@codyswann/lisa 2.293.0 → 2.294.0

package/dist/cli/deploy-status-adapter-linear.js

@@ -0,0 +1,204 @@
+/**
+ * Linear tracker adapter for deploy-status-sync over the Linear GraphQL API.
+ *
+ * Contract-tested only in DSS-2 (unit tests inject a recording fetch); DSS-6
+ * flips it live by supplying real deps through the same factory. The API key
+ * travels only in the raw `Authorization` header (Linear expects no Bearer
+ * prefix) — never in argv.
+ * @module cli/deploy-status-adapter-linear
+ */
+import { runKaneCommand } from "../core/kane-cli-process.js";
+import { DEPLOY_STATUS_SYNC_MARKER, } from "../core/deploy-status-transition.js";
+import { deriveLabelState, } from "./deploy-status-adapter-shared.js";
+import { getProcessEnv } from "./update-check.js";
+const GRAPHQL_URL = "https://api.linear.app/graphql";
+const TERMINAL_STATE_TYPES = new Set(["completed", "canceled", "cancelled"]);
+// children is bounded explicitly — Linear's default connection page size
+// (50) would silently under-count openChildren on large containers.
+const ISSUE_STATE_QUERY = "query($id:String!){issue(id:$id){id identifier state{name type} labels{nodes{name}} children(first:100){nodes{state{type}}}}}";
+const ISSUE_ID_QUERY = "query($id:String!){issue(id:$id){id}}";
+const LABEL_ID_QUERY = "query($name:String!){issueLabels(filter:{name:{eq:$name}}){nodes{id name}}}";
+const ADD_LABEL_MUTATION = "mutation($issueId:String!,$labelId:String!){issueAddLabel(id:$issueId,labelId:$labelId){success}}";
+// Bounded first page — live pagination is DSS-6 acceptance scope.
+const COMMENTS_QUERY = "query($id:String!){issue(id:$id){id comments(first:100){nodes{id body}}}}";
+const COMMENT_CREATE_MUTATION = "mutation($issueId:String!,$body:String!){commentCreate(input:{issueId:$issueId,body:$body}){success}}";
+const COMMENT_UPDATE_MUTATION = "mutation($commentId:String!,$body:String!){commentUpdate(id:$commentId,input:{body:$body}){success}}";
+const TEAM_STATES_QUERY = "query($id:String!){issue(id:$id){id team{states{nodes{id name type}}}}}";
+const ISSUE_UPDATE_STATE_MUTATION = "mutation($issueId:String!,$stateId:String!){issueUpdate(id:$issueId,input:{stateId:$stateId}){success}}";
+/**
+ * Read the darwin keychain entry for a Linear workspace.
+ * @param service - Keychain service name
+ * @param account - Keychain account (workspace)
+ * @returns Stored secret, or undefined when absent
+ */
+async function readKeychainSecret(service, account) {
+    if (process.platform !== "darwin")
+        return undefined;
+    const result = await runKaneCommand("security", ["find-generic-password", "-s", service, "-a", account, "-w"], { cwd: ".", timeoutMs: 15_000, env: getProcessEnv() });
+    const secret = result.stdout.trim();
+    return result.exitCode === 0 && secret.length > 0 ? secret : undefined;
+}
+/**
+ * Resolve the Linear API key: `LINEAR_API_KEY`, the workspace-suffixed
+ * variable, then the darwin `lisa-linear` keychain entry.
+ * @param workspace - Workspace slug
+ * @param deps - Injectable env and secret reader
+ * @returns The API key
+ */
+async function resolveLinearKey(workspace, deps) {
+    const env = deps.env ?? getProcessEnv();
+    const direct = env.LINEAR_API_KEY;
+    if (direct !== undefined && direct.length > 0)
+        return direct;
+    const suffix = workspace.toLowerCase().replace(/-/g, "_");
+    const scoped = env[`LINEAR_API_KEY_${suffix}`];
+    if (scoped !== undefined && scoped.length > 0)
+        return scoped;
+    const readSecret = deps.readSecret ?? readKeychainSecret;
+    const keychain = await readSecret("lisa-linear", workspace);
+    if (keychain !== undefined && keychain.length > 0)
+        return keychain;
+    throw new Error(`Linear credentials not found: set LINEAR_API_KEY (or LINEAR_API_KEY_${suffix}, or a darwin "lisa-linear" keychain entry for ${workspace})`);
+}
+/**
+ * Build the GraphQL transport (key resolved per request, header-only).
+ * @param workspace - Workspace slug for credential resolution
+ * @param deps - Injectable fetch, env, and secret reader
+ * @returns Bound GraphQL transport
+ */
+function createGraphql(workspace, deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    return async (query, variables) => {
+        const key = await resolveLinearKey(workspace, deps);
+        const response = await fetchImpl(GRAPHQL_URL, {
+            method: "POST",
+            headers: { Authorization: key, "Content-Type": "application/json" },
+            body: JSON.stringify({ query, variables }),
+        });
+        // Status-only error: a non-ok body (gateway HTML, proxy pages) must not
+        // be parsed as JSON nor echoed — it can be huge or carry sensitive text.
+        if (!response.ok) {
+            throw new Error(`Linear GraphQL request failed with HTTP ${String(response.status)}`);
+        }
+        const payload = (await response.json());
+        if (Array.isArray(payload.errors) && payload.errors.length > 0) {
+            throw new Error(`Linear GraphQL request failed: ${payload.errors[0]?.message ?? "unknown error"}`);
+        }
+        return payload.data ?? {};
+    };
+}
+/**
+ * Resolve the internal issue id for a canonical identifier.
+ * @param context - Bound collaborators
+ * @param ref - Canonical identifier (KEY-N)
+ * @returns Internal issue id
+ */
+async function issueId(context, ref) {
+    const data = await context.graphql(ISSUE_ID_QUERY, { id: ref });
+    const id = data.issue?.id;
+    if (typeof id !== "string") {
+        throw new Error(`Linear issue ${ref} does not exist or is inaccessible`);
+    }
+    return id;
+}
+/**
+ * Fetch the vendor-neutral state snapshot for one issue.
+ * @param context - Bound collaborators
+ * @param ref - Canonical identifier
+ * @returns Item state
+ */
+async function fetchState(context, ref) {
+    const data = await context.graphql(ISSUE_STATE_QUERY, { id: ref });
+    const issue = data.issue;
+    if (issue === undefined) {
+        throw new Error(`Linear issue ${ref} does not exist or is inaccessible`);
+    }
+    const labels = (issue.labels?.nodes ?? []).flatMap(node => typeof node.name === "string" ? [node.name] : []);
+    const openChildren = (issue.children?.nodes ?? []).filter(node => !TERMINAL_STATE_TYPES.has(node.state?.type ?? "")).length;
+    return {
+        ref,
+        ...deriveLabelState(labels, context.doneStatuses),
+        openChildren,
+        closed: TERMINAL_STATE_TYPES.has(issue.state?.type ?? ""),
+    };
+}
+/**
+ * Add the done label to the issue (labels binding).
+ * @param context - Bound collaborators
+ * @param ref - Canonical identifier
+ * @param doneStatus - Target done label name
+ */
+async function transition(context, ref, doneStatus) {
+    const id = await issueId(context, ref);
+    const labelData = await context.graphql(LABEL_ID_QUERY, {
+        name: doneStatus,
+    });
+    const nodes = labelData.issueLabels?.nodes;
+    const labelId = Array.isArray(nodes) ? nodes[0]?.id : undefined;
+    if (typeof labelId !== "string") {
+        throw new Error(`Linear label "${doneStatus}" was not found in the workspace — create it or fix linear.labels.build.done`);
+    }
+    await context.graphql(ADD_LABEL_MUTATION, { issueId: id, labelId });
+}
+/**
+ * Find-or-update the single marker-managed comment on the issue.
+ * @param context - Bound collaborators
+ * @param ref - Canonical identifier
+ * @param body - Deterministic comment body
+ * @returns Upsert outcome
+ */
+async function upsertComment(context, ref, body) {
+    const data = await context.graphql(COMMENTS_QUERY, { id: ref });
+    const issue = data.issue;
+    const existing = (issue?.comments?.nodes ?? []).find(node => (node.body ?? "").startsWith(DEPLOY_STATUS_SYNC_MARKER));
+    if (existing === undefined) {
+        await context.graphql(COMMENT_CREATE_MUTATION, {
+            issueId: issue?.id ?? "",
+            body,
+        });
+        return "created";
+    }
+    if (existing.body === body)
+        return "unchanged";
+    await context.graphql(COMMENT_UPDATE_MUTATION, {
+        commentId: existing.id ?? "",
+        body,
+    });
+    return "updated";
+}
+/**
+ * Close the issue by moving it to the team's completed workflow state.
+ * @param context - Bound collaborators
+ * @param ref - Canonical identifier
+ */
+async function closeIssue(context, ref) {
+    const data = await context.graphql(TEAM_STATES_QUERY, { id: ref });
+    const issue = data.issue;
+    const completed = (issue?.team?.states?.nodes ?? []).find(node => node.type === "completed");
+    if (completed?.id === undefined) {
+        throw new Error(`Linear team for ${ref} exposes no completed workflow state; cannot close natively`);
+    }
+    await context.graphql(ISSUE_UPDATE_STATE_MUTATION, {
+        issueId: issue?.id ?? "",
+        stateId: completed.id,
+    });
+}
+/**
+ * Create the Linear adapter.
+ * @param options - Workspace and done vocabulary
+ * @param deps - Injectable fetch, env, and secret reader
+ * @returns Tracker adapter over the Linear GraphQL API
+ */
+export function createLinearAdapter(options, deps = {}) {
+    const context = {
+        doneStatuses: options.doneStatuses,
+        graphql: createGraphql(options.workspace, deps),
+    };
+    return {
+        fetchItemState: ref => fetchState(context, ref),
+        transitionToDone: (ref, doneStatus) => transition(context, ref, doneStatus),
+        upsertManagedComment: (ref, body) => upsertComment(context, ref, body),
+        closeNatively: ref => closeIssue(context, ref),
+    };
+}
+//# sourceMappingURL=deploy-status-adapter-linear.js.map

package/dist/cli/deploy-status-adapter-linear.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter-linear.js","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter-linear.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,yBAAyB,GAE1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,gBAAgB,GAIjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAUlD,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAE7E,yEAAyE;AACzE,oEAAoE;AACpE,MAAM,iBAAiB,GACrB,+HAA+H,CAAC;AAClI,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAC/D,MAAM,cAAc,GAClB,6EAA6E,CAAC;AAChF,MAAM,kBAAkB,GACtB,mGAAmG,CAAC;AACtG,kEAAkE;AAClE,MAAM,cAAc,GAClB,2EAA2E,CAAC;AAC9E,MAAM,uBAAuB,GAC3B,uGAAuG,CAAC;AAC1G,MAAM,uBAAuB,GAC3B,sGAAsG,CAAC;AACzG,MAAM,iBAAiB,GACrB,yEAAyE,CAAC;AAC5E,MAAM,2BAA2B,GAC/B,yGAAyG,CAAC;AAc5G;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,OAAe;IAEf,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7D,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CACtD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,IAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnE,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,kDAAkD,SAAS,GAAG,CAC5I,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,SAAiB,EAAE,IAAwB;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACnE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGrC,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,OAAsB,EAAE,GAAW;IACxD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,GAAI,IAAI,CAAC,KAAsC,EAAE,EAAE,CAAC;IAC5D,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,oCAAoC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAAsB,EACtB,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAMN,CAAC;IACd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,oCAAoC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CACxD,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CACvD,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAC1D,CAAC,MAAM,CAAC;IACT,OAAO;QACL,GAAG;QACH,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;QACjD,YAAY;QACZ,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAAsB,EACtB,GAAW,EACX,UAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE;QACtD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;IACH,MAAM,KAAK,GACT,SAAS,CAAC,WACX,EAAE,KAAK,CAAC;IACT,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iBAAiB,UAAU,8EAA8E,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAC1B,OAAsB,EACtB,GAAW,EACX,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAKN,CAAC;IACd,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1D,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC,CACxD,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE;YAC7C,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE;YACxB,IAAI;SACL,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC;IAC/C,MAAM,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE;QAC7C,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE;QAC5B,IAAI;KACL,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,OAAsB,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAON,CAAC;IACd,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CACvD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAClC,CAAC;IACF,IAAI,SAAS,EAAE,EAAE,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,mBAAmB,GAAG,6DAA6D,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE;QACjD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE;QACxB,OAAO,EAAE,SAAS,CAAC,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA6B,EAC7B,OAA2B,EAAE;IAE7B,MAAM,OAAO,GAAkB;QAC7B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;KAChD,CAAC;IACF,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC;QAC3E,oBAAoB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;QACtE,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/cli/deploy-status-adapter-shared.d.ts

@@ -0,0 +1,57 @@
+import type { TrackerItemState } from "../core/deploy-status-transition.js";
+/** Result of a managed-comment upsert. */
+export type CommentUpsertResult = "created" | "updated" | "unchanged";
+/** Vendor adapter: dumb fetch/mutate over one tracker. */
+export interface TrackerAdapter {
+    /** Fetch the vendor-neutral state snapshot for one item. */
+    readonly fetchItemState: (ref: string) => Promise<TrackerItemState>;
+    /** Move the item to the given config-sourced done status. */
+    readonly transitionToDone: (ref: string, doneStatus: string) => Promise<void>;
+    /** Find-or-update the single marker-managed comment on the item. */
+    readonly upsertManagedComment: (ref: string, body: string) => Promise<CommentUpsertResult>;
+    /** Close the item natively (terminal rung only; may be a vendor no-op). */
+    readonly closeNatively: (ref: string) => Promise<void>;
+}
+/** Executes `gh` without a shell and returns stdout. */
+export type ExecGh = (args: readonly string[]) => Promise<string>;
+/** Injectable collaborators for the tracker-adapter factory. */
+export interface TrackerAdapterDeps {
+    /** gh executor (defaults to the runner from {@link createExecGh}) */
+    readonly execGh?: ExecGh;
+    /** Fetch implementation for Linear/Jira (defaults to global fetch) */
+    readonly fetchImpl?: typeof fetch;
+    /** Environment for credential sourcing (defaults to the process env) */
+    readonly env?: Record<string, string | undefined>;
+    /** Secret reader for the darwin keychain fallback */
+    readonly readSecret?: (service: string, account: string) => Promise<string | undefined>;
+}
+/**
+ * Build a fixed-argv executor for one executable over the shared process
+ * runner (no shell; credentials never appear in argv). Shared by the gh
+ * adapter transport and the ref-extraction git/gh deps.
+ * @param executable - Executable name resolved on PATH
+ * @param cwd - Working directory
+ * @param env - Optional environment override (tests point PATH at a fake)
+ * @returns Fixed-argv executor returning stdout
+ */
+export declare function createExec(executable: string, cwd: string, env?: NodeJS.ProcessEnv): (args: readonly string[]) => Promise<string>;
+/**
+ * Build a gh executor (ambient gh auth).
+ * @param cwd - Working directory
+ * @param env - Optional environment override (tests point PATH at a fake)
+ * @returns gh executor
+ */
+export declare function createExecGh(cwd: string, env?: NodeJS.ProcessEnv): ExecGh;
+/**
+ * Derive the vendor-neutral type and current status from an item's label
+ * names — shared by the label-driven adapters (GitHub, Linear). The
+ * highest-rung done label wins so at-or-beyond compares conservatively.
+ * @param labels - Label names on the item
+ * @param doneStatuses - Ladder done vocabulary, lowest rung first
+ * @returns Optional type and currentStatus fields
+ */
+export declare function deriveLabelState(labels: readonly string[], doneStatuses: readonly string[]): {
+    readonly type?: string;
+    readonly currentStatus?: string;
+};
+//# sourceMappingURL=deploy-status-adapter-shared.d.ts.map

package/dist/cli/deploy-status-adapter-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter-shared.d.ts","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter-shared.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAG5E,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;AAEtE,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpE,6DAA6D;IAC7D,QAAQ,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,wDAAwD;AACxD,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAElE,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAClD,qDAAqD;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GACtB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAc9C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7D"}

package/dist/cli/deploy-status-adapter-shared.js

@@ -0,0 +1,62 @@
+/**
+ * Leaf contract module for the deploy-status-sync tracker adapters: the
+ * adapter interface, injectable-deps shape, and the executor/label helpers
+ * shared by the vendor transports. Import-graph leaf by design — the vendor
+ * adapters and the factory (`deploy-status-adapter.ts`) both import FROM
+ * here one-way, so the factory can import the vendors without a cycle
+ * (import/no-cycle). The factory re-exports this surface, so downstream
+ * importers (engine, cmd, refs, tests) are unaffected.
+ * @module cli/deploy-status-adapter-shared
+ */
+import { runKaneCommand } from "../core/kane-cli-process.js";
+import { getProcessEnv } from "./update-check.js";
+/**
+ * Build a fixed-argv executor for one executable over the shared process
+ * runner (no shell; credentials never appear in argv). Shared by the gh
+ * adapter transport and the ref-extraction git/gh deps.
+ * @param executable - Executable name resolved on PATH
+ * @param cwd - Working directory
+ * @param env - Optional environment override (tests point PATH at a fake)
+ * @returns Fixed-argv executor returning stdout
+ */
+export function createExec(executable, cwd, env) {
+    return async (args) => {
+        const result = await runKaneCommand(executable, [...args], {
+            cwd,
+            timeoutMs: 120_000,
+            env: env ?? getProcessEnv(),
+        });
+        if (result.exitCode !== 0) {
+            throw new Error(`${executable} ${args[0] ?? ""} failed (exit ${String(result.exitCode)}): ${result.stderr.trim()}`);
+        }
+        return result.stdout;
+    };
+}
+/**
+ * Build a gh executor (ambient gh auth).
+ * @param cwd - Working directory
+ * @param env - Optional environment override (tests point PATH at a fake)
+ * @returns gh executor
+ */
+export function createExecGh(cwd, env) {
+    return createExec("gh", cwd, env);
+}
+/**
+ * Derive the vendor-neutral type and current status from an item's label
+ * names — shared by the label-driven adapters (GitHub, Linear). The
+ * highest-rung done label wins so at-or-beyond compares conservatively.
+ * @param labels - Label names on the item
+ * @param doneStatuses - Ladder done vocabulary, lowest rung first
+ * @returns Optional type and currentStatus fields
+ */
+export function deriveLabelState(labels, doneStatuses) {
+    const type = labels.find(name => name.toLowerCase().startsWith("type:"));
+    const currentStatus = [...doneStatuses]
+        .reverse()
+        .find(status => labels.includes(status));
+    return {
+        ...(type === undefined ? {} : { type }),
+        ...(currentStatus === undefined ? {} : { currentStatus }),
+    };
+}
+//# sourceMappingURL=deploy-status-adapter-shared.js.map

package/dist/cli/deploy-status-adapter-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter-shared.js","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter-shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAsClD;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,UAAkB,EAClB,GAAW,EACX,GAAuB;IAEvB,OAAO,KAAK,EAAC,IAAI,EAAC,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACzD,GAAG;YACH,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,GAAG,IAAI,aAAa,EAAE;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACnG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAuB;IAC/D,OAAO,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAyB,EACzB,YAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,aAAa,GAAG,CAAC,GAAG,YAAY,CAAC;SACpC,OAAO,EAAE;SACT,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,OAAO;QACL,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/cli/deploy-status-adapter.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Vendor-neutral tracker adapter seam for the deploy-status-sync engine.
+ *
+ * Adapters are dumb fetch/mutate transports: leaf/container classification
+ * and every policy decision live in the pure planner
+ * (`core/deploy-status-transition.ts`). The dry-run wrapper is both the
+ * production `--dry-run` implementation and the unit-test write recorder —
+ * one seam, two uses — so "zero API writes" holds by construction.
+ * @module cli/deploy-status-adapter
+ */
+import type { Tracker } from "../core/deploy-status-sync.js";
+import { type JsonValue } from "../sync/json-path.js";
+import { type TrackerAdapter, type TrackerAdapterDeps } from "./deploy-status-adapter-shared.js";
+export { createExec, createExecGh, deriveLabelState, } from "./deploy-status-adapter-shared.js";
+export type { CommentUpsertResult, ExecGh, TrackerAdapter, TrackerAdapterDeps, } from "./deploy-status-adapter-shared.js";
+/** Construction options for {@link createTrackerAdapter}. */
+export interface TrackerAdapterOptions {
+    readonly tracker: Tracker;
+    /** Parsed `.lisa.config.json` (vendor coordinates are read from it) */
+    readonly config: JsonValue;
+    /** Ladder done vocabulary, lowest rung first (config-sourced) */
+    readonly doneStatuses: readonly string[];
+    /** Working directory for gh */
+    readonly cwd: string;
+}
+/**
+ * Create the vendor adapter for the configured tracker.
+ * @param options - Tracker, parsed config, done vocabulary, cwd
+ * @param deps - Injectable transports (tests inject recorders)
+ * @returns The vendor adapter
+ */
+export declare function createTrackerAdapter(options: TrackerAdapterOptions, deps?: TrackerAdapterDeps): TrackerAdapter;
+/** One suppressed write reported by the dry-run wrapper. */
+export interface RecordedWrite {
+    readonly method: "transitionToDone" | "upsertManagedComment" | "closeNatively";
+    readonly ref: string;
+    readonly detail?: string;
+}
+/**
+ * Wrap an adapter so reads pass through and writes are reported to the
+ * caller but never executed. The caller owns accumulation (the CLI prints
+ * planned writes as they occur; tests collect them), keeping this wrapper
+ * stateless. Used for `--dry-run` and as the unit-test write recorder.
+ * @param inner - Real adapter (only its reads are used)
+ * @param onWrite - Sink invoked once per suppressed write, in call order
+ * @returns Wrapped adapter with all writes suppressed
+ */
+export declare function withDryRun(inner: Pick<TrackerAdapter, "fetchItemState">, onWrite: (write: RecordedWrite) => void): TrackerAdapter;
+//# sourceMappingURL=deploy-status-adapter.d.ts.map

package/dist/cli/deploy-status-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter.d.ts","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAIjE,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EACL,UAAU,EACV,YAAY,EACZ,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,MAAM,EACN,cAAc,EACd,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAE3C,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAgCD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,GAAE,kBAAuB,GAC5B,cAAc,CA8BhB;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EACX,kBAAkB,GAClB,sBAAsB,GACtB,eAAe,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAC7C,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GACtC,cAAc,CAgBhB"}

package/dist/cli/deploy-status-adapter.js

@@ -0,0 +1,87 @@
+import { getAtPath } from "../sync/json-path.js";
+import { createGithubAdapter } from "./deploy-status-adapter-github.js";
+import { createJiraAdapter } from "./deploy-status-adapter-jira.js";
+import { createLinearAdapter } from "./deploy-status-adapter-linear.js";
+import { createExecGh, } from "./deploy-status-adapter-shared.js";
+// Shared adapter surface lives in the leaf contract module (cycle-free:
+// the vendor adapters import it directly); re-exported here so downstream
+// importers (engine, cmd, refs, tests) keep a single import site.
+export { createExec, createExecGh, deriveLabelState, } from "./deploy-status-adapter-shared.js";
+/**
+ * Read a required string from config, failing decision-readably.
+ * @param config - Parsed config
+ * @param dotPath - Dot path of the key
+ * @returns The configured string
+ */
+function requireConfigString(config, dotPath) {
+    const value = getAtPath(config, dotPath);
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`Missing ${dotPath} in .lisa.config.json — required to reach the configured tracker`);
+    }
+    return value;
+}
+/**
+ * Read an optional string from config.
+ * @param config - Parsed config
+ * @param dotPath - Dot path of the key
+ * @returns The configured string, or undefined
+ */
+function optionalConfigString(config, dotPath) {
+    const value = getAtPath(config, dotPath);
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+/**
+ * Create the vendor adapter for the configured tracker.
+ * @param options - Tracker, parsed config, done vocabulary, cwd
+ * @param deps - Injectable transports (tests inject recorders)
+ * @returns The vendor adapter
+ */
+export function createTrackerAdapter(options, deps = {}) {
+    const { tracker, config, doneStatuses, cwd } = options;
+    if (tracker === "github") {
+        const org = requireConfigString(config, "github.org");
+        const repo = requireConfigString(config, "github.repo");
+        return createGithubAdapter({ repository: `${org}/${repo}`, doneStatuses }, { execGh: deps.execGh ?? createExecGh(cwd) });
+    }
+    if (tracker === "linear") {
+        return createLinearAdapter({
+            workspace: requireConfigString(config, "linear.workspace"),
+            doneStatuses,
+        }, deps);
+    }
+    const cloudId = optionalConfigString(config, "atlassian.cloudId");
+    const site = optionalConfigString(config, "atlassian.site");
+    const email = optionalConfigString(config, "atlassian.email");
+    return createJiraAdapter({
+        ...(cloudId === undefined ? {} : { cloudId }),
+        ...(site === undefined ? {} : { site }),
+        ...(email === undefined ? {} : { email }),
+    }, deps);
+}
+/**
+ * Wrap an adapter so reads pass through and writes are reported to the
+ * caller but never executed. The caller owns accumulation (the CLI prints
+ * planned writes as they occur; tests collect them), keeping this wrapper
+ * stateless. Used for `--dry-run` and as the unit-test write recorder.
+ * @param inner - Real adapter (only its reads are used)
+ * @param onWrite - Sink invoked once per suppressed write, in call order
+ * @returns Wrapped adapter with all writes suppressed
+ */
+export function withDryRun(inner, onWrite) {
+    return {
+        fetchItemState: ref => inner.fetchItemState(ref),
+        transitionToDone: (ref, doneStatus) => {
+            onWrite({ method: "transitionToDone", ref, detail: doneStatus });
+            return Promise.resolve();
+        },
+        upsertManagedComment: (ref, body) => {
+            onWrite({ method: "upsertManagedComment", ref, detail: body });
+            return Promise.resolve("created");
+        },
+        closeNatively: ref => {
+            onWrite({ method: "closeNatively", ref });
+            return Promise.resolve();
+        },
+    };
+}
+//# sourceMappingURL=deploy-status-adapter.js.map

package/dist/cli/deploy-status-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-adapter.js","sourceRoot":"","sources":["../../src/cli/deploy-status-adapter.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAkB,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACL,YAAY,GAGb,MAAM,mCAAmC,CAAC;AAE3C,wEAAwE;AACxE,0EAA0E;AAC1E,kEAAkE;AAClE,OAAO,EACL,UAAU,EACV,YAAY,EACZ,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAmB3C;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,MAAiB,EAAE,OAAe;IAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,WAAW,OAAO,kEAAkE,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,MAAiB,EACjB,OAAe;IAEf,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA8B,EAC9B,OAA2B,EAAE;IAE7B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACxD,OAAO,mBAAmB,CACxB,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,EAAE,YAAY,EAAE,EAC9C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,mBAAmB,CACxB;YACE,SAAS,EAAE,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,CAAC;YAC1D,YAAY;SACb,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9D,OAAO,iBAAiB,CACtB;QACE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,KAA6C,EAC7C,OAAuC;IAEvC,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC;QAChD,gBAAgB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YACpC,OAAO,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YAClC,OAAO,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,OAAO,CAAC,SAAkB,CAAC,CAAC;QAC7C,CAAC;QACD,aAAa,EAAE,GAAG,CAAC,EAAE;YACnB,OAAO,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1C,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/deploy-status-refs.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Work-item ref extraction for deploy-status-sync (DSS-2, AC 1).
+ *
+ * Given a `base..head` commit range: union the `Work-Item:` trailer values
+ * of every commit (parsed by git's own trailer engine via the
+ * `%(trailers:key=Work-Item,valueonly)` pretty format) with the `Refs` /
+ * `Closes` lines of every merged PR associated with those commits (GitHub
+ * associated-PRs endpoint — no search-index lag), canonicalize each token
+ * against the configured tracker, and dedupe on the canonical form.
+ * Out-of-scope tokens are skipped with a reason, never an error.
+ * @module cli/deploy-status-refs
+ */
+import type { Tracker } from "../core/deploy-status-sync.js";
+/** Injectable git/gh executors used by the extractor. */
+export interface RefExtractionDeps {
+    /** Run git with fixed argv and return stdout */
+    readonly execGit: (args: readonly string[]) => Promise<string>;
+    /** Run gh with fixed argv and return stdout */
+    readonly execGh: (args: readonly string[]) => Promise<string>;
+}
+/** Extraction options. */
+export interface ExtractRefsOptions {
+    /** Commit range in `base..head` form */
+    readonly range: string;
+    /** Tracker vendor the tokens canonicalize against */
+    readonly tracker: Tracker;
+    /** Configured `owner/repo` (binds bare `#N`; enables PR-body lookups) */
+    readonly repository?: string;
+    /** Jira project key / Linear team key for `KEY-N` canonicalization */
+    readonly projectKey?: string;
+    /** Repository working directory */
+    readonly cwd: string;
+}
+/** One out-of-scope token, reported instead of raised. */
+export interface SkippedRef {
+    readonly token: string;
+    readonly reason: string;
+}
+/** Extraction result. */
+export interface ExtractedRefs {
+    /** Canonical refs, deduped, in first-appearance order */
+    readonly refs: readonly string[];
+    /** Out-of-scope tokens with reasons */
+    readonly skipped: readonly SkippedRef[];
+    /** Resolved head SHA of the range */
+    readonly headSha: string;
+}
+/**
+ * Split items into consecutive chunks of at most `size` elements. Used to
+ * bound gh fan-out: chunks run sequentially, items within a chunk run
+ * concurrently.
+ * @param items - Items to split
+ * @param size - Maximum chunk size (must be positive)
+ * @returns Consecutive chunks in input order
+ */
+export declare function chunk<T>(items: readonly T[], size: number): readonly (readonly T[])[];
+/**
+ * Build production deps over the shared fixed-argv executor factory.
+ * @param cwd - Repository working directory
+ * @returns Real git/gh executors
+ */
+export declare function defaultRefExtractionDeps(cwd: string): RefExtractionDeps;
+/**
+ * Extract the deduped union of work-item refs for a commit range.
+ * @param options - Range, tracker scope, and working directory
+ * @param deps - Injectable executors (defaults to real git/gh)
+ * @returns Canonical refs, skipped tokens, and the resolved head SHA
+ */
+export declare function extractWorkItemRefs(options: ExtractRefsOptions, deps?: RefExtractionDeps): Promise<ExtractedRefs>;
+//# sourceMappingURL=deploy-status-refs.d.ts.map

package/dist/cli/deploy-status-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-refs.d.ts","sourceRoot":"","sources":["../../src/cli/deploy-status-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAG7D,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/D;AAED,0BAA0B;AAC1B,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,mCAAmC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,yBAAyB;AACzB,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AASD;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,CAAC,EACrB,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,IAAI,EAAE,MAAM,GACX,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAI3B;AAWD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAKvE;AA6ID;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,iBAAyD,GAC9D,OAAO,CAAC,aAAa,CAAC,CA6ExB"}