@voltro/plugin-atlassian 0.1.0

package/dist/index.js

@@ -0,0 +1,377 @@
+import { a as e, i as t, n, o as r, r as i, t as a } from "./types-CVyqPJzY.js";
+import { Effect as o, Layer as s, Option as c } from "effect";
+import { SubjectService as l, definePlugin as u } from "@voltro/protocol";
+import { DEFAULT_POLICY as d, DEFAULT_POLICY as f, assertSameHost as p, request as m, requestJson as h } from "@voltro/integration-http";
+//#region src/auth.ts
+var g = "voltro", _ = (e, t = {}) => {
+	let n = {
+		authorization: `Bearer ${e.token}`,
+		"x-pat-application": e.patApplication,
+		"x-pat-environment": e.patEnvironment
+	};
+	return t.binary || (n.accept = "application/json"), t.json && (n["content-type"] = "application/json"), n;
+}, v = "/_voltro/atlassian/avatar", y = (e, t) => ({
+	status: e,
+	body: t,
+	contentType: "text/plain"
+}), b = { "cache-control": "public, max-age=31536000, immutable" }, x = (e) => e?.["48x48"] ?? e?.["32x32"] ?? e?.["24x24"] ?? e?.["16x16"] ?? (e ? Object.values(e)[0] : void 0), S = (e) => {
+	let t = /^data:([^;,]*)(;base64)?,([\s\S]*)$/.exec(e);
+	if (!t) return null;
+	let n = t[1] || "image/png";
+	return {
+		bytes: t[2] ? new Uint8Array(Buffer.from(t[3], "base64")) : new TextEncoder().encode(decodeURIComponent(t[3])),
+		contentType: n
+	};
+}, C = (e) => {
+	let t = e.pathPrefix ?? "/_voltro/atlassian/avatar";
+	return {
+		method: "GET",
+		path: t,
+		handle: async (n) => {
+			let r = decodeURIComponent(n.path.slice(t.length).replace(/^\//, ""));
+			if (!r) return y(400, "missing avatar ref");
+			let i = await e.resolveCredentials(), a = i.baseUrl.replace(/\/$/, ""), o = encodeURIComponent, s = [
+				`${a}/rest/api/2/user?accountId=${o(r)}`,
+				`${a}/rest/api/2/user?username=${o(r)}`,
+				`${a}/rest/api/2/user?key=${o(r)}`
+			], c;
+			try {
+				for (let t of s) {
+					if (!p(i.baseUrl, t)) continue;
+					let n = await e.fetchImpl(t, {
+						method: "GET",
+						headers: _(i)
+					});
+					if (!(n.status < 200 || n.status >= 300) && (c = x(JSON.parse(await n.text()).avatarUrls), c)) break;
+				}
+			} catch (e) {
+				return y(502, `avatar user lookup failed: ${String(e)}`);
+			}
+			if (!c) return y(404, "no avatar");
+			if (c.startsWith("data:")) {
+				let e = S(c);
+				return !e || !e.contentType.startsWith("image/") ? y(415, "not an image") : {
+					status: 200,
+					body: e.bytes,
+					contentType: e.contentType,
+					headers: b
+				};
+			}
+			let l = c.startsWith("http") ? c : `${a}${c.startsWith("/") ? "" : "/"}${c}`;
+			if (!p(i.baseUrl, l) && !l.startsWith("https://")) return y(400, "blocked off-host avatar request");
+			try {
+				let t = await e.fetchImpl(l, {
+					method: "GET",
+					headers: _(i, { binary: !0 })
+				});
+				if (t.status < 200 || t.status >= 300) return y(502, `upstream ${t.status}`);
+				let n = t.headers.get("content-type") ?? "";
+				return n.startsWith("image/") ? {
+					status: 200,
+					body: new Uint8Array(await t.arrayBuffer()),
+					contentType: n,
+					headers: b
+				} : y(415, "not an image");
+			} catch (e) {
+				return y(502, `avatar fetch failed: ${String(e)}`);
+			}
+		}
+	};
+}, w = (e) => new i({
+	message: e.message,
+	transient: e.transient,
+	...e.status === void 0 ? {} : { status: e.status },
+	...e.code === void 0 ? {} : { code: e.code }
+}), T = encodeURIComponent, E = (e) => {
+	let t = (t, n, r) => o.gen(function* () {
+		let a = yield* l, s = yield* e.credentialsResolver(a).pipe(o.mapError((e) => new i({
+			message: e.message,
+			transient: e.transient,
+			...e.status === void 0 ? {} : { status: e.status },
+			...e.code === void 0 ? {} : { code: e.code }
+		})));
+		return yield* h({
+			fetchImpl: e.fetchImpl,
+			baseUrl: s.baseUrl,
+			method: t,
+			path: n,
+			headers: _(s, { json: r !== void 0 }),
+			...r === void 0 ? {} : { body: JSON.stringify(r) },
+			policy: e.policy,
+			makeError: w,
+			...e.now ? { now: e.now } : {}
+		});
+	});
+	return {
+		getContent: (e, n) => {
+			let r = n?.expand?.length ? n.expand.join(",") : "body.view,version";
+			return t("GET", `/rest/api/content/${T(e)}?expand=${T(r)}`);
+		},
+		searchContent: (e, n) => {
+			let r = n?.expand?.length ? n.expand.join(",") : "version,space", i = n?.limit === void 0 ? "" : `&limit=${n.limit}`;
+			return t("GET", `/rest/api/content/search?cql=${T(e)}&expand=${T(r)}${i}`).pipe(o.map((e) => e.results ?? []));
+		},
+		getSpace: (e) => t("GET", `/rest/api/space/${T(e)}`),
+		createContent: (e) => t("POST", "/rest/api/content", e),
+		updateContent: (e, n, r) => t("PUT", `/rest/api/content/${T(e)}`, {
+			...n,
+			version: { number: r.version }
+		}),
+		getAttachments: (e) => t("GET", `/rest/api/content/${T(e)}/child/attachment`).pipe(o.map((e) => e.results ?? [])),
+		addComment: (e, n) => t("POST", "/rest/api/content", {
+			type: "comment",
+			container: {
+				id: e,
+				type: "page"
+			},
+			body: { storage: {
+				value: n,
+				representation: "storage"
+			} }
+		}),
+		downloadImage: (t) => o.gen(function* () {
+			let n = yield* l, r = yield* e.credentialsResolver(n).pipe(o.mapError((e) => new i({
+				message: e.message,
+				transient: e.transient,
+				...e.status === void 0 ? {} : { status: e.status },
+				...e.code === void 0 ? {} : { code: e.code }
+			}))), a = t.startsWith("http") ? `${new URL(t).pathname}${new URL(t).search}` : t, s = yield* m({
+				fetchImpl: e.fetchImpl,
+				baseUrl: r.baseUrl,
+				method: "GET",
+				path: a,
+				headers: _(r, { json: !1 }),
+				policy: e.policy,
+				makeError: w,
+				...e.now ? { now: e.now } : {}
+			});
+			return s.contentType !== null && !s.contentType.startsWith("image/") ? yield* o.fail(w({
+				message: `not an image: ${s.contentType}`,
+				transient: !1
+			})) : {
+				bytes: s.bytes,
+				contentType: s.contentType
+			};
+		})
+	};
+}, D = (e, t, n, r, i) => {
+	if (!e) return i;
+	let a = `atlassian:${t}:${n ?? "_"}:${r}`, s = e.ttlMs?.[t];
+	return o.gen(function* () {
+		let t = yield* e.store.get(a).pipe(o.orElseSucceed(() => c.none()));
+		if (c.isSome(t)) return t.value;
+		let n = yield* i;
+		return yield* e.store.set(a, n, s === void 0 ? void 0 : { ttlMs: s }).pipe(o.ignore), n;
+	});
+}, O = (t) => new e({
+	message: t.message,
+	transient: t.transient,
+	...t.status === void 0 ? {} : { status: t.status },
+	...t.code === void 0 ? {} : { code: t.code }
+}), k = encodeURIComponent, A = (e) => {
+	let t = (t, n, r) => o.gen(function* () {
+		let i = yield* l, a = yield* e.credentialsResolver(i);
+		return yield* h({
+			fetchImpl: e.fetchImpl,
+			baseUrl: a.baseUrl,
+			method: t,
+			path: n,
+			headers: _(a, { json: r !== void 0 }),
+			...r === void 0 ? {} : { body: JSON.stringify(r) },
+			policy: e.policy,
+			makeError: O,
+			...e.now ? { now: e.now } : {}
+		});
+	}), n = o.gen(function* () {
+		return (yield* l).tenantId ?? null;
+	}), r = (r, i, a) => o.gen(function* () {
+		let o = yield* n;
+		return yield* D(e.cache, r, o, i, t("GET", a));
+	});
+	return {
+		searchIssues: (e, n) => o.gen(function* () {
+			let r = n?.maxResults ?? 100, i = n?.fields, a = [], o = n?.startAt ?? 0;
+			for (;;) {
+				let n = yield* t("POST", "/rest/api/2/search", {
+					jql: e,
+					startAt: o,
+					maxResults: r,
+					...i ? { fields: i } : {}
+				}), s = n.issues ?? [];
+				a.push(...s);
+				let c = n.total ?? a.length;
+				if (o += s.length, s.length === 0 || a.length >= c) break;
+			}
+			return a;
+		}),
+		getGreenhopperBoard: (e, n) => o.gen(function* () {
+			let r = n?.quickFilterId === void 0 ? "" : `&activeQuickFilters=${k(String(n.quickFilterId))}`, i = yield* t("GET", `/rest/greenhopper/1.0/xboard/work/allData.json?rapidViewId=${k(String(e))}${r}`);
+			return {
+				issues: i.issuesData?.issues ?? [],
+				columns: i.columnsData?.columns ?? [],
+				swimlanes: i.swimlanesData?.swimlanes ?? [],
+				raw: i
+			};
+		}),
+		getBoardConfig: (e) => r("boardConfig", String(e), `/rest/greenhopper/1.0/rapidviewconfig/editmodel?rapidViewId=${k(String(e))}`),
+		getActiveSprint: (e) => t("GET", `/rest/agile/1.0/board/${k(String(e))}/sprint?state=active`).pipe(o.map((e) => {
+			let t = (e.values ?? [])[0];
+			return t ? {
+				id: t.id,
+				name: t.name
+			} : null;
+		}), o.catchAll(() => o.succeed(null))),
+		getSprintIssues: (e) => t("GET", `/rest/agile/1.0/sprint/${k(String(e))}/issue`).pipe(o.map((e) => e.issues ?? [])),
+		getSprintInfo: (e) => t("GET", `/rest/agile/1.0/sprint/${k(String(e))}`),
+		getIssue: (e, n) => {
+			let r = [];
+			n?.expand?.length && r.push(`expand=${k(n.expand.join(","))}`), n?.fields?.length && r.push(`fields=${k(n.fields.join(","))}`);
+			let i = r.length ? `?${r.join("&")}` : "";
+			return t("GET", `/rest/api/2/issue/${k(e)}${i}`);
+		},
+		getIssueChangelog: (e) => t("GET", `/rest/api/2/issue/${k(e)}?expand=changelog`),
+		getComments: (e) => t("GET", `/rest/api/2/issue/${k(e)}/comment`).pipe(o.map((e) => e.comments ?? [])),
+		addComment: (e, n) => t("POST", `/rest/api/2/issue/${k(e)}/comment`, { body: n }),
+		getLinkedIssues: (e) => t("GET", `/rest/api/2/issue/${k(e)}?fields=issuelinks`).pipe(o.map((e) => (e.fields?.issuelinks ?? []).map((e) => e.inwardIssue ?? e.outwardIssue).filter((e) => e !== void 0))),
+		getUser: (e) => {
+			let n = e.key === void 0 ? `/rest/api/2/user/search?username=${k(e.username ?? "")}` : `/rest/api/2/user?key=${k(e.key)}`;
+			return t("GET", n);
+		},
+		getMyself: () => t("GET", "/rest/api/2/myself"),
+		getIssueTransitions: (e) => t("GET", `/rest/api/2/issue/${k(e)}/transitions`).pipe(o.map((e) => e.transitions ?? [])),
+		transitionIssue: (e, n, r) => t("POST", `/rest/api/2/issue/${k(e)}/transitions`, {
+			transition: { id: n },
+			...r?.fields ? { fields: r.fields } : {}
+		}).pipe(o.asVoid),
+		createIssue: (e) => t("POST", "/rest/api/2/issue", e),
+		updateIssue: (e, n) => t("PUT", `/rest/api/2/issue/${k(e)}`, n).pipe(o.asVoid),
+		getProject: (e) => r("project", e, `/rest/api/2/project/${k(e)}`),
+		getFields: () => r("field", "all", "/rest/api/2/field").pipe(o.map((e) => Array.isArray(e) ? e : [])),
+		getStatuses: () => r("status", "all", "/rest/api/2/status").pipe(o.map((e) => Array.isArray(e) ? e : [])),
+		getFilters: () => t("GET", "/rest/api/2/filter").pipe(o.map((e) => Array.isArray(e) ? e : [])),
+		getAvatarUrl: (t) => o.gen(function* () {
+			let n = yield* l;
+			return `${(yield* e.credentialsResolver(n)).baseUrl.replace(/\/$/, "")}/secure/useravatar?ownerId=${k(t)}`;
+		}),
+		getBoard: (e) => t("GET", `/rest/agile/1.0/board/${k(String(e))}`),
+		getBoardQuickFilters: (e) => t("GET", `/rest/agile/1.0/board/${k(String(e))}/quickfilter`).pipe(o.map((e) => e.values ?? [])),
+		assignIssue: (e, n) => t("PUT", `/rest/api/2/issue/${k(e)}/assignee`, { name: n }).pipe(o.asVoid),
+		deleteIssue: (e, n) => t("DELETE", `/rest/api/2/issue/${k(e)}${n?.deleteSubtasks ? "?deleteSubtasks=true" : ""}`).pipe(o.asVoid),
+		getBaseUrl: () => o.gen(function* () {
+			let t = yield* l;
+			return (yield* e.credentialsResolver(t)).baseUrl.replace(/\/$/, "");
+		}),
+		getBoardFilterJql: (e) => o.gen(function* () {
+			let n = (yield* t("GET", `/rest/agile/1.0/board/${k(String(e))}/configuration`)).filter?.id;
+			if (n == null) return null;
+			let r = yield* t("GET", `/rest/api/2/filter/${k(String(n))}`);
+			return typeof r.jql == "string" && r.jql.length > 0 ? r.jql : null;
+		})
+	};
+}, j = "https://auth.atlassian.com/authorize", M = "https://auth.atlassian.com/oauth/token", N = (e, t) => `${e.authorizeUrl ?? "https://auth.atlassian.com/authorize"}?${new URLSearchParams({
+	audience: t.audience ?? "api.atlassian.com",
+	client_id: e.clientId,
+	scope: t.scopes.join(" "),
+	redirect_uri: e.redirectUri,
+	state: t.state,
+	response_type: "code",
+	...t.prompt ? { prompt: t.prompt } : {}
+}).toString()}`, P = (e, t, n, r) => o.tryPromise({
+	try: async () => {
+		let i = await e(t, {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				accept: "application/json"
+			},
+			body: new URLSearchParams(n).toString()
+		}), o = new TextDecoder().decode(new Uint8Array(await i.arrayBuffer()));
+		if (i.status < 200 || i.status >= 300) throw new a({
+			message: `token endpoint ${i.status}: ${o.slice(0, 500)}`,
+			transient: i.status >= 500,
+			status: i.status
+		});
+		let s;
+		try {
+			s = JSON.parse(o);
+		} catch {
+			throw new a({
+				message: "invalid JSON in token response",
+				transient: !1,
+				status: i.status
+			});
+		}
+		if (typeof s.access_token != "string" || s.access_token.length === 0) throw new a({
+			message: "token response missing access_token",
+			transient: !1,
+			status: i.status
+		});
+		let c = (Number.isFinite(s.expires_in) ? s.expires_in : 3600) * 1e3;
+		return {
+			accessToken: s.access_token,
+			...s.refresh_token ? { refreshToken: s.refresh_token } : {},
+			expiresAt: r() + c,
+			scopes: (s.scope ?? "").split(" ").filter(Boolean),
+			tokenType: s.token_type ?? "Bearer"
+		};
+	},
+	catch: (e) => e instanceof a ? e : new a({
+		message: `token endpoint network error: ${String(e)}`,
+		transient: !0
+	})
+}), F = (e, t) => P(e.fetchImpl, e.tokenUrl ?? "https://auth.atlassian.com/oauth/token", {
+	grant_type: "authorization_code",
+	client_id: e.clientId,
+	client_secret: e.clientSecret,
+	code: t,
+	redirect_uri: e.redirectUri
+}, e.now ?? Date.now), I = (e, t) => P(e.fetchImpl, e.tokenUrl ?? "https://auth.atlassian.com/oauth/token", {
+	grant_type: "refresh_token",
+	client_id: e.clientId,
+	client_secret: e.clientSecret,
+	refresh_token: t
+}, e.now ?? Date.now), L = 6e4, R = (e, t, n) => o.gen(function* () {
+	let r = (e.now ?? Date.now)(), i = e.skewMs ?? 6e4;
+	if (t.expiresAt - r >= i) return t;
+	if (t.refreshToken === void 0) return yield* o.fail(new a({
+		message: "access token expired and no refresh token on file — re-consent required",
+		transient: !1
+	}));
+	let s = yield* I(e, t.refreshToken), c = n(s);
+	return c !== void 0 && (yield* c), s;
+}), z = (e, t) => fetch(e, t), B = (e) => {
+	let n = e.fetchImpl ?? z, i = {
+		...f,
+		...e.policy
+	}, a = e.cache, c = A({
+		credentialsResolver: e.credentialsResolver,
+		fetchImpl: n,
+		policy: i,
+		...a ? { cache: a } : {}
+	}), l = E({
+		credentialsResolver: e.credentialsResolver,
+		fetchImpl: n,
+		policy: i
+	}), d = s.mergeAll(s.succeed(r, c), s.succeed(t, l)), p = e.avatar ? [C({
+		resolveCredentials: e.avatar.resolveCredentials,
+		fetchImpl: e.avatar.fetchImpl ?? n,
+		...e.avatar.pathPrefix ? { pathPrefix: e.avatar.pathPrefix } : {}
+	})] : [];
+	return u({
+		name: e.name ? `@voltro/plugin-atlassian#${e.name}` : "@voltro/plugin-atlassian",
+		description: "Jira + Confluence — JiraService/ConfluenceService over the Atlassian APIs with a pluggable per-subject PAT resolver, transient retry, timeouts, and a public avatar proxy.",
+		permissions: ["network:outbound:*"],
+		services: d,
+		httpRoutes: p,
+		onActivate: (e) => o.sync(() => {
+			e.logger.info("atlassian active", {
+				avatar: p.length > 0,
+				cache: a !== void 0,
+				maxAttempts: i.maxAttempts,
+				timeoutMs: i.timeoutMs
+			});
+		})
+	});
+};
+//#endregion
+export { j as ATLASSIAN_AUTHORIZE_URL, M as ATLASSIAN_TOKEN_URL, a as AtlassianOAuthError, n as AtlassianWebhookError, i as ConfluenceError, t as ConfluenceService, v as DEFAULT_AVATAR_PREFIX, g as DEFAULT_PAT_APPLICATION, d as DEFAULT_POLICY, L as DEFAULT_REFRESH_SKEW_MS, e as JiraError, r as JiraService, B as atlassianPlugin, N as buildAuthorizeUrl, F as exchangeCode, I as refreshTokens, R as withFreshToken };

package/dist/types-CVyqPJzY.js

@@ -0,0 +1,22 @@
+import { Context as e, Schema as t } from "effect";
+//#region src/types.ts
+var n = class extends t.TaggedError()("JiraError", {
+	message: t.String,
+	transient: t.Boolean,
+	status: t.optional(t.Number),
+	code: t.optional(t.Literal("session_expired"))
+}) {}, r = class extends t.TaggedError()("ConfluenceError", {
+	message: t.String,
+	transient: t.Boolean,
+	status: t.optional(t.Number),
+	code: t.optional(t.Literal("session_expired"))
+}) {}, i = class extends t.TaggedError()("AtlassianOAuthError", {
+	message: t.String,
+	transient: t.Boolean,
+	status: t.optional(t.Number)
+}) {}, a = class extends t.TaggedError()("AtlassianWebhookError", {
+	message: t.String,
+	reason: t.Literal("signature", "payload")
+}) {}, o = class extends e.Tag("@voltro/plugin-atlassian/JiraService")() {}, s = class extends e.Tag("@voltro/plugin-atlassian/ConfluenceService")() {};
+//#endregion
+export { n as a, s as i, a as n, o, r, i as t };

package/dist/webhook.d.ts

@@ -0,0 +1,86 @@
+/** The header Atlassian writes the body HMAC to. */
+export declare const ATLASSIAN_SIGNATURE_HEADER = "X-Hub-Signature";
+
+/** HMAC-SHA-256 signature scheme over the raw body, `X-Hub-Signature: sha256=<hex>`.
+ *  Structurally a `@voltro/plugin-webhooks` `HmacSignatureScheme`. */
+export declare interface AtlassianSignatureScheme {
+    readonly _tag: 'hmac';
+    readonly algorithm: 'hmacSha256';
+    readonly header: string;
+    readonly includeTimestamp: false;
+    readonly encoding: 'hex';
+    readonly versionPrefix: 'sha256=';
+}
+
+export declare const atlassianSignatureScheme: (header?: string) => AtlassianSignatureScheme;
+
+/** The minimal shape of an Atlassian webhook envelope the plugin surfaces.
+ *  Everything beyond `webhookEvent` is kept loose — the app narrows per event
+ *  (Atlassian's payloads are large and event-specific). */
+export declare interface AtlassianWebhookEnvelope {
+    readonly webhookEvent: string;
+    readonly timestamp?: number;
+    readonly issue?: unknown;
+    readonly comment?: unknown;
+    readonly page?: unknown;
+    readonly user?: unknown;
+    /** The full decoded body, for fields not surfaced above. */
+    readonly raw: Record<string, unknown>;
+}
+
+/** A webhook-provider preset for inbound Jira/Confluence webhooks — a drop-in
+ *  `@voltro/plugin-webhooks` `WebhookProviderDescriptor` (matched by shape).
+ *
+ *   export default defineIncomingWebhook({
+ *     id: 'jira-events',
+ *     provider: atlassianWebhookProvider(),
+ *     payload: Schema.Any,
+ *     handler: async (ctx) => {
+ *       // signature already verified by the framework; switch on ctx.body.webhookEvent
+ *     },
+ *   })
+ *
+ *  The idempotency key defaults to the `X-Atlassian-Webhook-Identifier` header
+ *  (present on Cloud) and falls back to a body-derived `<event>:<timestamp>`. */
+export declare const atlassianWebhookProvider: (options?: {
+    readonly signatureHeader?: string;
+}) => {
+    _tag: "webhookProvider";
+    id: string;
+    name: string;
+    signature: AtlassianSignatureScheme;
+    idempotency: {
+        from: (headers: Readonly<Record<string, string>>, rawBody: Uint8Array) => string | undefined;
+        ttl: "1d";
+    };
+    bodyType: "json";
+    eventTypeFrom: (body: unknown) => string | undefined;
+};
+
+/** Atlassian's event-envelope discriminator lives in the body's
+ *  `webhookEvent` field (e.g. `jira:issue_updated`, `comment_created`,
+ *  `page_created`). */
+export declare const eventTypeFromBody: (body: unknown) => string | undefined;
+
+/**
+ * Parse the raw JSON body into a typed envelope. Throws
+ * {@link AtlassianWebhookError} (`reason: 'payload'`) on invalid JSON or a
+ * missing `webhookEvent` discriminator — the caller maps that to a 400.
+ */
+export declare const parseWebhookEnvelope: (rawBody: Uint8Array) => AtlassianWebhookEnvelope;
+
+/**
+ * Verify an inbound Atlassian webhook's HMAC signature over the raw body.
+ * Succeeds (returns `void`) on a valid signature; throws
+ * {@link AtlassianWebhookError} (`reason: 'signature'`) on a missing/invalid
+ * one — the caller maps that to a 401. Use this only on the raw-`PluginHttpRoute`
+ * path; the `*.webhook.tsx` provider path verifies automatically.
+ */
+export declare const verifyWebhookSignature: (args: {
+    readonly rawBody: Uint8Array;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly secret: string;
+    readonly signatureHeader?: string;
+}) => void;
+
+export { }

package/dist/webhook.js

@@ -0,0 +1,75 @@
+import { n as e } from "./types-CVyqPJzY.js";
+import { createHmac as t, timingSafeEqual as n } from "node:crypto";
+//#region src/webhook.ts
+var r = "X-Hub-Signature", i = (e = r) => ({
+	_tag: "hmac",
+	algorithm: "hmacSha256",
+	header: e,
+	includeTimestamp: !1,
+	encoding: "hex",
+	versionPrefix: "sha256="
+}), a = (e) => {
+	if (typeof e != "object" || !e) return;
+	let t = e.webhookEvent;
+	return typeof t == "string" ? t : void 0;
+}, o = (e, t) => {
+	let n = e["x-atlassian-webhook-identifier"];
+	if (n) return n;
+	try {
+		let e = JSON.parse(new TextDecoder().decode(t));
+		if (e.webhookEvent && e.timestamp !== void 0) return `${e.webhookEvent}:${e.timestamp}`;
+	} catch {
+		return;
+	}
+}, s = (e) => ({
+	_tag: "webhookProvider",
+	id: "atlassian",
+	name: "Atlassian (Jira / Confluence)",
+	signature: i(e?.signatureHeader),
+	idempotency: {
+		from: o,
+		ttl: "1d"
+	},
+	bodyType: "json",
+	eventTypeFrom: a
+}), c = (e, t) => {
+	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
+	return r.length === i.length ? n(r, i) : (n(r, Buffer.alloc(r.length)), !1);
+}, l = (n) => {
+	let r = (n.signatureHeader ?? "X-Hub-Signature").toLowerCase(), i = n.headers[r];
+	if (!i) throw new e({
+		message: "missing signature header",
+		reason: "signature"
+	});
+	let a = i.startsWith("sha256=") ? i.slice(7) : i;
+	if (!c(t("sha256", n.secret).update(Buffer.from(n.rawBody)).digest("hex"), a)) throw new e({
+		message: "signature mismatch",
+		reason: "signature"
+	});
+}, u = (t) => {
+	let n;
+	try {
+		n = JSON.parse(new TextDecoder().decode(t));
+	} catch {
+		throw new e({
+			message: "invalid JSON in webhook body",
+			reason: "payload"
+		});
+	}
+	let r = n.webhookEvent;
+	if (typeof r != "string" || r.length === 0) throw new e({
+		message: "webhook body missing `webhookEvent`",
+		reason: "payload"
+	});
+	return {
+		webhookEvent: r,
+		...typeof n.timestamp == "number" ? { timestamp: n.timestamp } : {},
+		..."issue" in n ? { issue: n.issue } : {},
+		..."comment" in n ? { comment: n.comment } : {},
+		..."page" in n ? { page: n.page } : {},
+		..."user" in n ? { user: n.user } : {},
+		raw: n
+	};
+};
+//#endregion
+export { r as ATLASSIAN_SIGNATURE_HEADER, i as atlassianSignatureScheme, s as atlassianWebhookProvider, a as eventTypeFromBody, u as parseWebhookEnvelope, l as verifyWebhookSignature };

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@voltro/plugin-atlassian",
+  "version": "0.1.0",
+  "description": "Jira + Confluence plugin — JiraService + ConfluenceService over the Atlassian REST/Greenhopper/Agile APIs, with a pluggable per-subject credentials resolver (PAT), transient retry + Retry-After, timeouts, an SSRF-guarded PAT-free avatar proxy, and optional response caching via @voltro/cache.",
+  "keywords": [
+    "voltro",
+    "typescript",
+    "framework"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://voltro.dev",
+  "bugs": {
+    "email": "support@voltro.dev"
+  },
+  "author": {
+    "name": "Voltro UG",
+    "url": "https://voltro.dev"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./webhook": {
+      "types": "./dist/webhook.d.ts",
+      "import": "./dist/webhook.js",
+      "default": "./dist/webhook.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "dependencies": {
+    "@voltro/integration-http": "0.1.0",
+    "@voltro/protocol": "0.1.0"
+  },
+  "peerDependencies": {
+    "effect": "^3.21.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}