@snagset/server 0.0.3 → 0.1.0

package/dist/db/migrations/0006_instance_settings.sql

@@ -0,0 +1,69 @@
+-- ───────────────────────────────────────
+-- Instance settings — D89, plan/08 §5b: what the dashboard connected.
+--
+-- "If added via the environment variables it takes those and doesn't allow
+-- to change in the dashboard, but if no env variables then we can add and
+-- connect via the general settings." The environment wins and locks; this
+-- table is where the dashboard's half lives. One row per key per org, the
+-- non-secret half in `value` and the secret sealed exactly as
+-- `orgs.storage_credentials` and `integrations.credentials` are — AES-256-GCM
+-- under HKDF(SNAGSET_SECRET_KEY, 'credential-enc') — so there is one way to
+-- hold a secret at rest rather than three.
+--
+-- Mail is the first key (`mail`: the transport URL sealed, the From address
+-- and the transport's shape in `value`); the trackers' credentials follow
+-- with phase 7. Storage stays on the `orgs.storage_*` columns it had before
+-- this table existed: moving it would be a migration of secrets for no gain.
+--
+-- Under D71, §3 describes the CURRENT schema, so the table is added there in
+-- the same commit and `pnpm schema:diff:check` asserts the two agree.
+--
+-- THE POLICY, TWICE. The generator renders every policy in 0001's shape, and
+-- 0002's rewrite (NULLIF and the maintenance claim) runs only over the
+-- `public` schema — in the diff tool's scratch schema it touches nothing, so
+-- both sides compare policies in 0001's shape. This file does the same as
+-- 0002 did for every earlier table: create the policy in 0001's shape, then
+-- rewrite it in place, scoped to this table and to `public`. On a real
+-- database the second step lands; in the diff's scratch schema it is inert,
+-- and the two agree. Guarded against running twice, unlike 0002, because a
+-- double NULLIF is what a re-run produced while this was being written.
+CREATE TABLE instance_settings (
+  org_id      uuid NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  key         text NOT NULL CHECK (key ~ '^[a-z][a-z0-9_.-]{0,63}$'),
+  value       jsonb NOT NULL DEFAULT '{}'::jsonb,
+  secret      bytea,
+  secret_iv   bytea,
+  updated_by  uuid REFERENCES users(id) ON DELETE SET NULL,
+  updated_at  timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (org_id, key),
+  CHECK ((secret IS NULL) = (secret_iv IS NULL))
+);
+ALTER TABLE instance_settings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE instance_settings FORCE ROW LEVEL SECURITY;
+CREATE POLICY instance_settings_org ON instance_settings
+  USING (org_id = current_setting('app.org_id', true)::uuid);
+
+DO $$
+DECLARE
+  existing text;
+BEGIN
+  SELECT pg_get_expr(pol.polqual, pol.polrelid) INTO existing
+  FROM pg_policy pol
+  JOIN pg_class c ON c.oid = pol.polrelid
+  JOIN pg_namespace n ON n.oid = c.relnamespace
+  WHERE n.nspname = 'public' AND c.relname = 'instance_settings' AND pol.polname = 'instance_settings_org';
+  IF existing IS NULL OR existing LIKE '%NULLIF%' THEN
+    RETURN;
+  END IF;
+  existing := replace(
+    existing,
+    'current_setting(''app.org_id''::text, true)',
+    'NULLIF(current_setting(''app.org_id''::text, true), ''''::text)'
+  );
+  IF existing NOT LIKE '%app.maintenance%' THEN
+    existing := existing || ' OR current_setting(''app.maintenance'', true) = ''on''';
+  END IF;
+  EXECUTE 'DROP POLICY instance_settings_org ON public.instance_settings';
+  EXECUTE format('CREATE POLICY instance_settings_org ON public.instance_settings USING (%s)', existing);
+END
+$$;

package/dist/db/migrations/0007_jira_provider.no-txn.sql

@@ -0,0 +1,13 @@
+-- ───────────────────────────────────────
+-- Jira joins the providers — D88 named it, D98 built it (2026-09-03).
+--
+-- `snag_provider` was closed at github, linear, slack and webhook in 0001;
+-- Jira Cloud was not in the original set and Faster Fixes made it a parity
+-- item. ADD VALUE cannot run inside a transaction block on every Postgres
+-- this ships on, and the new value cannot be used in the transaction that
+-- added it either — hence `.no-txn`, which migrate.ts runs on the bare
+-- connection, and hence a file of its own before anything writes 'jira'.
+--
+-- Under D71, §3.1's enum is amended in the same commit and
+-- `pnpm schema:diff:check` asserts the two agree.
+ALTER TYPE snag_provider ADD VALUE IF NOT EXISTS 'jira';

package/dist/domain.js

@@ -0,0 +1,129 @@
+/**
+ * A site's DOMAIN — plan/08 §3, D92, borrowed from Faster Fixes's one-field
+ * setup: the studio types `acme.com` once and the widget works on
+ * `https://acme.com`, `https://staging.acme.com`, `http://preview.acme.com:3000`
+ * and on localhost, with no list of origins to maintain. Exact origins stay
+ * as "also allowed" for the cases a domain cannot say (a client's separate
+ * marketing host, a numbered preview on somebody else's suffix).
+ *
+ * The rule, and the two boundaries that make it safe:
+ *   · the origin's HOSTNAME equals the domain, or ends with "." + domain — a
+ *     dot boundary, so `notacme.com` never matches `acme.com`;
+ *   · any scheme and any port, because a staging server on :3000 is the same
+ *     site as the one on :443, and the client's own site is the trust anchor
+ *     (05 §4.3's "scheme and port must match" was written for exact origins,
+ *     where a mismatch means a different origin; a domain is a claim about a
+ *     host, and the host is what the client owns);
+ *   · never a public suffix: `vercel.app` would allow every site on Vercel,
+ *     which is the subdomain-takeover class §4.3 refuses for wildcards.
+ */
+/** Suffixes shared by strangers — the ones §4.3 names, plus the usual PaaS hosts. */
+export const SHARED_SUFFIXES = [
+    "vercel.app",
+    "netlify.app",
+    "pages.dev",
+    "github.io",
+    "gitlab.io",
+    "workers.dev",
+    "ngrok-free.app",
+    "ngrok.io",
+    "ngrok.app",
+    "herokuapp.com",
+    "fly.dev",
+    "onrender.com",
+    "render.com",
+    "web.app",
+    "firebaseapp.com",
+    "azurewebsites.net",
+    "azurestaticapps.net",
+    "amazonaws.com",
+    "cloudfront.net",
+    "surge.sh",
+    "glitch.me",
+    "repl.co",
+    "replit.app",
+    "webflow.io",
+    "framer.app",
+    "framer.website",
+    "wixsite.com",
+    "squarespace.com",
+    "myshopify.com",
+    "wordpress.com",
+    "blogspot.com",
+    "github.dev",
+    "codesandbox.io",
+    "stackblitz.io",
+    "localhost",
+];
+const HOST = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+/**
+ * What the studio typed → the domain to store, or a sentence.
+ * Accepts a bare host or a full address (the hostname is taken), lower-cases,
+ * strips a trailing dot and a leading `www.` — `www.acme.com` and `acme.com`
+ * are one site, and the shorter one covers both.
+ */
+export function normaliseDomain(input) {
+    let raw = input.trim().toLowerCase();
+    if (!raw)
+        return { error: "Type the site's domain, like acme.com." };
+    if (raw.includes("://")) {
+        try {
+            raw = new URL(raw).hostname;
+        }
+        catch {
+            return { error: `${JSON.stringify(input.trim())} is not an address. A domain looks like acme.com.` };
+        }
+    }
+    else {
+        raw = raw.replace(/^\/+/, "").split(/[/?#:]/)[0] ?? "";
+    }
+    raw = raw.replace(/\.$/, "").replace(/^www\./, "");
+    if (raw === "localhost" || /^\d{1,3}(\.\d{1,3}){3}$/.test(raw) || raw.startsWith("[")) {
+        return { error: "localhost and IP addresses are always allowed while developing — the domain is the site's real host, like acme.com." };
+    }
+    if (!HOST.test(raw))
+        return { error: `${JSON.stringify(input.trim())} is not a domain. It looks like acme.com or staging.acme.com.` };
+    if (isSharedSuffix(raw)) {
+        return {
+            error: `${raw} is a host shared by everyone who deploys there. Name your own subdomain (like kilnwork.${raw}) or add the exact address under "Also allowed".`,
+        };
+    }
+    return { domain: raw };
+}
+/** A bare shared suffix, or a bare top-level label — never a site of its own. */
+export function isSharedSuffix(host) {
+    if (!host.includes("."))
+        return true;
+    return SHARED_SUFFIXES.includes(host);
+}
+/** Does this browser origin belong to the domain? Any scheme, any port, dot boundary on the host. */
+export function originMatchesDomain(domain, origin) {
+    if (!domain)
+        return false;
+    let host;
+    try {
+        host = new URL(origin.toLowerCase()).hostname;
+    }
+    catch {
+        return false;
+    }
+    return host === domain || host.endsWith("." + domain);
+}
+/**
+ * 05 §4.3 rule 4 — the developer's own machine, allowed by default:
+ * http(s)://localhost[:port], 127.0.0.1, [::1], and *.localhost.
+ */
+export function isLocalOrigin(origin) {
+    let u;
+    try {
+        u = new URL(origin.toLowerCase());
+    }
+    catch {
+        return false;
+    }
+    if (u.protocol !== "http:" && u.protocol !== "https:")
+        return false;
+    const h = u.hostname;
+    return h === "localhost" || h.endsWith(".localhost") || h === "127.0.0.1" || h === "[::1]";
+}
+//# sourceMappingURL=domain.js.map

package/dist/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../src/domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,YAAY;IACZ,aAAa;IACb,WAAW;IACX,WAAW;IACX,WAAW;IACX,aAAa;IACb,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,eAAe;IACf,SAAS;IACT,cAAc;IACd,YAAY;IACZ,SAAS;IACT,iBAAiB;IACjB,mBAAmB;IACnB,qBAAqB;IACrB,eAAe;IACf,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,eAAe;IACf,WAAW;CACZ,CAAC;AAEF,MAAM,IAAI,GAAG,gGAAgG,CAAC;AAE9G;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IACrE,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,mDAAmD,EAAE,CAAC;QACvG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC;IACD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,GAAG,KAAK,WAAW,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,KAAK,EAAE,qHAAqH,EAAE,CAAC;IAC1I,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,+DAA+D,EAAE,CAAC;IACtI,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,KAAK,EAAE,GAAG,GAAG,2FAA2F,GAAG,kDAAkD;SAC9J,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACzB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,MAAc;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrB,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,OAAO,CAAC;AAC7F,CAAC"}

package/dist/instance/settings.js

@@ -0,0 +1,54 @@
+import { open, seal } from "../crypto.js";
+export async function readSetting(sql, keys, orgId, key) {
+    const [row] = await sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${orgId}, true)`;
+        return tx `
+      SELECT value, secret, secret_iv, updated_at, updated_by
+      FROM instance_settings WHERE org_id = ${orgId}::uuid AND key = ${key}
+    `;
+    });
+    if (!row)
+        return null;
+    const sealed = row.secret && row.secret_iv ? { ciphertext: row.secret, iv: row.secret_iv } : null;
+    const secret = sealed ? open(keys, sealed) : null;
+    return {
+        value: row.value,
+        secret,
+        unreadable: !!sealed && secret === null,
+        updatedAt: row.updated_at,
+        updatedBy: row.updated_by,
+    };
+}
+export async function writeSetting(sql, keys, input) {
+    const sealed = input.secret === null ? null : seal(keys, input.secret);
+    await sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${input.orgId}, true)`;
+        await tx `
+      INSERT INTO instance_settings (org_id, key, value, secret, secret_iv, updated_by, updated_at)
+      VALUES (${input.orgId}::uuid, ${input.key}, ${tx.json(input.value)}, ${sealed?.ciphertext ?? null},
+              ${sealed?.iv ?? null}, ${input.updatedBy}, now())
+      ON CONFLICT (org_id, key) DO UPDATE
+        SET value = EXCLUDED.value, secret = EXCLUDED.secret, secret_iv = EXCLUDED.secret_iv,
+            updated_by = EXCLUDED.updated_by, updated_at = now()
+    `;
+    });
+}
+export async function clearSetting(sql, orgId, key) {
+    await sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${orgId}, true)`;
+        await tx `DELETE FROM instance_settings WHERE org_id = ${orgId}::uuid AND key = ${key}`;
+    });
+}
+/**
+ * The one org a v1 self-host has — the storage module's own convention,
+ * under the maintenance claim (0002, D56) because the callers that need it
+ * (the outbox job, boot) hold no org yet.
+ */
+export async function firstOrgId(sql) {
+    const [row] = await sql.begin(async (tx) => {
+        await tx `SET LOCAL app.maintenance = 'on'`;
+        return tx `SELECT id FROM orgs WHERE deleted_at IS NULL ORDER BY created_at LIMIT 1`;
+    });
+    return row?.id ?? null;
+}
+//# sourceMappingURL=settings.js.map

package/dist/instance/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/instance/settings.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAsC1C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,IAAa,EACb,KAAa,EACb,GAAW;IAEX,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzC,MAAM,EAAE,CAAA,mCAAmC,KAAK,SAAS,CAAC;QAC1D,OAAO,EAAE,CAAO;;8CAE0B,KAAK,oBAAoB,GAAG;KACrE,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAU;QACrB,MAAM;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAiB,EACjB,IAAa,EACb,KAAsH;IAEtH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,EAAE,CAAA,mCAAmC,KAAK,CAAC,KAAK,SAAS,CAAC;QAChE,MAAM,EAAE,CAAA;;gBAEI,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAA2B,CAAC,KAAK,MAAM,EAAE,UAAU,IAAI,IAAI;gBAC7G,MAAM,EAAE,EAAE,IAAI,IAAI,KAAK,KAAK,CAAC,SAAS;;;;KAIjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAiB,EAAE,KAAa,EAAE,GAAW;IAC9E,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,EAAE,CAAA,mCAAmC,KAAK,SAAS,CAAC;QAC1D,MAAM,EAAE,CAAA,gDAAgD,KAAK,oBAAoB,GAAG,EAAE,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAiB;IAChD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzC,MAAM,EAAE,CAAA,kCAAkC,CAAC;QAC3C,OAAO,EAAE,CAAkB,0EAA0E,CAAC;IACxG,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;AACzB,CAAC"}

package/dist/integrations/github.js

@@ -0,0 +1,112 @@
+/**
+ * GitHub, spoken with a fine-grained token — D88/D95, plan/08 §5.
+ *
+ * 07 §3.1 decided a GitHub App for the cloud; a self-host will not register
+ * one, so the connection here is a token scoped to one repository (Issues:
+ * read and write, Metadata: read). Three calls are all this needs: create an
+ * issue, move its state, and prove the token can see the repo. Every call
+ * carries the API version header, and every failure comes back as a sentence
+ * with GitHub's own message in it, because "422" tells nobody what to fix.
+ */
+export class GitHubError extends Error {
+    status;
+    retryable;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        // 5xx and the two rate-limit answers are "not now"; 4xx are "not like this".
+        this.retryable = status >= 500 || status === 429 || status === 403 && /rate limit/i.test(message);
+    }
+}
+export function githubClient(opts) {
+    const base = (opts.apiBase ?? "https://api.github.com").replace(/\/+$/, "");
+    const f = opts.fetch ?? globalThis.fetch;
+    const headers = {
+        authorization: `Bearer ${opts.token}`,
+        accept: "application/vnd.github+json",
+        "x-github-api-version": "2022-11-28",
+        "user-agent": "snagset",
+    };
+    async function call(method, path, body) {
+        let res;
+        try {
+            res = await f(`${base}${path}`, {
+                method,
+                headers: body === undefined ? headers : { ...headers, "content-type": "application/json" },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+        }
+        catch (e) {
+            throw new GitHubError(0, `could not reach GitHub: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        if (!res.ok) {
+            let detail = "";
+            try {
+                const j = (await res.json());
+                detail = [j.message, ...(j.errors ?? []).map((x) => x.message ?? x.field)].filter(Boolean).join("; ");
+            }
+            catch {
+                /* no body */
+            }
+            const what = res.status === 401
+                ? "the token was refused (revoked, expired, or not a GitHub token)"
+                : res.status === 404
+                    ? "the repository was not found, or the token cannot see it"
+                    : res.status === 403
+                        ? "the token is not allowed to do that on this repository"
+                        : `GitHub answered ${res.status}`;
+            throw new GitHubError(res.status, detail ? `${what}: ${detail}` : what);
+        }
+        return (await res.json());
+    }
+    return {
+        /** Proves the token can see the repo and may write issues. */
+        async probe(r) {
+            try {
+                const repo = await call("GET", `/repos/${enc(r.owner)}/${enc(r.repo)}`);
+                return { ok: true, fullName: repo.full_name, canWrite: !!(repo.permissions?.push || repo.permissions?.admin) };
+            }
+            catch (e) {
+                return { ok: false, detail: e instanceof Error ? e.message : String(e) };
+            }
+        },
+        async createIssue(r, issue) {
+            const made = await call("POST", `/repos/${enc(r.owner)}/${enc(r.repo)}/issues`, {
+                title: issue.title,
+                body: issue.body,
+                ...(issue.labels?.length ? { labels: issue.labels } : {}),
+            });
+            return { number: made.number, url: made.html_url };
+        },
+        /** `closed` with a reason, or `open`. GitHub's own vocabulary; the mapping from ours is the worker's. */
+        async setIssueState(r, number, state, reason) {
+            await call("PATCH", `/repos/${enc(r.owner)}/${enc(r.repo)}/issues/${number}`, {
+                state,
+                ...(state === "closed" && reason ? { state_reason: reason } : {}),
+            });
+        },
+        async comment(r, number, body) {
+            await call("POST", `/repos/${enc(r.owner)}/${enc(r.repo)}/issues/${number}/comments`, { body });
+        },
+    };
+}
+const enc = encodeURIComponent;
+/** The issue title — 07 §3.4's algorithm on an already-escaped first line. */
+export function issueTitle(input) {
+    let summary = "";
+    const raw = (input.firstBody ?? "")
+        .replace(/```[\s\S]*?```/g, " ")
+        .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1")
+        .replace(/[*_~`>#]/g, "")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (!raw)
+        summary = `review comment from ${input.author || "a reviewer"}`;
+    else {
+        const first = raw.split(/(?<=[.!?])\s+/)[0] ?? raw;
+        summary = first.length <= 72 ? first : `${first.slice(0, 71).replace(/\s+\S*$/, "")}…`;
+    }
+    const route = input.route.length > 32 ? `…${input.route.slice(-31)}` : input.route;
+    return `${route} — ${summary}`.slice(0, 256);
+}
+//# sourceMappingURL=github.js.map

package/dist/integrations/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/integrations/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmBH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,SAAS,CAAU;IAC5B,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,6EAA6E;QAC7E,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpG,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;QACrC,MAAM,EAAE,6BAA6B;QACrC,sBAAsB,EAAE,YAAY;QACpC,YAAY,EAAE,SAAS;KACxB,CAAC;IAEF,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;gBAC9B,MAAM;gBACN,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC1F,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,2BAA2B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0E,CAAC;gBACtG,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxG,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,iEAAiE;gBACnE,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,0DAA0D;oBAC5D,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;wBAClB,CAAC,CAAC,wDAAwD;wBAC1D,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,OAAO;QACL,8DAA8D;QAC9D,KAAK,CAAC,KAAK,CAAC,CAAa;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,KAAK,EACL,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACxC,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YACjH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,CAAa,EAAE,KAAyD;YACxF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAuC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE;gBACpH,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrD,CAAC;QACD,yGAAyG;QACzG,KAAK,CAAC,aAAa,CAAC,CAAa,EAAE,MAAc,EAAE,KAAwB,EAAE,MAAoC;YAC/G,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,EAAE;gBAC5E,KAAK;gBACL,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,CAAa,EAAE,MAAc,EAAE,IAAY;YACvD,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,MAAM,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,KAA+E;IACxG,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;SAChC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC;SACvC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,uBAAuB,KAAK,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;SACrE,CAAC;QACJ,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACnD,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACnF,OAAO,GAAG,KAAK,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/integrations/inbound.js

@@ -0,0 +1,88 @@
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+/**
+ * A tracker → us — D96 for GitHub, D97 for Linear: the status half of 07
+ * §3.5 and §5.2, for a self-host.
+ *
+ * NO ECHO. The change is written here, directly, and not through the status
+ * PATCH — so it queues no `issue.state` row and cannot bounce back. And when
+ * the change is ours to begin with (our worker moved the issue, the tracker
+ * tells us it moved), the thread already carries the status and the write
+ * is a no-op.
+ *
+ * REPLAY-PROOF by the sync ledger: `UNIQUE (provider, direction,
+ * delivery_id)` — a redelivered delivery id inserts nothing and changes
+ * nothing.
+ */
+export function verifyGitHubSignature(raw, header, secret) {
+    if (!header || !header.startsWith("sha256="))
+        return false;
+    const given = Buffer.from(header.slice(7), "hex");
+    const want = createHmac("sha256", secret).update(raw, "utf8").digest();
+    return given.length === want.length && timingSafeEqual(given, want);
+}
+export async function applyIssueState(sql, ev) {
+    return sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${ev.orgId}, true)`;
+        // The ledger row first: a replay stops here, before anything is touched.
+        const hash = createHash("sha256").update(`${ev.status}:${ev.externalId}`).digest();
+        const [ref] = await tx `
+      SELECT thread_id FROM external_refs
+       WHERE project_id = ${ev.projectId}::uuid AND provider = ${ev.provider}::snag_provider AND kind = 'issue'
+         AND external_id = ${ev.externalId} AND status <> 'detached'
+    `;
+        const [ledger] = await tx `
+      INSERT INTO sync_ledger (id, org_id, project_id, provider, direction, delivery_id, entity_kind, entity_id, external_id, content_hash, thread_id)
+      VALUES (${randomUUID()}, ${ev.orgId}::uuid, ${ev.projectId}::uuid, ${ev.provider}::snag_provider, 'inbound', ${ev.deliveryId}, 'status',
+              ${ref?.thread_id ?? null}, ${ev.externalId}, ${hash}, ${ref?.thread_id ?? null})
+      ON CONFLICT (provider, direction, delivery_id) DO NOTHING
+      RETURNING id
+    `;
+        if (!ledger)
+            return { kind: "ignored", why: "replay" };
+        if (!ref)
+            return { kind: "ignored", why: "no-thread" };
+        if (ev.status === "detach") {
+            await tx `UPDATE external_refs SET status = 'detached', synced_at = now()
+                WHERE thread_id = ${ref.thread_id}::uuid AND provider = ${ev.provider}::snag_provider AND kind = 'issue'`;
+            return { kind: "detached", threadId: ref.thread_id };
+        }
+        const [t] = await tx `
+      SELECT status, key, version, context FROM threads WHERE id = ${ref.thread_id}::uuid AND deleted_at IS NULL FOR UPDATE
+    `;
+        if (!t)
+            return { kind: "ignored", why: "no-thread" };
+        if (t.status === ev.status)
+            return { kind: "ignored", why: "unchanged" };
+        const [row] = await tx `
+      UPDATE threads
+         SET status = ${ev.status}::snag_thread_status,
+             resolved_at = ${ev.status === "resolved" ? tx `now()` : tx `NULL`},
+             version = version + 1, updated_at = now()
+       WHERE id = ${ref.thread_id}::uuid
+       RETURNING version
+    `;
+        return {
+            kind: ev.status === "resolved" ? "resolved" : "reopened",
+            status: ev.status,
+            threadId: ref.thread_id,
+            threadKey: t.key,
+            version: row?.version ?? t.version + 1,
+            pageUrl: String(t.context?.["url"] ?? ""),
+        };
+    });
+}
+/** GitHub's `issues` actions, mapped: closed resolves (any reason — no archived status since D9), reopened opens, deleted detaches. */
+export async function applyGitHubIssueEvent(sql, ev) {
+    const status = ev.action === "closed" ? "resolved" : ev.action === "reopened" ? "open" : ev.action === "deleted" ? "detach" : null;
+    if (!status)
+        return { kind: "ignored", why: "action" };
+    return applyIssueState(sql, {
+        provider: "github",
+        orgId: ev.orgId,
+        projectId: ev.projectId,
+        deliveryId: ev.deliveryId,
+        externalId: String(ev.issueNumber),
+        status,
+    });
+}
+//# sourceMappingURL=inbound.js.map

package/dist/integrations/inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../src/integrations/inbound.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAIlF;;;;;;;;;;;;;GAaG;AAEH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,MAA0B,EAAE,MAAc;IAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB,EAAE,EAAmB;IAC1E,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,EAAE,CAAA,mCAAmC,EAAE,CAAC,KAAK,SAAS,CAAC;QAC7D,yEAAyE;QACzE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAyB;;4BAEvB,EAAE,CAAC,SAAS,yBAAyB,EAAE,CAAC,QAAQ;6BAC/C,EAAE,CAAC,UAAU;KACrC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAkB;;gBAE/B,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,QAAQ,+BAA+B,EAAE,CAAC,UAAU;gBAClH,GAAG,EAAE,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,UAAU,KAAK,IAAI,KAAK,GAAG,EAAE,SAAS,IAAI,IAAI;;;KAGvF,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAEvD,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAA;oCACsB,GAAG,CAAC,SAAS,yBAAyB,EAAE,CAAC,QAAQ,oCAAoC,CAAC;YACpH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAA6F;qEAChD,GAAG,CAAC,SAAS;KAC7E,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAuB;;wBAEzB,EAAE,CAAC,MAAM;6BACJ,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA,MAAM;;oBAExD,GAAG,CAAC,SAAS;;KAE5B,CAAC;QACF,OAAO;YACL,IAAI,EAAE,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACxD,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,SAAS,EAAE,CAAC,CAAC,GAAG;YAChB,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;YACtC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAiB,EACjB,EAAiG;IAEjG,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACnI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACvD,OAAO,eAAe,CAAC,GAAG,EAAE;QAC1B,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC;QAClC,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/integrations/jira.js

@@ -0,0 +1,129 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export class JiraError extends Error {
+    status;
+    retryable;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.retryable = status >= 500 || status === 429;
+    }
+}
+export function jiraClient(opts) {
+    const base = opts.siteUrl.replace(/\/+$/, "");
+    const f = opts.fetch ?? globalThis.fetch;
+    const headers = {
+        authorization: "Basic " + Buffer.from(`${opts.email}:${opts.apiToken}`, "utf8").toString("base64"),
+        accept: "application/json",
+        "user-agent": "snagset",
+    };
+    async function call(method, path, body) {
+        let res;
+        try {
+            res = await f(`${base}${path}`, {
+                method,
+                headers: body === undefined ? headers : { ...headers, "content-type": "application/json" },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+        }
+        catch (e) {
+            throw new JiraError(0, `could not reach Jira: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        if (res.status === 204)
+            return undefined;
+        let parsed = null;
+        try {
+            parsed = await res.json();
+        }
+        catch {
+            /* no body */
+        }
+        if (!res.ok) {
+            const detail = [
+                ...(parsed?.errorMessages ?? []),
+                ...Object.entries(parsed?.errors ?? {}).map(([k, v]) => `${k}: ${v}`),
+            ].join("; ");
+            const what = res.status === 401
+                ? "the email and API token were refused"
+                : res.status === 403
+                    ? "the account is not allowed to do that in this project"
+                    : res.status === 404
+                        ? "the project was not found, or the account cannot see it"
+                        : `Jira answered ${res.status}`;
+            throw new JiraError(res.status, detail ? `${what}: ${detail}` : what);
+        }
+        return parsed;
+    }
+    return {
+        /** The account, the project, and an issue type to create with — Task if the project has one. */
+        async probe(projectKey) {
+            try {
+                const me = await call("GET", "/rest/api/2/myself");
+                const project = await call("GET", `/rest/api/2/project/${encodeURIComponent(projectKey)}`);
+                const types = (project.issueTypes ?? []).filter((t) => !t.subtask);
+                const issueType = types.find((t) => /^task$/i.test(t.name)) ?? types.find((t) => /^bug$/i.test(t.name)) ?? types[0];
+                if (!issueType)
+                    return { ok: false, detail: `project ${project.key} has no issue type this account can create` };
+                return {
+                    ok: true,
+                    me: me.displayName ?? me.emailAddress ?? opts.email,
+                    project: { id: String(project.id), key: project.key, name: project.name },
+                    issueType: { id: String(issueType.id), name: issueType.name },
+                };
+            }
+            catch (e) {
+                return { ok: false, detail: e instanceof Error ? e.message : String(e) };
+            }
+        },
+        async createIssue(input) {
+            const made = await call("POST", "/rest/api/2/issue", {
+                fields: {
+                    project: { id: input.projectId },
+                    issuetype: { id: input.issueTypeId },
+                    summary: input.summary.slice(0, 255),
+                    description: input.description,
+                },
+            });
+            return { id: String(made.id), key: made.key, url: `${base}/browse/${made.key}` };
+        },
+        /** Move the issue to a status in the category; refused with a sentence when the workflow offers none. */
+        async transitionTo(issueKey, category) {
+            const list = await call("GET", `/rest/api/2/issue/${encodeURIComponent(issueKey)}/transitions`);
+            const t = list.transitions.find((x) => x.to?.statusCategory?.key === category);
+            if (!t) {
+                // Already there is not a failure — a workflow offers no transition to
+                // the status the issue holds.
+                const current = await call("GET", `/rest/api/2/issue/${encodeURIComponent(issueKey)}?fields=status`);
+                if (current.fields?.status?.statusCategory?.key === category)
+                    return;
+                throw new JiraError(422, `the project's workflow offers no transition from the issue's current status to a ${category} status`);
+            }
+            await call("POST", `/rest/api/2/issue/${encodeURIComponent(issueKey)}/transitions`, { transition: { id: t.id } });
+        },
+    };
+}
+/** Jira Cloud signs a webhook that has a secret with `X-Hub-Signature: sha256=<hex HMAC-SHA256 of the body>`. */
+export function verifyJiraSignature(raw, header, secret) {
+    if (!header)
+        return false;
+    const hex = header.startsWith("sha256=") ? header.slice(7) : header;
+    const given = Buffer.from(hex.trim(), "hex");
+    const want = createHmac("sha256", secret).update(raw, "utf8").digest();
+    return given.length === want.length && timingSafeEqual(given, want);
+}
+/** Our status → the status category to transition to; their category → our status. */
+export function jiraCategoryFor(status) {
+    return status === "resolved" ? "done" : status === "progress" ? "indeterminate" : "new";
+}
+export function statusForJiraCategory(category) {
+    return category === "done" ? "resolved" : category === "indeterminate" ? "progress" : "open";
+}
+/**
+ * Jira's v2 description is wiki markup, which a reviewer's text could steer
+ * (`{code}`, `[link|url]`, `!image!`). The brief's own structure is plain
+ * Markdown and reads fine as text; the reviewer's words get the few wiki
+ * specials escaped after the outbound sanitiser has done its part.
+ */
+export function escapeForJiraWiki(s) {
+    return s.replace(/([{}\[\]|!])/g, "\\$1");
+}
+//# sourceMappingURL=jira.js.map

package/dist/integrations/jira.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jira.js","sourceRoot":"","sources":["../../src/integrations/jira.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAuB1D,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,SAAS,CAAU;IAC5B,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IACnD,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClG,MAAM,EAAE,kBAAkB;QAC1B,YAAY,EAAE,SAAS;KACxB,CAAC;IAEF,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;gBAC9B,MAAM;gBACN,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC1F,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,CAAC,EAAE,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,IAAI,MAAM,GAAQ,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG;gBACb,GAAG,CAAE,MAAM,EAAE,aAAsC,IAAI,EAAE,CAAC;gBAC1D,GAAG,MAAM,CAAC,OAAO,CAAE,MAAM,EAAE,MAA6C,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;aAC9G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,uDAAuD;oBACzD,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;wBAClB,CAAC,CAAC,yDAAyD;wBAC3D,CAAC,CAAC,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAW,CAAC;IACrB,CAAC;IAED,OAAO;QACL,gGAAgG;QAChG,KAAK,CAAC,KAAK,CAAC,UAAkB;YAI5B,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAkD,KAAK,EAAE,oBAAoB,CAAC,CAAC;gBACpG,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,KAAK,EACL,uBAAuB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACxD,CAAC;gBACF,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACnE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpH,IAAI,CAAC,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC,GAAG,4CAA4C,EAAE,CAAC;gBACjH,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,EAAE,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK;oBACnD,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBACzE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAC9D,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAuF;YACvG,MAAM,IAAI,GAAG,MAAM,IAAI,CAA8B,MAAM,EAAE,mBAAmB,EAAE;gBAChF,MAAM,EAAE;oBACN,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;oBAChC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE;oBACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACpC,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B;aACF,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,yGAAyG;QACzG,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,QAAsB;YACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,KAAK,EACL,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAChE,CAAC;YACF,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,sEAAsE;gBACtE,8BAA8B;gBAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,KAAK,EACL,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAClE,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,QAAQ;oBAAE,OAAO;gBACrE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oFAAoF,QAAQ,SAAS,CAAC,CAAC;YAClI,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,EAAE,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAA0B,EAAE,MAAc;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1F,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC"}