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlackSettingsService.js","sourceRoot":"","sources":["../../../src/modules/slack/SlackSettingsService.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAavD,SAAS,UAAU,CAAC,MAA2B;IAC7C,IAAI,MAAM,GAAwC,EAAE,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,GAAG,MAA6C,CAAA;QACxD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,CAAA;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;AACzF,CAAC;AAED,MAAM,OAAO,oBAAoB;IACF,IAAI;IAAjC,YAA6B,IAAsC;oBAAtC,IAAI;IAAqC,CAAC;IAEvE,oEAAoE;IACpE,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC3B,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAClF,OAAO,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAClF,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,KAA+B;QAE/B,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACvC,MAAM,MAAM,GAAwB;YAClC,WAAW;YACX,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS;SACV,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,SAAS,EAAE,CAAA;IACpF,CAAC;CACF"}

package/dist/modules/slack/slack.logic.d.ts

@@ -0,0 +1,55 @@
+import type { Notification, NotificationType, SlackMemberMappingEntry, SlackMemberRole, SlackNotificationSettings } from '@cat-factory/kernel';
+/** HKDF domain-separation tag for the Slack bot-token cipher. */
+export declare const SLACK_CIPHER_INFO = "cat-factory:slack";
+/** The notification types Slack routing can target (mirrors the closed set). */
+export declare const SLACK_ROUTABLE_TYPES: NotificationType[];
+/** A mapping entry's role, defaulting to `engineering` when unset (legacy entries). */
+export declare function resolveMemberRole(entry: SlackMemberMappingEntry): SlackMemberRole;
+/**
+ * Who a notification @-mentions, by audience:
+ *   - `roles`         — every mapped member with one of these roles is mentioned.
+ *   - `includeCreator`— also mention the task's creator (whoever they are).
+ *
+ * `requirement_review` is the product surface: product people are told to react to
+ * the findings, plus the creator. The engineering notifications target ONLY the
+ * creator — a build event is that person's to drive, not the whole workspace's (and
+ * product people, who don't care, are never pinged). A type with no policy mentions
+ * no one (still posts to its channel).
+ */
+export interface MentionAudience {
+    roles: SlackMemberRole[];
+    includeCreator: boolean;
+}
+/** The mention audience for a notification type. */
+export declare function mentionAudience(type: NotificationType): MentionAudience;
+/**
+ * Resolve the Slack member ids to @-mention for a notification, given the account's
+ * member map and the (optional) GitHub id of the task creator. Members are matched
+ * by role; the creator is added when the audience calls for it AND they have a
+ * mapping. De-duplicated, preserving first-seen order (roles first, then creator).
+ */
+export declare function resolveMentionTargets(type: NotificationType, mapping: SlackMemberMappingEntry[], creatorUserId: string | null | undefined): string[];
+/**
+ * The default settings for a workspace that has never configured Slack: every
+ * type present but unrouted (empty channel) and disabled, mentions off. So a
+ * fresh workspace posts nothing until a human sets a channel.
+ */
+export declare function defaultSlackSettings(updatedAt: number): SlackNotificationSettings;
+/**
+ * Resolve the channel a notification should post to, or null when it must not
+ * post (no settings, type missing/disabled, or empty channel).
+ */
+export declare function resolveRoute(settings: SlackNotificationSettings, type: NotificationType): string | null;
+export interface SlackMessageBody {
+    channel: string;
+    text: string;
+    blocks: unknown[];
+}
+/**
+ * Render a notification into a Slack message. `mentions` are pre-resolved Slack
+ * member ids (already filtered to those configured); they are prefixed to the
+ * body as `<@id>` so the people are tagged. `text` is the notification fallback
+ * (for push/preview); `blocks` carry the rich layout.
+ */
+export declare function renderNotificationMessage(notification: Notification, channel: string, mentions: string[]): SlackMessageBody;
+//# sourceMappingURL=slack.logic.d.ts.map

package/dist/modules/slack/slack.logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.logic.d.ts","sourceRoot":"","sources":["../../../src/modules/slack/slack.logic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,yBAAyB,EAE1B,MAAM,qBAAqB,CAAA;AAM5B,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AAEpD,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,EAAE,gBAAgB,EAMlD,CAAA;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,CAEjF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,EAAE,CAAA;IACxB,cAAc,EAAE,OAAO,CAAA;CACxB;AAeD,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,eAAe,CAEvE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,uBAAuB,EAAE,EAClC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,EAAE,CAoBV;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAUjF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,yBAAyB,EACnC,IAAI,EAAE,gBAAgB,GACrB,MAAM,GAAG,IAAI,CAKf;AAmBD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,EAAE,CAAA;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAAE,GACjB,gBAAgB,CAwClB"}

package/dist/modules/slack/slack.logic.js

@@ -0,0 +1,149 @@
+// Pure helpers for the Slack notification transport: default settings, route
+// resolution, audience/role targeting, and rendering a notification into a Slack
+// `chat.postMessage` body. No I/O here — unit-testable and shared by both facades.
+/** HKDF domain-separation tag for the Slack bot-token cipher. */
+export const SLACK_CIPHER_INFO = 'cat-factory:slack';
+/** The notification types Slack routing can target (mirrors the closed set). */
+export const SLACK_ROUTABLE_TYPES = [
+    'merge_review',
+    'pipeline_complete',
+    'ci_failed',
+    'requirement_review',
+    'release_regression',
+];
+/** A mapping entry's role, defaulting to `engineering` when unset (legacy entries). */
+export function resolveMemberRole(entry) {
+    return entry.role ?? 'engineering';
+}
+const MENTION_AUDIENCE = {
+    merge_review: { roles: [], includeCreator: true },
+    pipeline_complete: { roles: [], includeCreator: true },
+    ci_failed: { roles: [], includeCreator: true },
+    test_failed: { roles: [], includeCreator: true },
+    requirement_review: { roles: ['product'], includeCreator: true },
+    clarity_review: { roles: ['product'], includeCreator: true },
+    // A post-release regression is an operational event: tell the on-call engineers and
+    // the task's creator.
+    release_regression: { roles: ['engineering'], includeCreator: true },
+    decision_required: { roles: [], includeCreator: true },
+};
+/** The mention audience for a notification type. */
+export function mentionAudience(type) {
+    return MENTION_AUDIENCE[type];
+}
+/**
+ * Resolve the Slack member ids to @-mention for a notification, given the account's
+ * member map and the (optional) GitHub id of the task creator. Members are matched
+ * by role; the creator is added when the audience calls for it AND they have a
+ * mapping. De-duplicated, preserving first-seen order (roles first, then creator).
+ */
+export function resolveMentionTargets(type, mapping, creatorUserId) {
+    const audience = mentionAudience(type);
+    const ids = [];
+    const seen = new Set();
+    const add = (slackId) => {
+        if (!seen.has(slackId)) {
+            seen.add(slackId);
+            ids.push(slackId);
+        }
+    };
+    if (audience.roles.length > 0) {
+        for (const entry of mapping) {
+            if (audience.roles.includes(resolveMemberRole(entry)))
+                add(entry.slackUserId);
+        }
+    }
+    if (audience.includeCreator && creatorUserId != null) {
+        const creator = mapping.find((e) => e.userId === creatorUserId);
+        if (creator)
+            add(creator.slackUserId);
+    }
+    return ids;
+}
+/**
+ * The default settings for a workspace that has never configured Slack: every
+ * type present but unrouted (empty channel) and disabled, mentions off. So a
+ * fresh workspace posts nothing until a human sets a channel.
+ */
+export function defaultSlackSettings(updatedAt) {
+    const routes = {};
+    for (const type of SLACK_ROUTABLE_TYPES) {
+        routes[type] = { enabled: false, channel: '' };
+    }
+    return {
+        routes: routes,
+        mentionsEnabled: false,
+        updatedAt,
+    };
+}
+/**
+ * Resolve the channel a notification should post to, or null when it must not
+ * post (no settings, type missing/disabled, or empty channel).
+ */
+export function resolveRoute(settings, type) {
+    const route = settings.routes[type];
+    if (!route || !route.enabled)
+        return null;
+    const channel = route.channel.trim();
+    return channel.length > 0 ? channel : null;
+}
+/** A short per-type prefix so a Slack reader can triage at a glance. */
+const TYPE_LABEL = {
+    merge_review: ':eyes: Merge review',
+    pipeline_complete: ':white_check_mark: Pipeline complete',
+    ci_failed: ':rotating_light: CI failed',
+    test_failed: ':rotating_light: Tests failed',
+    requirement_review: ':memo: Requirement review',
+    clarity_review: ':mag: Bug-report triage',
+    release_regression: ':rotating_light: Release regression',
+    decision_required: ':vertical_traffic_light: Decision needed',
+};
+/** Format a percentage from a 0..1 score for the assessment context line. */
+function pct(score) {
+    return `${Math.round(score * 100)}%`;
+}
+/**
+ * Render a notification into a Slack message. `mentions` are pre-resolved Slack
+ * member ids (already filtered to those configured); they are prefixed to the
+ * body as `<@id>` so the people are tagged. `text` is the notification fallback
+ * (for push/preview); `blocks` carry the rich layout.
+ */
+export function renderNotificationMessage(notification, channel, mentions) {
+    const label = TYPE_LABEL[notification.type];
+    const mentionPrefix = mentions.length ? `${mentions.map((id) => `<@${id}>`).join(' ')} ` : '';
+    const bodyLines = [`*${notification.title}*`];
+    if (notification.body)
+        bodyLines.push(notification.body);
+    const blocks = [
+        { type: 'section', text: { type: 'mrkdwn', text: `${label}` } },
+        { type: 'section', text: { type: 'mrkdwn', text: `${mentionPrefix}${bodyLines.join('\n')}` } },
+    ];
+    const contextElements = [];
+    const payload = notification.payload;
+    if (payload?.pipelineName) {
+        contextElements.push({ type: 'mrkdwn', text: `Pipeline: ${payload.pipelineName}` });
+    }
+    if (typeof payload?.findingCount === 'number') {
+        const n = payload.findingCount;
+        contextElements.push({ type: 'mrkdwn', text: `${n} open finding${n === 1 ? '' : 's'}` });
+    }
+    if (payload?.assessment) {
+        const a = payload.assessment;
+        contextElements.push({
+            type: 'mrkdwn',
+            text: `Complexity ${pct(a.complexity)} · Risk ${pct(a.risk)} · Impact ${pct(a.impact)}`,
+        });
+    }
+    if (payload?.prUrl) {
+        contextElements.push({ type: 'mrkdwn', text: `<${payload.prUrl}|View PR>` });
+    }
+    if (contextElements.length) {
+        blocks.push({ type: 'context', elements: contextElements });
+    }
+    return {
+        channel,
+        text: `${label}: ${notification.title}`,
+        blocks,
+    };
+}
+//# sourceMappingURL=slack.logic.js.map

package/dist/modules/slack/slack.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.logic.js","sourceRoot":"","sources":["../../../src/modules/slack/slack.logic.ts"],"names":[],"mappings":"AASA,6EAA6E;AAC7E,iFAAiF;AACjF,mFAAmF;AAEnF,iEAAiE;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEpD,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,cAAc;IACd,mBAAmB;IACnB,WAAW;IACX,oBAAoB;IACpB,oBAAoB;CACrB,CAAA;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,KAA8B;IAC9D,OAAO,KAAK,CAAC,IAAI,IAAI,aAAa,CAAA;AACpC,CAAC;AAkBD,MAAM,gBAAgB,GAA8C;IAClE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;IACjD,iBAAiB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;IACtD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;IAC9C,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;IAChD,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IAChE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IAC5D,oFAAoF;IACpF,sBAAsB;IACtB,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACpE,iBAAiB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;CACvD,CAAA;AAED,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,OAAkC,EAClC,aAAwC;IAExC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACjB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,CAAA;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAA;QAC/D,IAAI,OAAO;YAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,MAAM,GAAkD,EAAE,CAAA;IAChE,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAChD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAA6C;QACrD,eAAe,EAAE,KAAK;QACtB,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAmC,EACnC,IAAsB;IAEtB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACpC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,GAAqC;IACnD,YAAY,EAAE,qBAAqB;IACnC,iBAAiB,EAAE,sCAAsC;IACzD,SAAS,EAAE,4BAA4B;IACvC,WAAW,EAAE,+BAA+B;IAC5C,kBAAkB,EAAE,2BAA2B;IAC/C,cAAc,EAAE,yBAAyB;IACzC,kBAAkB,EAAE,qCAAqC;IACzD,iBAAiB,EAAE,0CAA0C;CAC9D,CAAA;AAED,6EAA6E;AAC7E,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,CAAA;AACtC,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAA0B,EAC1B,OAAe,EACf,QAAkB;IAElB,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAE7F,MAAM,SAAS,GAAa,CAAC,IAAI,YAAY,CAAC,KAAK,GAAG,CAAC,CAAA;IACvD,IAAI,YAAY,CAAC,IAAI;QAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAExD,MAAM,MAAM,GAAc;QACxB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE;QAC/D,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE;KAC/F,CAAA;IAED,MAAM,eAAe,GAAuC,EAAE,CAAA;IAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAA;IACpC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,OAAO,CAAC,YAAY,CAAA;QAC9B,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAA;QAC5B,eAAe,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;SACxF,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,KAAK,WAAW,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO;QACL,OAAO;QACP,IAAI,EAAE,GAAG,KAAK,KAAK,YAAY,CAAC,KAAK,EAAE;QACvC,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/modules/tasks/GitHubIssuesProvider.d.ts

@@ -0,0 +1,50 @@
+import { type GitHubClient, type GitHubInstallationRepository, type TaskContent, type TaskCredentials, type TaskSearchResult, type TaskSourceProvider, type NormalizedTaskConnection } from '@cat-factory/kernel';
+export interface GitHubIssuesProviderDependencies {
+    githubClient: GitHubClient;
+    /** Resolves which installation owns a given repo owner (by account login). */
+    installations: GitHubInstallationRepository;
+}
+export declare class GitHubIssuesProvider implements TaskSourceProvider {
+    private readonly deps;
+    readonly kind: 'github';
+    readonly descriptor: {
+        source: "github" | "jira";
+        label: string;
+        icon: string;
+        credentialFields: {
+            key: string;
+            label: string;
+            help?: string | undefined;
+            placeholder?: string | undefined;
+            secret?: boolean | undefined;
+        }[];
+        refLabel: string;
+        refPlaceholder: string;
+        searchable?: boolean | undefined;
+    };
+    constructor(deps: GitHubIssuesProviderDependencies);
+    /**
+     * GitHub issues piggyback on the installed GitHub App, so there is nothing to
+     * validate or persist — the connection is a marker. Any supplied fields are
+     * ignored (the connect form has none).
+     */
+    normalizeConnection(_input: TaskCredentials): NormalizedTaskConnection;
+    parseRef(input: string): string | null;
+    fetchTask(_credentials: TaskCredentials, externalId: string): Promise<TaskContent>;
+    /**
+     * Search issues visible to *this workspace's* GitHub App installation. The
+     * installation token only sees its own account's repos, so scoping to the
+     * workspace's installation keeps results from leaking across tenants — a
+     * deployment may host many installations, but a workspace owns exactly one.
+     * Credentials are unused (the App authenticates), matching `fetchTask`.
+     */
+    search(_credentials: TaskCredentials, query: string, workspaceId: string): Promise<TaskSearchResult[]>;
+    /**
+     * Find the GitHub App installation whose account owns `owner`. The
+     * installation token for that account is what can read the repo's issues,
+     * regardless of which workspace triggered the import (one account → one
+     * installation, shared across that account's workspaces).
+     */
+    private resolveInstallationId;
+}
+//# sourceMappingURL=GitHubIssuesProvider.d.ts.map

package/dist/modules/tasks/GitHubIssuesProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubIssuesProvider.d.ts","sourceRoot":"","sources":["../../../src/modules/tasks/GitHubIssuesProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAA;AAiB5B,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,YAAY,CAAA;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,4BAA4B,CAAA;CAC5C;AAED,qBAAa,oBAAqB,YAAW,kBAAkB;IAIjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,IAAI,EAAG,QAAQ,CAAS;IACjC,QAAQ,CAAC,UAAU;;;;;;;;;;;;;;MAA2B;IAE9C,YAA6B,IAAI,EAAE,gCAAgC,EAAI;IAEvE;;;;OAIG;IACH,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,wBAAwB,CAErE;IAED,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErC;IAEK,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA0BvF;IAED;;;;;;OAMG;IACG,MAAM,CACV,YAAY,EAAE,eAAe,EAC7B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAsB7B;IAED;;;;;OAKG;YACW,qBAAqB;CAUpC"}

package/dist/modules/tasks/GitHubIssuesProvider.js

@@ -0,0 +1,92 @@
+import { ConflictError, ValidationError, } from '@cat-factory/kernel';
+import { GITHUB_ISSUES_DESCRIPTOR } from './github-issues.logic.js';
+import * as githubIssuesLogic from './github-issues.logic.js';
+export class GitHubIssuesProvider {
+    deps;
+    kind = 'github';
+    descriptor = GITHUB_ISSUES_DESCRIPTOR;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * GitHub issues piggyback on the installed GitHub App, so there is nothing to
+     * validate or persist — the connection is a marker. Any supplied fields are
+     * ignored (the connect form has none).
+     */
+    normalizeConnection(_input) {
+        return { credentials: {}, label: 'GitHub' };
+    }
+    parseRef(input) {
+        return githubIssuesLogic.parseGitHubIssueRef(input);
+    }
+    async fetchTask(_credentials, externalId) {
+        const id = githubIssuesLogic.parseGitHubIssueExternalId(externalId);
+        if (!id) {
+            throw new ValidationError(`"${externalId}" is not a valid GitHub issue reference`);
+        }
+        const installationId = await this.resolveInstallationId(id.owner);
+        const detail = await this.deps.githubClient.getIssue(installationId, { owner: id.owner, repo: id.repo }, id.number);
+        return {
+            externalId,
+            url: detail.url || githubIssuesLogic.githubIssueUrl(id),
+            title: detail.title,
+            // GitHub issues have no workflow status or type beyond open/closed; surface
+            // the state as the status and a constant type so the structured prompt
+            // rendering stays uniform across sources.
+            status: detail.state,
+            type: 'Issue',
+            assignee: detail.assignee,
+            priority: null,
+            labels: detail.labels,
+            description: detail.body,
+            comments: detail.comments,
+        };
+    }
+    /**
+     * Search issues visible to *this workspace's* GitHub App installation. The
+     * installation token only sees its own account's repos, so scoping to the
+     * workspace's installation keeps results from leaking across tenants — a
+     * deployment may host many installations, but a workspace owns exactly one.
+     * Credentials are unused (the App authenticates), matching `fetchTask`.
+     */
+    async search(_credentials, query, workspaceId) {
+        const installation = await this.deps.installations.getByWorkspace(workspaceId);
+        if (!installation)
+            return [];
+        const hits = await this.deps.githubClient
+            .searchIssues(installation.installationId, query, 20)
+            .catch(() => []);
+        const out = [];
+        const seen = new Set();
+        for (const hit of hits) {
+            const externalId = githubIssuesLogic.githubIssueExternalId(hit);
+            if (seen.has(externalId))
+                continue;
+            seen.add(externalId);
+            out.push({
+                source: 'github',
+                externalId,
+                title: hit.title,
+                url: hit.url,
+                status: hit.state,
+                excerpt: '',
+            });
+        }
+        return out.slice(0, 20);
+    }
+    /**
+     * Find the GitHub App installation whose account owns `owner`. The
+     * installation token for that account is what can read the repo's issues,
+     * regardless of which workspace triggered the import (one account → one
+     * installation, shared across that account's workspaces).
+     */
+    async resolveInstallationId(owner) {
+        const active = await this.deps.installations.listActive();
+        const match = active.find((i) => i.accountLogin.toLowerCase() === owner.toLowerCase());
+        if (!match) {
+            throw new ConflictError(`No GitHub App installation found for "${owner}". Install the GitHub App on that account to link its issues.`);
+        }
+        return match.installationId;
+    }
+}
+//# sourceMappingURL=GitHubIssuesProvider.js.map

package/dist/modules/tasks/GitHubIssuesProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubIssuesProvider.js","sourceRoot":"","sources":["../../../src/modules/tasks/GitHubIssuesProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,eAAe,GAQhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,iBAAiB,MAAM,0BAA0B,CAAA;AAqB7D,MAAM,OAAO,oBAAoB;IAIF,IAAI;IAHxB,IAAI,GAAG,QAAiB,CAAA;IACxB,UAAU,GAAG,wBAAwB,CAAA;IAE9C,YAA6B,IAAsC;oBAAtC,IAAI;IAAqC,CAAC;IAEvE;;;;OAIG;IACH,mBAAmB,CAAC,MAAuB;QACzC,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IAC7C,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAA6B,EAAE,UAAkB;QAC/D,MAAM,EAAE,GAAG,iBAAiB,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAA;QACnE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,eAAe,CAAC,IAAI,UAAU,yCAAyC,CAAC,CAAA;QACpF,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAClD,cAAc,EACd,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAClC,EAAE,CAAC,MAAM,CACV,CAAA;QACD,OAAO;YACL,UAAU;YACV,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;YACvD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,4EAA4E;YAC5E,uEAAuE;YACvE,0CAA0C;YAC1C,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,YAA6B,EAC7B,KAAa,EACb,WAAmB;QAEnB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAC9E,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY;aACtC,YAAY,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC;aACpD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAClB,MAAM,GAAG,GAAuB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAQ;YAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACpB,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,KAAK;gBACjB,OAAO,EAAE,EAAE;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CAAC,KAAa;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAA;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QACtF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CACrB,yCAAyC,KAAK,+DAA+D,CAC9G,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CAAA;IAC7B,CAAC;CACF"}

package/dist/modules/tasks/JiraProvider.d.ts

@@ -0,0 +1,29 @@
+import { type TaskContent, type TaskCredentials, type TaskSearchResult, type TaskSourceProvider, type NormalizedTaskConnection } from '@cat-factory/kernel';
+/** Carries the HTTP status so callers can surface a meaningful error. */
+export declare class JiraApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare class JiraProvider implements TaskSourceProvider {
+    readonly kind: 'jira';
+    readonly descriptor: {
+        source: "github" | "jira";
+        label: string;
+        icon: string;
+        credentialFields: {
+            key: string;
+            label: string;
+            help?: string | undefined;
+            placeholder?: string | undefined;
+            secret?: boolean | undefined;
+        }[];
+        refLabel: string;
+        refPlaceholder: string;
+        searchable?: boolean | undefined;
+    };
+    normalizeConnection(input: TaskCredentials): NormalizedTaskConnection;
+    parseRef(input: string): string | null;
+    fetchTask(credentials: TaskCredentials, externalId: string): Promise<TaskContent>;
+    search(credentials: TaskCredentials, query: string): Promise<TaskSearchResult[]>;
+}
+//# sourceMappingURL=JiraProvider.d.ts.map

package/dist/modules/tasks/JiraProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JiraProvider.d.ts","sourceRoot":"","sources":["../../../src/modules/tasks/JiraProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAA;AAkB5B,yEAAyE;AACzE,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IADzB,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAIhB;CACF;AAsBD,qBAAa,YAAa,YAAW,kBAAkB;IACrD,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAS;IAC/B,QAAQ,CAAC,UAAU;;;;;;;;;;;;;;MAAkB;IAErC,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,wBAAwB,CAepE;IAED,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAErC;IAEK,SAAS,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA4CtF;IAEK,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6BrF;CACF"}

package/dist/modules/tasks/JiraProvider.js

@@ -0,0 +1,114 @@
+import { ValidationError, atlassianLogic, } from '@cat-factory/kernel';
+import { JIRA_DESCRIPTOR } from './jira.logic.js';
+import * as jiraLogic from './jira.logic.js';
+// JiraProvider: the task-source provider for Jira Cloud. It authenticates with
+// HTTP Basic (account email + API token, the same scheme as Confluence), fetches
+// an issue via the REST v3 API, and maps it onto the structured TaskContent —
+// converting the ADF description and comment bodies to the Markdown the generic
+// excerpt/prompt logic consumes. All Jira-specific *pure* logic (ref parsing, ADF
+// conversion) lives in `jira.logic` so it is unit-testable; this class is the thin
+// `fetch` shell around it. No SDK — fetch + `btoa` suffice.
+//
+// Runtime-neutral: it depends only on the kernel ports + the shared pure logic and
+// the global `fetch`/`btoa` (present on both runtimes), so the Cloudflare and the
+// Node facade wire the SAME class (see CLAUDE.md "Keep the runtimes symmetric").
+const USER_AGENT = 'cat-factory';
+/** Carries the HTTP status so callers can surface a meaningful error. */
+export class JiraApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'JiraApiError';
+    }
+}
+export class JiraProvider {
+    kind = 'jira';
+    descriptor = JIRA_DESCRIPTOR;
+    normalizeConnection(input) {
+        const baseUrlRaw = input.baseUrl?.trim();
+        const accountEmail = input.accountEmail?.trim();
+        const apiToken = input.apiToken?.trim();
+        if (!baseUrlRaw || !accountEmail || !apiToken) {
+            throw new ValidationError('Jira requires a site URL, account email and API token');
+        }
+        const baseUrl = atlassianLogic.normalizeAtlassianBaseUrl(baseUrlRaw);
+        // Guard against SSRF: the stored base URL is later fetched with the
+        // workspace's credentials, so it must be a public https host.
+        atlassianLogic.assertSafeAtlassianBaseUrl(baseUrl);
+        return {
+            credentials: { baseUrl, accountEmail, apiToken },
+            label: baseUrl,
+        };
+    }
+    parseRef(input) {
+        return jiraLogic.parseJiraRef(input);
+    }
+    async fetchTask(credentials, externalId) {
+        const base = credentials.baseUrl.replace(/\/+$/, '');
+        const fields = 'summary,description,status,issuetype,assignee,priority,labels,comment';
+        const url = `${base}/rest/api/3/issue/${encodeURIComponent(externalId)}?fields=${fields}`;
+        const auth = btoa(`${credentials.accountEmail}:${credentials.apiToken}`);
+        const res = await fetch(url, {
+            method: 'GET',
+            headers: {
+                authorization: `Basic ${auth}`,
+                accept: 'application/json',
+                'user-agent': USER_AGENT,
+            },
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new JiraApiError(res.status, `Jira GET ${url} → ${res.status}: ${text.slice(0, 300)}`);
+        }
+        const json = (await res.json().catch(() => null));
+        if (!json || !json.key || !json.fields) {
+            throw new JiraApiError(502, `Jira returned an unexpected body for issue ${externalId}`);
+        }
+        const f = json.fields;
+        const comments = (f.comment?.comments ?? []).map((c) => ({
+            author: c.author?.displayName ?? '',
+            createdAt: c.created ?? '',
+            body: jiraLogic.adfToMarkdown(c.body),
+        }));
+        return {
+            externalId: json.key,
+            url: `${base}/browse/${json.key}`,
+            title: f.summary ?? '(untitled)',
+            status: f.status?.name ?? '',
+            type: f.issuetype?.name ?? '',
+            assignee: f.assignee?.displayName ?? null,
+            priority: f.priority?.name ?? null,
+            labels: Array.isArray(f.labels) ? f.labels : [],
+            description: jiraLogic.adfToMarkdown(f.description),
+            comments,
+        };
+    }
+    async search(credentials, query) {
+        const base = credentials.baseUrl.replace(/\/+$/, '');
+        // Re-validate the stored base before fetching with the workspace's credentials
+        // (defense-in-depth against a base that became unsafe since connect time).
+        atlassianLogic.assertSafeAtlassianBaseUrl(base);
+        const jql = encodeURIComponent(jiraLogic.buildJiraSearchJql(query));
+        // `/rest/api/3/search/jql` is the current enhanced-search endpoint; the legacy
+        // GET `/rest/api/3/search` was removed by Atlassian (May 2025). The `issues[]`
+        // response shape is unchanged, so `parseJiraSearchResults` still applies.
+        const url = `${base}/rest/api/3/search/jql?jql=${jql}&fields=summary,status&maxResults=20`;
+        const auth = btoa(`${credentials.accountEmail}:${credentials.apiToken}`);
+        const res = await fetch(url, {
+            method: 'GET',
+            headers: {
+                authorization: `Basic ${auth}`,
+                accept: 'application/json',
+                'user-agent': USER_AGENT,
+            },
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new JiraApiError(res.status, `Jira search ${url} → ${res.status}: ${text.slice(0, 300)}`);
+        }
+        const json = await res.json().catch(() => null);
+        return jiraLogic.parseJiraSearchResults(json, base);
+    }
+}
+//# sourceMappingURL=JiraProvider.js.map

package/dist/modules/tasks/JiraProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JiraProvider.js","sourceRoot":"","sources":["../../../src/modules/tasks/JiraProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,cAAc,GAOf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAE5C,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,mFAAmF;AACnF,4DAA4D;AAC5D,EAAE;AACF,mFAAmF;AACnF,kFAAkF;AAClF,iFAAiF;AAEjF,MAAM,UAAU,GAAG,aAAa,CAAA;AAEhC,yEAAyE;AACzE,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;sBAHL,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC5B,CAAC;CACF;AAsBD,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,MAAe,CAAA;IACtB,UAAU,GAAG,eAAe,CAAA;IAErC,mBAAmB,CAAC,KAAsB;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;QACxC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAA;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAA;QACvC,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,uDAAuD,CAAC,CAAA;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAA;QACpE,oEAAoE;QACpE,8DAA8D;QAC9D,cAAc,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAA;QAClD,OAAO;YACL,WAAW,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE;YAChD,KAAK,EAAE,OAAO;SACf,CAAA;IACH,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAA4B,EAAE,UAAkB;QAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,uEAAuE,CAAA;QACtF,MAAM,GAAG,GAAG,GAAG,IAAI,qBAAqB,kBAAkB,CAAC,UAAU,CAAC,WAAW,MAAM,EAAE,CAAA;QACzF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAA;QAExE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,IAAI,EAAE;gBAC9B,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,UAAU;aACzB;SACF,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC7C,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9F,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAA;QACzE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,8CAA8C,UAAU,EAAE,CAAC,CAAA;QACzF,CAAC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;QACrB,MAAM,QAAQ,GAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE;YACnC,SAAS,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YAC1B,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;SACtC,CAAC,CAAC,CAAA;QAEH,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,GAAG,EAAE,GAAG,IAAI,WAAW,IAAI,CAAC,GAAG,EAAE;YACjC,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,YAAY;YAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE;YAC5B,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI;YACzC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI;YAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC/C,WAAW,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;YACnD,QAAQ;SACT,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAA4B,EAAE,KAAa;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACrD,+EAA+E;QAC/E,2EAA2E;QAC3E,cAAc,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAA;QACnE,+EAA+E;QAC/E,+EAA+E;QAC/E,0EAA0E;QAC1E,MAAM,GAAG,GAAG,GAAG,IAAI,8BAA8B,GAAG,sCAAsC,CAAA;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAA;QAExE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,IAAI,EAAE;gBAC9B,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,UAAU;aACzB;SACF,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC7C,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,MAAM,EACV,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5D,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,SAAS,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;CACF"}

package/dist/modules/tasks/TaskConnectionService.d.ts

@@ -0,0 +1,30 @@
+import type { Clock } from '@cat-factory/kernel';
+import type { TaskConnectionRecord, TaskConnectionRepository } from '@cat-factory/kernel';
+import type { TaskSourceRegistry } from '@cat-factory/kernel';
+import type { TaskConnection, TaskSourceDescriptor, TaskSourceKind } from '@cat-factory/kernel';
+import type { WorkspaceRepository } from '@cat-factory/kernel';
+export interface TaskConnectionServiceDependencies {
+    taskConnectionRepository: TaskConnectionRepository;
+    registry: TaskSourceRegistry;
+    workspaceRepository: WorkspaceRepository;
+    clock: Clock;
+}
+export declare class TaskConnectionService {
+    private readonly deps;
+    constructor(deps: TaskConnectionServiceDependencies);
+    /** The descriptors of every configured source (drives the connect UI). */
+    listSources(): TaskSourceDescriptor[];
+    /** Resolve a provider for a source or throw if that source isn't configured. */
+    private requireProvider;
+    /** Connect (or re-connect) a workspace to a task source. */
+    connect(workspaceId: string, source: TaskSourceKind, credentials: Record<string, string>): Promise<TaskConnection>;
+    /** The workspace's current connection for a source, or null if not connected. */
+    getConnection(workspaceId: string, source: TaskSourceKind): Promise<TaskConnection | null>;
+    /** Every live connection the workspace holds, across sources. */
+    listConnections(workspaceId: string): Promise<TaskConnection[]>;
+    /** Resolve the live connection (with credentials) or throw if not connected. */
+    requireConnection(workspaceId: string, source: TaskSourceKind): Promise<TaskConnectionRecord>;
+    /** Disconnect a workspace from a source (tombstones the binding). */
+    disconnect(workspaceId: string, source: TaskSourceKind): Promise<void>;
+}
+//# sourceMappingURL=TaskConnectionService.d.ts.map

package/dist/modules/tasks/TaskConnectionService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaskConnectionService.d.ts","sourceRoot":"","sources":["../../../src/modules/tasks/TaskConnectionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACzF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAG/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAQ9D,MAAM,WAAW,iCAAiC;IAChD,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,KAAK,EAAE,KAAK,CAAA;CACb;AAUD,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,iCAAiC,EAAI;IAExE,0EAA0E;IAC1E,WAAW,IAAI,oBAAoB,EAAE,CAEpC;IAED,gFAAgF;IAChF,OAAO,CAAC,eAAe;IAMvB,4DAA4D;IACtD,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,OAAO,CAAC,cAAc,CAAC,CAezB;IAED,iFAAiF;IAC3E,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAG/F;IAED,iEAAiE;IAC3D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAGpE;IAED,gFAAgF;IAC1E,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,oBAAoB,CAAC,CAM/B;IAED,qEAAqE;IAC/D,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;CACF"}