@snagset/server 0.0.4 → 0.1.0

package/dist/instance/settings.js

@@ -0,0 +1,54 @@
+import { open, seal } from "../crypto.js";
+export async function readSetting(sql, keys, orgId, key) {
+    const [row] = await sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${orgId}, true)`;
+        return tx `
+      SELECT value, secret, secret_iv, updated_at, updated_by
+      FROM instance_settings WHERE org_id = ${orgId}::uuid AND key = ${key}
+    `;
+    });
+    if (!row)
+        return null;
+    const sealed = row.secret && row.secret_iv ? { ciphertext: row.secret, iv: row.secret_iv } : null;
+    const secret = sealed ? open(keys, sealed) : null;
+    return {
+        value: row.value,
+        secret,
+        unreadable: !!sealed && secret === null,
+        updatedAt: row.updated_at,
+        updatedBy: row.updated_by,
+    };
+}
+export async function writeSetting(sql, keys, input) {
+    const sealed = input.secret === null ? null : seal(keys, input.secret);
+    await sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${input.orgId}, true)`;
+        await tx `
+      INSERT INTO instance_settings (org_id, key, value, secret, secret_iv, updated_by, updated_at)
+      VALUES (${input.orgId}::uuid, ${input.key}, ${tx.json(input.value)}, ${sealed?.ciphertext ?? null},
+              ${sealed?.iv ?? null}, ${input.updatedBy}, now())
+      ON CONFLICT (org_id, key) DO UPDATE
+        SET value = EXCLUDED.value, secret = EXCLUDED.secret, secret_iv = EXCLUDED.secret_iv,
+            updated_by = EXCLUDED.updated_by, updated_at = now()
+    `;
+    });
+}
+export async function clearSetting(sql, orgId, key) {
+    await sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${orgId}, true)`;
+        await tx `DELETE FROM instance_settings WHERE org_id = ${orgId}::uuid AND key = ${key}`;
+    });
+}
+/**
+ * The one org a v1 self-host has — the storage module's own convention,
+ * under the maintenance claim (0002, D56) because the callers that need it
+ * (the outbox job, boot) hold no org yet.
+ */
+export async function firstOrgId(sql) {
+    const [row] = await sql.begin(async (tx) => {
+        await tx `SET LOCAL app.maintenance = 'on'`;
+        return tx `SELECT id FROM orgs WHERE deleted_at IS NULL ORDER BY created_at LIMIT 1`;
+    });
+    return row?.id ?? null;
+}
+//# sourceMappingURL=settings.js.map

package/dist/instance/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/instance/settings.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAsC1C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,IAAa,EACb,KAAa,EACb,GAAW;IAEX,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzC,MAAM,EAAE,CAAA,mCAAmC,KAAK,SAAS,CAAC;QAC1D,OAAO,EAAE,CAAO;;8CAE0B,KAAK,oBAAoB,GAAG;KACrE,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAU;QACrB,MAAM;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAiB,EACjB,IAAa,EACb,KAAsH;IAEtH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,EAAE,CAAA,mCAAmC,KAAK,CAAC,KAAK,SAAS,CAAC;QAChE,MAAM,EAAE,CAAA;;gBAEI,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAA2B,CAAC,KAAK,MAAM,EAAE,UAAU,IAAI,IAAI;gBAC7G,MAAM,EAAE,EAAE,IAAI,IAAI,KAAK,KAAK,CAAC,SAAS;;;;KAIjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAiB,EAAE,KAAa,EAAE,GAAW;IAC9E,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,EAAE,CAAA,mCAAmC,KAAK,SAAS,CAAC;QAC1D,MAAM,EAAE,CAAA,gDAAgD,KAAK,oBAAoB,GAAG,EAAE,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAiB;IAChD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACzC,MAAM,EAAE,CAAA,kCAAkC,CAAC;QAC3C,OAAO,EAAE,CAAkB,0EAA0E,CAAC;IACxG,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;AACzB,CAAC"}

package/dist/integrations/github.js

@@ -0,0 +1,112 @@
+/**
+ * GitHub, spoken with a fine-grained token — D88/D95, plan/08 §5.
+ *
+ * 07 §3.1 decided a GitHub App for the cloud; a self-host will not register
+ * one, so the connection here is a token scoped to one repository (Issues:
+ * read and write, Metadata: read). Three calls are all this needs: create an
+ * issue, move its state, and prove the token can see the repo. Every call
+ * carries the API version header, and every failure comes back as a sentence
+ * with GitHub's own message in it, because "422" tells nobody what to fix.
+ */
+export class GitHubError extends Error {
+    status;
+    retryable;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        // 5xx and the two rate-limit answers are "not now"; 4xx are "not like this".
+        this.retryable = status >= 500 || status === 429 || status === 403 && /rate limit/i.test(message);
+    }
+}
+export function githubClient(opts) {
+    const base = (opts.apiBase ?? "https://api.github.com").replace(/\/+$/, "");
+    const f = opts.fetch ?? globalThis.fetch;
+    const headers = {
+        authorization: `Bearer ${opts.token}`,
+        accept: "application/vnd.github+json",
+        "x-github-api-version": "2022-11-28",
+        "user-agent": "snagset",
+    };
+    async function call(method, path, body) {
+        let res;
+        try {
+            res = await f(`${base}${path}`, {
+                method,
+                headers: body === undefined ? headers : { ...headers, "content-type": "application/json" },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+        }
+        catch (e) {
+            throw new GitHubError(0, `could not reach GitHub: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        if (!res.ok) {
+            let detail = "";
+            try {
+                const j = (await res.json());
+                detail = [j.message, ...(j.errors ?? []).map((x) => x.message ?? x.field)].filter(Boolean).join("; ");
+            }
+            catch {
+                /* no body */
+            }
+            const what = res.status === 401
+                ? "the token was refused (revoked, expired, or not a GitHub token)"
+                : res.status === 404
+                    ? "the repository was not found, or the token cannot see it"
+                    : res.status === 403
+                        ? "the token is not allowed to do that on this repository"
+                        : `GitHub answered ${res.status}`;
+            throw new GitHubError(res.status, detail ? `${what}: ${detail}` : what);
+        }
+        return (await res.json());
+    }
+    return {
+        /** Proves the token can see the repo and may write issues. */
+        async probe(r) {
+            try {
+                const repo = await call("GET", `/repos/${enc(r.owner)}/${enc(r.repo)}`);
+                return { ok: true, fullName: repo.full_name, canWrite: !!(repo.permissions?.push || repo.permissions?.admin) };
+            }
+            catch (e) {
+                return { ok: false, detail: e instanceof Error ? e.message : String(e) };
+            }
+        },
+        async createIssue(r, issue) {
+            const made = await call("POST", `/repos/${enc(r.owner)}/${enc(r.repo)}/issues`, {
+                title: issue.title,
+                body: issue.body,
+                ...(issue.labels?.length ? { labels: issue.labels } : {}),
+            });
+            return { number: made.number, url: made.html_url };
+        },
+        /** `closed` with a reason, or `open`. GitHub's own vocabulary; the mapping from ours is the worker's. */
+        async setIssueState(r, number, state, reason) {
+            await call("PATCH", `/repos/${enc(r.owner)}/${enc(r.repo)}/issues/${number}`, {
+                state,
+                ...(state === "closed" && reason ? { state_reason: reason } : {}),
+            });
+        },
+        async comment(r, number, body) {
+            await call("POST", `/repos/${enc(r.owner)}/${enc(r.repo)}/issues/${number}/comments`, { body });
+        },
+    };
+}
+const enc = encodeURIComponent;
+/** The issue title — 07 §3.4's algorithm on an already-escaped first line. */
+export function issueTitle(input) {
+    let summary = "";
+    const raw = (input.firstBody ?? "")
+        .replace(/```[\s\S]*?```/g, " ")
+        .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1")
+        .replace(/[*_~`>#]/g, "")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (!raw)
+        summary = `review comment from ${input.author || "a reviewer"}`;
+    else {
+        const first = raw.split(/(?<=[.!?])\s+/)[0] ?? raw;
+        summary = first.length <= 72 ? first : `${first.slice(0, 71).replace(/\s+\S*$/, "")}…`;
+    }
+    const route = input.route.length > 32 ? `…${input.route.slice(-31)}` : input.route;
+    return `${route} — ${summary}`.slice(0, 256);
+}
+//# sourceMappingURL=github.js.map

package/dist/integrations/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/integrations/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmBH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,SAAS,CAAU;IAC5B,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,6EAA6E;QAC7E,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpG,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;QACrC,MAAM,EAAE,6BAA6B;QACrC,sBAAsB,EAAE,YAAY;QACpC,YAAY,EAAE,SAAS;KACxB,CAAC;IAEF,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;gBAC9B,MAAM;gBACN,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC1F,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,2BAA2B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0E,CAAC;gBACtG,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxG,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,iEAAiE;gBACnE,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,0DAA0D;oBAC5D,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;wBAClB,CAAC,CAAC,wDAAwD;wBAC1D,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,OAAO;QACL,8DAA8D;QAC9D,KAAK,CAAC,KAAK,CAAC,CAAa;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,KAAK,EACL,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACxC,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YACjH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,CAAa,EAAE,KAAyD;YACxF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAuC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE;gBACpH,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrD,CAAC;QACD,yGAAyG;QACzG,KAAK,CAAC,aAAa,CAAC,CAAa,EAAE,MAAc,EAAE,KAAwB,EAAE,MAAoC;YAC/G,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,EAAE;gBAC5E,KAAK;gBACL,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,CAAa,EAAE,MAAc,EAAE,IAAY;YACvD,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,MAAM,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,KAA+E;IACxG,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;SAChC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC;SACvC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,uBAAuB,KAAK,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;SACrE,CAAC;QACJ,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACnD,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACnF,OAAO,GAAG,KAAK,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/integrations/inbound.js

@@ -0,0 +1,88 @@
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+/**
+ * A tracker → us — D96 for GitHub, D97 for Linear: the status half of 07
+ * §3.5 and §5.2, for a self-host.
+ *
+ * NO ECHO. The change is written here, directly, and not through the status
+ * PATCH — so it queues no `issue.state` row and cannot bounce back. And when
+ * the change is ours to begin with (our worker moved the issue, the tracker
+ * tells us it moved), the thread already carries the status and the write
+ * is a no-op.
+ *
+ * REPLAY-PROOF by the sync ledger: `UNIQUE (provider, direction,
+ * delivery_id)` — a redelivered delivery id inserts nothing and changes
+ * nothing.
+ */
+export function verifyGitHubSignature(raw, header, secret) {
+    if (!header || !header.startsWith("sha256="))
+        return false;
+    const given = Buffer.from(header.slice(7), "hex");
+    const want = createHmac("sha256", secret).update(raw, "utf8").digest();
+    return given.length === want.length && timingSafeEqual(given, want);
+}
+export async function applyIssueState(sql, ev) {
+    return sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${ev.orgId}, true)`;
+        // The ledger row first: a replay stops here, before anything is touched.
+        const hash = createHash("sha256").update(`${ev.status}:${ev.externalId}`).digest();
+        const [ref] = await tx `
+      SELECT thread_id FROM external_refs
+       WHERE project_id = ${ev.projectId}::uuid AND provider = ${ev.provider}::snag_provider AND kind = 'issue'
+         AND external_id = ${ev.externalId} AND status <> 'detached'
+    `;
+        const [ledger] = await tx `
+      INSERT INTO sync_ledger (id, org_id, project_id, provider, direction, delivery_id, entity_kind, entity_id, external_id, content_hash, thread_id)
+      VALUES (${randomUUID()}, ${ev.orgId}::uuid, ${ev.projectId}::uuid, ${ev.provider}::snag_provider, 'inbound', ${ev.deliveryId}, 'status',
+              ${ref?.thread_id ?? null}, ${ev.externalId}, ${hash}, ${ref?.thread_id ?? null})
+      ON CONFLICT (provider, direction, delivery_id) DO NOTHING
+      RETURNING id
+    `;
+        if (!ledger)
+            return { kind: "ignored", why: "replay" };
+        if (!ref)
+            return { kind: "ignored", why: "no-thread" };
+        if (ev.status === "detach") {
+            await tx `UPDATE external_refs SET status = 'detached', synced_at = now()
+                WHERE thread_id = ${ref.thread_id}::uuid AND provider = ${ev.provider}::snag_provider AND kind = 'issue'`;
+            return { kind: "detached", threadId: ref.thread_id };
+        }
+        const [t] = await tx `
+      SELECT status, key, version, context FROM threads WHERE id = ${ref.thread_id}::uuid AND deleted_at IS NULL FOR UPDATE
+    `;
+        if (!t)
+            return { kind: "ignored", why: "no-thread" };
+        if (t.status === ev.status)
+            return { kind: "ignored", why: "unchanged" };
+        const [row] = await tx `
+      UPDATE threads
+         SET status = ${ev.status}::snag_thread_status,
+             resolved_at = ${ev.status === "resolved" ? tx `now()` : tx `NULL`},
+             version = version + 1, updated_at = now()
+       WHERE id = ${ref.thread_id}::uuid
+       RETURNING version
+    `;
+        return {
+            kind: ev.status === "resolved" ? "resolved" : "reopened",
+            status: ev.status,
+            threadId: ref.thread_id,
+            threadKey: t.key,
+            version: row?.version ?? t.version + 1,
+            pageUrl: String(t.context?.["url"] ?? ""),
+        };
+    });
+}
+/** GitHub's `issues` actions, mapped: closed resolves (any reason — no archived status since D9), reopened opens, deleted detaches. */
+export async function applyGitHubIssueEvent(sql, ev) {
+    const status = ev.action === "closed" ? "resolved" : ev.action === "reopened" ? "open" : ev.action === "deleted" ? "detach" : null;
+    if (!status)
+        return { kind: "ignored", why: "action" };
+    return applyIssueState(sql, {
+        provider: "github",
+        orgId: ev.orgId,
+        projectId: ev.projectId,
+        deliveryId: ev.deliveryId,
+        externalId: String(ev.issueNumber),
+        status,
+    });
+}
+//# sourceMappingURL=inbound.js.map

package/dist/integrations/inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../src/integrations/inbound.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAIlF;;;;;;;;;;;;;GAaG;AAEH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,MAA0B,EAAE,MAAc;IAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB,EAAE,EAAmB;IAC1E,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,EAAE,CAAA,mCAAmC,EAAE,CAAC,KAAK,SAAS,CAAC;QAC7D,yEAAyE;QACzE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAyB;;4BAEvB,EAAE,CAAC,SAAS,yBAAyB,EAAE,CAAC,QAAQ;6BAC/C,EAAE,CAAC,UAAU;KACrC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAkB;;gBAE/B,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,QAAQ,+BAA+B,EAAE,CAAC,UAAU;gBAClH,GAAG,EAAE,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,UAAU,KAAK,IAAI,KAAK,GAAG,EAAE,SAAS,IAAI,IAAI;;;KAGvF,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAEvD,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAA;oCACsB,GAAG,CAAC,SAAS,yBAAyB,EAAE,CAAC,QAAQ,oCAAoC,CAAC;YACpH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAA6F;qEAChD,GAAG,CAAC,SAAS;KAC7E,CAAC;QACF,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAuB;;wBAEzB,EAAE,CAAC,MAAM;6BACJ,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA,MAAM;;oBAExD,GAAG,CAAC,SAAS;;KAE5B,CAAC;QACF,OAAO;YACL,IAAI,EAAE,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACxD,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,SAAS,EAAE,CAAC,CAAC,GAAG;YAChB,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;YACtC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAiB,EACjB,EAAiG;IAEjG,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACnI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACvD,OAAO,eAAe,CAAC,GAAG,EAAE;QAC1B,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC;QAClC,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/integrations/jira.js

@@ -0,0 +1,129 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export class JiraError extends Error {
+    status;
+    retryable;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.retryable = status >= 500 || status === 429;
+    }
+}
+export function jiraClient(opts) {
+    const base = opts.siteUrl.replace(/\/+$/, "");
+    const f = opts.fetch ?? globalThis.fetch;
+    const headers = {
+        authorization: "Basic " + Buffer.from(`${opts.email}:${opts.apiToken}`, "utf8").toString("base64"),
+        accept: "application/json",
+        "user-agent": "snagset",
+    };
+    async function call(method, path, body) {
+        let res;
+        try {
+            res = await f(`${base}${path}`, {
+                method,
+                headers: body === undefined ? headers : { ...headers, "content-type": "application/json" },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+        }
+        catch (e) {
+            throw new JiraError(0, `could not reach Jira: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        if (res.status === 204)
+            return undefined;
+        let parsed = null;
+        try {
+            parsed = await res.json();
+        }
+        catch {
+            /* no body */
+        }
+        if (!res.ok) {
+            const detail = [
+                ...(parsed?.errorMessages ?? []),
+                ...Object.entries(parsed?.errors ?? {}).map(([k, v]) => `${k}: ${v}`),
+            ].join("; ");
+            const what = res.status === 401
+                ? "the email and API token were refused"
+                : res.status === 403
+                    ? "the account is not allowed to do that in this project"
+                    : res.status === 404
+                        ? "the project was not found, or the account cannot see it"
+                        : `Jira answered ${res.status}`;
+            throw new JiraError(res.status, detail ? `${what}: ${detail}` : what);
+        }
+        return parsed;
+    }
+    return {
+        /** The account, the project, and an issue type to create with — Task if the project has one. */
+        async probe(projectKey) {
+            try {
+                const me = await call("GET", "/rest/api/2/myself");
+                const project = await call("GET", `/rest/api/2/project/${encodeURIComponent(projectKey)}`);
+                const types = (project.issueTypes ?? []).filter((t) => !t.subtask);
+                const issueType = types.find((t) => /^task$/i.test(t.name)) ?? types.find((t) => /^bug$/i.test(t.name)) ?? types[0];
+                if (!issueType)
+                    return { ok: false, detail: `project ${project.key} has no issue type this account can create` };
+                return {
+                    ok: true,
+                    me: me.displayName ?? me.emailAddress ?? opts.email,
+                    project: { id: String(project.id), key: project.key, name: project.name },
+                    issueType: { id: String(issueType.id), name: issueType.name },
+                };
+            }
+            catch (e) {
+                return { ok: false, detail: e instanceof Error ? e.message : String(e) };
+            }
+        },
+        async createIssue(input) {
+            const made = await call("POST", "/rest/api/2/issue", {
+                fields: {
+                    project: { id: input.projectId },
+                    issuetype: { id: input.issueTypeId },
+                    summary: input.summary.slice(0, 255),
+                    description: input.description,
+                },
+            });
+            return { id: String(made.id), key: made.key, url: `${base}/browse/${made.key}` };
+        },
+        /** Move the issue to a status in the category; refused with a sentence when the workflow offers none. */
+        async transitionTo(issueKey, category) {
+            const list = await call("GET", `/rest/api/2/issue/${encodeURIComponent(issueKey)}/transitions`);
+            const t = list.transitions.find((x) => x.to?.statusCategory?.key === category);
+            if (!t) {
+                // Already there is not a failure — a workflow offers no transition to
+                // the status the issue holds.
+                const current = await call("GET", `/rest/api/2/issue/${encodeURIComponent(issueKey)}?fields=status`);
+                if (current.fields?.status?.statusCategory?.key === category)
+                    return;
+                throw new JiraError(422, `the project's workflow offers no transition from the issue's current status to a ${category} status`);
+            }
+            await call("POST", `/rest/api/2/issue/${encodeURIComponent(issueKey)}/transitions`, { transition: { id: t.id } });
+        },
+    };
+}
+/** Jira Cloud signs a webhook that has a secret with `X-Hub-Signature: sha256=<hex HMAC-SHA256 of the body>`. */
+export function verifyJiraSignature(raw, header, secret) {
+    if (!header)
+        return false;
+    const hex = header.startsWith("sha256=") ? header.slice(7) : header;
+    const given = Buffer.from(hex.trim(), "hex");
+    const want = createHmac("sha256", secret).update(raw, "utf8").digest();
+    return given.length === want.length && timingSafeEqual(given, want);
+}
+/** Our status → the status category to transition to; their category → our status. */
+export function jiraCategoryFor(status) {
+    return status === "resolved" ? "done" : status === "progress" ? "indeterminate" : "new";
+}
+export function statusForJiraCategory(category) {
+    return category === "done" ? "resolved" : category === "indeterminate" ? "progress" : "open";
+}
+/**
+ * Jira's v2 description is wiki markup, which a reviewer's text could steer
+ * (`{code}`, `[link|url]`, `!image!`). The brief's own structure is plain
+ * Markdown and reads fine as text; the reviewer's words get the few wiki
+ * specials escaped after the outbound sanitiser has done its part.
+ */
+export function escapeForJiraWiki(s) {
+    return s.replace(/([{}\[\]|!])/g, "\\$1");
+}
+//# sourceMappingURL=jira.js.map

package/dist/integrations/jira.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jira.js","sourceRoot":"","sources":["../../src/integrations/jira.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAuB1D,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,SAAS,CAAU;IAC5B,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IACnD,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClG,MAAM,EAAE,kBAAkB;QAC1B,YAAY,EAAE,SAAS;KACxB,CAAC;IAEF,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;gBAC9B,MAAM;gBACN,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC1F,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,CAAC,EAAE,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,IAAI,MAAM,GAAQ,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG;gBACb,GAAG,CAAE,MAAM,EAAE,aAAsC,IAAI,EAAE,CAAC;gBAC1D,GAAG,MAAM,CAAC,OAAO,CAAE,MAAM,EAAE,MAA6C,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;aAC9G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,uDAAuD;oBACzD,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;wBAClB,CAAC,CAAC,yDAAyD;wBAC3D,CAAC,CAAC,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAW,CAAC;IACrB,CAAC;IAED,OAAO;QACL,gGAAgG;QAChG,KAAK,CAAC,KAAK,CAAC,UAAkB;YAI5B,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAkD,KAAK,EAAE,oBAAoB,CAAC,CAAC;gBACpG,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,KAAK,EACL,uBAAuB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACxD,CAAC;gBACF,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACnE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpH,IAAI,CAAC,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC,GAAG,4CAA4C,EAAE,CAAC;gBACjH,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,EAAE,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK;oBACnD,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBACzE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAC9D,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAuF;YACvG,MAAM,IAAI,GAAG,MAAM,IAAI,CAA8B,MAAM,EAAE,mBAAmB,EAAE;gBAChF,MAAM,EAAE;oBACN,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;oBAChC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE;oBACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACpC,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B;aACF,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,yGAAyG;QACzG,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,QAAsB;YACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,KAAK,EACL,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAChE,CAAC;YACF,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,sEAAsE;gBACtE,8BAA8B;gBAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,KAAK,EACL,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAClE,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,QAAQ;oBAAE,OAAO;gBACrE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oFAAoF,QAAQ,SAAS,CAAC,CAAC;YAClI,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,EAAE,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAA0B,EAAE,MAAc;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1F,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC"}

package/dist/integrations/linear.js

@@ -0,0 +1,111 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export class LinearError extends Error {
+    status;
+    retryable;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.retryable = status >= 500 || status === 429;
+    }
+}
+export function linearClient(opts) {
+    const url = opts.apiBase ?? "https://api.linear.app/graphql";
+    const f = opts.fetch ?? globalThis.fetch;
+    async function gql(query, variables = {}) {
+        let res;
+        try {
+            res = await f(url, {
+                method: "POST",
+                headers: { authorization: opts.apiKey, "content-type": "application/json", "user-agent": "snagset" },
+                body: JSON.stringify({ query, variables }),
+            });
+        }
+        catch (e) {
+            throw new LinearError(0, `could not reach Linear: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        let body = {};
+        try {
+            body = (await res.json());
+        }
+        catch {
+            /* no body */
+        }
+        if (res.status === 401 || res.status === 403) {
+            throw new LinearError(res.status, "the API key was refused (revoked, or not a Linear key)");
+        }
+        if (!res.ok)
+            throw new LinearError(res.status, `Linear answered ${res.status}${body.errors?.[0]?.message ? `: ${body.errors[0].message}` : ""}`);
+        if (body.errors?.length) {
+            const first = body.errors[0];
+            const code = first.extensions?.code ?? "";
+            const auth = /AUTHENTICATION|FORBIDDEN|UNAUTHENTICATED/i.test(code);
+            throw new LinearError(auth ? 401 : 422, first.message ?? "Linear refused the request");
+        }
+        if (!body.data)
+            throw new LinearError(502, "Linear answered without data");
+        return body.data;
+    }
+    return {
+        /** The team by key, and the first state of each type we need — the shape the worker moves issues between. */
+        async probe(teamKey) {
+            try {
+                const data = await gql(`query SnagsetProbe($key: String!) {
+             viewer { name }
+             teams(filter: { key: { eq: $key } }, first: 1) {
+               nodes { id key name states { nodes { id name type position } } }
+             }
+           }`, { key: teamKey });
+                const team = data.teams.nodes[0];
+                if (!team)
+                    return { ok: false, detail: `no team with the key ${teamKey} is visible to this API key (private teams need a member's key)` };
+                const byType = (type) => team.states.nodes.filter((s) => s.type === type).sort((a, b) => a.position - b.position)[0];
+                const completed = byType("completed");
+                const started = byType("started");
+                const unstarted = byType("unstarted") ?? byType("backlog") ?? byType("triage");
+                if (!completed || !started || !unstarted) {
+                    return { ok: false, detail: `team ${team.key} lacks a workflow state of type completed, started or unstarted` };
+                }
+                return {
+                    ok: true,
+                    team: { id: team.id, key: team.key, name: team.name },
+                    states: { completed: completed.id, started: started.id, unstarted: unstarted.id },
+                    viewer: data.viewer.name,
+                };
+            }
+            catch (e) {
+                return { ok: false, detail: e instanceof Error ? e.message : String(e) };
+            }
+        },
+        async createIssue(input) {
+            const data = await gql(`mutation SnagsetCreate($input: IssueCreateInput!) {
+           issueCreate(input: $input) { success issue { id identifier url } }
+         }`, { input: { teamId: input.teamId, title: input.title, description: input.description, ...(input.stateId ? { stateId: input.stateId } : {}) } });
+            if (!data.issueCreate.success || !data.issueCreate.issue)
+                throw new LinearError(502, "Linear did not create the issue");
+            return data.issueCreate.issue;
+        },
+        async setState(issueId, stateId) {
+            const data = await gql(`mutation SnagsetState($id: String!, $input: IssueUpdateInput!) {
+           issueUpdate(id: $id, input: $input) { success }
+         }`, { id: issueId, input: { stateId } });
+            if (!data.issueUpdate.success)
+                throw new LinearError(502, "Linear did not move the issue");
+        },
+    };
+}
+/** 07 §5.3: `Linear-Signature` is the hex HMAC-SHA256 of the raw body with the webhook's signing secret. */
+export function verifyLinearSignature(raw, header, secret) {
+    if (!header)
+        return false;
+    const given = Buffer.from(header.trim(), "hex");
+    const want = createHmac("sha256", secret).update(raw, "utf8").digest();
+    return given.length === want.length && timingSafeEqual(given, want);
+}
+/** Our status → the team's state (by TYPE); their state type → our status. */
+export function linearStateFor(status, states) {
+    return status === "resolved" ? states.completed : status === "progress" ? states.started : states.unstarted;
+}
+export function statusForLinearState(type) {
+    return type === "completed" || type === "canceled" ? "resolved" : type === "started" ? "progress" : "open";
+}
+//# sourceMappingURL=linear.js.map

package/dist/integrations/linear.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear.js","sourceRoot":"","sources":["../../src/integrations/linear.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA4B1D,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,SAAS,CAAU;IAC5B,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IACnD,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,gCAAgC,CAAC;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAEzC,KAAK,UAAU,GAAG,CAAI,KAAa,EAAE,YAAqC,EAAE;QAC1E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;gBACjB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,SAAS,EAAE;gBACpG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,2BAA2B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,IAAI,GAAkF,EAAE,CAAC;QAC7F,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,wDAAwD,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjJ,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,4BAA4B,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,OAAO;QACL,6GAA6G;QAC7G,KAAK,CAAC,KAAK,CAAC,OAAe;YAGzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAIpB;;;;;aAKG,EACH,EAAE,GAAG,EAAE,OAAO,EAAE,CACjB,CAAC;gBACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,IAAI;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,OAAO,iEAAiE,EAAE,CAAC;gBAC1I,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7H,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC/E,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;oBACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,CAAC,GAAG,iEAAiE,EAAE,CAAC;gBAClH,CAAC;gBACD,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;oBACrD,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE;oBACjF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;iBACzB,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAA+E;YAC/F,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB;;WAEG,EACH,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9I,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YACxH,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,OAAe;YAC7C,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB;;WAEG,EACH,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CACpC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,MAA0B,EAAE,MAAc;IAC3F,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAoB;IACjE,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;AAC9G,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;AAC7G,CAAC"}