@jam-mcp/server 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 colosair
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,65 @@
+# @jam-mcp/server
+
+JAM (Jira Agent MCP) itself: the MCP server, the setup core, and the `jam` CLI.
+
+JAM is an agent-facing Jira **read** layer. It takes over the decisions an agent
+should not be making — which fields to request, when to paginate, when to read
+the comment thread, what to do when a result is too big — so everyday reads stay
+cheap and important judgements still get full context.
+
+## The three tools
+
+The external contract is exactly three tools. Adding or renaming one is a
+breaking change.
+
+| Tool | Use it for |
+|---|---|
+| `jira_search` | listing, discovery, "what's open", picking candidates |
+| `jira_context` | readiness, blockers, dependencies, priority |
+| `jira_full` | agreement, contract, approval, closure |
+
+A `jira_search` result is never complete issue context — nothing about
+agreement, approval, or done-ness follows from it.
+
+## Evidence boundary
+
+Every result carries a `meta` block, and nothing is ever truncated silently.
+
+`meta.complete` means **JAM finished the Jira retrieval with no known loss**. It
+is not a statement about the project: not readiness, not "unblocked", not "the
+whole story". What JAM did not look at is named in the same block —
+`evidenceScope` and `limitations` call out the repository, external sources, and
+dependencies that live outside Jira. `provenance` and `source` say where the
+records came from.
+
+So an empty comment thread on a complete read is a complete read *of Jira*, not
+proof that nothing was agreed. If the issue points at an external canonical
+source, that source is what settles the question.
+
+## Running it
+
+Normally you don't run this package directly — your coding agent launches
+[`@jam-mcp/launcher`](https://www.npmjs.com/package/@jam-mcp/launcher), which
+resolves which JAM build this machine runs and dispatches here. Going through
+the launcher is what keeps a committed `.mcp.json` free of machine-specific
+paths.
+
+The `jam` CLI is the same binary:
+
+```text
+jam serve      Run the MCP server over stdio
+jam doctor     Diagnose config, credentials and Jira connectivity
+jam setup      Wire up JAM and verify (personal by default; --shared for the team)
+jam auth login Store Jira credentials in this user's OS secret store
+jam runtime    Show or change which JAM build this machine runs
+```
+
+Credentials come from the process environment or this user's OS secret store —
+never from a repository file — and never appear in logs, telemetry, or tool
+results. `stdout` is reserved for the MCP protocol and for JSON output;
+diagnostics go to `stderr`.
+
+## More
+
+- [Repository README](https://github.com/colosair/jam#readme)
+- [JAM design of record](https://github.com/colosair/jam/blob/main/docs/architecture/jira-agent-mcp-design.md)

package/dist/adapters/cache/noop-cache.d.ts

@@ -0,0 +1,7 @@
+import type { CachePort } from "../../ports/cache.port.js";
+/** First release ships without caching. Jira stays the single source of truth. */
+export declare class NoopCache implements CachePort {
+    get<T>(): Promise<T | undefined>;
+    set(): Promise<void>;
+    invalidate(): Promise<void>;
+}

package/dist/adapters/cache/noop-cache.js

@@ -0,0 +1,12 @@
+/** First release ships without caching. Jira stays the single source of truth. */
+export class NoopCache {
+    async get() {
+        return undefined;
+    }
+    async set() {
+        // intentionally empty
+    }
+    async invalidate() {
+        // intentionally empty
+    }
+}

package/dist/adapters/credentials/composite.d.ts

@@ -0,0 +1,30 @@
+import type { CredentialDescription, CredentialPort, CredentialSource, JiraCredentials } from "../../ports/credentials.port.js";
+import { type CredentialValueSource } from "./process-env.js";
+type NamedSource = {
+    name: Exclude<CredentialSource, "mixed" | "none">;
+    source: CredentialValueSource;
+};
+/**
+ * Merges credential values field-by-field across sources, in priority order:
+ * the current process's own environment, then this user's OS secret store,
+ * then the Windows User environment.
+ *
+ * process.env stays first so a per-session override still behaves as expected,
+ * and so CI keeps working unchanged. The secret store comes next because it is
+ * the only source an editor launched from a Dock or Start menu can reach - such
+ * a process never sourced a shell profile. The Windows User environment stays
+ * last: a team member who only ever `setx`'d their token still boots without a
+ * fresh terminal.
+ *
+ * Merging is per field, so a single exported variable can shadow one field of a
+ * stored credential and leave the rest - `describe()` reports that as "mixed".
+ */
+export declare class CompositeCredentialProvider implements CredentialPort {
+    private readonly sources;
+    private cached?;
+    constructor(sources?: NamedSource[]);
+    private resolve;
+    load(): JiraCredentials;
+    describe(): CredentialDescription;
+}
+export {};

package/dist/adapters/credentials/composite.js

@@ -0,0 +1,79 @@
+import { JamError } from "../../domain/errors.js";
+import { CREDENTIAL_ENV_KEYS, ProcessEnvCredentialSource, } from "./process-env.js";
+import { SecretStoreCredentialSource, resolveSecretStore } from "./secret-store.js";
+import { WindowsUserEnvCredentialSource } from "./windows-user-env.js";
+const FIELD_BY_KEY = {
+    JIRA_BASE_URL: "baseUrl",
+    JIRA_EMAIL: "email",
+    JIRA_API_TOKEN: "apiToken",
+};
+/**
+ * Merges credential values field-by-field across sources, in priority order:
+ * the current process's own environment, then this user's OS secret store,
+ * then the Windows User environment.
+ *
+ * process.env stays first so a per-session override still behaves as expected,
+ * and so CI keeps working unchanged. The secret store comes next because it is
+ * the only source an editor launched from a Dock or Start menu can reach - such
+ * a process never sourced a shell profile. The Windows User environment stays
+ * last: a team member who only ever `setx`'d their token still boots without a
+ * fresh terminal.
+ *
+ * Merging is per field, so a single exported variable can shadow one field of a
+ * stored credential and leave the rest - `describe()` reports that as "mixed".
+ */
+export class CompositeCredentialProvider {
+    sources;
+    cached;
+    constructor(sources = [
+        { name: "process", source: new ProcessEnvCredentialSource() },
+        { name: "secret-store", source: new SecretStoreCredentialSource(resolveSecretStore()) },
+        { name: "user-env", source: new WindowsUserEnvCredentialSource() },
+    ]) {
+        this.sources = sources;
+    }
+    resolve() {
+        if (this.cached)
+            return this.cached;
+        const values = {};
+        const sourceByKey = {};
+        for (const { name, source } of this.sources) {
+            const read = source.read();
+            for (const key of CREDENTIAL_ENV_KEYS) {
+                if (values[key] === undefined && read[key]) {
+                    values[key] = read[key];
+                    sourceByKey[key] = name;
+                }
+            }
+        }
+        this.cached = { values, sourceByKey };
+        return this.cached;
+    }
+    load() {
+        const { values } = this.resolve();
+        const missing = CREDENTIAL_ENV_KEYS.filter((k) => !values[k]);
+        if (missing.length > 0) {
+            throw new JamError("CONFIG_INVALID", `Missing Jira credentials: ${missing.join(", ")} (checked the process environment, this user's OS secret store, then the Windows User environment). Run \`jam auth login\`.`, { missing });
+        }
+        return {
+            baseUrl: values.JIRA_BASE_URL.replace(/\/+$/, ""),
+            email: values.JIRA_EMAIL,
+            apiToken: values.JIRA_API_TOKEN,
+        };
+    }
+    describe() {
+        const { values, sourceByKey } = this.resolve();
+        const used = new Set(Object.values(sourceByKey));
+        let source = "none";
+        if (used.size === 1)
+            source = [...used][0];
+        else if (used.size > 1)
+            source = "mixed";
+        const description = { hasToken: Boolean(values.JIRA_API_TOKEN), source };
+        if (values.JIRA_BASE_URL)
+            description.baseUrl = values.JIRA_BASE_URL;
+        if (values.JIRA_EMAIL)
+            description.email = values.JIRA_EMAIL;
+        return description;
+    }
+}

package/dist/adapters/credentials/process-env.d.ts

@@ -0,0 +1,13 @@
+export declare const CREDENTIAL_ENV_KEYS: readonly ["JIRA_BASE_URL", "JIRA_EMAIL", "JIRA_API_TOKEN"];
+export type CredentialEnvKey = (typeof CREDENTIAL_ENV_KEYS)[number];
+export type RawCredentialValues = Partial<Record<CredentialEnvKey, string>>;
+/** A named source of raw credential values, keyed by env var name. */
+export interface CredentialValueSource {
+    read(): RawCredentialValues;
+}
+/** Reads the current process's own environment. Always tried first. */
+export declare class ProcessEnvCredentialSource implements CredentialValueSource {
+    private readonly env;
+    constructor(env?: NodeJS.ProcessEnv);
+    read(): RawCredentialValues;
+}

package/dist/adapters/credentials/process-env.js

@@ -0,0 +1,17 @@
+export const CREDENTIAL_ENV_KEYS = ["JIRA_BASE_URL", "JIRA_EMAIL", "JIRA_API_TOKEN"];
+/** Reads the current process's own environment. Always tried first. */
+export class ProcessEnvCredentialSource {
+    env;
+    constructor(env = process.env) {
+        this.env = env;
+    }
+    read() {
+        const out = {};
+        for (const key of CREDENTIAL_ENV_KEYS) {
+            const value = this.env[key]?.trim();
+            if (value)
+                out[key] = value;
+        }
+        return out;
+    }
+}

package/dist/adapters/credentials/secret-store.d.ts

@@ -0,0 +1,69 @@
+import { type CredentialValueSource, type RawCredentialValues } from "./process-env.js";
+/**
+ * Credentials held by the operating system for this user, rather than by a
+ * shell profile.
+ *
+ * This is what makes JAM work in an editor launched from a Dock or Start menu.
+ * Such an editor never sourced a shell profile, so the MCP child it spawns
+ * inherits no `JIRA_*` at all - but it does run as the user, so it can read
+ * what the OS is holding for that user.
+ *
+ * The stored value never appears in a log, an error, or a tool result. It is
+ * read into memory, handed to the credential chain, and nothing else.
+ */
+export type StoredCredentials = {
+    baseUrl: string;
+    email: string;
+    apiToken: string;
+};
+export type RunResult = {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    error?: NodeJS.ErrnoException;
+};
+/** Injected by tests so the suite never touches a real keychain. */
+export type RunFn = (command: string, args: string[], input?: string) => RunResult;
+export interface SecretStore {
+    /** Shown by `jam auth login`. Names the mechanism, never a value. */
+    readonly label: string;
+    /** Missing or unreadable resolves to undefined - reading never throws. */
+    read(): StoredCredentials | undefined;
+    /** Throws on failure: the user just asked for this and must not be told it worked. */
+    write(values: StoredCredentials): void;
+    /** Succeeds when there was nothing to remove. */
+    clear(): void;
+}
+/** Raised when the platform's backend is absent, as opposed to empty. */
+export declare class SecretStoreUnavailableError extends Error {
+    readonly remedy: string;
+    constructor(message: string, remedy: string);
+}
+export declare function secretStoreDisabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The store for this system, or undefined when there is none that works.
+ *
+ * Being on Linux is not the same as having a secret store: a headless server or
+ * a container routinely has no libsecret and no session keyring. So the backend
+ * is probed, not assumed from `process.platform`.
+ */
+export declare function resolveSecretStore(run?: RunFn, env?: NodeJS.ProcessEnv): SecretStore | undefined;
+/**
+ * The credential chain's view of the store.
+ *
+ * Fail-soft by design, like the Windows registry source: a machine with no
+ * store, or an empty one, is a normal state that must not turn every command
+ * into an error. `jam auth login` is where a failure gets reported, because
+ * there the user asked for something specific.
+ */
+export declare class SecretStoreCredentialSource implements CredentialValueSource {
+    private readonly store;
+    /**
+     * The store is required, with no default that would resolve a real one.
+     * A parameter default cannot tell `undefined` meaning "this system has no
+     * store" from `undefined` meaning "not supplied" - and getting that wrong
+     * silently reaches the user's real keychain, including from a test.
+     */
+    constructor(store: SecretStore | undefined);
+    read(): RawCredentialValues;
+}

package/dist/adapters/credentials/secret-store.js

@@ -0,0 +1,259 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { join } from "node:path";
+import { CREDENTIAL_ENV_KEYS, } from "./process-env.js";
+/** Raised when the platform's backend is absent, as opposed to empty. */
+export class SecretStoreUnavailableError extends Error {
+    remedy;
+    constructor(message, remedy) {
+        super(message);
+        this.name = "SecretStoreUnavailableError";
+        this.remedy = remedy;
+    }
+}
+/** Derived from constants, never from user input, except the account name. */
+const SERVICE = "jam-mcp";
+/**
+ * Escape hatch for isolated test sandboxes.
+ *
+ * An OS secret store is per-user, not per-HOME, so a sandbox that repoints HOME
+ * still reads the developer's real keychain - the same hole the Windows
+ * registry source has always had. This is not a user-facing feature: it exists
+ * so `npm run smoke` can be offline and deterministic, and `jam auth login`
+ * reports it distinctly rather than claiming no store exists.
+ */
+const DISABLE_ENV = "JAM_DISABLE_SECRET_STORE";
+export function secretStoreDisabled(env = process.env) {
+    return Boolean(env[DISABLE_ENV]);
+}
+function account() {
+    return userInfo().username;
+}
+function defaultRun(command, args, input) {
+    const result = spawnSync(command, args, {
+        encoding: "utf8",
+        ...(input === undefined ? {} : { input }),
+        // No shell: arguments are passed as an array, so nothing is re-parsed.
+        windowsHide: true,
+    });
+    return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        ...(result.error ? { error: result.error } : {}),
+    };
+}
+/** Whether a command exists and runs at all. ENOENT is the signal we want. */
+function canRun(run, command, args) {
+    return run(command, args).error?.code !== "ENOENT";
+}
+function parse(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed?.baseUrl || !parsed.email || !parsed.apiToken)
+            return undefined;
+        return { baseUrl: parsed.baseUrl, email: parsed.email, apiToken: parsed.apiToken };
+    }
+    catch {
+        // A corrupt entry is treated as absent. Reading is one step of credential
+        // resolution and must not turn into a crash on an unrelated command.
+        return undefined;
+    }
+}
+/**
+ * macOS login Keychain.
+ *
+ * The item is created and read by the same binary (`/usr/bin/security`), which
+ * is what keeps the OS from prompting for approval on every read.
+ */
+function macosStore(run) {
+    const base = ["-s", SERVICE, "-a", account()];
+    return {
+        label: "macOS Keychain",
+        read() {
+            const res = run("security", ["find-generic-password", ...base, "-w"]);
+            if (res.error || res.status !== 0)
+                return undefined;
+            return parse(res.stdout.trim());
+        },
+        write(values) {
+            // `-U` updates in place rather than failing on an existing item.
+            // The secret rides in argv here because `security` reads its -w prompt
+            // from the controlling terminal, not stdin, and we already collected the
+            // token through our own masked prompt - prompting again would be worse.
+            // Visible only to this user, for the lifetime of one short-lived child.
+            const res = run("security", [
+                "add-generic-password",
+                ...base,
+                "-U",
+                "-w",
+                JSON.stringify(values),
+            ]);
+            if (res.error?.code === "ENOENT")
+                throw unavailable("security");
+            if (res.status !== 0)
+                throw new Error(`Keychain write failed: ${res.stderr.trim()}`);
+        },
+        clear() {
+            run("security", ["delete-generic-password", ...base]);
+        },
+    };
+}
+/** Linux libsecret, via the `secret-tool` CLI. */
+function linuxStore(run) {
+    const attrs = ["service", SERVICE, "account", account()];
+    return {
+        label: "libsecret (secret-tool)",
+        read() {
+            const res = run("secret-tool", ["lookup", ...attrs]);
+            if (res.error || res.status !== 0)
+                return undefined;
+            return parse(res.stdout.trim());
+        },
+        write(values) {
+            // secret-tool reads the secret from stdin, so it never reaches argv.
+            const res = run("secret-tool", ["store", "--label", "JAM (Jira Agent MCP)", ...attrs], JSON.stringify(values));
+            if (res.error?.code === "ENOENT")
+                throw unavailable("secret-tool");
+            if (res.status !== 0)
+                throw new Error(`secret-tool store failed: ${res.stderr.trim()}`);
+        },
+        clear() {
+            run("secret-tool", ["clear", ...attrs]);
+        },
+    };
+}
+/**
+ * Windows: a file encrypted to the current user account with DPAPI.
+ *
+ * Credential Manager is not usable here - `cmdkey` can store a credential but
+ * cannot read one back, and reading it needs either a P/Invoke or a PowerShell
+ * module that is not installed by default.
+ *
+ * The confidentiality boundary is DPAPI's current-user binding. The 0o600 mode
+ * on the file is best-effort hardening on top, not the thing protecting it -
+ * Node's mode argument does not carry POSIX semantics on Windows.
+ *
+ * Kept separate from ~/.jam/config.yaml, which declares itself hand-editable
+ * and free of credentials.
+ */
+function windowsStore(run) {
+    const dir = join(homedir(), ".jam");
+    const path = join(dir, "credentials.dpapi");
+    // The path reaches PowerShell as an argument, never interpolated into the
+    // script text; the secret reaches it on stdin.
+    const decrypt = [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        "$p=$args[0]; if(!(Test-Path $p)){exit 1};" +
+            "$s=Get-Content $p -Raw | ConvertTo-SecureString;" +
+            "[Runtime.InteropServices.Marshal]::PtrToStringAuto(" +
+            "[Runtime.InteropServices.Marshal]::SecureStringToBSTR($s))",
+        "-args",
+    ];
+    const encrypt = [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        "$in=[Console]::In.ReadToEnd();" +
+            "$in | ConvertTo-SecureString -AsPlainText -Force |" +
+            " ConvertFrom-SecureString | Set-Content $args[0] -NoNewline",
+        "-args",
+    ];
+    return {
+        label: "Windows DPAPI (user-encrypted file)",
+        read() {
+            if (!existsSync(path))
+                return undefined;
+            const res = run("powershell", [...decrypt, path]);
+            if (res.error || res.status !== 0)
+                return undefined;
+            return parse(res.stdout.trim());
+        },
+        write(values) {
+            mkdirSync(dir, { recursive: true });
+            const res = run("powershell", [...encrypt, path], JSON.stringify(values));
+            if (res.error?.code === "ENOENT")
+                throw unavailable("powershell");
+            if (res.status !== 0)
+                throw new Error(`DPAPI write failed: ${res.stderr.trim()}`);
+            try {
+                // Best-effort only; DPAPI is what actually protects the contents.
+                writeFileSync(path, "", { flag: "r+", mode: 0o600 });
+            }
+            catch {
+                /* ignore - the encryption, not the mode, is the boundary */
+            }
+        },
+        clear() {
+            rmSync(path, { force: true });
+        },
+    };
+}
+function unavailable(command) {
+    return new SecretStoreUnavailableError(`No usable secret store was found on this system (${command} is not available).`, command === "secret-tool"
+        ? "Install secret-tool (libsecret), or set JIRA_BASE_URL, JIRA_EMAIL and JIRA_API_TOKEN instead."
+        : "Set JIRA_BASE_URL, JIRA_EMAIL and JIRA_API_TOKEN instead.");
+}
+/**
+ * The store for this system, or undefined when there is none that works.
+ *
+ * Being on Linux is not the same as having a secret store: a headless server or
+ * a container routinely has no libsecret and no session keyring. So the backend
+ * is probed, not assumed from `process.platform`.
+ */
+export function resolveSecretStore(run = defaultRun, env = process.env) {
+    if (secretStoreDisabled(env))
+        return undefined;
+    if (process.platform === "darwin") {
+        return canRun(run, "security", ["help"]) ? macosStore(run) : undefined;
+    }
+    if (process.platform === "win32") {
+        return canRun(run, "powershell", ["-NoProfile", "-Command", "$null"])
+            ? windowsStore(run)
+            : undefined;
+    }
+    if (process.platform === "linux") {
+        return canRun(run, "secret-tool", ["--version"]) ? linuxStore(run) : undefined;
+    }
+    return undefined;
+}
+/**
+ * The credential chain's view of the store.
+ *
+ * Fail-soft by design, like the Windows registry source: a machine with no
+ * store, or an empty one, is a normal state that must not turn every command
+ * into an error. `jam auth login` is where a failure gets reported, because
+ * there the user asked for something specific.
+ */
+export class SecretStoreCredentialSource {
+    store;
+    /**
+     * The store is required, with no default that would resolve a real one.
+     * A parameter default cannot tell `undefined` meaning "this system has no
+     * store" from `undefined` meaning "not supplied" - and getting that wrong
+     * silently reaches the user's real keychain, including from a test.
+     */
+    constructor(store) {
+        this.store = store;
+    }
+    read() {
+        const stored = this.store?.read();
+        if (!stored)
+            return {};
+        const values = {};
+        const byKey = {
+            JIRA_BASE_URL: stored.baseUrl,
+            JIRA_EMAIL: stored.email,
+            JIRA_API_TOKEN: stored.apiToken,
+        };
+        for (const key of CREDENTIAL_ENV_KEYS) {
+            const value = byKey[key]?.trim();
+            if (value)
+                values[key] = value;
+        }
+        return values;
+    }
+}

package/dist/adapters/credentials/windows-user-env.d.ts

@@ -0,0 +1,20 @@
+import { type CredentialValueSource, type RawCredentialValues } from "./process-env.js";
+export type RegQueryFn = (name: string) => string | undefined;
+/**
+ * Reads Jira credentials from the Windows *User* environment (HKCU\Environment)
+ * rather than the current process's environment.
+ *
+ * This exists because a shell that had `setx JIRA_API_TOKEN ...` run in it does
+ * NOT see the new value until a new process is spawned - but every terminal
+ * spawned afterwards, including the one Claude Code's MCP child inherits from,
+ * does. Falling back to the registry closes that gap without asking the user
+ * to open a fresh terminal.
+ *
+ * A value read here is never logged, thrown in an error, or written back
+ * anywhere - `read()` only returns it to the caller for in-memory use.
+ */
+export declare class WindowsUserEnvCredentialSource implements CredentialValueSource {
+    private readonly queryFn;
+    constructor(queryFn?: RegQueryFn);
+    read(): RawCredentialValues;
+}

package/dist/adapters/credentials/windows-user-env.js

@@ -0,0 +1,51 @@
+import { spawnSync } from "node:child_process";
+import { CREDENTIAL_ENV_KEYS } from "./process-env.js";
+/**
+ * Reads Jira credentials from the Windows *User* environment (HKCU\Environment)
+ * rather than the current process's environment.
+ *
+ * This exists because a shell that had `setx JIRA_API_TOKEN ...` run in it does
+ * NOT see the new value until a new process is spawned - but every terminal
+ * spawned afterwards, including the one Claude Code's MCP child inherits from,
+ * does. Falling back to the registry closes that gap without asking the user
+ * to open a fresh terminal.
+ *
+ * A value read here is never logged, thrown in an error, or written back
+ * anywhere - `read()` only returns it to the caller for in-memory use.
+ */
+export class WindowsUserEnvCredentialSource {
+    queryFn;
+    constructor(queryFn = defaultRegQuery) {
+        this.queryFn = queryFn;
+    }
+    read() {
+        if (process.platform !== "win32")
+            return {};
+        const out = {};
+        for (const key of CREDENTIAL_ENV_KEYS) {
+            const value = this.queryFn(key)?.trim();
+            if (value)
+                out[key] = value;
+        }
+        return out;
+    }
+}
+const VALUE_LINE = /^\s*\S+\s+REG_(?:SZ|EXPAND_SZ)\s+(.*)$/;
+// Built from a char code rather than a literal backslash escape - a lone
+// backslash before a letter isn't a recognized JS escape and silently
+// disappears, which would quietly turn this into an invalid registry path.
+const HKCU_ENVIRONMENT_KEY = ["HKCU", "Environment"].join(String.fromCharCode(92));
+function defaultRegQuery(name) {
+    const res = spawnSync("reg.exe", ["query", HKCU_ENVIRONMENT_KEY, "/v", name], {
+        encoding: "utf8",
+        windowsHide: true,
+    });
+    if (res.status !== 0 || !res.stdout)
+        return undefined;
+    for (const line of res.stdout.split(/\r?\n/)) {
+        const match = VALUE_LINE.exec(line);
+        if (match)
+            return match[1];
+    }
+    return undefined;
+}

package/dist/adapters/jira-cloud/adf-to-text.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Atlassian Document Format -> plain text.
+ *
+ * ADF raw JSON is mostly structural tokens the agent has to pay for and then
+ * ignore. Normalizing to text is the single biggest payload win in JAM, so
+ * nothing downstream of the adapter ever sees an ADF node.
+ *
+ * Unknown node types are surfaced as `[unsupported: <type>]` rather than
+ * dropped - a silently missing paragraph is exactly the failure mode the
+ * completeness rules exist to prevent.
+ */
+export declare function adfToText(doc: unknown): string;