@codyswann/lisa 2.293.0 → 2.294.0

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -426,15 +426,24 @@ function namesFrom(value) {
 }
 
 function assertRepoScope(ref, contract, labels, components = []) {
-  const expected = `repo:${contract.identityRepo}`.toLowerCase();
+  // #1957: mirror the intake-side scoping rule uniformly across trackers
+  // (plugins/lisa/rules/reference/config-resolution.md:949,:968): a work item
+  // is repo-scoped by the label `repo:<name>` OR the bare `<name>` label
+  // (Sentry-provenance items carry only the bare repo name). The match is the
+  // exact repo short name, case-insensitive via namesFrom's lowercasing —
+  // never substring or prefix. Jira additionally accepts a component equal to
+  // the bare name.
+  const bare = contract.identityRepo.toLowerCase();
+  const expected = `repo:${bare}`;
   const labelNames = namesFrom(labels);
   const componentNames = namesFrom(components);
   if (
     !labelNames.includes(expected) &&
-    !componentNames.includes(contract.identityRepo.toLowerCase())
+    !labelNames.includes(bare) &&
+    !componentNames.includes(bare)
   ) {
     throw new TrackingError(
-      `Work item ${ref} is not scoped to repository ${contract.identityRepo}; require label ${expected}`
+      `Work item ${ref} is not scoped to repository ${contract.identityRepo}; require label ${expected} or bare label ${bare}`
     );
   }
 }

package/dist/cli/deploy-status-adapter-github.d.ts

@@ -0,0 +1,20 @@
+import { type ExecGh, type TrackerAdapter } from "./deploy-status-adapter-shared.js";
+/** Construction options for {@link createGithubAdapter}. */
+export interface GithubAdapterOptions {
+    /** `owner/repo` the canonical refs belong to */
+    readonly repository: string;
+    /** Ladder done vocabulary, lowest rung first (config-sourced) */
+    readonly doneStatuses: readonly string[];
+}
+/** Injectable collaborators for {@link createGithubAdapter}. */
+export interface GithubAdapterDeps {
+    readonly execGh: ExecGh;
+}
+/**
+ * Create the GitHub adapter.
+ * @param options - Repository and done vocabulary
+ * @param deps - gh executor
+ * @returns Tracker adapter over gh
+ */
+export declare function createGithubAdapter(options: GithubAdapterOptions, deps: GithubAdapterDeps): TrackerAdapter;
+//# sourceMappingURL=deploy-status-adapter-github.d.ts.map

package/dist/cli/deploy-status-adapter-github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter-github.d.ts","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter-github.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,cAAc,EACpB,MAAM,mCAAmC,CAAC;AAE3C,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,gDAAgD;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgLD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,iBAAiB,GACtB,cAAc,CAgBhB"}

package/dist/cli/deploy-status-adapter-github.js

@@ -0,0 +1,167 @@
+/**
+ * GitHub tracker adapter for deploy-status-sync: label transitions, one
+ * marker-managed comment, and native closure — all via `gh` with fixed argv
+ * (ambient `gh` / `GITHUB_TOKEN` auth; credentials never in argv).
+ * @module cli/deploy-status-adapter-github
+ */
+import { DEPLOY_STATUS_SYNC_MARKER, } from "../core/deploy-status-transition.js";
+import { deriveLabelState, } from "./deploy-status-adapter-shared.js";
+const HIERARCHY_QUERY = "query($owner:String!,$repo:String!,$number:Int!){repository(owner:$owner,name:$repo){issue(number:$number){subIssues(first:100){nodes{state}}}}}";
+/**
+ * Extract the issue number from a canonical `owner/repo#N` ref.
+ * @param ref - Canonical ref
+ * @returns Issue number as a string
+ */
+function issueNumber(ref) {
+    return ref.slice(ref.lastIndexOf("#") + 1);
+}
+/**
+ * Parse label names from a gh issue-view payload.
+ * @param value - Parsed issue JSON
+ * @returns Label names
+ */
+function labelNames(value) {
+    const labels = value.labels;
+    if (!Array.isArray(labels))
+        return [];
+    return labels.flatMap(label => typeof label.name === "string" ? [label.name] : []);
+}
+/**
+ * Count open sub-issues from the hierarchy GraphQL payload.
+ * @param value - Parsed GraphQL response
+ * @returns Number of open children
+ */
+function openChildrenOf(value) {
+    const nodes = value.data?.repository?.issue?.subIssues?.nodes;
+    if (!Array.isArray(nodes))
+        return 0;
+    return nodes.filter(node => node.state === "OPEN").length;
+}
+/**
+ * Fetch the vendor-neutral state snapshot for one issue.
+ * @param context - Bound adapter collaborators
+ * @param ref - Canonical ref
+ * @returns Item state
+ */
+async function fetchState(context, ref) {
+    const number = issueNumber(ref);
+    const issueRaw = await context.execGh([
+        "issue",
+        "view",
+        number,
+        "--repo",
+        context.repository,
+        "--json",
+        "number,state,labels",
+    ]);
+    const issue = JSON.parse(issueRaw);
+    const [owner, repo] = context.repository.split("/");
+    // -f passes owner/repo as raw strings; -F stays only for the integer
+    // number variable — typed -F parsing of attacker-influencable strings
+    // could coerce them into unintended JSON values.
+    const hierarchyRaw = await context.execGh([
+        "api",
+        "graphql",
+        "-f",
+        `query=${HIERARCHY_QUERY}`,
+        "-f",
+        `owner=${owner ?? ""}`,
+        "-f",
+        `repo=${repo ?? ""}`,
+        "-F",
+        `number=${number}`,
+    ]);
+    return {
+        ref,
+        ...deriveLabelState(labelNames(issue), context.doneStatuses),
+        openChildren: openChildrenOf(JSON.parse(hierarchyRaw)),
+        closed: issue.state === "CLOSED",
+    };
+}
+/**
+ * Move the issue to the target done label, removing the other done labels.
+ * @param context - Bound adapter collaborators
+ * @param ref - Canonical ref
+ * @param doneStatus - Target done label
+ */
+async function transition(context, ref, doneStatus) {
+    const removals = context.doneStatuses
+        .filter(status => status !== doneStatus)
+        .flatMap(status => ["--remove-label", status]);
+    await context.execGh([
+        "issue",
+        "edit",
+        issueNumber(ref),
+        "--repo",
+        context.repository,
+        "--add-label",
+        doneStatus,
+        ...removals,
+    ]);
+}
+/**
+ * Find-or-update the single marker-managed comment on the issue.
+ * @param context - Bound adapter collaborators
+ * @param ref - Canonical ref
+ * @param body - Deterministic comment body
+ * @returns Upsert outcome
+ */
+async function upsertComment(context, ref, body) {
+    const number = issueNumber(ref);
+    // --slurp wraps each page in one top-level array; without it, multi-page
+    // output is concatenated JSON documents that JSON.parse cannot read and a
+    // marker comment past page 1 would be re-created instead of updated.
+    const listRaw = await context.execGh([
+        "api",
+        `repos/${context.repository}/issues/${number}/comments`,
+        "--paginate",
+        "--slurp",
+    ]);
+    const comments = JSON.parse(listRaw).flat();
+    const existing = comments.find(comment => typeof comment.body === "string" &&
+        comment.body.startsWith(DEPLOY_STATUS_SYNC_MARKER));
+    if (existing === undefined) {
+        await context.execGh([
+            "api",
+            `repos/${context.repository}/issues/${number}/comments`,
+            "-f",
+            `body=${body}`,
+        ]);
+        return "created";
+    }
+    if (existing.body === body)
+        return "unchanged";
+    await context.execGh([
+        "api",
+        `repos/${context.repository}/issues/comments/${String(existing.id)}`,
+        "-X",
+        "PATCH",
+        "-f",
+        `body=${body}`,
+    ]);
+    return "updated";
+}
+/**
+ * Create the GitHub adapter.
+ * @param options - Repository and done vocabulary
+ * @param deps - gh executor
+ * @returns Tracker adapter over gh
+ */
+export function createGithubAdapter(options, deps) {
+    const context = { ...options, execGh: deps.execGh };
+    return {
+        fetchItemState: ref => fetchState(context, ref),
+        transitionToDone: (ref, doneStatus) => transition(context, ref, doneStatus),
+        upsertManagedComment: (ref, body) => upsertComment(context, ref, body),
+        closeNatively: async (ref) => {
+            await context.execGh([
+                "issue",
+                "close",
+                issueNumber(ref),
+                "--repo",
+                context.repository,
+            ]);
+        },
+    };
+}
+//# sourceMappingURL=deploy-status-adapter-github.js.map

package/dist/cli/deploy-status-adapter-github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter-github.js","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter-github.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,GAE1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,gBAAgB,GAIjB,MAAM,mCAAmC,CAAC;AAoB3C,MAAM,eAAe,GACnB,kJAAkJ,CAAC;AAErJ;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,MAAM,GAAI,KAAoD,CAAC,MAAM,CAAC;IAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAC5B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,KAAK,GACT,KAOD,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAAsB,EACtB,GAAW;IAEX,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;QACpC,OAAO;QACP,MAAM;QACN,MAAM;QACN,QAAQ;QACR,OAAO,CAAC,UAAU;QAClB,QAAQ;QACR,qBAAqB;KACtB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwB,CAAC;IAC1D,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,qEAAqE;IACrE,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;QACxC,KAAK;QACL,SAAS;QACT,IAAI;QACJ,SAAS,eAAe,EAAE;QAC1B,IAAI;QACJ,SAAS,KAAK,IAAI,EAAE,EAAE;QACtB,IAAI;QACJ,QAAQ,IAAI,IAAI,EAAE,EAAE;QACpB,IAAI;QACJ,UAAU,MAAM,EAAE;KACnB,CAAC,CAAC;IACH,OAAO;QACL,GAAG;QACH,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;QAC5D,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,QAAQ;KACjC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAAsB,EACtB,GAAW,EACX,UAAkB;IAElB,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY;SAClC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC;SACvC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,MAAM;QACN,WAAW,CAAC,GAAG,CAAC;QAChB,QAAQ;QACR,OAAO,CAAC,UAAU;QAClB,aAAa;QACb,UAAU;QACV,GAAG,QAAQ;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAC1B,OAAsB,EACtB,GAAW,EACX,IAAY;IAEZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;QACnC,KAAK;QACL,SAAS,OAAO,CAAC,UAAU,WAAW,MAAM,WAAW;QACvD,YAAY;QACZ,SAAS;KACV,CAAC,CAAC;IACH,MAAM,QAAQ,GACZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAInB,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAC5B,OAAO,CAAC,EAAE,CACR,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAChC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CACrD,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,KAAK;YACL,SAAS,OAAO,CAAC,UAAU,WAAW,MAAM,WAAW;YACvD,IAAI;YACJ,QAAQ,IAAI,EAAE;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC;IAC/C,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,KAAK;QACL,SAAS,OAAO,CAAC,UAAU,oBAAoB,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;QACpE,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,QAAQ,IAAI,EAAE;KACf,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA6B,EAC7B,IAAuB;IAEvB,MAAM,OAAO,GAAkB,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACnE,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC;QAC3E,oBAAoB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;QACtE,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,CAAC,MAAM,CAAC;gBACnB,OAAO;gBACP,OAAO;gBACP,WAAW,CAAC,GAAG,CAAC;gBAChB,QAAQ;gBACR,OAAO,CAAC,UAAU;aACnB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/deploy-status-adapter-jira.d.ts

@@ -0,0 +1,18 @@
+import type { TrackerAdapter, TrackerAdapterDeps } from "./deploy-status-adapter-shared.js";
+/** Construction options for {@link createJiraAdapter}. */
+export interface JiraAdapterOptions {
+    /** Atlassian cloud id (gateway base URL for writes) */
+    readonly cloudId?: string;
+    /** Site host fallback when no cloudId is configured */
+    readonly site?: string;
+    /** Login fallback when `JIRA_LOGIN` is unset */
+    readonly email?: string;
+}
+/**
+ * Create the Jira adapter.
+ * @param options - Cloud id / site / login fallback
+ * @param deps - Injectable fetch and env
+ * @returns Tracker adapter over the Jira REST API
+ */
+export declare function createJiraAdapter(options: JiraAdapterOptions, deps?: TrackerAdapterDeps): TrackerAdapter;
+//# sourceMappingURL=deploy-status-adapter-jira.d.ts.map

package/dist/cli/deploy-status-adapter-jira.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter-jira.d.ts","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter-jira.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAEV,cAAc,EACd,kBAAkB,EACnB,MAAM,mCAAmC,CAAC;AAG3C,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAuQD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,kBAAuB,GAC5B,cAAc,CAUhB"}

package/dist/cli/deploy-status-adapter-jira.js

@@ -0,0 +1,215 @@
+/**
+ * Jira tracker adapter for deploy-status-sync over the Jira Cloud REST API.
+ *
+ * Contract-tested only in DSS-2 (unit tests inject a recording fetch); DSS-7
+ * flips it live through the same factory. Writes go through the cloudId
+ * gateway (`api.atlassian.com/ex/jira/<cloudId>`); transitions resolve the
+ * transition id first, then POST it. Credentials travel only in the Basic
+ * `Authorization` header — never in argv. Native closure is a no-op: in Jira
+ * the terminal done-category status IS closure.
+ * @module cli/deploy-status-adapter-jira
+ */
+import { DEPLOY_STATUS_SYNC_MARKER, } from "../core/deploy-status-transition.js";
+import { getProcessEnv } from "./update-check.js";
+/**
+ * Build the ADF document for a managed comment body: one paragraph node per
+ * line — ADF text nodes must not carry raw newline characters (Jira rejects
+ * or mangles them), so the body is split on `\n` and a blank line becomes an
+ * empty paragraph.
+ * @param text - Plain comment text (may span multiple lines)
+ * @returns ADF document
+ */
+function adfDocument(text) {
+    return {
+        type: "doc",
+        version: 1,
+        content: text.split("\n").map(line => ({
+            type: "paragraph",
+            content: line.length === 0 ? [] : [{ type: "text", text: line }],
+        })),
+    };
+}
+/**
+ * Extract the first text node from an ADF comment body.
+ * @param body - ADF body value
+ * @returns The first text run, or empty string
+ */
+function adfFirstText(body) {
+    const doc = body;
+    const text = doc.content?.[0]?.content?.[0]?.text;
+    return typeof text === "string" ? text : "";
+}
+/**
+ * Project an ADF comment body onto plain text: text nodes joined per
+ * paragraph, paragraphs joined with newlines. This is the unchanged-check
+ * comparison basis — Jira round-trips ADF with its own key order and extra
+ * fields (attrs, marks), so a raw JSON comparison would report a semantic
+ * no-change as different and issue a redundant PUT on every run.
+ * @param body - ADF body value
+ * @returns Plain-text projection of the document
+ */
+function adfPlainText(body) {
+    const doc = body;
+    return (doc.content ?? [])
+        .map(paragraph => (paragraph.content ?? [])
+        .map(node => (typeof node.text === "string" ? node.text : ""))
+        .join(""))
+        .join("\n");
+}
+/**
+ * Whether a Jira status payload sits in the done category.
+ * @param status - Jira status field value
+ * @returns True for done-category statuses
+ */
+function isDoneCategory(status) {
+    const key = status.statusCategory
+        ?.key;
+    return key === "done";
+}
+/** The only host shape the site fallback may target. */
+const SITE_HOST_PATTERN = /^[a-z0-9-]+\.atlassian\.net$/i;
+/**
+ * Resolve the REST base URL: the cloudId gateway when configured, else the
+ * `atlassian.site` fallback — which must be a bare `*.atlassian.net` host.
+ * Anything else (paths, foreign hosts) is rejected decision-readably before
+ * any request is made, so a poisoned config value cannot steer credentialed
+ * requests to an attacker-chosen server.
+ * @param options - Cloud id / site fallback
+ * @returns Base URL, or undefined when neither source is configured
+ */
+function resolveBaseUrl(options) {
+    if (options.cloudId !== undefined) {
+        return `https://api.atlassian.com/ex/jira/${encodeURIComponent(options.cloudId)}`;
+    }
+    const site = (options.site ?? "")
+        .replace(/^https?:\/\//, "")
+        .replace(/\/$/, "");
+    if (site.length === 0)
+        return undefined;
+    if (!SITE_HOST_PATTERN.test(site)) {
+        throw new Error(`Invalid atlassian.site "${options.site ?? ""}" in .lisa.config.json: expected a bare "<site>.atlassian.net" host. Set atlassian.cloudId (preferred) or fix atlassian.site.`);
+    }
+    return `https://${site}`;
+}
+/**
+ * Build the authenticated REST transport (Basic auth header only — the
+ * token never reaches argv or the URL).
+ * @param options - Cloud id / site / login fallback
+ * @param deps - Injectable fetch and env
+ * @returns Bound transport
+ */
+function createRequest(options, deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    return async (path, init = {}) => {
+        const env = deps.env ?? getProcessEnv();
+        const token = env.JIRA_API_TOKEN ?? env.ATLASSIAN_API_TOKEN;
+        const login = env.JIRA_LOGIN ?? options.email;
+        const baseUrl = resolveBaseUrl(options);
+        if (token === undefined || login === undefined || baseUrl === undefined) {
+            throw new Error("Jira credentials not found: set JIRA_API_TOKEN or ATLASSIAN_API_TOKEN (plus JIRA_LOGIN or atlassian.email) and configure atlassian.cloudId");
+        }
+        const basic = Buffer.from(`${login}:${token}`).toString("base64");
+        const response = await fetchImpl(`${baseUrl}${path}`, {
+            method: init.method ?? "GET",
+            headers: {
+                Authorization: `Basic ${basic}`,
+                Accept: "application/json",
+                ...(init.body === undefined
+                    ? {}
+                    : { "Content-Type": "application/json" }),
+            },
+            ...(init.body === undefined ? {} : { body: init.body }),
+        });
+        if (!response.ok) {
+            throw new Error(`Jira request ${init.method ?? "GET"} ${path} failed with HTTP ${String(response.status)}`);
+        }
+        const text = await response.text();
+        return text.length > 0 ? JSON.parse(text) : {};
+    };
+}
+/**
+ * Fetch the vendor-neutral state snapshot for one issue.
+ * @param request - Bound transport
+ * @param ref - Issue key
+ * @returns Item state
+ */
+async function fetchState(request, ref) {
+    const issue = (await request(`/rest/api/3/issue/${ref}?fields=status,issuetype,subtasks`));
+    const status = issue.fields?.status;
+    const type = issue.fields?.issuetype?.name;
+    const openChildren = (issue.fields?.subtasks ?? []).filter(subtask => !isDoneCategory(subtask.fields?.status)).length;
+    return {
+        ref,
+        ...(type === undefined ? {} : { type }),
+        openChildren,
+        ...(status?.name === undefined ? {} : { currentStatus: status.name }),
+        closed: isDoneCategory(status),
+    };
+}
+/**
+ * Resolve the transition id reaching the done status, then POST it.
+ * @param request - Bound transport
+ * @param ref - Issue key
+ * @param doneStatus - Target status name (config-sourced)
+ */
+async function transition(request, ref, doneStatus) {
+    const payload = (await request(`/rest/api/3/issue/${ref}/transitions`));
+    const match = (payload.transitions ?? []).find(candidate => (candidate.to?.name ?? "").toLowerCase() === doneStatus.toLowerCase());
+    if (match?.id === undefined) {
+        throw new Error(`Jira issue ${ref} has no transition reaching "${doneStatus}" — fix the workflow or jira.workflow.done`);
+    }
+    await request(`/rest/api/3/issue/${ref}/transitions`, {
+        method: "POST",
+        body: JSON.stringify({ transition: { id: match.id } }),
+    });
+}
+/**
+ * Find-or-update the single marker-managed ADF comment on the issue.
+ * @param request - Bound transport
+ * @param ref - Issue key
+ * @param body - Deterministic plain-text comment body
+ * @returns Upsert outcome
+ */
+async function upsertComment(request, ref, body) {
+    // Bounded page, newest first: the marker comment is recent by
+    // construction. Live multi-page walking is DSS-7 acceptance scope.
+    const payload = (await request(`/rest/api/3/issue/${ref}/comment?maxResults=100&orderBy=-created`));
+    const existing = (payload.comments ?? []).find(comment => adfFirstText(comment.body).startsWith(DEPLOY_STATUS_SYNC_MARKER));
+    const doc = adfDocument(body);
+    if (existing === undefined) {
+        await request(`/rest/api/3/issue/${ref}/comment`, {
+            method: "POST",
+            body: JSON.stringify({ body: doc }),
+        });
+        return "created";
+    }
+    // Compare on the plain-text projection, not raw JSON — the server-stored
+    // ADF is normalized (key order, attrs/marks defaults) and would never
+    // byte-match the freshly built document.
+    if (adfPlainText(existing.body) === body) {
+        return "unchanged";
+    }
+    await request(`/rest/api/3/issue/${ref}/comment/${existing.id ?? ""}`, {
+        method: "PUT",
+        body: JSON.stringify({ body: doc }),
+    });
+    return "updated";
+}
+/**
+ * Create the Jira adapter.
+ * @param options - Cloud id / site / login fallback
+ * @param deps - Injectable fetch and env
+ * @returns Tracker adapter over the Jira REST API
+ */
+export function createJiraAdapter(options, deps = {}) {
+    const request = createRequest(options, deps);
+    return {
+        fetchItemState: ref => fetchState(request, ref),
+        transitionToDone: (ref, doneStatus) => transition(request, ref, doneStatus),
+        upsertManagedComment: (ref, body) => upsertComment(request, ref, body),
+        // Jira has no separate close: the terminal done-category status IS the
+        // native closure, so this is deliberately a zero-request no-op.
+        closeNatively: () => Promise.resolve(),
+    };
+}
+//# sourceMappingURL=deploy-status-adapter-jira.js.map

package/dist/cli/deploy-status-adapter-jira.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter-jira.js","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter-jira.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,yBAAyB,GAE1B,MAAM,qCAAqC,CAAC;AAM7C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA+BlD;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO;QACL,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,WAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SAC1E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAa;IACjC,MAAM,GAAG,GAAG,IAEX,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAClD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAa;IACjC,MAAM,GAAG,GAAG,IAEX,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SACvB,GAAG,CAAC,SAAS,CAAC,EAAE,CACf,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;SACtB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC7D,IAAI,CAAC,EAAE,CAAC,CACZ;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAe;IACrC,MAAM,GAAG,GAAI,MAAiD,CAAC,cAAc;QAC3E,EAAE,GAAG,CAAC;IACR,OAAO,GAAG,KAAK,MAAM,CAAC;AACxB,CAAC;AAED,wDAAwD;AACxD,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAE1D;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAA2B;IACjD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,qCAAqC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAC9B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,OAAO,CAAC,IAAI,IAAI,EAAE,+HAA+H,CAC7K,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,OAA2B,EAC3B,IAAwB;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,mBAAmB,CAAC;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;QAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,4IAA4I,CAC7I,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,KAAK,EAAE;gBAC/B,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;oBACzB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC5C;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,GAAW;IAEX,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAC1B,qBAAqB,GAAG,mCAAmC,CAC5D,CAMA,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CACxD,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CACnD,CAAC,MAAM,CAAC;IACT,OAAO;QACL,GAAG;QACH,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,YAAY;QACZ,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,GAAW,EACX,UAAkB;IAElB,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,qBAAqB,GAAG,cAAc,CAAC,CAErE,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5C,SAAS,CAAC,EAAE,CACV,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CACxE,CAAC;IACF,IAAI,KAAK,EAAE,EAAE,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,cAAc,GAAG,gCAAgC,UAAU,4CAA4C,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,CAAC,qBAAqB,GAAG,cAAc,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAC1B,OAAoB,EACpB,GAAW,EACX,IAAY;IAEZ,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAC5B,qBAAqB,GAAG,0CAA0C,CACnE,CAEA,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACvD,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC,CACjE,CAAC;IACF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAC,qBAAqB,GAAG,UAAU,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,yCAAyC;IACzC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,CAAC,qBAAqB,GAAG,YAAY,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACrE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA2B,EAC3B,OAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC;QAC3E,oBAAoB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;QACtE,uEAAuE;QACvE,gEAAgE;QAChE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;KACvC,CAAC;AACJ,CAAC"}

package/dist/cli/deploy-status-adapter-linear.d.ts

@@ -0,0 +1,16 @@
+import { type TrackerAdapter, type TrackerAdapterDeps } from "./deploy-status-adapter-shared.js";
+/** Construction options for {@link createLinearAdapter}. */
+export interface LinearAdapterOptions {
+    /** Linear workspace slug (credential scoping + keychain account) */
+    readonly workspace: string;
+    /** Ladder done vocabulary, lowest rung first (config-sourced) */
+    readonly doneStatuses: readonly string[];
+}
+/**
+ * Create the Linear adapter.
+ * @param options - Workspace and done vocabulary
+ * @param deps - Injectable fetch, env, and secret reader
+ * @returns Tracker adapter over the Linear GraphQL API
+ */
+export declare function createLinearAdapter(options: LinearAdapterOptions, deps?: TrackerAdapterDeps): TrackerAdapter;
+//# sourceMappingURL=deploy-status-adapter-linear.d.ts.map

package/dist/cli/deploy-status-adapter-linear.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter-linear.d.ts","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter-linear.ts"],"names":[],"mappings":"AAcA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,mCAAmC,CAAC;AAG3C,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAqQD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,GAAE,kBAAuB,GAC5B,cAAc,CAWhB"}