@snagset/server 0.0.3 → 0.1.0

package/dist/routes/integrations.js

@@ -0,0 +1,610 @@
+import { Hono } from "hono";
+import { ID_PREFIX } from "../vendor/types/names.js";
+import { open } from "../crypto.js";
+import { githubClient } from "../integrations/github.js";
+import { linearClient, statusForLinearState, verifyLinearSignature } from "../integrations/linear.js";
+import { jiraClient, statusForJiraCategory, verifyJiraSignature } from "../integrations/jira.js";
+import { slackClient, slackManifest } from "../integrations/slack.js";
+import { getIntegration, isTracker, listIntegrations, markIntegration, mintWebhookSecret, putIntegration, removeIntegration, trackerSecrets, REF_KIND, } from "../integrations/store.js";
+import { applyGitHubIssueEvent, applyIssueState, verifyGitHubSignature } from "../integrations/inbound.js";
+import { queueResolvedNotice } from "../mail/notify.js";
+import { drainNow, queueIntegrationEvent } from "../integrations/outbox.js";
+function fail(c, status, code, message, details) {
+    return c.json({ error: { code, message, ...(details ? { details } : {}), requestId: c.get("requestId") } }, status);
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const NAME = { github: "GitHub", linear: "Linear", jira: "Jira", slack: "Slack" };
+export function integrationRoutes(deps) {
+    const { sql, keys, projects } = deps;
+    const app = new Hono();
+    const webhookUrl = (provider) => `${deps.baseUrl.replace(/\/+$/, "")}/api/v1/integrations/${provider}/inbound`;
+    const ghOpts = () => ({ ...(deps.push.githubApiBase ? { apiBase: deps.push.githubApiBase } : {}), ...(deps.push.fetch ? { fetch: deps.push.fetch } : {}) });
+    const lnOpts = () => ({ ...(deps.push.linearApiBase ? { apiBase: deps.push.linearApiBase } : {}), ...(deps.push.fetch ? { fetch: deps.push.fetch } : {}) });
+    const mustBeOwner = (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        if (owner.role !== "owner")
+            return fail(c, 403, "forbidden", "Only an owner can change what a site is connected to.");
+        return owner;
+    };
+    const site = async (c, owner) => {
+        const p = await projects.get(c.req.param("uid") ?? "");
+        if (!p || p.org_id !== owner.orgId)
+            return null;
+        return p;
+    };
+    const provider = (c) => {
+        const v = c.req.param("provider") ?? "";
+        return isTracker(v) ? v : fail(c, 404, "integration_not_configured", `No tracker called ${JSON.stringify(v)}. This build speaks: github, linear, jira, slack.`);
+    };
+    /** The card's view of a connection — never a token. */
+    const shape = (i, projectUid) => {
+        const base = {
+            site: projectUid,
+            createOn: (i.config.createOn === "thread.created" ? "thread.created" : "manual"),
+            health: i.unreadable ? "needs_reauth" : i.installState,
+            lastError: i.lastError,
+            updatedAt: i.updatedAt.toISOString(),
+            hasWebhookSecret: !!trackerSecrets(i.secret).webhookSecret,
+        };
+        if (i.provider === "linear") {
+            const cfg = i.config;
+            return { provider: "linear", ...base, teamKey: cfg.teamKey, teamName: cfg.teamName };
+        }
+        if (i.provider === "jira") {
+            const cfg = i.config;
+            return { provider: "jira", ...base, siteUrl: cfg.siteUrl, projectKey: cfg.projectKey, projectName: cfg.projectName, issueType: cfg.issueTypeName, email: cfg.email };
+        }
+        if (i.provider === "slack") {
+            const cfg = i.config;
+            return { provider: "slack", ...base, teamName: cfg.teamName, teamUrl: cfg.teamUrl, channelId: cfg.channelId, channelName: cfg.channelName };
+        }
+        const cfg = i.config;
+        return { provider: "github", ...base, owner: cfg.owner, repo: cfg.repo, labels: cfg.labels ?? [] };
+    };
+    const sites = async (orgId) => {
+        const rows = await sql `
+      SELECT id, uid, name FROM projects WHERE org_id = ${orgId}::uuid AND deleted_at IS NULL
+    `;
+        return new Map(rows.map((p) => [p.id, p]));
+    };
+    app.get("/api/v1/integrations", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const byId = await sites(owner.orgId);
+        const rows = await listIntegrations(sql, keys, owner.orgId);
+        return c.json({
+            data: rows
+                .filter((r) => isTracker(r.provider) && byId.has(r.projectId))
+                .map((r) => ({ ...shape(r, byId.get(r.projectId).uid), siteName: byId.get(r.projectId).name })),
+        });
+    });
+    app.get("/api/v1/projects/:uid/integrations", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const p = await site(c, owner);
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const rows = (await listIntegrations(sql, keys, owner.orgId)).filter((r) => r.projectId === p.id && isTracker(r.provider));
+        return c.json({ data: rows.map((r) => shape(r, p.uid)) });
+    });
+    /** 07 §6.2: the manifest the operator creates the Slack app from — one link, scopes pre-filled. */
+    app.get("/api/v1/integrations/slack/manifest", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const [org] = await sql `SELECT name FROM orgs WHERE id = ${owner.orgId}::uuid`;
+        const manifest = slackManifest(org?.name ?? "Snagset");
+        return c.json({ manifest, url: `https://api.slack.com/apps?new_app=1&manifest_json=${encodeURIComponent(JSON.stringify(manifest))}` });
+    });
+    app.get("/api/v1/projects/:uid/integrations/:provider", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const pv = provider(c);
+        if (pv instanceof Response)
+            return pv;
+        const p = await site(c, owner);
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const i = await getIntegration(sql, keys, p.org_id, p.id, pv);
+        return c.json({ integration: i ? shape(i, p.uid) : null });
+    });
+    app.put("/api/v1/projects/:uid/integrations/:provider", async (c) => {
+        const owner = mustBeOwner(c);
+        if (owner instanceof Response)
+            return owner;
+        const pv = provider(c);
+        if (pv instanceof Response)
+            return pv;
+        const p = await site(c, owner);
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const body = (await c.req.json().catch(() => null));
+        const str = (k) => (typeof body?.[k] === "string" ? body[k].trim() : "");
+        // Slack announces: every new comment by default. The trackers ask first.
+        const createOn = body?.["createOn"] === "thread.created" ? "thread.created" : body?.["createOn"] === "manual" ? "manual" : pv === "slack" ? "thread.created" : "manual";
+        const existing = await getIntegration(sql, keys, p.org_id, p.id, pv);
+        const had = trackerSecrets(existing?.secret ?? null);
+        if (pv === "slack") {
+            // Slack (D99): a bot token from the app the operator created from our
+            // manifest, and a channel by #name or id. Probed — the token, then the
+            // channel — before it is stored.
+            const token = str("token") || had.token || "";
+            if (!/^xox[bp]-/.test(token))
+                return fail(c, 422, "validation_failed", "Paste the app's Bot User OAuth Token — it starts with xoxb-.", { field: "token" });
+            const channel = str("channel") || existing?.config?.channelId || "";
+            if (!channel)
+                return fail(c, 422, "validation_failed", "Give the channel, like #reviews.", { field: "channel" });
+            const sc = slackClient({ token, ...(deps.push.slackApiBase ? { apiBase: deps.push.slackApiBase } : {}), ...(deps.push.fetch ? { fetch: deps.push.fetch } : {}) });
+            let who;
+            let ch;
+            try {
+                who = await sc.whoami();
+                ch = await sc.resolveChannel(channel);
+            }
+            catch (e) {
+                return fail(c, 422, "validation_failed", e instanceof Error ? e.message : String(e), { field: "token" });
+            }
+            await putIntegration(sql, keys, {
+                orgId: p.org_id,
+                projectId: p.id,
+                provider: "slack",
+                config: { teamName: who.team, teamUrl: who.url, channelId: ch.id, channelName: ch.name, createOn },
+                secret: JSON.stringify({ token, webhookSecret: null }),
+            });
+            const i = await getIntegration(sql, keys, p.org_id, p.id, "slack");
+            return c.json({ integration: i ? shape(i, p.uid) : null });
+        }
+        if (pv === "github") {
+            // `owner/repo` in one box is what people paste; two boxes are accepted too.
+            let ownerName = str("owner");
+            let repo = str("repo");
+            const full = str("repository");
+            if (full && !ownerName && !repo) {
+                const m = /^(?:https?:\/\/github\.com\/)?([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(full);
+                if (!m)
+                    return fail(c, 422, "validation_failed", "Give the repository as owner/name, like kilnwork/site.", { field: "repository" });
+                ownerName = m[1];
+                repo = m[2];
+            }
+            if (!ownerName || !repo)
+                return fail(c, 422, "validation_failed", "Give the repository as owner/name, like kilnwork/site.", { field: "repository" });
+            const token = str("token") || had.token || "";
+            if (!token)
+                return fail(c, 422, "validation_failed", "Paste a fine-grained token with Issues: read and write on that repository.", { field: "token" });
+            // D96: the webhook secret is minted on the first connect and kept across
+            // replacements — the operator registered it on the repository once.
+            const minted = had.webhookSecret ? null : mintWebhookSecret();
+            const webhookSecret = had.webhookSecret ?? minted;
+            const prior = existing?.config?.labels ?? [];
+            const labels = Array.isArray(body?.["labels"])
+                ? body["labels"].map(String).map((s) => s.trim()).filter(Boolean).slice(0, 20)
+                : typeof body?.["labels"] === "string"
+                    ? body["labels"].split(",").map((s) => s.trim()).filter(Boolean).slice(0, 20)
+                    : prior;
+            // Probed before it is stored: a token that is merely well-formed is the
+            // one that fails on the first issue, in front of the client.
+            const probe = await githubClient({ token, ...ghOpts() }).probe({ owner: ownerName, repo });
+            if (!probe.ok)
+                return fail(c, 422, "validation_failed", probe.detail, { field: "token" });
+            if (!probe.canWrite) {
+                return fail(c, 422, "validation_failed", `The token can see ${probe.fullName} but cannot write to it. It needs Issues: read and write.`, { field: "token" });
+            }
+            await putIntegration(sql, keys, {
+                orgId: p.org_id,
+                projectId: p.id,
+                provider: "github",
+                config: { owner: ownerName, repo, labels, createOn },
+                secret: JSON.stringify({ token, webhookSecret }),
+            });
+            const i = await getIntegration(sql, keys, p.org_id, p.id, "github");
+            return c.json({
+                integration: i ? shape(i, p.uid) : null,
+                // Shown ONCE, like a review link: the URL to paste and the secret GitHub signs with.
+                ...(minted ? { webhook: { url: webhookUrl("github"), secret: minted } } : {}),
+            });
+        }
+        if (pv === "jira") {
+            // Jira Cloud (D98): the site, the project key, the account's email and
+            // an API token — basic auth, what Atlassian gives a self-hoster — and,
+            // for the way back, the secret the operator typed into Jira's webhook.
+            const siteUrl = str("siteUrl").replace(/\/+$/, "");
+            if (!/^https?:\/\/[^\s/]+$/.test(siteUrl))
+                return fail(c, 422, "validation_failed", "Give the site's address, like https://kilnwork.atlassian.net.", { field: "siteUrl" });
+            const projectKey = str("project").toUpperCase();
+            if (!/^[A-Z][A-Z0-9_]{0,9}$/.test(projectKey))
+                return fail(c, 422, "validation_failed", "Give the project's key, like KAN.", { field: "project" });
+            const prior = existing?.config;
+            const email = str("email").toLowerCase() || prior?.email || "";
+            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
+                return fail(c, 422, "validation_failed", "Give the Atlassian account's email — the token belongs to it.", { field: "email" });
+            const apiToken = str("apiToken") || had.token || "";
+            if (!apiToken)
+                return fail(c, 422, "validation_failed", "Paste an API token from id.atlassian.com › Security › API tokens.", { field: "apiToken" });
+            const webhookSecret = str("webhookSecret") || had.webhookSecret || null;
+            const probe = await jiraClient({ siteUrl, email, apiToken, ...(deps.push.fetch ? { fetch: deps.push.fetch } : {}) }).probe(projectKey);
+            if (!probe.ok)
+                return fail(c, 422, "validation_failed", probe.detail, { field: "apiToken" });
+            await putIntegration(sql, keys, {
+                orgId: p.org_id,
+                projectId: p.id,
+                provider: "jira",
+                config: {
+                    siteUrl,
+                    email,
+                    projectKey: probe.project.key,
+                    projectId: probe.project.id,
+                    projectName: probe.project.name,
+                    issueTypeId: probe.issueType.id,
+                    issueTypeName: probe.issueType.name,
+                    createOn,
+                },
+                secret: JSON.stringify({ token: apiToken, webhookSecret }),
+            });
+            const i = await getIntegration(sql, keys, p.org_id, p.id, "jira");
+            return c.json({ integration: i ? shape(i, p.uid) : null, webhook: { url: webhookUrl("jira") } });
+        }
+        // Linear (D97): an API key belonging to a member of the team, the team's
+        // key, and — for the way back — the signing secret Linear shows when the
+        // operator creates the webhook, pasted here.
+        const teamKey = str("team").toUpperCase();
+        if (!/^[A-Z][A-Z0-9]{0,7}$/.test(teamKey))
+            return fail(c, 422, "validation_failed", "Give the team's key, like ENG.", { field: "team" });
+        const apiKey = str("apiKey") || had.token || "";
+        if (!apiKey)
+            return fail(c, 422, "validation_failed", "Paste a personal API key from Linear › Settings › API.", { field: "apiKey" });
+        const webhookSecret = str("webhookSecret") || had.webhookSecret || null;
+        const probe = await linearClient({ apiKey, ...lnOpts() }).probe(teamKey);
+        if (!probe.ok)
+            return fail(c, 422, "validation_failed", probe.detail, { field: "apiKey" });
+        await putIntegration(sql, keys, {
+            orgId: p.org_id,
+            projectId: p.id,
+            provider: "linear",
+            config: { teamId: probe.team.id, teamKey: probe.team.key, teamName: probe.team.name, states: probe.states, createOn },
+            secret: JSON.stringify({ token: apiKey, webhookSecret }),
+        });
+        const i = await getIntegration(sql, keys, p.org_id, p.id, "linear");
+        return c.json({ integration: i ? shape(i, p.uid) : null, webhook: { url: webhookUrl("linear") } });
+    });
+    app.delete("/api/v1/projects/:uid/integrations/:provider", async (c) => {
+        const owner = mustBeOwner(c);
+        if (owner instanceof Response)
+            return owner;
+        const pv = provider(c);
+        if (pv instanceof Response)
+            return pv;
+        const p = await site(c, owner);
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        await removeIntegration(sql, p.org_id, p.id, pv);
+        return c.json({ integration: null });
+    });
+    app.post("/api/v1/projects/:uid/integrations/:provider/test", async (c) => {
+        const owner = mustBeOwner(c);
+        if (owner instanceof Response)
+            return owner;
+        const pv = provider(c);
+        if (pv instanceof Response)
+            return pv;
+        const p = await site(c, owner);
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const i = await getIntegration(sql, keys, p.org_id, p.id, pv);
+        const token = trackerSecrets(i?.secret ?? null).token;
+        if (!i || !token)
+            return fail(c, 409, "integration_not_configured", `${NAME[pv]} is not connected on this site.`);
+        let ok;
+        if (pv === "github") {
+            const cfg = i.config;
+            const r = await githubClient({ token, ...ghOpts() }).probe({ owner: cfg.owner, repo: cfg.repo });
+            ok = r.ok ? { ok: true, target: r.fullName } : r;
+        }
+        else if (pv === "jira") {
+            const cfg = i.config;
+            const r = await jiraClient({ siteUrl: cfg.siteUrl, email: cfg.email, apiToken: token, ...(deps.push.fetch ? { fetch: deps.push.fetch } : {}) }).probe(cfg.projectKey);
+            ok = r.ok ? { ok: true, target: `${r.project.key} · ${r.project.name}` } : r;
+        }
+        else if (pv === "slack") {
+            const cfg = i.config;
+            try {
+                const sc = slackClient({ token, ...(deps.push.slackApiBase ? { apiBase: deps.push.slackApiBase } : {}), ...(deps.push.fetch ? { fetch: deps.push.fetch } : {}) });
+                const who = await sc.whoami();
+                const ch = await sc.resolveChannel(cfg.channelId);
+                ok = { ok: true, target: `#${ch.name} in ${who.team}` };
+            }
+            catch (e) {
+                ok = { ok: false, detail: e instanceof Error ? e.message : String(e) };
+            }
+        }
+        else {
+            const cfg = i.config;
+            const r = await linearClient({ apiKey: token, ...lnOpts() }).probe(cfg.teamKey);
+            ok = r.ok ? { ok: true, target: `${r.team.key} · ${r.team.name}` } : r;
+        }
+        await markIntegration(sql, p.org_id, i.id, ok.ok ? "ok" : "needs_reauth", ok.ok ? null : ok.detail);
+        return c.json(ok.ok ? { ok: true, repository: ok.target, target: ok.target } : { ok: false, detail: ok.detail });
+    });
+    /** GitHub only: a new minted webhook secret, shown once; the old one stops working the moment this answers. */
+    app.post("/api/v1/projects/:uid/integrations/:provider/webhook-secret", async (c) => {
+        const owner = mustBeOwner(c);
+        if (owner instanceof Response)
+            return owner;
+        const pv = provider(c);
+        if (pv instanceof Response)
+            return pv;
+        const p = await site(c, owner);
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        if (pv === "slack")
+            return fail(c, 409, "integration_not_configured", "Slack sends nothing back in this version; there is no webhook to secure.");
+        if (pv !== "github") {
+            return fail(c, 409, "integration_not_configured", `${NAME[pv]}'s webhook secret is typed into ${NAME[pv]}'s own webhook form: paste the same secret when connecting.`);
+        }
+        const i = await getIntegration(sql, keys, p.org_id, p.id, "github");
+        const had = trackerSecrets(i?.secret ?? null);
+        if (!i || !had.token)
+            return fail(c, 409, "integration_not_configured", "GitHub is not connected on this site.");
+        const secret = mintWebhookSecret();
+        await putIntegration(sql, keys, {
+            orgId: p.org_id,
+            projectId: p.id,
+            provider: "github",
+            config: i.config,
+            secret: JSON.stringify({ token: had.token, webhookSecret: secret }),
+        });
+        return c.json({ webhook: { url: webhookUrl("github"), secret } });
+    });
+    /** After an inbound resolve, the same mail a dashboard resolve sends, signed by the tracker. */
+    const noticeIfResolved = async (applied, orgId, projectId, actorName) => {
+        if (applied.kind !== "resolved" || !(await deps.notifications()))
+            return;
+        await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${orgId}, true)`;
+            await queueResolvedNotice(tx, {
+                orgId,
+                projectId,
+                threadId: applied.threadId,
+                threadKey: applied.threadKey,
+                version: applied.version,
+                actorId: applied.threadId,
+                actorName,
+                pageUrl: applied.pageUrl,
+            });
+        });
+    };
+    const candidatesFor = (pv, where) => sql.begin(async (tx) => {
+        // Read under the maintenance claim: the tracker holds no org, and the
+        // org is what the row tells us.
+        await tx `SET LOCAL app.maintenance = 'on'`;
+        return where(tx);
+    });
+    const secretOf = (r) => trackerSecrets(r.credentials && r.credentials_iv ? open(keys, { ciphertext: r.credentials, iv: r.credentials_iv }) : null).webhookSecret;
+    /**
+     * The tracker → us (05 endpoint 25c). Unauthenticated in the session
+     * sense; authenticated by the provider's signature over the RAW body with
+     * the secret this connection holds — minted by us for GitHub (D96),
+     * pasted from Linear's form for Linear (D97). The target named in the
+     * payload picks the candidate connections; the signature picks the one.
+     */
+    app.post("/api/v1/integrations/:provider/inbound", async (c) => {
+        const pv = provider(c);
+        if (pv instanceof Response)
+            return pv;
+        if (pv === "slack")
+            return fail(c, 409, "integration_not_configured", "Slack sends nothing back in this version.");
+        const raw = await c.req.text();
+        let payload;
+        try {
+            payload = JSON.parse(raw);
+        }
+        catch {
+            return fail(c, 400, "validation_failed", "The body is not JSON.");
+        }
+        if (pv === "github") {
+            const signature = c.req.header("x-hub-signature-256");
+            const event = c.req.header("x-github-event") ?? "";
+            const delivery = c.req.header("x-github-delivery") ?? "";
+            if (event === "ping")
+                return c.json({ ok: true, pong: true });
+            const fullName = String(payload?.repository?.full_name ?? "").toLowerCase();
+            if (!fullName.includes("/"))
+                return fail(c, 400, "validation_failed", "The payload names no repository.");
+            const [ownerName, repo] = fullName.split("/");
+            const candidates = await candidatesFor("github", (tx) => tx `
+        SELECT id, org_id, project_id, credentials, credentials_iv FROM integrations
+         WHERE provider = 'github' AND deleted_at IS NULL AND enabled
+           AND lower(config->>'owner') = ${ownerName} AND lower(config->>'repo') = ${repo}
+      `);
+            const match = candidates.find((r) => {
+                const s = secretOf(r);
+                return !!s && verifyGitHubSignature(raw, signature, s);
+            });
+            if (!match) {
+                return candidates.length
+                    ? fail(c, 401, "provider_signature_invalid", "The signature does not match this repository's webhook secret.")
+                    : fail(c, 409, "integration_not_configured", `No site here is connected to ${fullName}.`);
+            }
+            if (event !== "issues")
+                return c.json({ ok: true, ignored: event });
+            const number = Number(payload?.issue?.number);
+            if (!Number.isInteger(number))
+                return fail(c, 400, "validation_failed", "The payload names no issue.");
+            const applied = await applyGitHubIssueEvent(sql, {
+                orgId: match.org_id,
+                projectId: match.project_id,
+                deliveryId: delivery || `${fullName}#${number}:${String(payload?.action)}:${Date.now()}`,
+                action: String(payload?.action ?? ""),
+                issueNumber: number,
+            });
+            await noticeIfResolved(applied, match.org_id, match.project_id, "GitHub");
+            return c.json({ ok: true, applied: applied.kind, ...("why" in applied ? { why: applied.why } : {}) });
+        }
+        if (pv === "jira") {
+            // Jira Cloud: X-Hub-Signature over the body with the secret typed into
+            // the webhook; X-Atlassian-Webhook-Identifier is the replay key. The
+            // project and the site in the payload pick the candidates.
+            const signature = c.req.header("x-hub-signature");
+            const delivery = c.req.header("x-atlassian-webhook-identifier") ?? "";
+            const event = String(payload?.webhookEvent ?? "");
+            const issue = payload?.issue;
+            const projectId = String(issue?.fields?.project?.id ?? "");
+            const issueKey = String(issue?.key ?? "");
+            if (!projectId || !issueKey)
+                return fail(c, 400, "validation_failed", "The payload names no issue in a project.");
+            let host = "";
+            try {
+                host = new URL(String(issue?.self ?? "")).host.toLowerCase();
+            }
+            catch {
+                /* no self link — the project id alone will have to do */
+            }
+            const candidates = await candidatesFor("jira", (tx) => tx `
+        SELECT id, org_id, project_id, credentials, credentials_iv FROM integrations
+         WHERE provider = 'jira' AND deleted_at IS NULL AND enabled AND config->>'projectId' = ${projectId}
+           AND (${host} = '' OR lower(config->>'siteUrl') LIKE ${"%//" + host + "%"})
+      `);
+            const match = candidates.find((r) => {
+                const s = secretOf(r);
+                return !!s && verifyJiraSignature(raw, signature, s);
+            });
+            if (!match) {
+                return candidates.length
+                    ? fail(c, 401, "provider_signature_invalid", "The signature does not match this project's webhook secret — type the same secret into Jira's webhook and when connecting.")
+                    : fail(c, 409, "integration_not_configured", "No site here is connected to that Jira project.");
+            }
+            let status = null;
+            if (event === "jira:issue_deleted")
+                status = "detach";
+            else if (event === "jira:issue_updated" || event === "jira:issue_created") {
+                const category = String(issue?.fields?.status?.statusCategory?.key ?? "");
+                if (category)
+                    status = statusForJiraCategory(category);
+            }
+            if (!status)
+                return c.json({ ok: true, applied: "ignored", why: "action" });
+            const applied = await applyIssueState(sql, {
+                provider: "jira",
+                orgId: match.org_id,
+                projectId: match.project_id,
+                deliveryId: delivery || `${issueKey}:${event}:${String(issue?.fields?.updated ?? Date.now())}`,
+                externalId: issueKey,
+                status,
+            });
+            await noticeIfResolved(applied, match.org_id, match.project_id, "Jira");
+            return c.json({ ok: true, applied: applied.kind, ...("why" in applied ? { why: applied.why } : {}) });
+        }
+        // Linear (07 §5.3): Linear-Signature is the hex HMAC over the raw body
+        // with the webhook's signing secret; Linear-Delivery is the replay key;
+        // webhookTimestamp guards a captured body replayed much later.
+        const signature = c.req.header("linear-signature");
+        const delivery = c.req.header("linear-delivery") ?? "";
+        const stamp = Number(payload?.webhookTimestamp);
+        if (Number.isFinite(stamp) && Math.abs(Date.now() - stamp) > 5 * 60_000) {
+            return fail(c, 401, "provider_signature_invalid", "The delivery's timestamp is more than five minutes off.");
+        }
+        const teamId = String(payload?.data?.teamId ?? payload?.data?.team?.id ?? "");
+        if (!teamId)
+            return fail(c, 400, "validation_failed", "The payload names no team.");
+        const candidates = await candidatesFor("linear", (tx) => tx `
+      SELECT id, org_id, project_id, credentials, credentials_iv FROM integrations
+       WHERE provider = 'linear' AND deleted_at IS NULL AND enabled AND config->>'teamId' = ${teamId}
+    `);
+        const match = candidates.find((r) => {
+            const s = secretOf(r);
+            return !!s && verifyLinearSignature(raw, signature, s);
+        });
+        if (!match) {
+            return candidates.length
+                ? fail(c, 401, "provider_signature_invalid", "The signature does not match this team's webhook secret — paste the signing secret from Linear's webhook when connecting.")
+                : fail(c, 409, "integration_not_configured", "No site here is connected to that Linear team.");
+        }
+        if (payload?.type !== "Issue")
+            return c.json({ ok: true, ignored: String(payload?.type ?? "") });
+        const issueId = String(payload?.data?.id ?? "");
+        if (!issueId)
+            return fail(c, 400, "validation_failed", "The payload names no issue.");
+        const action = String(payload?.action ?? "");
+        const stateType = typeof payload?.data?.state?.type === "string" ? payload.data.state.type : null;
+        let status = null;
+        if (action === "remove")
+            status = "detach";
+        else if ((action === "update" || action === "create") && stateType)
+            status = statusForLinearState(stateType);
+        if (!status)
+            return c.json({ ok: true, applied: "ignored", why: "action" });
+        const applied = await applyIssueState(sql, {
+            provider: "linear",
+            orgId: match.org_id,
+            projectId: match.project_id,
+            deliveryId: delivery || `${issueId}:${action}:${Date.now()}`,
+            externalId: issueId,
+            status,
+        });
+        await noticeIfResolved(applied, match.org_id, match.project_id, "Linear");
+        return c.json({ ok: true, applied: applied.kind, ...("why" in applied ? { why: applied.why } : {}) });
+    });
+    /** "Create … issue" on the Brief — queued in a transaction, drained now, the link comes back. */
+    app.post("/api/v1/projects/:uid/threads/:id/integrations/:provider", async (c) => {
+        const owner = mustBeOwner(c);
+        if (owner instanceof Response)
+            return owner;
+        const pv = provider(c);
+        if (pv instanceof Response)
+            return pv;
+        const p = await site(c, owner);
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const raw = c.req.param("id") ?? "";
+        const threadRow = raw.startsWith(ID_PREFIX.thread) ? raw.slice(ID_PREFIX.thread.length) : raw;
+        if (!UUID.test(threadRow))
+            return fail(c, 404, "thread_not_found", "No such thread in this project.");
+        const i = await getIntegration(sql, keys, p.org_id, p.id, pv);
+        if (!i || !i.enabled)
+            return fail(c, 409, "integration_not_configured", `${NAME[pv]} is not connected on this site.`);
+        const queued = await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${p.org_id}, true)`;
+            const [t] = await tx `
+        SELECT version FROM threads WHERE id = ${threadRow}::uuid AND project_id = ${p.id}::uuid AND deleted_at IS NULL
+      `;
+            if (!t)
+                return false;
+            // The dedupe key counts the issues this thread has LOST: the first
+            // create is row 0, a second click while that issue lives hits the same
+            // key and queues nothing (the live ref answers), and a new issue after
+            // the tracker deleted the old one is row 1. The worker still refuses
+            // to create beside a live ref, so the key can never make a duplicate.
+            const [had] = await tx `
+        SELECT count(*)::int AS n FROM external_refs
+         WHERE thread_id = ${threadRow}::uuid AND provider = ${pv}::snag_provider AND kind = ${REF_KIND[pv]}::snag_ref_kind AND status = 'detached'
+      `;
+            await queueIntegrationEvent(tx, {
+                orgId: p.org_id,
+                projectId: p.id,
+                integrationId: i.id,
+                threadId: threadRow,
+                provider: pv,
+                topic: "issue.create",
+                version: had?.n ?? 0,
+            });
+            return true;
+        });
+        if (!queued)
+            return fail(c, 404, "thread_not_found", "No such thread in this project.");
+        await drainNow(sql, deps.push);
+        const [ref] = await sql `
+      SELECT external_id, url, status FROM external_refs
+       WHERE thread_id = ${threadRow}::uuid AND provider = ${pv}::snag_provider AND kind = ${REF_KIND[pv]}::snag_ref_kind AND status <> 'detached'
+    `;
+        if (ref)
+            return c.json({ ref: { provider: pv, kind: REF_KIND[pv], externalId: ref.external_id, url: ref.url, status: ref.status } });
+        const fresh = await getIntegration(sql, keys, p.org_id, p.id, pv);
+        return fail(c, 502, "integration_push_failed", fresh?.lastError ?? `${NAME[pv]} did not take the ${REF_KIND[pv]}. The card on Studio › Integrations says why.`);
+    });
+    return app;
+}
+//# sourceMappingURL=integrations.js.map