@wardby/cli 0.2.1 → 0.4.0

package/dist/providers/executor/dbos.d.ts

@@ -13,12 +13,11 @@
  * `recover()` (Task 6) before declaring a DBOS run lost.
  */
 import type { PrismaClient } from "#prisma";
-import type { ProviderRegistry } from "../index.js";
 import type { DbosConfig } from "../../config/providers.js";
-import { type RunnerDb } from "../../core/runner.js";
+import { type NativeRunProviders, type RunnerDb } from "../../core/runner.js";
 import type { Executor, ExecutionRecoveryResult, PersistedExecutionHandle } from "./types.js";
 export declare const DBOS_BACKEND = "dbos";
-type Providers = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "memory">;
+type Providers = NativeRunProviders;
 type Db = RunnerDb & Pick<PrismaClient, "run">;
 export declare class DbosExecutor implements Executor {
     private readonly providers;
@@ -39,6 +38,8 @@ export declare class DbosExecutor implements Executor {
     get executorId(): string;
     launch(): Promise<void>;
     close(): Promise<void>;
+    /** Where a run this executor marks failed files its self-defect (no-op without a configured issue tracker). */
+    private get selfDefects();
     start(runId: string): Promise<void>;
     stop(runId: string, reason?: string): Promise<void>;
     /**

package/dist/providers/executor/dbos.js

@@ -133,6 +133,10 @@ export class DbosExecutor {
             setActiveExecutor(undefined);
         await DBOS.shutdown({ workflowCompletionTimeoutMS: 5_000 });
     }
+    /** Where a run this executor marks failed files its self-defect (no-op without a configured issue tracker). */
+    get selfDefects() {
+        return { db: this.db, issueTrackers: this.providers.issueTrackers };
+    }
     async start(runId) {
         if (!this.launched)
             await this.launch();
@@ -165,7 +169,7 @@ export class DbosExecutor {
             // the same failure — dispatchRun's own `.catch` around `start()` calls
             // it too — which is harmless precisely because it is conditional and
             // idempotent: the second call matches zero rows.
-            await markRunFailedFromExecutorError(this.db, runId, err);
+            await markRunFailedFromExecutorError(this.db, runId, err, this.selfDefects);
             throw err;
         }
     }
@@ -241,10 +245,8 @@ export class DbosExecutor {
                 return { state: "terminal" };
             case "mark-failed":
                 this.resumeAttempts.delete(handle.runId);
-                await this.db.run.updateMany({
-                    where: { id: handle.runId, status: { in: ["pending", "running"] } },
-                    data: { status: "failed", error: decision.error, finishedAt: new Date() },
-                });
+                // Conditional (only a pending/running row), so a self-defect is filed only when this made the run failed.
+                await markRunFailedFromExecutorError(this.db, handle.runId, decision.error, this.selfDefects);
                 return { state: "terminal" };
             case "lost":
                 this.resumeAttempts.delete(handle.runId);

package/dist/providers/executor/in-process.d.ts

@@ -5,14 +5,13 @@
  * heartbeat and recovers the run to `lost` rather than leaving it stuck
  * `running` forever.
  */
-import type { ProviderRegistry } from "../index.js";
-import { type RunnerDb } from "../../core/runner.js";
+import { type NativeRunProviders, type RunnerDb } from "../../core/runner.js";
 import type { Executor } from "./types.js";
 export declare class InProcessExecutor implements Executor {
     private readonly providers;
     private readonly db;
     private readonly heartbeatIntervalMs;
-    constructor(providers: Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "memory">, db?: RunnerDb, heartbeatIntervalMs?: number);
+    constructor(providers: NativeRunProviders, db?: RunnerDb, heartbeatIntervalMs?: number);
     start(runId: string): Promise<void>;
     stop(_runId: string, _reason?: string): Promise<void>;
 }

package/dist/providers/executor/routing.d.ts

@@ -1,4 +1,5 @@
 import type { CodingImageSelector, Executor, ExecutionRecoveryResult, PersistedExecutionHandle } from "./types.js";
+import type { CodingProvider } from "../../coding/provider.js";
 export interface ExecutionKindResolver {
     kindForRun(runId: string): Promise<"native" | "coding" | null>;
 }
@@ -21,6 +22,18 @@ export declare class RoutingExecutor implements Executor {
     launch(): Promise<void>;
     close(): Promise<void>;
     resolveCodingWorkerImage(selector: CodingImageSelector): string;
+    resolveCodingToolImage(selector: CodingImageSelector): string | null;
+    readCodingServiceDeclaration(input: {
+        repository: string;
+        baseRef: string;
+    }): Promise<string | null>;
+    readCodingRepositoryFile(input: {
+        repository: string;
+        baseRef: string;
+        path: string;
+        maxBytes: number;
+    }): Promise<string | null>;
+    supportsCodingServices(provider: CodingProvider): boolean;
 }
 export declare class PrismaExecutionKindResolver implements ExecutionKindResolver {
     private readonly db;

package/dist/providers/executor/routing.js

@@ -54,6 +54,24 @@ export class RoutingExecutor {
             throw new Error("coding_execution_not_configured");
         return this.coding.resolveCodingWorkerImage(selector);
     }
+    resolveCodingToolImage(selector) {
+        if (!this.coding.resolveCodingToolImage)
+            throw new Error("coding_execution_not_configured");
+        return this.coding.resolveCodingToolImage(selector);
+    }
+    async readCodingServiceDeclaration(input) {
+        if (!this.coding.readCodingServiceDeclaration)
+            return null;
+        return this.coding.readCodingServiceDeclaration(input);
+    }
+    async readCodingRepositoryFile(input) {
+        if (!this.coding.readCodingRepositoryFile)
+            return null;
+        return this.coding.readCodingRepositoryFile(input);
+    }
+    supportsCodingServices(provider) {
+        return this.coding.supportsCodingServices?.(provider) === true;
+    }
 }
 export class PrismaExecutionKindResolver {
     db;

package/dist/providers/executor/types.d.ts

@@ -51,5 +51,39 @@ export interface Executor {
      * the LLM pricing tables' unknown-model throw.
      */
     resolveCodingWorkerImage?(selector: CodingImageSelector): string;
+    /**
+     * Claude Code's tool-runner image (the container that runs its commands) for the agent's
+     * toolchain, resolved and persisted at dispatch alongside the worker image; null for Codex, whose
+     * one worker image carries the toolchain. Throws, like resolveCodingWorkerImage, on a toolchain
+     * with no image.
+     */
+    resolveCodingToolImage?(selector: CodingImageSelector): string | null;
+    /**
+     * Coding-run services (docs/coding-services.md): the raw text of the
+     * repository's .wardby/services.yaml at `baseRef`, or null when it has none.
+     * Called by dispatch before its transaction (it is a network call). An
+     * executor without it gives coding runs no services.
+     */
+    readCodingServiceDeclaration?(input: {
+        repository: string;
+        baseRef: string;
+    }): Promise<string | null>;
+    /**
+     * The raw text of one repository file at `baseRef`, or null when absent.
+     * Throws (github_file_too_large, github_file_not_a_file, github_file_not_utf8)
+     * when the file is oversized or not UTF-8 text. Called by dispatch before its transaction (network call).
+     * Used for the knowledge note (src/knowledge/note.ts).
+     */
+    readCodingRepositoryFile?(input: {
+        repository: string;
+        baseRef: string;
+        path: string;
+        maxBytes: number;
+    }): Promise<string | null>;
+    /**
+     * Whether this executor can start coding-run services for a run of `provider`: its job launcher
+     * says so (Kubernetes and Docker, for Codex and Claude Code).
+     */
+    supportsCodingServices?(provider: CodingProvider): boolean;
 }
 import type { CodingProvider } from "../../coding/provider.js";

package/dist/providers/issue-tracker/adf.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Atlassian Document Format helpers. Jira Cloud's v3 API takes and returns
+ * rich text as ADF; webhook payloads use the v2 shape (wiki-markup strings),
+ * so the readers (adfToText, adfMentionIds) accept both. Agents write a
+ * small Markdown subset (markdownToAdf); the control plane reads issue text
+ * as plain text (adfToText). Nothing here
+ * produces HTML or mention nodes: a model can never ping a person.
+ */
+export interface AdfNode {
+    type: string;
+    version?: number;
+    attrs?: Record<string, unknown>;
+    content?: AdfNode[];
+    text?: string;
+    marks?: Array<{
+        type: string;
+        attrs?: Record<string, unknown>;
+    }>;
+}
+/**
+ * Smart links (ADF inlineCard, what Jira's editor makes from a pasted issue link) for this site's
+ * issues: a bare `<siteUrl>/browse/KEY-1` URL, and a bare `KEY-1` whose project is in `projectKeys`
+ * (only those, so look-alikes such as UTF-8 or SHA-256 stay text).
+ */
+export interface SmartLinkOptions {
+    siteUrl: string;
+    projectKeys?: readonly string[];
+}
+export declare function markdownToAdf(markdown: string, smart?: SmartLinkOptions): AdfNode;
+export declare function adfToText(node: unknown, maxChars?: number): string;
+export declare function adfMentionIds(node: unknown): string[];

package/dist/providers/issue-tracker/adf.js

@@ -0,0 +1,181 @@
+// `_x_` is italic only when the underscores aren't inside a word, so
+// snake_case identifiers (WARDBY_JIRA_API_TOKEN, my_var_name) stay literal.
+// A bare https:// URL becomes a link too; it ends before whitespace or a
+// bracket and drops trailing sentence punctuation (`see https://x/y.`).
+const INLINE = /\*\*([^*]+)\*\*|`([^`]+)`|(?<![A-Za-z0-9_])_([^_\s][^_]*?)_(?![A-Za-z0-9_])|\[([^\]]+)\]\(([^)\s]+)\)|(https:\/\/[^\s<>()[\]"']*[^\s<>()[\]"'.,;:!?])/g;
+const ISSUE_KEY = /^[A-Z][A-Z0-9_]+-[1-9][0-9]*$/;
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function inline(text, smart) {
+    const out = [];
+    const site = smart?.siteUrl.replace(/\/+$/, "");
+    const card = (key) => ({ type: "inlineCard", attrs: { url: `${site}/browse/${key}` } });
+    const keys = (smart?.projectKeys ?? []).filter((k) => /^[A-Z][A-Z0-9_]+$/.test(k));
+    const keyRe = keys.length
+        ? new RegExp(`(?<![A-Za-z0-9_/.-])(?:${keys.map(escapeRe).join("|")})-[1-9][0-9]*(?![A-Za-z0-9_-])`, "g")
+        : null;
+    const plain = (t) => {
+        if (!t)
+            return;
+        if (!keyRe)
+            return void out.push({ type: "text", text: t });
+        let at = 0;
+        for (const k of t.matchAll(keyRe)) {
+            if (k.index > at)
+                out.push({ type: "text", text: t.slice(at, k.index) });
+            out.push(card(k[0]));
+            at = k.index + k[0].length;
+        }
+        if (at < t.length)
+            out.push({ type: "text", text: t.slice(at) });
+    };
+    const push = (t, marks) => {
+        if (!t)
+            return;
+        if (marks)
+            out.push({ type: "text", text: t, marks });
+        else
+            plain(t);
+    };
+    const siteIssueKey = (url) => {
+        if (!site || !url.startsWith(`${site}/browse/`))
+            return null;
+        const key = url.slice(site.length + "/browse/".length);
+        return ISSUE_KEY.test(key) ? key : null;
+    };
+    let last = 0;
+    for (const m of text.matchAll(INLINE)) {
+        push(text.slice(last, m.index));
+        if (m[1] !== undefined)
+            push(m[1], [{ type: "strong" }]);
+        else if (m[2] !== undefined)
+            push(m[2], [{ type: "code" }]);
+        else if (m[3] !== undefined)
+            push(m[3], [{ type: "em" }]);
+        else if (m[5]?.startsWith("https://"))
+            push(m[4], [{ type: "link", attrs: { href: m[5] } }]);
+        else if (m[6] !== undefined) {
+            const key = siteIssueKey(m[6]);
+            if (key)
+                out.push(card(key));
+            else
+                push(m[6], [{ type: "link", attrs: { href: m[6] } }]);
+        }
+        else
+            push(m[0]);
+        last = m.index + m[0].length;
+    }
+    push(text.slice(last));
+    return out;
+}
+export function markdownToAdf(markdown, smart) {
+    const paragraph = (text) => ({ type: "paragraph", content: inline(text, smart) });
+    const lines = markdown.replace(/\r\n/g, "\n").split("\n");
+    const content = [];
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line.trim() === "") {
+            i++;
+            continue;
+        }
+        const fence = /^```(\w*)\s*$/.exec(line);
+        if (fence) {
+            const body = [];
+            i++;
+            while (i < lines.length && !/^```\s*$/.test(lines[i]))
+                body.push(lines[i++]);
+            i++;
+            content.push({
+                type: "codeBlock",
+                ...(fence[1] ? { attrs: { language: fence[1] } } : {}),
+                content: body.length ? [{ type: "text", text: body.join("\n") }] : [],
+            });
+            continue;
+        }
+        const heading = /^(#{1,3})\s+(.*)$/.exec(line);
+        if (heading) {
+            content.push({ type: "heading", attrs: { level: heading[1].length }, content: inline(heading[2], smart) });
+            i++;
+            continue;
+        }
+        const listOf = (re, type) => {
+            const items = [];
+            while (i < lines.length && re.test(lines[i])) {
+                items.push({ type: "listItem", content: [paragraph(lines[i].replace(re, ""))] });
+                i++;
+            }
+            content.push({ type, content: items });
+        };
+        if (/^\s*[-*]\s+/.test(line)) {
+            listOf(/^\s*[-*]\s+/, "bulletList");
+            continue;
+        }
+        if (/^\s*\d+\.\s+/.test(line)) {
+            listOf(/^\s*\d+\.\s+/, "orderedList");
+            continue;
+        }
+        if (/^>\s?/.test(line)) {
+            const quoted = [];
+            while (i < lines.length && /^>\s?/.test(lines[i]))
+                quoted.push(lines[i++].replace(/^>\s?/, ""));
+            content.push({ type: "blockquote", content: [paragraph(quoted.join(" "))] });
+            continue;
+        }
+        const para = [];
+        while (i < lines.length && lines[i].trim() !== "" && !/^(```|#{1,3}\s|\s*[-*]\s|\s*\d+\.\s|>)/.test(lines[i])) {
+            para.push(lines[i++]);
+        }
+        content.push(paragraph(para.join(" ")));
+    }
+    return { type: "doc", version: 1, content };
+}
+const BLOCKS = new Set(["paragraph", "heading", "codeBlock", "blockquote", "listItem", "rule", "panel", "tableRow"]);
+/**
+ * Webhook payloads carry rich text in the REST v2 shape: a wiki-markup
+ * string, where a mention is `[~accountid:<accountId>]`.
+ */
+const WIKI_MENTION = /\[~accountid:([^\]\s]+)\]/gi;
+export function adfToText(node, maxChars = 20_000) {
+    if (typeof node === "string")
+        return cap(node.replace(WIKI_MENTION, "@user"), maxChars);
+    const parts = [];
+    const walk = (n) => {
+        if (!n || typeof n !== "object")
+            return;
+        const a = n;
+        if (a.type === "text" && typeof a.text === "string")
+            parts.push(a.text);
+        else if (a.type === "mention")
+            parts.push(typeof a.attrs?.text === "string" ? a.attrs.text : "@user");
+        else if (a.type === "hardBreak")
+            parts.push("\n");
+        for (const c of a.content ?? [])
+            walk(c);
+        if (BLOCKS.has(a.type))
+            parts.push("\n");
+    };
+    walk(node);
+    return cap(parts
+        .join("")
+        .replace(/\n{2,}/g, "\n")
+        .trim(), maxChars);
+}
+function cap(text, max) {
+    return text.length > max ? `${text.slice(0, max)}…` : text;
+}
+export function adfMentionIds(node) {
+    if (typeof node === "string")
+        return [...node.matchAll(WIKI_MENTION)].map((m) => m[1]);
+    const ids = [];
+    const walk = (n) => {
+        if (!n || typeof n !== "object")
+            return;
+        const a = n;
+        if (a.type === "mention" && typeof a.attrs?.id === "string")
+            ids.push(a.attrs.id);
+        for (const c of a.content ?? [])
+            walk(c);
+    };
+    walk(node);
+    return ids;
+}

package/dist/providers/issue-tracker/index.d.ts

@@ -0,0 +1,5 @@
+import type { IssueTrackerRegistry } from "./types.js";
+export * from "./types.js";
+export { JiraIssueTracker, agentFooter } from "./jira.js";
+/** One tracker per configured provider; empty when Jira isn't configured (the jira_* tools are then never offered). */
+export declare function buildIssueTrackers(env?: NodeJS.ProcessEnv): IssueTrackerRegistry;

package/dist/providers/issue-tracker/index.js

@@ -0,0 +1,12 @@
+import { loadJiraConfig } from "../../config/providers.js";
+import { JiraClient } from "./jira-client.js";
+import { JiraIssueTracker } from "./jira.js";
+export * from "./types.js";
+export { JiraIssueTracker, agentFooter } from "./jira.js";
+/** One tracker per configured provider; empty when Jira isn't configured (the jira_* tools are then never offered). */
+export function buildIssueTrackers(env = process.env) {
+    const jira = loadJiraConfig(env);
+    return jira
+        ? { jira: new JiraIssueTracker(new JiraClient(jira), jira.siteUrl, { epicLinkField: jira.epicLinkField }) }
+        : {};
+}

package/dist/providers/issue-tracker/jira-client.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Minimal Jira Cloud REST client. Holds the credential; callers pass paths.
+ * One retry on 429 honouring Retry-After (capped), per Atlassian's
+ * rate-limiting guidance. Response bodies are never logged.
+ */
+import type { JiraConfig } from "../../config/providers.js";
+export interface RequestOptions {
+    /** Accept an empty 2xx body as `undefined` (void writes). */
+    allowEmpty?: boolean;
+    /** Per-attempt timeout; default 30 s. */
+    timeoutMs?: number;
+    /** Retry once on 429 honouring Retry-After; default true. */
+    retryOn429?: boolean;
+}
+export declare class JiraClient {
+    private readonly cfg;
+    private readonly authorization;
+    private readonly fetchImpl;
+    private readonly sleep;
+    /**
+     * Always sent explicitly: undici's default `Accept-Language: *` makes Jira answer in the site's default
+     * language rather than the account's own, which breaks matching of status and link type names.
+     */
+    private language;
+    constructor(cfg: Pick<JiraConfig, "apiBaseUrl" | "auth">, opts?: {
+        fetch?: typeof fetch;
+        sleep?: (ms: number) => Promise<void>;
+    });
+    setLanguage(tag: string): void;
+    request<T>(method: "GET" | "POST" | "PUT", path: string, body?: unknown, opts?: RequestOptions): Promise<T>;
+    /**
+     * GET returning at most `maxBytes` of the raw body (attachment content). Sends `Range` (unless
+     * `range: false`) and caps client-side too, in case the server ignores it. Redirects are never followed with the credential:
+     * a 3xx is followed only to an https Atlassian host and without Authorization.
+     */
+    requestBytes(path: string, opts: {
+        maxBytes: number;
+        timeoutMs?: number;
+        range?: boolean;
+    }): Promise<Uint8Array>;
+}

package/dist/providers/issue-tracker/jira-client.js

@@ -0,0 +1,151 @@
+import { IssueTrackerError } from "./types.js";
+const MAX_RETRY_AFTER_MS = 10_000;
+const DEFAULT_TIMEOUT_MS = 30_000;
+export class JiraClient {
+    cfg;
+    authorization;
+    fetchImpl;
+    sleep;
+    /**
+     * Always sent explicitly: undici's default `Accept-Language: *` makes Jira answer in the site's default
+     * language rather than the account's own, which breaks matching of status and link type names.
+     */
+    language = "en-US";
+    constructor(cfg, opts = {}) {
+        this.cfg = cfg;
+        this.authorization = `Bearer ${cfg.auth.token}`;
+        this.fetchImpl = opts.fetch ?? fetch;
+        this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    }
+    setLanguage(tag) {
+        this.language = tag;
+    }
+    async request(method, path, body, opts = {}) {
+        for (let attempt = 0;; attempt++) {
+            let res;
+            try {
+                res = await this.fetchImpl(`${this.cfg.apiBaseUrl}${path}`, {
+                    method,
+                    headers: {
+                        authorization: this.authorization,
+                        accept: "application/json",
+                        "accept-language": this.language,
+                        ...(body !== undefined ? { "content-type": "application/json" } : {}),
+                    },
+                    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+                    signal: AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+                });
+            }
+            catch {
+                throw new IssueTrackerError("tracker_api_error", "Jira could not be reached.");
+            }
+            if (res.status === 429 && attempt === 0 && opts.retryOn429 !== false) {
+                const seconds = Number(res.headers.get("retry-after"));
+                await this.sleep(Math.min(Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : 2000, MAX_RETRY_AFTER_MS));
+                continue;
+            }
+            if (res.status === 204)
+                return undefined;
+            if (!res.ok)
+                throw statusError(res.status);
+            try {
+                // Void writes (issue links, property writes) may succeed with an empty body; JSON callers may not.
+                const text = await res.text();
+                if (text === "" && opts.allowEmpty)
+                    return undefined;
+                return JSON.parse(text);
+            }
+            catch {
+                throw new IssueTrackerError("tracker_invalid_response", "Jira returned a response that was not JSON.");
+            }
+        }
+    }
+    /**
+     * GET returning at most `maxBytes` of the raw body (attachment content). Sends `Range` (unless
+     * `range: false`) and caps client-side too, in case the server ignores it. Redirects are never followed with the credential:
+     * a 3xx is followed only to an https Atlassian host and without Authorization.
+     */
+    async requestBytes(path, opts) {
+        const headers = {
+            authorization: this.authorization,
+            accept: "*/*",
+            "accept-language": this.language,
+            ...(opts.range === false ? {} : { range: `bytes=0-${Math.max(opts.maxBytes, 1) - 1}` }),
+        };
+        let url = `${this.cfg.apiBaseUrl}${path}`;
+        let res;
+        let retried = false;
+        try {
+            for (let hops = 0; hops <= 3;) {
+                res = await this.fetchImpl(url, {
+                    method: "GET",
+                    headers,
+                    redirect: "manual",
+                    signal: AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+                });
+                if (res.status === 429 && !retried) {
+                    retried = true;
+                    const seconds = Number(res.headers.get("retry-after"));
+                    await this.sleep(Math.min(Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : 2000, MAX_RETRY_AFTER_MS));
+                    continue;
+                }
+                if (res.status < 300 || res.status >= 400)
+                    break;
+                hops++;
+                let next;
+                try {
+                    next = new URL(res.headers.get("location") ?? "", url);
+                }
+                catch {
+                    throw new IssueTrackerError("tracker_invalid_response", "Jira returned an unusable download redirect.");
+                }
+                if (next.protocol !== "https:" || !isAtlassianHost(next.hostname))
+                    throw new IssueTrackerError("tracker_invalid_response", "Jira redirected the download somewhere unexpected.");
+                url = next.toString();
+                // A pre-signed media URL: the Jira credential never goes to it.
+                delete headers.authorization;
+            }
+        }
+        catch (err) {
+            if (err instanceof IssueTrackerError)
+                throw err;
+            throw new IssueTrackerError("tracker_api_error", "Jira could not be reached.");
+        }
+        if (!res || (res.status >= 300 && res.status < 400))
+            throw new IssueTrackerError("tracker_api_error", "Jira's download redirected too many times.");
+        if (!res.ok)
+            throw statusError(res.status);
+        const chunks = [];
+        let total = 0;
+        try {
+            const reader = res.body?.getReader();
+            while (reader && total < opts.maxBytes) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                const piece = value.subarray(0, opts.maxBytes - total);
+                chunks.push(piece);
+                total += piece.length;
+            }
+            if (reader && total >= opts.maxBytes)
+                await reader.cancel().catch(() => undefined);
+        }
+        catch {
+            throw new IssueTrackerError("tracker_api_error", "Jira's download was interrupted.");
+        }
+        return Buffer.concat(chunks);
+    }
+}
+/** Hosts a download redirect may point at (Atlassian media). */
+const isAtlassianHost = (h) => /(^|\.)(atlassian\.com|atlassian\.net|atl-paas\.net)$/.test(h);
+function statusError(status) {
+    if (status === 404)
+        return new IssueTrackerError("tracker_not_found", "Not found in Jira (or not visible to wardby's Jira account).");
+    if (status === 401 || status === 403)
+        return new IssueTrackerError("tracker_permission_denied", "wardby's Jira account is not allowed to do that.");
+    if (status === 429)
+        return new IssueTrackerError("tracker_rate_limited", "Jira is rate-limiting wardby; try again shortly.");
+    if (status === 400)
+        return new IssueTrackerError("tracker_invalid_request", "Jira rejected the request as invalid.");
+    return new IssueTrackerError("tracker_api_error", `Jira returned HTTP ${status}.`);
+}

package/dist/providers/issue-tracker/jira-events.d.ts

@@ -0,0 +1,3 @@
+import { type IssueEvent } from "./types.js";
+export declare function verifyJiraSignature(rawBody: string, header: string | undefined, secret: string): boolean;
+export declare function normalizeJiraEvent(payload: unknown, botAccountId: string): IssueEvent | null;