@specship/specship-win32-arm64 0.13.0 → 0.14.0

package/lib/dist/jira/client.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Minimal JIRA REST client (REQ-JIRA-001, A3).
+ *
+ * Wraps `fetch` with the base URL + auth header. `testConnection()` probes
+ * `/rest/api/2/myself` (available on both Cloud and Data Center);
+ * `listMyIssues()` (REQ-JIRA-002) searches the current user's issues. Both
+ * go through the private `request()` helper so the security guards below
+ * apply to every credentialed call.
+ *
+ * SECURITY (foundation for REQ-JIRA-009):
+ *  - `redirect: 'manual'` — we never auto-follow a redirect, so the
+ *    `Authorization` header can't be replayed to a different host.
+ *  - We only ever talk to the configured base URL's host; a cross-host
+ *    (or any) redirect is refused, not followed.
+ *  - No thrown error or result field ever contains the credential.
+ */
+import { JiraCredentials, JiraConnectionResult, JiraIssueListResult, JiraIssueResult, JiraTransition, JiraTransitionResult } from './types';
+export declare class JiraClient {
+    private readonly baseUrl;
+    private readonly host;
+    private readonly authHeader;
+    private readonly deployment;
+    constructor(creds: JiraCredentials);
+    /**
+     * Probe the instance's `/myself` endpoint.
+     *  - 200 → `{ ok: true, accountId, displayName }`.
+     *  - 401 / 403 → `JiraAuthError`.
+     *  - 3xx redirect → `JiraConfigError` (refused, never followed).
+     *  - network / DNS failure → `JiraConfigError`.
+     */
+    testConnection(): Promise<JiraConnectionResult>;
+    /**
+     * List the issues assigned to the authenticated user (REQ-JIRA-002).
+     * Identity comes from the token via JQL `currentUser()` — the user never
+     * types their own name (A1). An optional `project` narrows the search
+     * (A2); the value is quote-escaped to prevent JQL injection. Ordered
+     * most-actionable-first (recently updated). Bounded by `MAX_ISSUE_RESULTS`.
+     *
+     *  - 200 → `{ ok: true, issues }`; an empty list is a valid success (A3).
+     *  - 401 / 403 → `JiraAuthError`; redirect / network / non-200 →
+     *    `JiraConfigError` (A4) — never a partial or fabricated list.
+     */
+    listMyIssues(opts?: {
+        project?: string;
+    }): Promise<JiraIssueListResult>;
+    /**
+     * Fetch a single issue by its key (REQ-JIRA-003). Identity/authorization
+     * ride the token — a key the user can't see is indistinguishable from a
+     * missing one and both surface as `JiraNotFoundError` (A2). The key is
+     * URL-encoded before it enters the path so a slash/space can't traverse or
+     * inject into the request line.
+     *
+     *  - 200 → `{ ok: true, issue }` with summary/description/status/type/subtasks.
+     *  - 404 → `JiraNotFoundError` (no such issue, or no access).
+     *  - 401 / 403 → `JiraAuthError`; redirect / network / non-200 →
+     *    `JiraConfigError`. Never a partial or fabricated issue.
+     */
+    getIssue(key: string): Promise<JiraIssueResult>;
+    /**
+     * List the transitions the issue's current workflow state offers
+     * (REQ-JIRA-007). `GET /issue/{key}/transitions`. Used to resolve a
+     * configured transition name/id to an executable id before writing.
+     */
+    listTransitions(key: string): Promise<JiraTransition[]>;
+    /**
+     * Drive the issue toward a target state (REQ-JIRA-007). `nameOrId` is
+     * matched against the issue's available transitions by exact id first, then
+     * case-insensitively by name. On a match it POSTs `/transitions`. When NO
+     * transition matches — because this project's workflow doesn't offer it —
+     * it returns `{ ok, skipped, reason }` and NEVER throws (A3): a missing
+     * transition is an expected, recoverable state, and the caller still
+     * comments the PR link and reports the skip. Auth/network faults on the
+     * write still throw like any other credentialed call.
+     */
+    transitionIssue(key: string, nameOrId: string): Promise<JiraTransitionResult>;
+    /**
+     * Assign the issue (REQ-JIRA-007). Cloud keys assignment by `accountId`;
+     * Data Center by `name`. `PUT /issue/{key}/assignee`. A 204 (no body) is the
+     * success shape — the `write` helper tolerates an empty response.
+     */
+    assignIssue(key: string, accountId: string): Promise<void>;
+    /**
+     * Add a comment to the issue (REQ-JIRA-007) — used to record the PR link.
+     * `POST /issue/{key}/comment`. api/2 takes a plain-string body.
+     *
+     * SECURITY: the caller only ever passes the public PR URL / issue key here,
+     * never a credential (REQ-JIRA-009).
+     */
+    addComment(key: string, body: string): Promise<void>;
+    /**
+     * Shared, credentialed GET against the configured host. Delegates to
+     * `send()` for the security guards, then parses JSON. Returns the parsed
+     * JSON body on success; a non-JSON body is a `JiraConfigError`.
+     */
+    private request;
+    /**
+     * Shared, credentialed write (POST/PUT) against the configured host
+     * (REQ-JIRA-007). Carries EVERY guard `request()` does via `send()` —
+     * `redirect: 'manual'`, host-lock, 401/403 → auth, 404 → not-found,
+     * non-2xx → config, credential-free messages. A JSON body is sent with
+     * `Content-Type: application/json`; a success with no/empty body (204, the
+     * common transition/assignee shape) resolves to `null` rather than erroring
+     * on the missing JSON.
+     */
+    private write;
+    /**
+     * The single fetch + guard chokepoint shared by `request` and `write`. Every
+     * security guard lives here so no call path can skip one:
+     *  - `redirect: 'manual'` — the `Authorization` header is never replayed
+     *    across a redirect; any 3xx / opaqueredirect is refused, not followed.
+     *  - only ever talks to the configured host.
+     *  - 401 / 403 → `JiraAuthError`; 404 → `JiraNotFoundError`; network /
+     *    non-2xx → `JiraConfigError`.
+     *  - No thrown message ever contains the credential — only the host.
+     *
+     * Returns the raw `Response` on a 2xx; the caller parses the body.
+     */
+    private send;
+}
+//# sourceMappingURL=client.d.ts.map

package/lib/dist/jira/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/jira/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,eAAe,EACf,oBAAoB,EAEpB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,oBAAoB,EAIrB,MAAM,SAAS,CAAC;AAKjB,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;gBAE/C,KAAK,EAAE,eAAe;IAclC;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAUrD;;;;;;;;;;OAUG;IACG,YAAY,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA6B7E;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IA2CrD;;;;OAIG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAY7D;;;;;;;;;OASG;IACG,eAAe,CACnB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;IAmChC;;;;OAIG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBhE;;;;;;OAMG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1D;;;;OAIG;YACW,OAAO;IAWrB;;;;;;;;OAQG;YACW,KAAK;IAgBnB;;;;;;;;;;;OAWG;YACW,IAAI;CAoEnB"}

package/lib/dist/jira/client.js

@@ -0,0 +1,316 @@
+"use strict";
+/**
+ * Minimal JIRA REST client (REQ-JIRA-001, A3).
+ *
+ * Wraps `fetch` with the base URL + auth header. `testConnection()` probes
+ * `/rest/api/2/myself` (available on both Cloud and Data Center);
+ * `listMyIssues()` (REQ-JIRA-002) searches the current user's issues. Both
+ * go through the private `request()` helper so the security guards below
+ * apply to every credentialed call.
+ *
+ * SECURITY (foundation for REQ-JIRA-009):
+ *  - `redirect: 'manual'` — we never auto-follow a redirect, so the
+ *    `Authorization` header can't be replayed to a different host.
+ *  - We only ever talk to the configured base URL's host; a cross-host
+ *    (or any) redirect is refused, not followed.
+ *  - No thrown error or result field ever contains the credential.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JiraClient = void 0;
+const auth_1 = require("./auth");
+const types_1 = require("./types");
+/** Upper bound on issues fetched in one list call — never unbounded. */
+const MAX_ISSUE_RESULTS = 50;
+class JiraClient {
+    baseUrl;
+    host;
+    authHeader;
+    deployment;
+    constructor(creds) {
+        // Normalize: strip trailing slashes so path joins are clean.
+        this.baseUrl = creds.baseUrl.replace(/\/+$/, '');
+        try {
+            this.host = new URL(this.baseUrl).host;
+        }
+        catch {
+            throw new types_1.JiraConfigError(`Invalid JIRA base URL: ${creds.baseUrl}`);
+        }
+        this.authHeader = (0, auth_1.buildAuthHeader)(creds);
+        this.deployment = creds.deployment;
+    }
+    /**
+     * Probe the instance's `/myself` endpoint.
+     *  - 200 → `{ ok: true, accountId, displayName }`.
+     *  - 401 / 403 → `JiraAuthError`.
+     *  - 3xx redirect → `JiraConfigError` (refused, never followed).
+     *  - network / DNS failure → `JiraConfigError`.
+     */
+    async testConnection() {
+        const body = await this.request('/rest/api/2/myself');
+        return {
+            ok: true,
+            // Cloud → accountId; Data Center → key/name. Prefer the most stable.
+            accountId: body?.accountId ?? body?.key ?? body?.name,
+            displayName: body?.displayName ?? body?.name,
+        };
+    }
+    /**
+     * List the issues assigned to the authenticated user (REQ-JIRA-002).
+     * Identity comes from the token via JQL `currentUser()` — the user never
+     * types their own name (A1). An optional `project` narrows the search
+     * (A2); the value is quote-escaped to prevent JQL injection. Ordered
+     * most-actionable-first (recently updated). Bounded by `MAX_ISSUE_RESULTS`.
+     *
+     *  - 200 → `{ ok: true, issues }`; an empty list is a valid success (A3).
+     *  - 401 / 403 → `JiraAuthError`; redirect / network / non-200 →
+     *    `JiraConfigError` (A4) — never a partial or fabricated list.
+     */
+    async listMyIssues(opts) {
+        let jql = 'assignee = currentUser()';
+        if (opts?.project && opts.project.trim()) {
+            // Quote-escape the project so an embedded quote can't break out of the
+            // JQL string literal (injection guard). JQL escapes `"` as `\"`.
+            const escaped = opts.project.trim().replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+            jql = `project = "${escaped}" AND ${jql}`;
+        }
+        jql += ' ORDER BY updated DESC';
+        const params = new URLSearchParams({
+            jql,
+            fields: 'summary,status,issuetype',
+            maxResults: String(MAX_ISSUE_RESULTS),
+        });
+        const body = await this.request(`/rest/api/2/search?${params.toString()}`);
+        const rawIssues = Array.isArray(body?.issues) ? body.issues : [];
+        const issues = rawIssues.map(issue => ({
+            key: String(issue?.key ?? ''),
+            id: String(issue?.id ?? ''),
+            summary: String(issue?.fields?.summary ?? ''),
+            status: String(issue?.fields?.status?.name ?? ''),
+            issueType: String(issue?.fields?.issuetype?.name ?? ''),
+        }));
+        return { ok: true, issues };
+    }
+    /**
+     * Fetch a single issue by its key (REQ-JIRA-003). Identity/authorization
+     * ride the token — a key the user can't see is indistinguishable from a
+     * missing one and both surface as `JiraNotFoundError` (A2). The key is
+     * URL-encoded before it enters the path so a slash/space can't traverse or
+     * inject into the request line.
+     *
+     *  - 200 → `{ ok: true, issue }` with summary/description/status/type/subtasks.
+     *  - 404 → `JiraNotFoundError` (no such issue, or no access).
+     *  - 401 / 403 → `JiraAuthError`; redirect / network / non-200 →
+     *    `JiraConfigError`. Never a partial or fabricated issue.
+     */
+    async getIssue(key) {
+        const trimmed = (key ?? '').trim();
+        if (!trimmed) {
+            throw new types_1.JiraConfigError('An issue key is required (e.g., "PROJ-123").');
+        }
+        // URL-encode the key: a slash or space in the key must not traverse the
+        // path or split the request — encode it into a single path segment.
+        const params = new URLSearchParams({
+            fields: 'summary,description,status,issuetype,subtasks',
+        });
+        const body = await this.request(`/rest/api/2/issue/${encodeURIComponent(trimmed)}?${params.toString()}`);
+        const fields = body?.fields ?? {};
+        // api/2 returns `description` as a plain string. Guard the non-string case
+        // (null → no body; an ADF object under a future api/3 → not `[object
+        // Object]`) by treating anything non-string as empty.
+        const description = typeof fields.description === 'string' ? fields.description : '';
+        const rawSubtasks = Array.isArray(fields.subtasks)
+            ? fields.subtasks
+            : [];
+        const subtasks = rawSubtasks.map(st => ({
+            key: String(st?.key ?? ''),
+            summary: String(st?.fields?.summary ?? ''),
+            status: String(st?.fields?.status?.name ?? ''),
+        }));
+        const issue = {
+            key: String(body?.key ?? trimmed),
+            id: String(body?.id ?? ''),
+            summary: String(fields.summary ?? ''),
+            status: String(fields.status?.name ?? ''),
+            issueType: String(fields.issuetype?.name ?? ''),
+            description,
+            subtasks,
+        };
+        return { ok: true, issue };
+    }
+    /**
+     * List the transitions the issue's current workflow state offers
+     * (REQ-JIRA-007). `GET /issue/{key}/transitions`. Used to resolve a
+     * configured transition name/id to an executable id before writing.
+     */
+    async listTransitions(key) {
+        const trimmed = (key ?? '').trim();
+        if (!trimmed) {
+            throw new types_1.JiraConfigError('An issue key is required (e.g., "PROJ-123").');
+        }
+        const body = await this.request(`/rest/api/2/issue/${encodeURIComponent(trimmed)}/transitions`);
+        const raw = Array.isArray(body?.transitions) ? body.transitions : [];
+        return raw.map(t => ({ id: String(t?.id ?? ''), name: String(t?.name ?? '') }));
+    }
+    /**
+     * Drive the issue toward a target state (REQ-JIRA-007). `nameOrId` is
+     * matched against the issue's available transitions by exact id first, then
+     * case-insensitively by name. On a match it POSTs `/transitions`. When NO
+     * transition matches — because this project's workflow doesn't offer it —
+     * it returns `{ ok, skipped, reason }` and NEVER throws (A3): a missing
+     * transition is an expected, recoverable state, and the caller still
+     * comments the PR link and reports the skip. Auth/network faults on the
+     * write still throw like any other credentialed call.
+     */
+    async transitionIssue(key, nameOrId) {
+        const trimmed = (key ?? '').trim();
+        if (!trimmed) {
+            throw new types_1.JiraConfigError('An issue key is required (e.g., "PROJ-123").');
+        }
+        const target = (nameOrId ?? '').trim();
+        if (!target) {
+            return {
+                ok: true,
+                skipped: nameOrId,
+                reason: 'no transition name/id was configured',
+            };
+        }
+        const available = await this.listTransitions(trimmed);
+        const wanted = target.toLowerCase();
+        const match = available.find(t => t.id === target || t.name.toLowerCase() === wanted);
+        if (!match) {
+            const names = available.map(t => t.name).join(', ') || 'none';
+            return {
+                ok: true,
+                skipped: target,
+                reason: `no "${target}" transition on this issue's workflow (available: ${names})`,
+            };
+        }
+        await this.write(`/rest/api/2/issue/${encodeURIComponent(trimmed)}/transitions`, { transition: { id: match.id } });
+        return { ok: true, transitioned: match.name };
+    }
+    /**
+     * Assign the issue (REQ-JIRA-007). Cloud keys assignment by `accountId`;
+     * Data Center by `name`. `PUT /issue/{key}/assignee`. A 204 (no body) is the
+     * success shape — the `write` helper tolerates an empty response.
+     */
+    async assignIssue(key, accountId) {
+        const trimmed = (key ?? '').trim();
+        if (!trimmed) {
+            throw new types_1.JiraConfigError('An issue key is required (e.g., "PROJ-123").');
+        }
+        const body = this.deployment === 'datacenter'
+            ? { name: accountId }
+            : { accountId };
+        await this.write(`/rest/api/2/issue/${encodeURIComponent(trimmed)}/assignee`, body, 'PUT');
+    }
+    /**
+     * Add a comment to the issue (REQ-JIRA-007) — used to record the PR link.
+     * `POST /issue/{key}/comment`. api/2 takes a plain-string body.
+     *
+     * SECURITY: the caller only ever passes the public PR URL / issue key here,
+     * never a credential (REQ-JIRA-009).
+     */
+    async addComment(key, body) {
+        const trimmed = (key ?? '').trim();
+        if (!trimmed) {
+            throw new types_1.JiraConfigError('An issue key is required (e.g., "PROJ-123").');
+        }
+        await this.write(`/rest/api/2/issue/${encodeURIComponent(trimmed)}/comment`, { body });
+    }
+    /**
+     * Shared, credentialed GET against the configured host. Delegates to
+     * `send()` for the security guards, then parses JSON. Returns the parsed
+     * JSON body on success; a non-JSON body is a `JiraConfigError`.
+     */
+    async request(path) {
+        const res = await this.send(path, 'GET');
+        try {
+            return await res.json();
+        }
+        catch {
+            throw new types_1.JiraConfigError(`JIRA at ${this.host} returned a non-JSON response.`);
+        }
+    }
+    /**
+     * Shared, credentialed write (POST/PUT) against the configured host
+     * (REQ-JIRA-007). Carries EVERY guard `request()` does via `send()` —
+     * `redirect: 'manual'`, host-lock, 401/403 → auth, 404 → not-found,
+     * non-2xx → config, credential-free messages. A JSON body is sent with
+     * `Content-Type: application/json`; a success with no/empty body (204, the
+     * common transition/assignee shape) resolves to `null` rather than erroring
+     * on the missing JSON.
+     */
+    async write(path, body, method = 'POST') {
+        const res = await this.send(path, method, JSON.stringify(body ?? {}));
+        // 204 No Content (assignee/transition) has no body — don't force JSON.
+        if (res.status === 204)
+            return null;
+        try {
+            return await res.json();
+        }
+        catch {
+            // A 2xx write with an empty/non-JSON body is still a success.
+            return null;
+        }
+    }
+    /**
+     * The single fetch + guard chokepoint shared by `request` and `write`. Every
+     * security guard lives here so no call path can skip one:
+     *  - `redirect: 'manual'` — the `Authorization` header is never replayed
+     *    across a redirect; any 3xx / opaqueredirect is refused, not followed.
+     *  - only ever talks to the configured host.
+     *  - 401 / 403 → `JiraAuthError`; 404 → `JiraNotFoundError`; network /
+     *    non-2xx → `JiraConfigError`.
+     *  - No thrown message ever contains the credential — only the host.
+     *
+     * Returns the raw `Response` on a 2xx; the caller parses the body.
+     */
+    async send(path, method, jsonBody) {
+        const url = `${this.baseUrl}${path}`;
+        const headers = {
+            Authorization: this.authHeader,
+            Accept: 'application/json',
+        };
+        if (jsonBody !== undefined) {
+            headers['Content-Type'] = 'application/json';
+        }
+        let res;
+        try {
+            res = await fetch(url, {
+                method,
+                redirect: 'manual',
+                headers,
+                ...(jsonBody !== undefined ? { body: jsonBody } : {}),
+            });
+        }
+        catch (err) {
+            // Network / DNS — the message is fetch's own (no credential in it),
+            // but we prepend the host, never the header.
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new types_1.JiraConfigError(`Could not reach JIRA at ${this.host}: ${msg}`);
+        }
+        // Refuse any redirect — do not follow it to another host.
+        if (res.type === 'opaqueredirect' ||
+            (res.status >= 300 && res.status < 400)) {
+            throw new types_1.JiraConfigError(`JIRA at ${this.host} returned an unexpected redirect; refusing to ` +
+                `follow it to another host.`);
+        }
+        if (res.status === 401 || res.status === 403) {
+            throw new types_1.JiraAuthError(`JIRA rejected the credentials (HTTP ${res.status}). ` +
+                `Check the email/token or PAT.`);
+        }
+        // A missing issue — or one the token can't see — is a distinct, expected
+        // signal (REQ-JIRA-003 A2). Must precede the generic !res.ok branch below,
+        // and stays credential-free like every other message here.
+        if (res.status === 404) {
+            throw new types_1.JiraNotFoundError(`JIRA at ${this.host} has no such issue, or you don't have access ` +
+                `to it (HTTP 404).`);
+        }
+        if (!res.ok) {
+            throw new types_1.JiraConfigError(`JIRA at ${this.host} returned HTTP ${res.status}.`);
+        }
+        return res;
+    }
+}
+exports.JiraClient = JiraClient;
+//# sourceMappingURL=client.js.map

package/lib/dist/jira/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/jira/client.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,iCAAyC;AACzC,mCAWiB;AAEjB,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAa,UAAU;IACJ,OAAO,CAAS;IAChB,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,UAAU,CAAgC;IAE3D,YAAY,KAAsB;QAChC,6DAA6D;QAC7D,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAe,CACvB,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAA,sBAAe,EAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,qEAAqE;YACrE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,IAAI;YACrD,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,IAAI;SAC7C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,YAAY,CAAC,IAA2B;QAC5C,IAAI,GAAG,GAAG,0BAA0B,CAAC;QACrC,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChF,GAAG,GAAG,cAAc,OAAO,SAAS,GAAG,EAAE,CAAC;QAC5C,CAAC;QACD,GAAG,IAAI,wBAAwB,CAAC;QAEhC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,GAAG;YACH,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE3E,MAAM,SAAS,GAAU,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,MAAM,GAAgB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClD,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;YAC7B,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;YAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;SACxD,CAAC,CAAC,CAAC;QAEJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,uBAAe,CAAC,8CAA8C,CAAC,CAAC;QAC5E,CAAC;QAED,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,MAAM,EAAE,+CAA+C;SACxD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CACxE,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;QAClC,2EAA2E;QAC3E,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,WAAW,GACf,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,WAAW,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvD,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;SAC/C,CAAC,CAAC,CAAC;QAEJ,MAAM,KAAK,GAAc;YACvB,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC;YACjC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACrC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;YAC/C,WAAW;YACX,QAAQ;SACT,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,uBAAe,CAAC,8CAA8C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAC/D,CAAC;QACF,MAAM,GAAG,GAAU,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CACnB,GAAW,EACX,QAAgB;QAEhB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,uBAAe,CAAC,8CAA8C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,QAAQ;gBACjB,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACxD,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;YAC9D,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,OAAO,MAAM,qDAAqD,KAAK,GAAG;aACnF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CACd,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,cAAc,EAC9D,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CACjC,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,SAAiB;QAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,uBAAe,CAAC,8CAA8C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GACR,IAAI,CAAC,UAAU,KAAK,YAAY;YAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;YACrB,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,KAAK,CACd,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAC3D,IAAI,EACJ,KAAK,CACN,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,IAAY;QACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,uBAAe,CAAC,8CAA8C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CACd,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAC1D,EAAE,IAAI,EAAE,CACT,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CAAC,IAAY;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAe,CACvB,WAAW,IAAI,CAAC,IAAI,gCAAgC,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,KAAK,CACjB,IAAY,EACZ,IAAa,EACb,SAAyB,MAAM;QAE/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACtE,uEAAuE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,MAA8B,EAC9B,QAAiB;QAEjB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QAErC,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,IAAI,CAAC,UAAU;YAC9B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM;gBACN,QAAQ,EAAE,QAAQ;gBAClB,OAAO;gBACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,uBAAe,CACvB,2BAA2B,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,IACE,GAAG,CAAC,IAAI,KAAK,gBAAgB;YAC7B,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EACvC,CAAC;YACD,MAAM,IAAI,uBAAe,CACvB,WAAW,IAAI,CAAC,IAAI,gDAAgD;gBAClE,4BAA4B,CAC/B,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,qBAAa,CACrB,uCAAuC,GAAG,CAAC,MAAM,KAAK;gBACpD,+BAA+B,CAClC,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAiB,CACzB,WAAW,IAAI,CAAC,IAAI,+CAA+C;gBACjE,mBAAmB,CACtB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAe,CACvB,WAAW,IAAI,CAAC,IAAI,kBAAkB,GAAG,CAAC,MAAM,GAAG,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AArWD,gCAqWC"}

package/lib/dist/jira/config.d.ts

@@ -0,0 +1,45 @@
+/**
+ * JIRA config load / resolve / save (REQ-JIRA-001, A2).
+ *
+ * Config lives at `~/.specship/jira.json` — **user-level only, never in
+ * the project tree** (not even a gitignored project file), because it
+ * holds a secret. The path is overridable via `SPECSHIP_JIRA_CONFIG`
+ * (mirrors `SPECSHIP_SERVER_CONFIG`) so tests never touch the real home.
+ */
+import { JiraConfig, JiraCredentials, JiraDeployment } from './types';
+/**
+ * Absolute path to the user-level JIRA config. Overridable via
+ * `SPECSHIP_JIRA_CONFIG` for tests. Never project-scoped.
+ */
+export declare function jiraConfigPath(): string;
+/**
+ * Read `~/.specship/jira.json`. Returns `null` when the file is absent.
+ * Throws `JiraConfigError` when it exists but is malformed — a corrupt
+ * secret file is a hard error, not a silent fall-through to `{}`.
+ */
+export declare function loadJiraConfig(): JiraConfig | null;
+/**
+ * Infer the deployment kind from which credentials are present. An
+ * explicit `deployment` field always wins. Otherwise: a PAT (with no
+ * email+token pair) ⇒ Data Center; an email+token pair ⇒ Cloud.
+ */
+export declare function inferDeployment(creds: {
+    deployment?: JiraDeployment;
+    email?: string;
+    apiToken?: string;
+    pat?: string;
+}): JiraDeployment;
+/**
+ * Resolve effective credentials from environment (highest precedence,
+ * per-field) then the on-disk config. Throws `JiraConfigError` with an
+ * actionable message when required fields are missing or malformed.
+ *
+ * SECURITY: the thrown messages never include a token or PAT value.
+ */
+export declare function resolveJiraCredentials(): JiraCredentials;
+/**
+ * Persist config to `~/.specship/jira.json` with `0600` permissions —
+ * it holds a secret, so it must not be group/world readable.
+ */
+export declare function saveJiraConfig(config: JiraConfig): void;
+//# sourceMappingURL=config.d.ts.map

package/lib/dist/jira/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/jira/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EACL,UAAU,EACV,eAAe,EAEf,cAAc,EACf,MAAM,SAAS,CAAC;AAEjB;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAKvC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAsBlD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,cAAc,CAWjB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,eAAe,CAyDxD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAQvD"}