dsh-atlassian-plugin 0.0.0-stage → 0.3.1

package/lib/index.js

@@ -0,0 +1,2836 @@
+// ../mcp-oauth/src/account.ts
+var DEFAULT_INSTANCE = "default";
+var INSTANCE_PATTERN = /^[a-z][a-z0-9-]*$/;
+var idFor = (instance) => instance === DEFAULT_INSTANCE ? "mcp" : `mcp-${instance}`;
+function credentialKeyFor(scope, instance = DEFAULT_INSTANCE) {
+  for (const segment of [scope, instance])
+    if (!INSTANCE_PATTERN.test(segment))
+      throw new TypeError(
+        `credential key segment "${segment}" must match ${String(INSTANCE_PATTERN)}`
+      );
+  return `${scope}/${idFor(instance)}`;
+}
+
+// ../mcp-oauth/src/config.ts
+var REQUEST_TIMEOUT_MS = 3e4;
+var PORT_ATTEMPTS = 20;
+var SIGN_IN_TIMEOUT_MS = 5 * 6e4;
+var REFRESH_MARGIN_MS = 6e4;
+
+// ../mcp-oauth/src/log.ts
+function loggerOf(ctx) {
+  const logger = ctx.logger;
+  if (typeof logger?.info === "function" && typeof logger.warn === "function") {
+    return {
+      info: (message, ...args) => logger.info?.(message, ...args),
+      warn: (message, ...args) => logger.warn?.(message, ...args)
+    };
+  }
+  return {
+    info: (message, ...args) => console.info(message, ...args),
+    warn: (message, ...args) => console.warn(message, ...args)
+  };
+}
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// ../mcp-oauth/src/net.ts
+var Network = class {
+  /** A JSON GET, or undefined when the document is absent or unreadable. */
+  getJSON = async (url) => {
+    try {
+      const response = await fetch(url, {
+        headers: { accept: "application/json" },
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      });
+      if (!response.ok) return void 0;
+      const body = await response.json();
+      return body !== null && typeof body === "object" ? body : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+  /** A JSON POST that must succeed; the response body is returned as JSON. */
+  postJSON = async (url, body, what) => {
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json"
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      });
+    } catch (error) {
+      throw new Error(`${what} failed: ${errorText(error)}`);
+    }
+    const text = await response.text();
+    if (!response.ok)
+      throw new Error(`${what} failed (${response.status}): ${text}`);
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object")
+      throw new Error(`${what} returned a non-object`);
+    return parsed;
+  };
+  /** A form POST to a token endpoint, with the same deadline discipline. */
+  postForm = async (url, fields, what, authorization) => {
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json",
+          ...authorization === void 0 ? {} : { authorization }
+        },
+        body: new URLSearchParams(fields),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      });
+    } catch (error) {
+      throw new Error(`${what} failed: ${errorText(error)}`);
+    }
+    const text = await response.text();
+    if (!response.ok)
+      throw new Error(`${what} failed (${response.status}): ${text}`);
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object")
+      throw new Error(`${what} returned a non-object`);
+    return parsed;
+  };
+};
+var network = new Network();
+
+// ../mcp-oauth/src/server.ts
+function chooseTokenAuthMethod(advertised) {
+  if (advertised === void 0 || advertised.includes("none")) return "none";
+  if (advertised.includes("client_secret_post")) return "client_secret_post";
+  if (advertised.includes("client_secret_basic")) return "client_secret_basic";
+  return "none";
+}
+function authMethodOf(client) {
+  if (client.tokenAuthMethod !== void 0) return client.tokenAuthMethod;
+  return client.clientSecret === void 0 ? "none" : "client_secret_post";
+}
+var OAuthServer = class {
+  /** Issuer identifier, used to detect a generation switch. */
+  issuer;
+  /** MCP resource URL the tokens are scoped to (RFC 8707 `resource`). */
+  resource;
+  authorizationEndpoint;
+  tokenEndpoint;
+  registrationEndpoint;
+  revocationEndpoint;
+  scopes;
+  /** The space-delimited `scope` parameter. */
+  scopeString;
+  /** Client authentication to ask for at registration. */
+  tokenAuthMethod;
+  constructor(params) {
+    this.issuer = params.issuer;
+    this.resource = params.resource;
+    this.authorizationEndpoint = params.authorizationEndpoint;
+    this.tokenEndpoint = params.tokenEndpoint;
+    this.registrationEndpoint = params.registrationEndpoint;
+    this.revocationEndpoint = params.revocationEndpoint;
+    this.scopes = params.scopes;
+    this.scopeString = params.scopeString;
+    this.tokenAuthMethod = params.tokenAuthMethod;
+  }
+  /** Register this installation as a client (RFC 7591). */
+  registerClient = async (redirectUri, clientName) => {
+    if (this.registrationEndpoint === void 0)
+      throw new Error(`${this.issuer} offers no dynamic client registration`);
+    const body = await network.postJSON(
+      this.registrationEndpoint,
+      {
+        client_name: clientName,
+        redirect_uris: [redirectUri],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: this.tokenAuthMethod,
+        scope: this.scopeString
+      },
+      "dynamic client registration"
+    );
+    const clientId = body.client_id;
+    if (typeof clientId !== "string" || clientId === "")
+      throw new Error("client registration returned no client_id");
+    const clientSecret = typeof body.client_secret === "string" ? body.client_secret : void 0;
+    const tokenAuthMethod = readTokenAuthMethod(body.token_endpoint_auth_method) ?? (clientSecret === void 0 ? "none" : this.tokenAuthMethod);
+    return clientSecret === void 0 ? { clientId, tokenAuthMethod } : { clientId, clientSecret, tokenAuthMethod };
+  };
+  /** Exchange an authorization code, or a refresh token, for tokens. */
+  tokenRequest = async (client, body) => {
+    const { clientId, clientSecret } = client;
+    const method = authMethodOf(client);
+    const fields = {
+      ...body,
+      resource: this.resource
+    };
+    if (method === "client_secret_basic") {
+      if (clientId === void 0 || clientSecret === void 0)
+        throw new Error("client_secret_basic needs a client id and secret");
+      return await network.postForm(
+        this.tokenEndpoint,
+        fields,
+        "token request",
+        basicAuth(clientId, clientSecret)
+      );
+    }
+    if (clientId !== void 0) fields.client_id = clientId;
+    if (method === "client_secret_post" && clientSecret !== void 0)
+      fields.client_secret = clientSecret;
+    return await network.postForm(this.tokenEndpoint, fields, "token request");
+  };
+  /**
+   * Map a token-endpoint response onto grant fields, keeping what the response
+   * omits. Servers that rotate refresh tokens send a new one, and a response
+   * that carries one replaces the stored value; one that does not leaves it
+   * alone.
+   */
+  toTokenFields = (payload, previous) => {
+    const expiresIn = Number(payload.expires_in);
+    return {
+      accessToken: typeof payload.access_token === "string" ? payload.access_token : previous.accessToken,
+      refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : previous.refreshToken,
+      tokenType: typeof payload.token_type === "string" ? payload.token_type : previous.tokenType,
+      scope: typeof payload.scope === "string" ? payload.scope : previous.scope,
+      expiresAt: Date.now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 3600) * 1e3
+    };
+  };
+};
+function basicAuth(clientId, clientSecret) {
+  const credentials = `${encodeURIComponent(clientId)}:${encodeURIComponent(clientSecret)}`;
+  return `Basic ${Buffer.from(credentials).toString("base64")}`;
+}
+function readTokenAuthMethod(value) {
+  return value === "none" || value === "client_secret_post" || value === "client_secret_basic" ? value : void 0;
+}
+
+// ../mcp-oauth/src/discovery.ts
+async function discover(profile) {
+  const endpoint = profile.endpoint;
+  let protectedResource;
+  let issuer = new URL(endpoint).origin;
+  for (const candidate of protectedResourceCandidates(endpoint)) {
+    const document = await network.getJSON(candidate);
+    const servers = stringList(document?.authorization_servers);
+    if (document !== void 0 && servers !== void 0) {
+      protectedResource = document;
+      issuer = servers[0] ?? issuer;
+      break;
+    }
+  }
+  let metadata;
+  for (const candidate of authorizationServerCandidates(issuer)) {
+    const document = await network.getJSON(candidate);
+    if (firstString(document?.token_endpoint) !== void 0) {
+      metadata = document;
+      break;
+    }
+  }
+  if (metadata === void 0)
+    throw new Error(`no OAuth metadata for ${endpoint} (issuer ${issuer})`);
+  const authorizationEndpoint = firstString(metadata.authorization_endpoint);
+  const tokenEndpoint = firstString(metadata.token_endpoint);
+  if (authorizationEndpoint === void 0 || tokenEndpoint === void 0)
+    throw new Error(`incomplete OAuth metadata for ${issuer}`);
+  const advertised = stringList(protectedResource?.scopes_supported) ?? stringList(metadata.scopes_supported);
+  const scopes = chooseScopes(profile, advertised);
+  const registrationEndpoint = firstString(metadata.registration_endpoint);
+  const revocationEndpoint = firstString(metadata.revocation_endpoint);
+  return new OAuthServer({
+    issuer: firstString(metadata.issuer) ?? issuer,
+    resource: endpoint,
+    authorizationEndpoint,
+    tokenEndpoint,
+    scopes,
+    scopeString: scopes.join(" "),
+    tokenAuthMethod: chooseTokenAuthMethod(
+      stringList(metadata.token_endpoint_auth_methods_supported)
+    ),
+    ...registrationEndpoint === void 0 ? {} : { registrationEndpoint },
+    ...revocationEndpoint === void 0 ? {} : { revocationEndpoint }
+  });
+}
+function protectedResourceCandidates(endpoint) {
+  const url = new URL(endpoint);
+  const path = url.pathname.replace(/\/+$/u, "");
+  return [
+    `${url.origin}/.well-known/oauth-protected-resource${path}`,
+    `${url.origin}/.well-known/oauth-protected-resource`
+  ];
+}
+function authorizationServerCandidates(issuer) {
+  const url = new URL(issuer);
+  const path = url.pathname.replace(/\/+$/u, "");
+  const bare = issuer.replace(/\/+$/u, "");
+  return [
+    `${url.origin}/.well-known/oauth-authorization-server${path}`,
+    `${bare}/.well-known/oauth-authorization-server`,
+    `${url.origin}/.well-known/openid-configuration${path}`,
+    `${bare}/.well-known/openid-configuration`
+  ];
+}
+function chooseScopes(profile, advertised) {
+  const wanted = profile.oauth.scopes;
+  if (advertised === void 0 || advertised.length === 0)
+    return [...profile.oauth.fallbackScopes];
+  const chosen = wanted.filter((scope) => advertised.includes(scope));
+  if (chosen.length > 0) return chosen;
+  return advertised.includes("offline_access") ? ["offline_access"] : [...profile.oauth.fallbackScopes];
+}
+function stringList(value) {
+  if (!Array.isArray(value)) return void 0;
+  const items = value.filter(
+    (item) => typeof item === "string"
+  );
+  return items.length > 0 ? items : void 0;
+}
+function firstString(value) {
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+
+// ../mcp-oauth/src/provider.ts
+function needsOAuth(profile) {
+  return profile.oauth !== void 0;
+}
+function credentialKeyOf(profile) {
+  return credentialKeyFor(profile.scope, profile.instance);
+}
+function accountLabel(profile) {
+  return profile.instance === DEFAULT_INSTANCE ? profile.scope : `${profile.scope}/${profile.instance}`;
+}
+
+// ../mcp-oauth/src/tool-name.ts
+var MAX_TOOL_NAME = 64;
+function toolPrefix(namespace) {
+  return `mcp__${namespace}__`;
+}
+function publicToolName(serverTool, namespace) {
+  const cleaned = serverTool.replace(/[^A-Za-z0-9_-]/gu, "_") || "tool";
+  const full = `${toolPrefix(namespace)}${cleaned}`;
+  if (full.length <= MAX_TOOL_NAME) return full;
+  const digest = digestOf(serverTool);
+  return `${full.slice(0, MAX_TOOL_NAME - digest.length - 1)}_${digest}`;
+}
+function digestOf(input) {
+  let hash = 0xcbf29ce484222325n;
+  const prime = 0x100000001b3n;
+  const mask = 0xffffffffffffffffn;
+  for (let index = 0; index < input.length; index += 1) {
+    hash = (hash ^ BigInt(input.charCodeAt(index))) * prime & mask;
+  }
+  return hash.toString(16).padStart(16, "0").slice(0, 12);
+}
+
+// ../mcp-oauth/src/bridge.ts
+var TOOL_CALL_TIMEOUT_MS = 6e4;
+var McpBridge = class {
+  constructor(options) {
+    this.options = options;
+    if (needsOAuth(options.profile) && options.store === void 0)
+      throw new TypeError(
+        `the ${accountLabel(options.profile)} bridge needs a grant store for its OAuth profile`
+      );
+  }
+  client;
+  oauth;
+  disposers = /* @__PURE__ */ new Map();
+  names = [];
+  ready = false;
+  failure;
+  /** Public names of the published tools, in discovery order. */
+  get toolNames() {
+    return this.names;
+  }
+  /** Whether the connection is currently usable. */
+  get isConnected() {
+    return this.ready;
+  }
+  /**
+   * Why the last connection attempt failed, when one did.
+   *
+   * A server that refuses the connection — a resource that needs an
+   * administrator's switch, a scope the token lacks — says so here, so a
+   * settings card can show the reason instead of an unexplained "not connected".
+   */
+  get lastFailure() {
+    return this.failure;
+  }
+  /**
+   * Connect and publish tools, once the account is signed in if it needs to be.
+   * @param ctx - host context, for logging.
+   * @returns whether the bridge is usable; failures are logged, never thrown.
+   */
+  async ensure(ctx) {
+    const { profile, store } = this.options;
+    if (needsOAuth(profile)) {
+      const grant = await store?.read();
+      if (grant === void 0 || !grant.isSignedIn()) return false;
+    }
+    try {
+      const oauth = needsOAuth(profile) ? await this.authorizationServer(profile) : void 0;
+      if (this.client === void 0) await this.connect(profile, store, oauth);
+      await this.publishTools(ctx);
+      await this.options.onConnected?.();
+      this.failure = void 0;
+      loggerOf(ctx).info(
+        "[%s] %d tools available from %s",
+        accountLabel(profile),
+        this.names.length,
+        profile.endpoint
+      );
+      return true;
+    } catch (error) {
+      this.ready = false;
+      await this.drop();
+      this.failure = errorText(error);
+      loggerOf(ctx).warn(
+        "[%s] MCP bridge unavailable: %s",
+        accountLabel(profile),
+        this.failure
+      );
+      return false;
+    }
+  }
+  /** Close the connection and withdraw every published tool. */
+  async drop() {
+    for (const dispose of this.disposers.values()) dispose();
+    this.disposers = /* @__PURE__ */ new Map();
+    this.names = [];
+    this.ready = false;
+    this.failure = void 0;
+    const client = this.client;
+    this.client = void 0;
+    if (client !== void 0) await client.close().catch(() => void 0);
+  }
+  /**
+   * Call one tool of the connected server by its own name.
+   * @param name - the server's tool name, without any published prefix.
+   * @param args - tool arguments.
+   * @throws when the connection is not open.
+   */
+  async callTool(name2, args) {
+    const client = this.client;
+    if (client === void 0)
+      throw new Error(
+        `the ${this.options.profile.label} MCP connection is not open`
+      );
+    return await client.callTool(
+      { name: name2, arguments: args },
+      { timeout: TOOL_CALL_TIMEOUT_MS }
+    );
+  }
+  /** The discovered authorization server, remembered across reconnects. */
+  async authorizationServer(profile) {
+    const oauth = this.oauth ?? await discover(profile);
+    this.oauth = oauth;
+    return oauth;
+  }
+  /** Open the MCP connection, authenticated when the profile has OAuth facts. */
+  async connect(profile, store, oauth) {
+    const { Client: McpClient, StreamableHTTPClientTransport } = await import("@modelcontextprotocol/client");
+    const transport = new StreamableHTTPClientTransport(
+      new URL(profile.endpoint),
+      oauth === void 0 || store === void 0 ? {} : {
+        authProvider: {
+          // Asked for before every request, so a refreshed token needs no reconnect.
+          token: async () => await store.accessToken(oauth),
+          onUnauthorized: async () => {
+            await store.refresh(oauth);
+          }
+        }
+      }
+    );
+    const client = new McpClient(this.options.clientInfo, { capabilities: {} });
+    await client.connect(transport);
+    this.client = client;
+    this.ready = true;
+  }
+  /** Publish every server tool, replacing the previous generation. */
+  async publishTools(ctx) {
+    const client = this.client;
+    if (client === void 0) throw new Error("the MCP connection is not open");
+    const { createMcpToolDefinition } = await import("@deepseek-ai/dsh-mcp-client");
+    const listed = await client.listTools(void 0, { cacheMode: "refresh" });
+    const disposers = /* @__PURE__ */ new Map();
+    const names = [];
+    for (const tool of listed.tools) {
+      const name2 = publicToolName(
+        tool.name,
+        this.options.profile.toolNamespace
+      );
+      const base = createMcpToolDefinition(ctx, {
+        name: name2,
+        rawName: tool.name,
+        description: tool.description ?? `MCP tool ${tool.name}`,
+        inputSchema: tool.inputSchema ?? {
+          type: "object",
+          properties: {}
+        },
+        ...tool.outputSchema === void 0 ? {} : { outputSchema: tool.outputSchema },
+        ...tool.execution?.taskSupport === "required" ? { taskRequired: true } : {},
+        call: async (args, execution) => await client.callTool(
+          { name: tool.name, arguments: args },
+          {
+            signal: execution.signal,
+            toolDefinition: tool,
+            timeout: TOOL_CALL_TIMEOUT_MS
+          }
+        )
+      });
+      disposers.set(
+        name2,
+        ctx.tools.register(this.options.decorate?.(base, tool) ?? base)
+      );
+      names.push(name2);
+    }
+    for (const dispose of this.disposers.values()) dispose();
+    this.disposers = disposers;
+    this.names = names;
+    return names;
+  }
+};
+
+// ../mcp-oauth/src/browser.ts
+import { execFile } from "node:child_process";
+function openBrowser(ctx, url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  execFile(command, args, (error) => {
+    if (error !== null)
+      loggerOf(ctx).warn(
+        "[mcp-oauth] could not open a browser: %s",
+        errorText(error)
+      );
+  });
+}
+
+// ../mcp-oauth/src/flow.ts
+import { createHash, randomBytes } from "node:crypto";
+
+// ../mcp-oauth/src/json.ts
+function jsonSafe(value) {
+  if (Array.isArray(value)) {
+    const items = [];
+    for (const item of value) {
+      const safe = jsonSafe(item);
+      if (safe !== void 0) items.push(safe);
+    }
+    return items;
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      const safe = jsonSafe(item);
+      if (safe !== void 0) out[key] = safe;
+    }
+    return out;
+  }
+  if (value === void 0 || typeof value === "function" || typeof value === "symbol")
+    return void 0;
+  if (typeof value === "number" && !Number.isFinite(value)) return void 0;
+  return value;
+}
+
+// ../mcp-oauth/src/grant.ts
+var Grant = class _Grant {
+  version;
+  /** Issuer the tokens came from, so a generation switch is detectable. */
+  issuer;
+  /** MCP resource the tokens are valid for (RFC 8707). */
+  resource;
+  /** Dynamically registered client identity. */
+  clientId;
+  /** Present only for a server that issues one, which a confidential client requires. */
+  clientSecret;
+  /** How this client authenticates at the token endpoint. */
+  tokenAuthMethod;
+  /** The exact redirect URI the client was registered with. */
+  redirectUri;
+  /** Application data the provider keeps with its tokens. */
+  extra;
+  accessToken;
+  refreshToken;
+  tokenType;
+  scope;
+  expiresAt;
+  constructor(params) {
+    this.version = params.version;
+    this.issuer = params.issuer;
+    this.resource = params.resource;
+    this.clientId = params.clientId;
+    this.clientSecret = params.clientSecret;
+    this.tokenAuthMethod = params.tokenAuthMethod;
+    this.redirectUri = params.redirectUri;
+    this.extra = params.extra;
+    this.accessToken = params.accessToken;
+    this.refreshToken = params.refreshToken;
+    this.tokenType = params.tokenType;
+    this.scope = params.scope;
+    this.expiresAt = params.expiresAt;
+  }
+  /**
+   * Rebuild a grant from a stored payload.
+   * @param payload - whatever the credential store returned.
+   * @returns the grant, or undefined for a payload that is not an object.
+   */
+  static from(payload) {
+    if (payload === null || typeof payload !== "object") return void 0;
+    return new _Grant(payload);
+  }
+  /** Whether a stored grant carries a usable access token. */
+  isSignedIn() {
+    return typeof this.accessToken === "string" && this.accessToken !== "";
+  }
+};
+var GrantStore = class {
+  /**
+   * @param ctx - host context carrying the credential store.
+   * @param key - the record key, in the store's `<scope>/<id>` grammar.
+   */
+  constructor(ctx, key) {
+    this.ctx = ctx;
+    this.credentialKey = key;
+  }
+  /** The record key, as the harness authorization seam spells it. */
+  credentialKey;
+  /** Read the stored grant, or undefined when there is none. */
+  async read() {
+    const record = await this.ctx.credentials.readRecord(this.credentialKey);
+    if (record === void 0 || record.kind !== "grant") return void 0;
+    return Grant.from(record.payload);
+  }
+  /**
+   * Read-decide-replace the grant under the store's cross-process lock.
+   * @param mutate - receives the current grant; returning undefined leaves it alone.
+   * @returns the stored grant after the change.
+   */
+  async mutate(mutate) {
+    const record = await this.ctx.credentials.modifyRecord(
+      this.credentialKey,
+      async (current) => {
+        const previous = current?.kind === "grant" ? Grant.from(current.payload) : void 0;
+        const next = await mutate(previous);
+        if (next === void 0) return void 0;
+        const payload = jsonSafe(next);
+        if (payload === void 0) return void 0;
+        return { kind: "grant", payload };
+      }
+    );
+    return record?.kind === "grant" ? Grant.from(record.payload) : void 0;
+  }
+  /** Merge provider facts into the record, creating it when absent. */
+  async remember(patch) {
+    await this.mutate(
+      async (grant) => new Grant({
+        ...grant ?? { version: 1 },
+        version: 1,
+        extra: { ...grant?.extra, ...patch }
+      })
+    );
+  }
+  /** Forget the record entirely; the issuer is not told, matching the seam. */
+  async clear() {
+    await this.ctx.credentials.deleteRecord(this.credentialKey);
+  }
+  /**
+   * The token an MCP transport asks for before every request, refreshed when
+   * it is about to expire.
+   * @param oauth - the authorization server the tokens belong to.
+   * @returns the access token, or undefined when nobody is signed in.
+   */
+  async accessToken(oauth) {
+    const grant = await this.read();
+    if (grant === void 0 || !grant.isSignedIn()) return void 0;
+    if (Date.now() < (grant.expiresAt ?? 0) - REFRESH_MARGIN_MS)
+      return grant.accessToken;
+    return await this.refresh(oauth);
+  }
+  /**
+   * Exchange the refresh token for a new access token, inside the store lock.
+   * A peer that refreshed while we waited makes this a no-op.
+   * @param oauth - the authorization server to refresh against.
+   * @throws when the record carries no refresh token, or nobody is signed in.
+   */
+  async refresh(oauth) {
+    const after = await this.mutate(async (grant) => {
+      if (grant === void 0) return void 0;
+      if (Date.now() < (grant.expiresAt ?? 0) - REFRESH_MARGIN_MS)
+        return void 0;
+      if (typeof grant.refreshToken !== "string" || grant.refreshToken === "")
+        throw new Error(
+          "the stored sign-in has no refresh token; sign in again"
+        );
+      const payload = await oauth.tokenRequest(grant, {
+        grant_type: "refresh_token",
+        refresh_token: grant.refreshToken
+      });
+      return new Grant({ ...grant, ...oauth.toTokenFields(payload, grant) });
+    });
+    if (after === void 0 || !after.isSignedIn())
+      throw new Error("not signed in");
+    return after.accessToken;
+  }
+};
+
+// ../mcp-oauth/src/loopback.ts
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+var LoopbackListener = class _LoopbackListener {
+  server;
+  port;
+  redirectUri;
+  /** Resolves with the authorization code the browser returned. */
+  code;
+  fail;
+  constructor(server, port, redirectUri, code, fail) {
+    this.server = server;
+    this.port = port;
+    this.redirectUri = redirectUri;
+    this.code = code;
+    this.fail = fail;
+  }
+  /**
+   * Bind the first free port at or after `preferredPort` and wait for the code.
+   * @param preferredPort - the configured port to try first.
+   * @param expectedState - the `state` value the response must carry back.
+   * @param label - the provider's name, for the pages the browser sees.
+   */
+  static async listenForCode(preferredPort, expectedState, label) {
+    let resolveCode = () => {
+    };
+    let rejectCode = () => {
+    };
+    const code = new Promise((resolve, reject) => {
+      resolveCode = resolve;
+      rejectCode = reject;
+    });
+    code.catch(() => void 0);
+    let lastError;
+    for (let offset = 0; offset < PORT_ATTEMPTS; offset += 1) {
+      const port = preferredPort + offset;
+      const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", `http://127.0.0.1:${port}`);
+        if (url.pathname !== "/callback") {
+          response.writeHead(404, { "content-type": "text/plain; charset=utf-8" }).end("not found");
+          return;
+        }
+        const gotState = url.searchParams.get("state") ?? "";
+        const oauthError = url.searchParams.get("error");
+        const returned = url.searchParams.get("code");
+        const comparable = Buffer.byteLength(gotState) === Buffer.byteLength(expectedState);
+        const stateMatches = comparable && timingSafeEqual(Buffer.from(gotState), Buffer.from(expectedState));
+        if (oauthError !== null || returned === null || !stateMatches) {
+          const reason = oauthError !== null ? `${label} reported: ${oauthError}` : "The response did not match this sign-in attempt.";
+          response.writeHead(400, { "content-type": "text/html; charset=utf-8" }).end(_LoopbackListener.callbackPage("Authorization failed", reason));
+          rejectCode(
+            new Error(
+              oauthError !== null ? `authorization denied: ${oauthError}` : "state mismatch"
+            )
+          );
+          return;
+        }
+        response.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(
+          _LoopbackListener.callbackPage(
+            `Signed in to ${label}`,
+            "You can close this tab and return to DeepSeek Harness."
+          )
+        );
+        resolveCode(returned);
+      });
+      try {
+        await new Promise((resolve, reject) => {
+          server.once("error", reject);
+          server.listen(port, "127.0.0.1", resolve);
+        });
+      } catch (error) {
+        lastError = error;
+        continue;
+      }
+      return new _LoopbackListener(
+        server,
+        port,
+        `http://127.0.0.1:${port}/callback`,
+        code,
+        rejectCode
+      );
+    }
+    throw new Error(
+      `no free loopback port in ${preferredPort}..${preferredPort + PORT_ATTEMPTS - 1}: ${errorText(lastError)}`
+    );
+  }
+  // `close()` alone only stops accepting: it waits for existing sockets,
+  // and a browser that used keep-alive would hold the flow open forever.
+  close = async () => {
+    this.server.closeAllConnections();
+    await new Promise((resolve) => {
+      this.server.close(() => resolve());
+    });
+  };
+  static callbackPage = (title, message) => {
+    return `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font:16px/1.5 system-ui;margin:4rem auto;max-width:32rem;text-align:center"><h1 style="font-size:1.25rem">${title}</h1><p>${message}</p></body>`;
+  };
+};
+
+// ../mcp-oauth/src/flow.ts
+var AuthorizationFlow = class {
+  /**
+   * @param profile - the provider account to sign in to.
+   * @param store - the record the finished grant is committed through.
+   */
+  constructor(profile, store) {
+    this.profile = profile;
+    this.store = store;
+  }
+  /**
+   * Run one sign-in attempt to completion.
+   * @param _ctx - host context; the flow itself only touches the store.
+   * @param session - the seam's session: signals cancellation, publishes notices, commits.
+   */
+  async run(_ctx, session) {
+    const endpoint = this.profile.endpoint;
+    const oauth = await discover(this.profile);
+    const verifier = b64url(randomBytes(32));
+    const expectedState = b64url(randomBytes(32));
+    const challenge = b64url(createHash("sha256").update(verifier).digest());
+    const listener = await LoopbackListener.listenForCode(
+      this.profile.oauth.redirectPort,
+      expectedState,
+      this.profile.label
+    );
+    const onAbort = () => listener.fail(new Error("sign-in cancelled"));
+    session.signal.addEventListener("abort", onAbort, { once: true });
+    let timer;
+    try {
+      const existing = await this.store.read();
+      const client = await this.clientFor(
+        oauth,
+        listener.redirectUri,
+        existing
+      );
+      const authorize = new URL(oauth.authorizationEndpoint);
+      for (const [key, value] of Object.entries({
+        response_type: "code",
+        client_id: client.clientId,
+        redirect_uri: listener.redirectUri,
+        scope: oauth.scopeString,
+        state: expectedState,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        resource: endpoint
+      })) {
+        authorize.searchParams.set(key, value);
+      }
+      session.notify({
+        message: `Approve the ${this.profile.label} sign-in in your browser.`,
+        url: authorize.href
+      });
+      const authorizationCode = await new Promise((resolve, reject) => {
+        timer = setTimeout(
+          () => reject(new Error("sign-in timed out")),
+          SIGN_IN_TIMEOUT_MS
+        );
+        listener.code.then(resolve, reject);
+      });
+      session.signal.throwIfAborted();
+      const payload = await oauth.tokenRequest(client, {
+        grant_type: "authorization_code",
+        code: authorizationCode,
+        redirect_uri: listener.redirectUri,
+        code_verifier: verifier
+      });
+      const base = {
+        ...existing ?? { version: 1 },
+        version: 1,
+        issuer: oauth.issuer,
+        resource: endpoint,
+        redirectUri: listener.redirectUri,
+        ...client,
+        scope: oauth.scopeString
+      };
+      const payloadPair = jsonSafe({
+        ...base,
+        ...oauth.toTokenFields(payload, base)
+      });
+      if (payloadPair === void 0)
+        throw new Error("the grant could not be represented as JSON");
+      await session.commit({ kind: "grant", payload: payloadPair });
+    } finally {
+      clearTimeout(timer);
+      session.signal.removeEventListener("abort", onAbort);
+      await listener.close();
+    }
+  }
+  /**
+   * The client to authorize with, registering one when the stored identity
+   * cannot be reused.
+   *
+   * A registration is bound to the exact redirect URIs it was issued for, and
+   * the loopback port is not guaranteed to be free, so a stored client is
+   * reused only when the resource and the URI both still match.
+   */
+  async clientFor(oauth, redirectUri, existing) {
+    if (existing !== void 0 && existing.resource === this.profile.endpoint && existing.redirectUri === redirectUri && typeof existing.clientId === "string") {
+      const tokenAuthMethod = authMethodOf(existing);
+      return existing.clientSecret === void 0 ? { clientId: existing.clientId, tokenAuthMethod } : {
+        clientId: existing.clientId,
+        clientSecret: existing.clientSecret,
+        tokenAuthMethod
+      };
+    }
+    const registered = await oauth.registerClient(
+      redirectUri,
+      this.profile.oauth.clientName
+    );
+    await this.store.mutate(
+      async (grant) => new Grant({
+        ...grant ?? { version: 1 },
+        version: 1,
+        issuer: oauth.issuer,
+        resource: this.profile.endpoint,
+        redirectUri,
+        ...registered
+      })
+    );
+    return registered;
+  }
+};
+function b64url(input) {
+  return input.toString("base64").replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+}
+
+// ../mcp-oauth/src/payload.ts
+function mcpText(value) {
+  if (value === null || typeof value !== "object") return [];
+  const content = value.content;
+  if (!Array.isArray(content)) return [];
+  const out = [];
+  for (const block of content) {
+    if (block === null || typeof block !== "object") continue;
+    const { type, text } = block;
+    if (type === "text" && typeof text === "string") out.push(text);
+  }
+  return out;
+}
+function mcpJson(value) {
+  const roots = [];
+  if (value !== null && typeof value === "object") {
+    const structured = value.structuredContent;
+    if (structured !== void 0) roots.push(structured);
+  }
+  for (const text of mcpText(value)) {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) continue;
+    try {
+      roots.push(JSON.parse(trimmed));
+    } catch {
+    }
+  }
+  return roots;
+}
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function pickString(source, ...names) {
+  const record = asRecord(source);
+  if (record === void 0) return void 0;
+  for (const name2 of names) {
+    const value = record[name2];
+    if (typeof value === "string" && value.trim() !== "") return value.trim();
+    if (typeof value === "number") return String(value);
+  }
+  return void 0;
+}
+function pickNumber(source, ...names) {
+  const record = asRecord(source);
+  if (record === void 0) return void 0;
+  for (const name2 of names) {
+    const value = record[name2];
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+    if (typeof value === "string" && value.trim() !== "") {
+      const parsed = Number(value);
+      if (Number.isFinite(parsed)) return parsed;
+    }
+  }
+  return void 0;
+}
+
+// ../integration-host/src/auth.ts
+var IntegrationAuth = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /** Start a sign-in attempt, or join the one already running. */
+  async signIn() {
+    const { ctx, state, spec } = this.deps;
+    if (state.running !== void 0) return state.running;
+    state.notice = void 0;
+    state.error = void 0;
+    const controller = new AbortController();
+    state.running = (async () => {
+      try {
+        const outcome = await ctx.authorization.begin({
+          key: this.deps.store.credentialKey,
+          signal: controller.signal,
+          interaction: {
+            // The flow publishes the authorize URL; opening it is the driver's
+            // business, because a generic UI driving the same flow would render
+            // the URL instead of launching a browser.
+            notify: (notice) => {
+              state.notice = notice;
+              if (typeof notice.url === "string") openBrowser(ctx, notice.url);
+            },
+            prompt: () => Promise.reject(
+              new Error(`${spec.label} sign-in needs no prompts`)
+            )
+          }
+        });
+        if (outcome.status === "authorized") {
+          state.notice = { message: `Signed in to ${spec.label}.` };
+          await this.connect();
+        } else {
+          state.error = "Sign-in was cancelled.";
+        }
+        return outcome;
+      } catch (error) {
+        state.error = errorText(error);
+        loggerOf(ctx).warn("%s sign-in failed: %s", spec.logTag, state.error);
+        return { status: "failed" };
+      } finally {
+        state.running = void 0;
+      }
+    })();
+    return state.running;
+  }
+  /** Forget the sign-in and withdraw every published tool. */
+  async signOut() {
+    const { ctx, state, store, bridge } = this.deps;
+    try {
+      ctx.authorization.cancel(store.credentialKey);
+    } catch {
+    }
+    await bridge.drop();
+    await store.clear();
+    state.notice = void 0;
+    state.error = void 0;
+    state.facts = void 0;
+  }
+  /**
+   * Connect, restoring the known account facts first so published tools have
+   * them.
+   * @returns whether the connection is usable.
+   */
+  async connect() {
+    const { state, store, bridge, ctx, spec } = this.deps;
+    state.facts = spec.facts.from(await store.read());
+    const ready = await bridge.ensure(ctx);
+    if (ready) {
+      state.error = void 0;
+      await this.learn();
+    } else {
+      state.error = bridge.lastFailure;
+    }
+    return ready;
+  }
+  /** Build the status document for one caller. */
+  async getStatus() {
+    const { state, config, bridge, store, spec } = this.deps;
+    const grant = await store.read();
+    const signedIn = grant?.isSignedIn() ?? false;
+    return spec.status(
+      {
+        signedIn,
+        inFlight: state.running !== void 0,
+        expiresAt: signedIn ? grant?.expiresAt ?? null : null,
+        scope: signedIn ? grant?.scope ?? null : null,
+        notice: state.notice ?? null,
+        error: state.error ?? null,
+        connected: bridge.isConnected,
+        tools: [...bridge.toolNames],
+        endpoint: config.endpoint
+      },
+      state.facts ?? spec.facts.from(grant)
+    );
+  }
+  /** The line the command and any notice show for a sign-in in progress. */
+  loginMessage(status) {
+    if (status.notice?.url !== void 0)
+      return `${status.notice.message} ${status.notice.url}`;
+    return status.notice?.message ?? `Opening your browser to sign in to ${this.deps.spec.label}\u2026`;
+  }
+  /** Wait briefly so a just-started attempt can publish its authorize URL. */
+  async settleNotice(ms = 400) {
+    await new Promise((resolve) => {
+      setTimeout(resolve, ms);
+    });
+  }
+  /** Learn the account facts once, and remember them for the next start. */
+  async learn() {
+    const { ctx, state, store, bridge, spec } = this.deps;
+    const known = state.facts;
+    if (known?.isComplete === true) return;
+    if (!bridge.toolNames.some((name2) => name2.endsWith(spec.facts.toolName)))
+      return;
+    try {
+      const learned = spec.facts.parse(
+        await bridge.callTool(spec.facts.toolName, {})
+      );
+      if (learned.isEmpty) return;
+      const merged = spec.facts.merge(known, learned);
+      state.facts = merged;
+      await store.remember(spec.facts.remember(merged));
+    } catch (error) {
+      loggerOf(ctx).warn(
+        "%s could not read the account facts: %s",
+        spec.logTag,
+        errorText(error)
+      );
+    }
+  }
+};
+
+// ../integration-host/src/command.ts
+var ACTIONS = ["status", "login", "logout", "sync"];
+var createIntegrationCommand = (spec, auth) => {
+  const parseAction = (rawInput) => {
+    const first = String(rawInput ?? "").trim().split(/\s+/u)[0] ?? "";
+    return ACTIONS.includes(first) ? first : "status";
+  };
+  return async ({ rawInput }) => {
+    const action = parseAction(rawInput);
+    try {
+      if (action === "login") {
+        void auth.signIn();
+        await auth.settleNotice();
+        return {
+          kind: "success",
+          text: auth.loginMessage(await auth.getStatus())
+        };
+      }
+      if (action === "logout") {
+        await auth.signOut();
+        return { kind: "success", text: `Signed out of ${spec.label}.` };
+      }
+      if (action === "sync") {
+        const ok = await auth.connect();
+        const status2 = await auth.getStatus();
+        return ok ? {
+          kind: "success",
+          text: `${spec.label} tools ready (${status2.tools.length}).`
+        } : {
+          kind: "error",
+          text: status2.error ?? `Not signed in to ${spec.label}. Run /${spec.name} login.`
+        };
+      }
+      const status = await auth.getStatus();
+      if (!status.signedIn)
+        return {
+          kind: "success",
+          text: `Not signed in to ${spec.label}. Run /${spec.name} login.`
+        };
+      const until = status.expiresAt === null ? "unknown" : new Date(status.expiresAt).toLocaleString();
+      const extra = spec.describe?.(status) ?? "";
+      const tail = extra === "" ? "" : ` ${extra}`;
+      return {
+        kind: "success",
+        text: `Signed in to ${spec.label}. Token valid until ${until}.${tail} ${status.tools.length} tools loaded.`
+      };
+    } catch (error) {
+      return { kind: "error", text: `${spec.label}: ${errorText(error)}` };
+    }
+  };
+};
+
+// ../integration-host/src/config.ts
+function resolveEndpointConfig(input, defaults) {
+  const endpoint = typeof input?.endpoint === "string" && input.endpoint !== "" ? input.endpoint : defaults.endpoint;
+  const port = Number(input?.redirectPort);
+  return {
+    endpoint,
+    redirectPort: Number.isInteger(port) && port > 0 && port < 65536 ? port : defaults.redirectPort,
+    debug: input?.debug === true
+  };
+}
+
+// ../integration-host/src/correlation.ts
+import { Service } from "@deepseek-ai/cordis";
+var CORRELATION_SOURCES = "correlationSources";
+
+// ../integration-host/src/digest.ts
+import { Service as Service2 } from "@deepseek-ai/cordis";
+var DIGEST_SOURCES = "digestSources";
+
+// ../integration-host/src/markdown.ts
+var FENCE = /^\s{0,3}(?:```|~~~)/u;
+var OPEN = "<!--";
+var CLOSE = "-->";
+var uncomment = (lines) => {
+  const kept = [];
+  let inFence = false;
+  let inComment = false;
+  for (const line of lines) {
+    if (!inComment && FENCE.test(line)) {
+      inFence = !inFence;
+      kept.push({ text: line, touched: false });
+      continue;
+    }
+    if (inFence) {
+      kept.push({ text: line, touched: false });
+      continue;
+    }
+    let rest = line;
+    let text = "";
+    let touched = false;
+    while (rest !== "") {
+      if (inComment) {
+        const end = rest.indexOf(CLOSE);
+        if (end === -1) {
+          rest = "";
+          break;
+        }
+        inComment = false;
+        rest = rest.slice(end + CLOSE.length);
+        continue;
+      }
+      const start = rest.indexOf(OPEN);
+      if (start === -1) {
+        text += rest;
+        rest = "";
+        break;
+      }
+      text += rest.slice(0, start);
+      touched = true;
+      inComment = true;
+      rest = rest.slice(start + OPEN.length);
+    }
+    kept.push({ text, touched });
+  }
+  return kept;
+};
+var stripHtmlComments = (markdown) => {
+  if (!markdown.includes(OPEN)) return markdown;
+  const kept = [];
+  let inFence = false;
+  let blank = false;
+  for (const line of uncomment(markdown.split("\n"))) {
+    if (FENCE.test(line.text)) {
+      inFence = !inFence;
+      blank = false;
+      kept.push(line.text);
+      continue;
+    }
+    if (inFence) {
+      kept.push(line.text);
+      continue;
+    }
+    if (line.text.trim() === "") {
+      if (kept.length === 0 || blank) continue;
+      blank = true;
+      kept.push(line.text);
+      continue;
+    }
+    blank = false;
+    kept.push(
+      line.touched ? line.text.replace(/[ \t]{2,}(?=\S)/gu, " ") : line.text
+    );
+  }
+  while (kept.length > 0 && kept[kept.length - 1]?.trim() === "") kept.pop();
+  return kept.join("\n");
+};
+
+// ../integration-host/src/route.ts
+var MAX_BODY_BYTES = 8 * 1024;
+function mountIntegrationRoute(ctx, spec) {
+  ctx.inject(["webServer"], (scoped) => {
+    const webServer = scoped.get(
+      "webServer"
+    );
+    scoped.effect(
+      () => webServer.register({
+        kind: "prefix",
+        path: spec.prefix,
+        handler: spec.handler
+      }),
+      `${spec.prefix}: route`
+    );
+  });
+}
+var BadRequest = class extends Error {
+};
+function bodyOf(value) {
+  return {
+    fields: value,
+    required: (name2) => {
+      const field = value?.[name2];
+      if (typeof field !== "string" || field === "")
+        throw new BadRequest(`the request needs a "${name2}"`);
+      return field;
+    }
+  };
+}
+async function readJson(request) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    const buffer = chunk;
+    size += buffer.length;
+    if (size > MAX_BODY_BYTES)
+      throw new Error("request body is larger than this route accepts");
+    chunks.push(buffer);
+  }
+  if (chunks.length === 0) return void 0;
+  try {
+    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function createIntegrationRoute(spec) {
+  const { prefix, auth } = spec;
+  return async (request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    const method = request.method ?? "GET";
+    const send = (status, body2) => {
+      response.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store"
+      });
+      response.end(JSON.stringify(body2));
+    };
+    const sendBytes = (status, contentType, body2) => {
+      response.writeHead(status, {
+        "content-type": contentType,
+        "content-length": body2.byteLength,
+        "cache-control": "no-store"
+      });
+      response.end(body2);
+    };
+    const sendData = async (load) => {
+      try {
+        send(200, await load());
+      } catch (error) {
+        send(502, { error: errorText(error) });
+      }
+    };
+    let body;
+    const context = {
+      url,
+      method,
+      read: () => body ??= readJson(request).then(bodyOf),
+      send,
+      sendBytes,
+      sendData
+    };
+    try {
+      if (url.pathname === `${prefix}/status` && method === "GET") {
+        send(200, await auth.getStatus());
+        return;
+      }
+      if (url.pathname === `${prefix}/login` && method === "POST") {
+        void auth.signIn();
+        await auth.settleNotice(300);
+        send(202, await auth.getStatus());
+        return;
+      }
+      if (url.pathname === `${prefix}/logout` && method === "POST") {
+        await auth.signOut();
+        send(200, await auth.getStatus());
+        return;
+      }
+      if (url.pathname === `${prefix}/sync` && method === "POST") {
+        await auth.connect();
+        send(200, await auth.getStatus());
+        return;
+      }
+      for (const handler of spec.routes ?? []) {
+        if (await handler(context)) return;
+      }
+      send(404, { error: "not-found", path: url.pathname });
+    } catch (error) {
+      send(error instanceof BadRequest ? 400 : 500, {
+        error: errorText(error)
+      });
+    }
+  };
+}
+
+// ../integration-host/src/state.ts
+var RuntimeState = class {
+  /** The last notice a running attempt published, so a card can show the URL. */
+  notice;
+  /** The last failure, cleared when a new attempt starts. */
+  error;
+  /** Settles when the in-flight attempt finishes. */
+  running;
+  /** The account facts this connection works with, once known. */
+  facts;
+  constructor() {
+    this.notice = void 0;
+    this.error = void 0;
+    this.running = void 0;
+    this.facts = void 0;
+  }
+};
+
+// src/host/store/site.ts
+var SITE_TOOL = "getAccessibleAtlassianResources";
+var SiteFacts = class _SiteFacts {
+  siteUrl;
+  cloudId;
+  constructor(params) {
+    this.siteUrl = params.siteUrl;
+    this.cloudId = params.cloudId;
+  }
+  /** What the stored grant already knows, if anything. */
+  static from(grant) {
+    const extra = grant?.extra;
+    return new _SiteFacts({
+      ...typeof extra?.siteUrl === "string" ? { siteUrl: extra.siteUrl } : {},
+      ...typeof extra?.cloudId === "string" ? { cloudId: extra.cloudId } : {}
+    });
+  }
+  /**
+   * Read the first site of an account's own list.
+   * @param value - the result of `getAccessibleAtlassianResources`.
+   * @returns the facts it names, or empty facts when it names none.
+   */
+  static parse(value) {
+    for (const text of mcpText(value)) {
+      const sites = parseJson(text);
+      const record = asRecord(Array.isArray(sites) ? sites[0] : void 0);
+      if (record === void 0) continue;
+      const url = pickString(record, "url");
+      const id = pickString(record, "id");
+      if (url === void 0 && id === void 0) continue;
+      return new _SiteFacts({
+        ...url === void 0 ? {} : { siteUrl: url.replace(/\/+$/u, "") },
+        ...id === void 0 ? {} : { cloudId: id }
+      });
+    }
+    return new _SiteFacts({});
+  }
+  /** Whether neither the site nor the cloud id is known. */
+  get isEmpty() {
+    return this.siteUrl === void 0 && this.cloudId === void 0;
+  }
+  /** Whether both the site and the cloud id are known, so nothing is left to learn. */
+  get isComplete() {
+    return this.siteUrl !== void 0 && this.cloudId !== void 0;
+  }
+};
+var siteFacts = {
+  toolName: SITE_TOOL,
+  from: (grant) => SiteFacts.from(grant),
+  parse: (value) => SiteFacts.parse(value),
+  merge: (known, learned) => new SiteFacts({
+    siteUrl: learned.siteUrl ?? known?.siteUrl,
+    cloudId: learned.cloudId ?? known?.cloudId
+  }),
+  remember: (facts) => ({
+    ...facts.siteUrl === void 0 ? {} : { siteUrl: facts.siteUrl },
+    ...facts.cloudId === void 0 ? {} : { cloudId: facts.cloudId }
+  })
+};
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+
+// src/host/auth.ts
+var atlassianAuthSpec = {
+  label: "Atlassian",
+  logTag: "[atlassian]",
+  facts: siteFacts,
+  status: (base, facts) => ({
+    ...base,
+    siteUrl: facts?.siteUrl ?? null
+  })
+};
+
+// src/host/config.ts
+var DEFAULT_ENDPOINT = "https://mcp.atlassian.com/v1/mcp";
+var DEFAULT_REDIRECT_PORT = 8143;
+var PLUGIN_NAME = "dsh-atlassian";
+var DESIRED_SCOPES = [
+  "offline_access",
+  "read:jira-work",
+  "write:jira-work",
+  "read:jira-user",
+  "read:page:confluence",
+  "write:page:confluence",
+  "search:confluence",
+  "read:space:confluence",
+  "read:jira:agent-interface",
+  "write:jira:agent-interface",
+  "search:jira:agent-interface",
+  "read:confluence:agent-interface",
+  "write:confluence:agent-interface",
+  "search:confluence:agent-interface"
+];
+var FALLBACK_SCOPES = [
+  "offline_access",
+  "read:jira-work",
+  "write:jira-work",
+  "read:jira-user",
+  "read:page:confluence",
+  "write:page:confluence",
+  "search:confluence",
+  "read:space:confluence"
+];
+var resolveConfig = (input) => {
+  return resolveEndpointConfig(input, {
+    endpoint: DEFAULT_ENDPOINT,
+    redirectPort: DEFAULT_REDIRECT_PORT
+  });
+};
+var atlassianProfile = (config) => {
+  return {
+    scope: PLUGIN_NAME,
+    label: "Atlassian",
+    instance: DEFAULT_INSTANCE,
+    endpoint: config.endpoint,
+    toolNamespace: "atlassian",
+    debug: config.debug,
+    oauth: {
+      redirectPort: config.redirectPort,
+      scopes: DESIRED_SCOPES,
+      fallbackScopes: FALLBACK_SCOPES,
+      clientName: "DeepSeek Harness"
+    }
+  };
+};
+
+// src/host/presentation/extract.ts
+var MINUTES_PER_DAY = 480;
+function formatDuration(seconds) {
+  if (!Number.isFinite(seconds) || seconds <= 0) return void 0;
+  const total = Math.round(seconds / 60);
+  if (total < 1) return "<1m";
+  const days = Math.floor(total / MINUTES_PER_DAY);
+  const hours = Math.floor((total - days * MINUTES_PER_DAY) / 60);
+  const minutes = total - days * MINUTES_PER_DAY - hours * 60;
+  const parts = [
+    days === 0 ? "" : `${days}d`,
+    hours === 0 ? "" : `${hours}h`,
+    minutes === 0 || days > 0 ? "" : `${minutes}m`
+  ];
+  return parts.filter(Boolean).join(" ");
+}
+var Extractor = class {
+  /** Jira issue keys: an uppercase project key, a dash, and a number. */
+  ISSUE_KEY = /\b[A-Z][A-Z0-9_]{0,9}-\d+\b/u;
+  /** Bound the work a pathological payload can cause. */
+  MAX_OBJECTS = 3e3;
+  MAX_STRINGS = 800;
+  MAX_DEPTH = 7;
+  MAX_CARDS = 25;
+  MAX_TEXT = 4e3;
+  /** Longest description or body kept for a summary pass or a panel. */
+  MAX_BODY = 8e3;
+  /** Node types that end a line, so a flattened document keeps its shape. */
+  BLOCK_TYPES = /* @__PURE__ */ new Set([
+    "paragraph",
+    "heading",
+    "blockquote",
+    "codeBlock",
+    "listItem",
+    "tableRow",
+    "panel",
+    "rule"
+  ]);
+  /**
+   * Extract card data from one tool result.
+   * @param options - the tool name, its arguments, and the returned value.
+   * @returns the meta the client renders; `text` is always populated.
+   */
+  extract = (options) => {
+    const texts = mcpText(options.value);
+    const joined = texts.join("\n").trim();
+    const roots = [];
+    const structured = this.asRecord(options.value)?.structuredContent;
+    if (structured !== void 0) roots.push(structured);
+    roots.push(...mcpJson(options.value));
+    const objects = [];
+    const strings = [];
+    for (const root of roots) {
+      this.collectObjects(root, objects, 0);
+      this.collectStrings(root, strings, 0);
+    }
+    this.collectStrings(joined, strings, 0);
+    const issues = this.issueCards(
+      objects,
+      strings,
+      options.siteUrl,
+      options.bodies === true
+    );
+    const pages = issues.length > 0 ? [] : this.pageCards(
+      objects,
+      strings,
+      options.siteUrl,
+      options.bodies === true
+    );
+    const query = this.pick(
+      options.args,
+      "jql",
+      "cql",
+      "query",
+      "searchString",
+      "issueIdOrKey",
+      "pageId",
+      "cloudId"
+    );
+    const kind = issues.length > 0 ? "jira-issues" : pages.length > 0 ? "confluence-pages" : "text";
+    const total = kind === "text" ? void 0 : this.totalOf(roots);
+    return {
+      kind,
+      tool: options.tool,
+      ...query === void 0 ? {} : { query },
+      ...total === void 0 ? {} : { total },
+      issues,
+      pages,
+      text: joined.slice(0, this.MAX_TEXT)
+    };
+  };
+  /**
+   * Flatten one rich field to the plain text a caller can use.
+   *
+   * The side panel reads a description or a comment body through this: the same
+   * markdown-or-ADF handling the cards use, with the same bound.
+   * @param value - a markdown string, an ADF tree, or anything else.
+   * @returns the text, or undefined when there is none.
+   */
+  text = (value) => this.plainText(value);
+  collectStrings = (node, out, depth) => {
+    if (depth > this.MAX_DEPTH || node === null || node === void 0 || out.length >= this.MAX_STRINGS)
+      return;
+    if (typeof node === "string") {
+      out.push(node);
+      return;
+    }
+    if (Array.isArray(node)) {
+      for (const item of node) this.collectStrings(item, out, depth + 1);
+      return;
+    }
+    if (typeof node === "object") {
+      for (const item of Object.values(node))
+        this.collectStrings(item, out, depth + 1);
+    }
+  };
+  collectObjects = (node, out, depth) => {
+    if (depth > this.MAX_DEPTH || node === null || node === void 0 || out.length >= this.MAX_OBJECTS)
+      return;
+    if (Array.isArray(node)) {
+      for (const item of node) this.collectObjects(item, out, depth + 1);
+      return;
+    }
+    if (typeof node !== "object") return;
+    out.push(node);
+    for (const item of Object.values(node))
+      this.collectObjects(item, out, depth + 1);
+  };
+  /** The first non-empty string among the named fields. */
+  pick = (source, ...names) => {
+    if (source === null || source === void 0 || typeof source !== "object")
+      return void 0;
+    const record = source;
+    for (const name2 of names) {
+      const value = record[name2];
+      if (typeof value === "string" && value.trim() !== "") return value.trim();
+      if (typeof value === "number") return String(value);
+    }
+    return void 0;
+  };
+  /** The first finite number among the named fields. */
+  numberOf = (source, ...names) => {
+    if (source === null || source === void 0 || typeof source !== "object")
+      return void 0;
+    const record = source;
+    for (const name2 of names) {
+      const value = record[name2];
+      if (typeof value === "number" && Number.isFinite(value)) return value;
+      if (typeof value === "string" && value.trim() !== "") {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed)) return parsed;
+      }
+    }
+    return void 0;
+  };
+  /**
+   * How many items the server says matched, when a root record reports it.
+   *
+   * Only the roots are read, never the hundreds of nested objects: `total` is
+   * a page-level fact, and a nested one belongs to something else.
+   */
+  totalOf = (roots) => {
+    let total;
+    const raise = (candidate) => {
+      if (candidate === void 0) return;
+      total = total === void 0 ? candidate : Math.max(total, candidate);
+    };
+    for (const root of roots) {
+      if (Array.isArray(root)) {
+        raise(root.length);
+        continue;
+      }
+      raise(
+        this.numberOf(this.asRecord(root), "total", "totalCount", "totalSize")
+      );
+    }
+    return total;
+  };
+  /** A duration estimate, in Jira's own words when it gave them. */
+  estimateOf = (fields) => {
+    const tracking = this.asRecord(fields.timetracking) ?? this.asRecord(fields.timeTracking);
+    const stated = this.pick(tracking, "originalEstimate", "remainingEstimate");
+    if (stated !== void 0) return stated;
+    const seconds = this.numberOf(
+      tracking,
+      "originalEstimateSeconds",
+      "remainingEstimateSeconds"
+    );
+    if (seconds !== void 0) return formatDuration(seconds);
+    return formatDuration(
+      this.numberOf(
+        fields,
+        "timeoriginalestimate",
+        "aggregateoriginalestimate",
+        "timeestimate",
+        "aggregatetimeestimate"
+      ) ?? 0
+    );
+  };
+  /**
+   * The plain text of a rich field.
+   *
+   * A description arrives as markdown text from one server generation and as
+   * an Atlassian Document Format tree from the other, so this reads both: text
+   * nodes in order, with a break between the blocks that carry one.
+   */
+  plainText = (value) => {
+    if (typeof value === "string") return this.tidy(stripHtmlComments(value));
+    const text = this.tidy(this.richText(value, 0));
+    return text === "" ? void 0 : text;
+  };
+  /**
+   * The plain text of a search snippet.
+   *
+   * A Confluence search result carries an `excerpt` that is not a document but
+   * a fragment of rendered HTML, entities and all.
+   */
+  snippetText = (value) => {
+    if (typeof value !== "string") return this.plainText(value);
+    const stripped = value.replace(/<[^>]*>/gu, " ").replace(/&lt;/gu, "<").replace(/&gt;/gu, ">").replace(/&quot;/gu, '"').replace(/&#39;/gu, "'").replace(/&nbsp;/gu, " ").replace(/&amp;/gu, "&");
+    return this.plainText(stripped);
+  };
+  richText = (node, depth) => {
+    if (depth > this.MAX_DEPTH || node === null || node === void 0)
+      return "";
+    if (typeof node === "string") return node;
+    if (typeof node === "number" || typeof node === "boolean")
+      return ` ${String(node)} `;
+    if (Array.isArray(node))
+      return node.map((item) => this.richText(item, depth + 1)).join("");
+    if (typeof node !== "object") return "";
+    const record = node;
+    const body = typeof record.text === "string" ? record.text : record.content === void 0 ? "" : this.richText(record.content, depth + 1);
+    return this.BLOCK_TYPES.has(String(record.type)) ? `${body}
+
+` : body;
+  };
+  /** Collapse the whitespace a markdown or ADF body is full of. */
+  tidy = (value) => {
+    return value.replace(/\r\n?/gu, "\n").replace(/[^\S\n]+/gu, " ").replace(/\n{3,}/gu, "\n\n").trim().slice(0, this.MAX_BODY);
+  };
+  asRecord = (value) => {
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+  };
+  compact = (value) => {
+    return Object.fromEntries(
+      Object.entries(value).filter(
+        ([, item]) => item !== void 0 && item !== ""
+      )
+    );
+  };
+  /** The first absolute `/browse/<key>` URL in the payload, else the site's own. */
+  issueUrl = (strings, key, siteUrl) => {
+    for (const text of strings) {
+      if (!text.includes("/browse/") || !text.includes(key)) continue;
+      const match = text.match(
+        /https?:\/\/[^\s"')<>]*\/browse\/[A-Z][A-Z0-9_]{0,9}-\d+/u
+      );
+      if (match !== null) return match[0];
+    }
+    return siteUrl === void 0 ? void 0 : `${siteUrl}/browse/${key}`;
+  };
+  /**
+   * Resolve a possibly relative Atlassian path against the site's own root.
+   *
+   * A Confluence search answers with `"/spaces/KEY/pages/123/Title"`, which is
+   * relative to the wiki (`https://site.atlassian.net/wiki`), while a `webui`
+   * link that already starts with `/wiki` is relative to the site itself. The
+   * payload's own absolute URLs say which site that is; the learned site is
+   * the fallback when the payload never spells one out.
+   */
+  absoluteUrl = (raw, strings, siteUrl) => {
+    if (raw === void 0) return void 0;
+    if (raw.startsWith("http")) return raw;
+    if (!raw.startsWith("/")) return void 0;
+    const site = this.siteBase(strings) ?? siteUrl;
+    if (site === void 0) return void 0;
+    return `${raw.startsWith("/wiki/") ? site : `${site}/wiki`}${raw}`;
+  };
+  /** The first `https://<site>.atlassian.net` the payload spells out. */
+  siteBase = (strings) => {
+    for (const text of strings) {
+      const match = text.match(/https?:\/\/[^\s"')<>]*atlassian\.net/u);
+      if (match !== null) return match[0];
+    }
+    return void 0;
+  };
+  issueCards = (objects, strings, siteUrl, bodies) => {
+    const issues = /* @__PURE__ */ new Map();
+    for (const node of objects) {
+      const key = this.pick(node, "key");
+      if (key === void 0 || !this.ISSUE_KEY.test(key) || issues.has(key))
+        continue;
+      const fields = this.asRecord(node.fields) ?? node;
+      const rawText = bodies ? this.plainText(fields.description) : void 0;
+      issues.set(
+        key,
+        this.compact({
+          key,
+          summary: this.pick(fields, "summary", "name", "title"),
+          status: this.pick(this.asRecord(fields.status) ?? fields.status, "name") ?? this.pick(fields, "status"),
+          assignee: this.pick(
+            this.asRecord(fields.assignee) ?? fields.assignee,
+            "displayName",
+            "name"
+          ) ?? this.pick(fields, "assignee"),
+          priority: this.pick(
+            this.asRecord(fields.priority) ?? fields.priority,
+            "name"
+          ) ?? this.pick(fields, "priority"),
+          type: this.pick(
+            this.asRecord(fields.issuetype) ?? fields.issuetype,
+            "name"
+          ) ?? this.pick(fields, "issuetype"),
+          estimate: this.estimateOf(fields),
+          url: this.issueUrl(strings, key, siteUrl),
+          rawText
+        })
+      );
+      if (issues.size >= this.MAX_CARDS) break;
+    }
+    return [...issues.values()];
+  };
+  pageCards = (objects, strings, siteUrl, bodies) => {
+    const pages = /* @__PURE__ */ new Map();
+    for (const node of objects) {
+      const title = this.pick(node, "title");
+      if (title === void 0) continue;
+      const id = this.pick(node, "id");
+      const raw = this.pick(node, "url") ?? this.pick(this.asRecord(node._links), "webui");
+      if (id === void 0 && raw === void 0) continue;
+      const identity = raw ?? id ?? title;
+      if (pages.has(identity)) continue;
+      const url = this.absoluteUrl(raw, strings, siteUrl) ?? (id !== void 0 && siteUrl !== void 0 ? `${siteUrl}/wiki/pages/viewpage.action?pageId=${id}` : void 0);
+      const rawText = !bodies ? void 0 : node.body === void 0 ? this.snippetText(node.excerpt) : this.plainText(node.body);
+      pages.set(
+        identity,
+        this.compact({
+          id,
+          title,
+          url,
+          space: this.pick(
+            this.asRecord(node.space) ?? node.space,
+            "name",
+            "key"
+          ),
+          rawText
+        })
+      );
+      if (pages.size >= this.MAX_CARDS) break;
+    }
+    return [...pages.values()];
+  };
+};
+var extractor = new Extractor();
+
+// src/host/correlation.ts
+var ISSUE_TOOL = "getJiraIssue";
+var ISSUE_FIELDS = ["summary", "status", "assignee", "issuetype", "priority"];
+var nameOf = (value) => typeof value === "string" && value !== "" ? value : pickString(asRecord(value) ?? {}, "displayName", "name", "value");
+var factOf = (key, value, siteUrl) => {
+  const record = asRecord(value) ?? {};
+  const fields = asRecord(record.fields) ?? record;
+  const identity = pickString(record, "key") ?? key;
+  const summary = extractor.text(pickString(fields, "summary"));
+  const parts = [
+    nameOf(fields.status),
+    nameOf(fields.issuetype),
+    nameOf(fields.priority),
+    nameOf(fields.assignee)
+  ].filter((part) => part !== void 0 && part !== "");
+  return {
+    id: `jira:${identity}`,
+    provider: "Atlassian",
+    kind: "task",
+    label: "Jira issue",
+    title: summary === void 0 ? identity : `${identity} \xB7 ${summary}`,
+    ...siteUrl === void 0 ? {} : { url: `${siteUrl}/browse/${identity}` },
+    ...parts.length === 0 ? {} : { meta: parts.join(" \xB7 ") }
+  };
+};
+var atlassianCorrelationSource = (deps) => ({
+  provider: "Atlassian",
+  entry: "task",
+  resolves: ["task"],
+  resolve: async (ref) => {
+    if (ref.kind !== "task") return [];
+    const cloudId = deps.state.facts?.cloudId;
+    if (cloudId === void 0)
+      throw new Error(
+        "no Atlassian site known yet; sign in again or run /atlassian sync"
+      );
+    const value = await deps.bridge.callTool(ISSUE_TOOL, {
+      cloudId,
+      issueIdOrKey: ref.key,
+      fields: ISSUE_FIELDS,
+      responseContentFormat: "markdown"
+    });
+    return [factOf(ref.key, value, deps.state.facts?.siteUrl)];
+  }
+});
+var registerCorrelationSource = (ctx, deps) => {
+  ctx.inject([CORRELATION_SOURCES], (scoped) => {
+    scoped.effect(
+      () => scoped.correlationSources.register(atlassianCorrelationSource(deps)),
+      "atlassian: correlation source"
+    );
+  });
+};
+
+// src/host/digest.ts
+var SEARCH_TOOL = "searchJiraIssuesUsingJql";
+var ISSUE_FIELDS2 = [
+  "summary",
+  "status",
+  "assignee",
+  "priority",
+  "issuetype",
+  "duedate"
+];
+var JQL = {
+  "jira-active": 'assignee = currentUser() AND statusCategory != Done AND (statusCategory = "In Progress" OR duedate <= now()) ORDER BY duedate ASC',
+  "jira-queued": 'assignee = currentUser() AND statusCategory = "To Do" ORDER BY created DESC'
+};
+var toItem = (issue) => {
+  const meta = [issue.status, issue.priority].filter(Boolean).join(" \xB7 ");
+  return {
+    id: issue.key,
+    title: [issue.key, issue.summary].filter(Boolean).join(" \xB7 "),
+    ...issue.url === void 0 ? {} : { url: issue.url },
+    ...meta === "" ? {} : { meta }
+  };
+};
+var atlassianDigestSource = (deps) => ({
+  provider: "Atlassian",
+  blocks: [
+    {
+      id: "jira-active",
+      title: "Jira \xB7 In progress and overdue",
+      defaultOn: true
+    },
+    {
+      id: "jira-queued",
+      title: "Jira \xB7 Assigned, not started",
+      defaultOn: true
+    }
+  ],
+  load: async (blockId, options) => {
+    const jql = JQL[blockId];
+    if (jql === void 0) throw new Error(`no Jira block named "${blockId}"`);
+    const cloudId = deps.state.facts?.cloudId;
+    if (cloudId === void 0)
+      throw new Error(
+        "the Atlassian site is not known yet; run /atlassian sync"
+      );
+    const value = await deps.bridge.callTool(SEARCH_TOOL, {
+      cloudId,
+      jql,
+      fields: ISSUE_FIELDS2,
+      maxResults: options.limit
+    });
+    return extractor.extract({
+      tool: SEARCH_TOOL,
+      args: {},
+      value,
+      siteUrl: deps.state.facts?.siteUrl
+    }).issues.slice(0, options.limit).map(toItem);
+  }
+});
+var registerDigestSource = (ctx, deps) => {
+  ctx.inject([DIGEST_SOURCES], (scoped) => {
+    scoped.effect(
+      () => scoped.digestSources.register(atlassianDigestSource(deps)),
+      "atlassian: digest source"
+    );
+  });
+};
+
+// src/host/panels/panel.ts
+var COMMENT_LIMIT = 25;
+var PEOPLE_LIMIT = 8;
+var PanelApi = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /** The issue fields the panel renders. */
+  ISSUE_FIELDS = [
+    "summary",
+    "description",
+    "status",
+    "issuetype",
+    "priority",
+    "assignee",
+    "reporter",
+    "created",
+    "updated",
+    "duedate",
+    "labels",
+    "resolution",
+    "timetracking",
+    "timeoriginalestimate"
+  ];
+  /** Everything one issue panel shows. */
+  issue = async (key) => {
+    const cloudId = this.cloudId();
+    const [detail, transitions] = await Promise.all([
+      this.deps.bridge.callTool("getJiraIssue", {
+        cloudId,
+        issueIdOrKey: key,
+        fields: [...this.ISSUE_FIELDS, "comment"],
+        responseContentFormat: "markdown"
+      }),
+      this.deps.bridge.callTool("getTransitionsForJiraIssue", {
+        cloudId,
+        issueIdOrKey: key
+      }).then((value) => this.transitionsOf(value)).catch(() => [])
+    ]);
+    const record = this.issueRecord(detail);
+    if (record === void 0)
+      throw new Error(`Atlassian returned no issue for ${key}`);
+    const fields = asRecord(record.fields) ?? record;
+    const identity = pickString(record, "key") ?? key;
+    const summary = extractor.text(pickString(fields, "summary"));
+    return {
+      kind: "issue",
+      key: identity,
+      ...summary === void 0 ? {} : { summary },
+      type: pickString(asRecord(fields.issuetype) ?? fields.issuetype, "name"),
+      status: pickString(asRecord(fields.status) ?? fields.status, "name"),
+      priority: pickString(
+        asRecord(fields.priority) ?? fields.priority,
+        "name"
+      ),
+      assignee: this.personOf(fields.assignee),
+      reporter: pickString(
+        asRecord(fields.reporter) ?? fields.reporter,
+        "displayName",
+        "name"
+      ),
+      estimate: this.estimateOf(fields),
+      due: pickString(fields, "duedate"),
+      labels: Array.isArray(fields.labels) ? fields.labels.filter(
+        (label) => typeof label === "string"
+      ) : [],
+      created: pickString(fields, "created"),
+      updated: pickString(fields, "updated"),
+      description: extractor.text(fields.description),
+      url: this.deps.state.facts?.siteUrl === void 0 ? void 0 : `${this.deps.state.facts?.siteUrl}/browse/${identity}`,
+      comments: this.commentsOf(fields.comment),
+      transitions
+    };
+  };
+  /** Everything one page panel shows. */
+  page = async (id) => {
+    const cloudId = this.cloudId();
+    const [detail, comments] = await Promise.all([
+      this.deps.bridge.callTool("getConfluencePage", {
+        cloudId,
+        pageId: id,
+        contentFormat: "markdown"
+      }),
+      this.deps.bridge.callTool("getConfluencePageFooterComments", {
+        cloudId,
+        pageId: id,
+        limit: COMMENT_LIMIT
+      }).catch(() => void 0)
+    ]);
+    const record = this.firstRecord(detail);
+    if (record === void 0)
+      throw new Error(`Atlassian returned no page for ${id}`);
+    const title = pickString(record, "title") ?? id;
+    const webui = pickString(asRecord(record._links), "webui");
+    return {
+      kind: "page",
+      id: pickString(record, "id") ?? id,
+      title,
+      space: pickString(asRecord(record.space) ?? record.space, "name", "key"),
+      url: webui === void 0 ? this.deps.state.facts?.siteUrl === void 0 ? void 0 : `${this.deps.state.facts?.siteUrl}/wiki/pages/viewpage.action?pageId=${id}` : this.wikiUrl(webui, this.deps.state.facts?.siteUrl),
+      body: extractor.text(record.body),
+      comments: this.commentsOf(asRecord(comments)?.results)
+    };
+  };
+  /** People the site matches to one search string. */
+  people = async (query) => {
+    const value = await this.deps.bridge.callTool("lookupJiraAccountId", {
+      cloudId: this.cloudId(),
+      searchString: query,
+      showAvatar: false
+    });
+    const users = this.userList(value);
+    return users.map((user) => ({
+      name: pickString(user, "displayName") ?? "",
+      accountId: pickString(user, "accountId") ?? ""
+    })).filter((person) => person.name !== "" && person.accountId !== "").slice(0, PEOPLE_LIMIT);
+  };
+  /**
+   * The signed-in user, as the site names them.
+   *
+   * `atlassianUserInfo` answers about the account the connection belongs to, in
+   * a shape of its own; the first record that carries an account id is the
+   * answer. A site that names none leaves the panel without a self-assignment
+   * rather than offering one Jira would refuse.
+   * @returns the reader, or undefined when the answer names no account.
+   */
+  me = async () => {
+    const value = await this.deps.bridge.callTool("atlassianUserInfo", {});
+    return this.personIn(value);
+  };
+  /** Move one issue through a workflow transition. */
+  transition = async (key, transitionId) => {
+    await this.deps.bridge.callTool("transitionJiraIssue", {
+      cloudId: this.cloudId(),
+      issueIdOrKey: key,
+      transition: { id: transitionId }
+    });
+  };
+  /** Set or clear one issue's assignee. */
+  assign = async (key, accountId) => {
+    await this.deps.bridge.callTool("editJiraIssue", {
+      cloudId: this.cloudId(),
+      issueIdOrKey: key,
+      fields: { assignee: accountId === null ? null : { accountId } }
+    });
+  };
+  /** The connected site's cloud id, or a message the user can act on. */
+  cloudId = () => {
+    if (this.deps.state.facts?.cloudId === void 0)
+      throw new Error(
+        "no Atlassian site known yet \u2014 sign in from Settings, then try again"
+      );
+    return this.deps.state.facts?.cloudId;
+  };
+  /** Jira's own estimate words, or a duration rendered from raw seconds. */
+  estimateOf = (fields) => {
+    const tracking = asRecord(fields.timetracking);
+    const stated = pickString(
+      tracking,
+      "originalEstimate",
+      "remainingEstimate"
+    );
+    if (stated !== void 0) return stated;
+    const seconds = pickNumber(
+      tracking,
+      "originalEstimateSeconds",
+      "remainingEstimateSeconds"
+    );
+    if (seconds !== void 0) return formatDuration(seconds);
+    return formatDuration(
+      pickNumber(fields, "timeoriginalestimate", "timeestimate") ?? 0
+    );
+  };
+  personOf = (value) => {
+    const record = asRecord(value);
+    const accountId = pickString(record, "accountId");
+    const name2 = pickString(record, "displayName", "name");
+    if (accountId === void 0 || name2 === void 0) return void 0;
+    return { accountId, name: name2 };
+  };
+  /** The Jira issue inside one `getJiraIssue` result. */
+  issueRecord = (value) => this.firstRecord(value, (record) => asRecord(record.fields) !== void 0);
+  /** The first JSON record in a result, or the first one a predicate accepts. */
+  firstRecord = (value, accept = () => true) => {
+    for (const root of mcpJson(value)) {
+      const record = asRecord(root);
+      if (record !== void 0 && accept(record)) return record;
+      if (!Array.isArray(root)) continue;
+      for (const item of root) {
+        const candidate = asRecord(item);
+        if (candidate !== void 0 && accept(candidate)) return candidate;
+      }
+    }
+    return void 0;
+  };
+  /** The comment list one issue or page carries. */
+  commentsOf = (value) => {
+    const list = Array.isArray(value) ? value : Array.isArray(asRecord(value)?.comments) ? asRecord(value)?.comments : [];
+    const comments = [];
+    for (const item of list) {
+      const record = asRecord(item);
+      if (record === void 0) continue;
+      const body = extractor.text(record.body);
+      if (body === void 0) continue;
+      const author = pickString(
+        asRecord(record.author) ?? record.author,
+        "displayName",
+        "publicName",
+        "name"
+      );
+      comments.push({
+        body,
+        ...author === void 0 ? {} : { author },
+        ...pickString(record, "created") === void 0 ? {} : { created: pickString(record, "created") }
+      });
+      if (comments.length >= COMMENT_LIMIT) break;
+    }
+    return comments;
+  };
+  /** The transitions a workflow currently offers. */
+  transitionsOf = (value) => {
+    const record = this.firstRecord(value);
+    const list = Array.isArray(record?.transitions) ? record.transitions : [];
+    const transitions = [];
+    for (const item of list) {
+      const candidate = asRecord(item);
+      if (candidate === void 0) continue;
+      const id = pickString(candidate, "id");
+      const name2 = pickString(candidate, "name");
+      if (id === void 0 || name2 === void 0) continue;
+      const to = asRecord(candidate.to);
+      transitions.push({
+        id,
+        name: name2,
+        ...pickString(to, "name") === void 0 ? {} : { to: pickString(to, "name") },
+        // Jira omits `isAvailable` when the transition is offered.
+        available: candidate.isAvailable !== false,
+        needsFields: candidate.hasScreen === true
+      });
+    }
+    return transitions;
+  };
+  /** The user list inside one `lookupJiraAccountId` result. */
+  userList = (value) => {
+    for (const root of mcpJson(value)) {
+      const users = asRecord(asRecord(asRecord(root)?.data)?.users);
+      const list = users?.users;
+      if (Array.isArray(list))
+        return list.map((item) => asRecord(item)).filter(
+          (item) => item !== void 0
+        );
+    }
+    return [];
+  };
+  /** The first person named anywhere in one tool result. */
+  personIn = (value) => {
+    for (const root of mcpJson(value)) {
+      const person = this.personOf(root) ?? this.personOf(asRecord(asRecord(root)?.data));
+      if (person !== void 0) return person;
+    }
+    return this.personOf(this.firstRecord(value));
+  };
+  /** A page's own path, resolved against the site's wiki. */
+  wikiUrl = (raw, siteUrl) => {
+    if (raw.startsWith("http")) return raw;
+    if (!raw.startsWith("/") || siteUrl === void 0) return void 0;
+    return `${raw.startsWith("/wiki/") ? siteUrl : `${siteUrl}/wiki`}${raw}`;
+  };
+};
+
+// src/host/surface/command.ts
+var COMMAND_NAME = "atlassian";
+var createCommandHandler = (auth) => {
+  return createIntegrationCommand(
+    { name: COMMAND_NAME, label: "Atlassian" },
+    auth
+  );
+};
+
+// src/host/surface/http.ts
+var ROUTE_PREFIX = "/dsh-atlassian";
+var panelRoutes = (panel) => [
+  async (route) => {
+    if (route.url.pathname !== `${ROUTE_PREFIX}/issue` || route.method !== "GET")
+      return false;
+    const key = route.url.searchParams.get("key") ?? "";
+    await route.sendData(() => panel.issue(key));
+    return true;
+  },
+  async (route) => {
+    if (route.url.pathname !== `${ROUTE_PREFIX}/page` || route.method !== "GET")
+      return false;
+    const id = route.url.searchParams.get("id") ?? "";
+    await route.sendData(() => panel.page(id));
+    return true;
+  },
+  async (route) => {
+    if (route.url.pathname !== `${ROUTE_PREFIX}/people` || route.method !== "GET")
+      return false;
+    const query = route.url.searchParams.get("q") ?? "";
+    await route.sendData(() => panel.people(query));
+    return true;
+  },
+  async (route) => {
+    if (route.url.pathname !== `${ROUTE_PREFIX}/me` || route.method !== "GET")
+      return false;
+    await route.sendData(async () => ({
+      person: await panel.me() ?? null
+    }));
+    return true;
+  },
+  async (route) => {
+    if (route.url.pathname !== `${ROUTE_PREFIX}/issue/transition` || route.method !== "POST")
+      return false;
+    const body = await route.read();
+    const key = body.required("key");
+    const transitionId = body.required("transitionId");
+    await route.sendData(async () => {
+      await panel.transition(key, transitionId);
+      return await panel.issue(key);
+    });
+    return true;
+  },
+  async (route) => {
+    if (route.url.pathname !== `${ROUTE_PREFIX}/issue/assignee` || route.method !== "POST")
+      return false;
+    const body = await route.read();
+    const key = body.required("key");
+    const accountId = body.fields?.accountId;
+    if (accountId !== null && typeof accountId !== "string")
+      throw new BadRequest('the request needs an "accountId" or null');
+    await route.sendData(async () => {
+      await panel.assign(key, accountId);
+      return await panel.issue(key);
+    });
+    return true;
+  }
+];
+var createApiHandler = (deps) => {
+  return createIntegrationRoute({
+    prefix: ROUTE_PREFIX,
+    auth: deps.auth,
+    routes: panelRoutes(deps.panel)
+  });
+};
+
+// src/host/presentation/gist.ts
+var MAX_BODY_CHARS = 900;
+var MAX_PROMPT_CHARS = 12e3;
+var MAX_GIST_CHARS = 240;
+var TIMEOUT_MS = 2e4;
+var SYSTEM_PROMPT = [
+  "You write the one-line summary a card shows for each numbered item below.",
+  "Each item is a Jira issue or a Confluence page; its text may be in any language.",
+  "Answer with exactly one line per item, formatted `<number>: <sentence>`.",
+  "Say what the item actually asks for or contains, in the item's own language.",
+  "At most 25 words. No markdown, no quotes, no bullet characters, no preamble, no closing remarks."
+].join(" ");
+function modelRoute(exec) {
+  const config = exec.agent?.session.requestHeader()?.config;
+  const provider = config?.provider ?? exec.agent?.options.provider;
+  const model = config?.model ?? exec.agent?.options.model;
+  if (provider === void 0 || model === void 0) return void 0;
+  if (provider === "" || model === "") return void 0;
+  return { provider, model };
+}
+function parseGists(text, count) {
+  const gists = new Array(count).fill(void 0);
+  for (const line of text.split("\n")) {
+    const match = line.trim().replace(/^[-*•]\s*/u, "").match(/^(\d{1,3})\s*[).:\-–—]\s*(.+)$/u);
+    if (match === null) continue;
+    const index = Number(match[1]) - 1;
+    const sentence = match[2]?.replace(/^["'«“]+|["'»”]+$/gu, "").replace(/\s+/gu, " ").trim();
+    if (index < 0 || index >= count) continue;
+    if (gists[index] !== void 0) continue;
+    if (sentence === void 0 || sentence === "") continue;
+    gists[index] = sentence.slice(0, MAX_GIST_CHARS);
+  }
+  return gists;
+}
+async function summarizeGists(ctx, targets, options) {
+  if (targets.length === 0) return void 0;
+  const route = options.route;
+  if (route === void 0) return void 0;
+  const llm = ctx.get("llm");
+  if (llm === void 0) return void 0;
+  const prompt = buildPrompt(targets);
+  if (prompt === "") return void 0;
+  const signal = options.signal === void 0 ? AbortSignal.timeout(TIMEOUT_MS) : AbortSignal.any([options.signal, AbortSignal.timeout(TIMEOUT_MS)]);
+  let answer = "";
+  try {
+    const stream = llm.stream({
+      provider: route.provider,
+      model: route.model,
+      system: SYSTEM_PROMPT,
+      messages: [{ role: "user", content: [{ type: "text", text: prompt }] }],
+      temperature: 0,
+      signal
+    });
+    for await (const chunk of stream) {
+      if (chunk.type === "text-delta") answer += chunk.text;
+    }
+  } catch {
+    return void 0;
+  }
+  const sentences = parseGists(answer, targets.length);
+  const gists = [];
+  targets.forEach((target, index) => {
+    const sentence = sentences[index];
+    if (sentence !== void 0) gists.push({ id: target.id, text: sentence });
+  });
+  return gists.length === 0 ? void 0 : gists;
+}
+function buildPrompt(targets) {
+  const parts = [];
+  let used = 0;
+  targets.forEach((target, index) => {
+    const heading = `${index + 1}. ${target.title}`;
+    const room = MAX_PROMPT_CHARS - used - heading.length;
+    const body = room <= 0 ? "" : target.body.slice(0, Math.min(room, MAX_BODY_CHARS));
+    used += heading.length + body.length;
+    parts.push(body === "" ? heading : `${heading}
+${body}`);
+  });
+  return parts.join("\n\n");
+}
+
+// src/host/tools/present.ts
+function stringList2(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (item) => typeof item === "string" && item !== ""
+  );
+}
+function optionalString(value) {
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+var PresentTool = class {
+  /** The wire name the agent calls. */
+  TOOL_NAME = "atlassian_present";
+  /** Never put more than this many items on one card. */
+  MAX_ITEMS = 25;
+  /** Fields that make a card useful without making the call enormous. */
+  ISSUE_FIELDS = [
+    "summary",
+    "status",
+    "assignee",
+    "priority",
+    "issuetype",
+    "timetracking",
+    "timeoriginalestimate",
+    // Read to write one sentence per issue, then dropped again: the recorded
+    // card carries the sentence, never the description.
+    "description"
+  ];
+  /**
+   * Build the tool definition for one plugin instance.
+   * @param ctx - host context; the model service is read from it for summaries.
+   * @param state - runtime state holding the MCP connection and cloud id.
+   */
+  create = (deps) => ({
+    name: this.TOOL_NAME,
+    description: "Show Jira issues and/or Confluence pages to the user as a card under your answer. Use this whenever the user asks to see work \u2014 a daily plan, a shortlist, a single issue, or search results \u2014 instead of only describing it in prose. Resolve the content by issue keys, by page ids, by JQL, or by CQL. Each row carries a link to the item, its status, assignee, priority, type and estimate, plus one sentence summarizing its description, so the user can act without opening the issue. Call it once per card, then write your answer; do not repeat the card's contents as a list in the text.",
+    parameters: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        title: {
+          type: "string",
+          description: 'Optional heading for the card, such as "\u041F\u043B\u0430\u043D \u043D\u0430 \u0434\u0435\u043D\u044C". Omit for an untitled card.'
+        },
+        layout: {
+          type: "string",
+          enum: ["auto", "single", "compact", "list"],
+          description: "auto (default) picks by item count: one item as a full card, two to four as compact rows, more as a dense list. A card longer than four rows scrolls and shows how many items matched. Force one when the content calls for it."
+        },
+        issues: {
+          type: "array",
+          items: { type: "string" },
+          description: 'Issue keys to show, for example ["DEV-6477", "DQ-66"].'
+        },
+        pages: {
+          type: "array",
+          items: { type: "string" },
+          description: "Confluence page ids to show."
+        },
+        jql: {
+          type: "string",
+          description: 'A JQL query whose results become the card, for example "assignee = currentUser() AND status != Done ORDER BY priority DESC".'
+        },
+        cql: {
+          type: "string",
+          description: "A CQL query whose Confluence results become the card."
+        },
+        cloudId: {
+          type: "string",
+          description: "Atlassian cloud id. Omit unless the user has several sites: the plugin remembers it."
+        }
+      }
+    },
+    output: {
+      schema: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          shown: { type: "integer" },
+          summary: { type: "string" },
+          failed: { type: "array", items: { type: "string" } },
+          // The card payload, carried to the browser as `result.meta`.
+          // Left open on purpose: it is presentation data, and the browser
+          // half validates it before rendering.
+          presentation: { type: "object", additionalProperties: true }
+        },
+        required: ["shown", "summary", "failed", "presentation"]
+      },
+      render: (_args, value) => [
+        { type: "text", text: value.summary }
+      ],
+      // The browser half reads this back as `result.meta` and renders the
+      // card. It never reaches the model: the text above is what the model
+      // reads, and this is presentation only.
+      presentationMeta: (_args, value) => value.presentation
+    },
+    execute: async (rawArgs, exec) => {
+      const args = this.parseArgs(rawArgs);
+      const outcome = await this.resolve(deps, args, exec);
+      const viewed = this.describe(outcome, args);
+      const summary = outcome.failed.length === 0 ? viewed : `${viewed}
+Could not resolve: ${outcome.failed.join(", ")}`;
+      const presentation = {
+        callId: String(exec.callId),
+        ...outcome.title === void 0 ? {} : { title: outcome.title },
+        layout: outcome.layout,
+        ...outcome.total === void 0 ? {} : { total: outcome.total },
+        items: outcome.items
+      };
+      return {
+        shown: outcome.items.length,
+        summary,
+        failed: [...outcome.failed],
+        presentation
+      };
+    }
+  });
+  /** Validate the model's arguments; unknown keys are ignored. */
+  parseArgs(rawArgs) {
+    const args = rawArgs !== null && typeof rawArgs === "object" ? rawArgs : {};
+    const layout = optionalString(args.layout);
+    return {
+      title: optionalString(args.title),
+      layout: layout === "auto" || layout === "single" || layout === "compact" || layout === "list" ? layout : void 0,
+      cloudId: optionalString(args.cloudId),
+      issues: stringList2(args.issues),
+      pages: stringList2(args.pages),
+      jql: optionalString(args.jql),
+      cql: optionalString(args.cql)
+    };
+  }
+  /** Resolve every requested source into card items. */
+  resolve = async (deps, args, exec) => {
+    const cloudId = args.cloudId ?? deps.state.facts?.cloudId;
+    if (cloudId === void 0)
+      throw new Error(
+        "no Atlassian site known yet; run a Jira or Confluence search first, or sign in again"
+      );
+    const items = [];
+    const failed = [];
+    let matched = 0;
+    const push = (candidate) => {
+      for (const item of candidate) {
+        if (items.length >= this.MAX_ITEMS) return;
+        items.push(item);
+      }
+    };
+    for (const key of args.issues) {
+      try {
+        const value = await deps.bridge.callTool("getJiraIssue", {
+          cloudId,
+          issueIdOrKey: key,
+          fields: this.ISSUE_FIELDS
+        });
+        const found = this.issuesOf(value, deps.state.facts?.siteUrl, key);
+        push(found.items);
+        matched += found.total ?? found.items.length;
+      } catch {
+        failed.push(key);
+      }
+    }
+    if (args.jql !== void 0) {
+      const value = await deps.bridge.callTool("searchJiraIssuesUsingJql", {
+        cloudId,
+        jql: args.jql,
+        fields: this.ISSUE_FIELDS,
+        maxResults: this.MAX_ITEMS
+      });
+      const found = this.issuesOf(value, deps.state.facts?.siteUrl);
+      push(found.items);
+      matched += found.total ?? found.items.length;
+    }
+    for (const id of args.pages) {
+      try {
+        const value = await deps.bridge.callTool("getConfluencePage", {
+          cloudId,
+          pageId: id
+        });
+        const found = this.pagesOf(value, deps.state.facts?.siteUrl, id);
+        push(found.items);
+        matched += found.total ?? found.items.length;
+      } catch {
+        failed.push(id);
+      }
+    }
+    if (args.cql !== void 0) {
+      const value = await deps.bridge.callTool("searchConfluenceUsingCql", {
+        cloudId,
+        cql: args.cql,
+        limit: this.MAX_ITEMS
+      });
+      const found = this.pagesOf(value, deps.state.facts?.siteUrl);
+      push(found.items);
+      matched += found.total ?? found.items.length;
+    }
+    if (items.length === 0 && failed.length === 0)
+      throw new Error("nothing to show: pass issues, pages, jql, or cql");
+    const gists = await this.summarize(deps.ctx, items, exec);
+    const projected = items.map(
+      (item, index) => item.kind === "issue" ? {
+        kind: "issue",
+        issue: this.issueWire(item.issue, gists.get(String(index)))
+      } : {
+        kind: "page",
+        page: this.pageWire(item.page, gists.get(String(index)))
+      }
+    );
+    return {
+      title: args.title,
+      layout: this.resolveLayout(args.layout, projected.length),
+      items: projected,
+      total: matched > projected.length ? matched : void 0,
+      failed
+    };
+  };
+  /**
+   * Compress the long text behind each item into one sentence.
+   *
+   * A card is worth waiting a moment for, not a minute: the pass is bounded by
+   * its own timeout and any failure simply leaves the items without summaries.
+   */
+  summarize = async (ctx, items, exec) => {
+    const targets = items.flatMap((item, index) => {
+      const title = item.kind === "issue" ? item.issue.summary ?? item.issue.key : item.page.title;
+      const body = (item.kind === "issue" ? item.issue.rawText : item.page.rawText) ?? "";
+      return body === "" ? [] : [{ id: String(index), title, body }];
+    });
+    if (targets.length === 0) return /* @__PURE__ */ new Map();
+    const gists = await summarizeGists(
+      ctx,
+      targets,
+      { route: modelRoute(exec), signal: exec.signal }
+    );
+    return new Map((gists ?? []).map((gist) => [gist.id, gist.text]));
+  };
+  /**
+   * The recorded shape of one issue.
+   *
+   * Built field by field rather than spread: `rawText` is the description the
+   * compression pass read, and the card must not carry a word of it.
+   */
+  issueWire = (issue, gist) => ({
+    key: issue.key,
+    ...issue.summary === void 0 ? {} : { summary: issue.summary },
+    ...issue.status === void 0 ? {} : { status: issue.status },
+    ...issue.assignee === void 0 ? {} : { assignee: issue.assignee },
+    ...issue.priority === void 0 ? {} : { priority: issue.priority },
+    ...issue.type === void 0 ? {} : { type: issue.type },
+    ...issue.estimate === void 0 ? {} : { estimate: issue.estimate },
+    ...gist === void 0 ? {} : { description: gist },
+    ...issue.url === void 0 ? {} : { url: issue.url }
+  });
+  /** The recorded shape of one page; see {@link issueWire}. */
+  pageWire = (page, gist) => ({
+    title: page.title,
+    ...page.id === void 0 ? {} : { id: page.id },
+    ...page.url === void 0 ? {} : { url: page.url },
+    ...page.space === void 0 ? {} : { space: page.space },
+    ...gist === void 0 ? {} : { excerpt: gist }
+  });
+  /** Normalize one Jira result; `fallbackKey` keeps a single-issue fetch labelled. */
+  issuesOf(value, siteUrl, fallbackKey) {
+    const meta = extractor.extract({
+      tool: "getJiraIssue",
+      args: {},
+      value,
+      siteUrl,
+      // The description is read here and compressed before it is recorded.
+      bodies: true
+    });
+    const issues = meta.issues;
+    if (issues.length > 0)
+      return {
+        items: issues.map((issue) => ({ kind: "issue", issue })),
+        total: meta.total
+      };
+    return {
+      items: fallbackKey === void 0 ? [] : [{ kind: "issue", issue: { key: fallbackKey } }],
+      total: meta.total
+    };
+  }
+  /** Normalize one Confluence result; `fallbackId` keeps a single fetch labelled. */
+  pagesOf(value, siteUrl, fallbackId) {
+    const meta = extractor.extract({
+      tool: "getConfluencePage",
+      args: {},
+      value,
+      siteUrl,
+      bodies: true
+    });
+    const pages = meta.pages;
+    if (pages.length > 0)
+      return {
+        items: pages.map((page) => ({ kind: "page", page })),
+        total: meta.total
+      };
+    return {
+      items: fallbackId === void 0 ? [] : [{ kind: "page", page: { id: fallbackId, title: fallbackId } }],
+      total: meta.total
+    };
+  }
+  /** Pick the layout the caller asked for, or infer one from the item count. */
+  resolveLayout(input, count) {
+    if (input === "single" || input === "compact" || input === "list")
+      return input;
+    if (count <= 1) return "single";
+    if (count <= 4) return "compact";
+    return "list";
+  }
+  /** The text the model reads: what the card shows, in order. */
+  describe(outcome, args) {
+    const issues = outcome.items.filter((item) => item.kind === "issue");
+    const pages = outcome.items.filter((item) => item.kind === "page");
+    const counts = [
+      issues.length > 0 ? `${issues.length} issue${issues.length === 1 ? "" : "s"}` : "",
+      pages.length > 0 ? `${pages.length} page${pages.length === 1 ? "" : "s"}` : ""
+    ].filter(Boolean);
+    const heading = outcome.title === void 0 ? "Shown as a card" : `Shown as a card titled "${outcome.title}"`;
+    const lines = [`${heading}: ${counts.join(" and ")}.`];
+    for (const item of outcome.items) {
+      if (item.kind === "issue") {
+        const parts = [
+          item.issue.key,
+          item.issue.summary,
+          item.issue.status,
+          item.issue.assignee,
+          item.issue.estimate === void 0 ? void 0 : `estimate ${item.issue.estimate}`,
+          item.issue.url
+        ].filter(
+          (part) => typeof part === "string" && part !== ""
+        );
+        lines.push(`- ${parts.join(" \xB7 ")}`);
+      } else {
+        const parts = [item.page.title, item.page.space, item.page.url].filter(
+          (part) => typeof part === "string" && part !== ""
+        );
+        lines.push(`- ${parts.join(" \xB7 ")}`);
+      }
+    }
+    if (args.jql !== void 0) lines.push(`JQL: ${args.jql}`);
+    if (args.cql !== void 0) lines.push(`CQL: ${args.cql}`);
+    return lines.join("\n");
+  }
+};
+var presentTool = new PresentTool();
+
+// src/host/index.ts
+var name = PLUGIN_NAME;
+var inject = ["tools", "credentials", "commands", "authorization"];
+var OAUTH_METHOD = "oauth";
+var CLIENT_INFO = { name: "dsh-atlassian", version: "0.3.0" };
+function apply(ctx, configInput) {
+  const config = resolveConfig(configInput);
+  const profile = atlassianProfile(config);
+  const state = new RuntimeState();
+  const logger = loggerOf(ctx);
+  const store = new GrantStore(ctx, credentialKeyOf(profile));
+  const flow = new AuthorizationFlow(profile, store);
+  const bridge = new McpBridge({
+    profile,
+    store,
+    clientInfo: CLIENT_INFO,
+    // The durable UI channel: the Web Client reads this back as `result.meta`.
+    decorate: (definition, tool) => ({
+      ...definition,
+      output: {
+        ...definition.output,
+        presentationMeta: (args, value) => extractor.extract({
+          tool: tool.name,
+          args,
+          value,
+          siteUrl: state.facts?.siteUrl
+        })
+      }
+    })
+  });
+  const auth = new IntegrationAuth({ ctx, config, state, store, flow, bridge, spec: atlassianAuthSpec });
+  const panel = new PanelApi({ bridge, state });
+  registerDigestSource(ctx, { bridge, state });
+  registerCorrelationSource(ctx, { bridge, state });
+  const disposeFlow = ctx.authorization.registerFlow({
+    key: store.credentialKey,
+    label: "Atlassian",
+    methods: [{ id: OAUTH_METHOD, label: "Sign in with Atlassian" }],
+    run: async (session) => {
+      await flow.run(ctx, session);
+    }
+  });
+  ctx.commands.register({
+    name: COMMAND_NAME,
+    description: "Jira and Confluence: status | login | logout | sync",
+    input: { hint: "status | login | logout | sync" },
+    handler: createCommandHandler(auth)
+  });
+  ctx.tools.register(presentTool.create({ ctx, bridge, state }));
+  mountIntegrationRoute(ctx, {
+    prefix: ROUTE_PREFIX,
+    handler: createApiHandler({ auth, panel })
+  });
+  ctx.effect(
+    () => () => {
+      disposeFlow();
+      return bridge.drop();
+    },
+    "atlassian: flow and MCP bridge"
+  );
+  void auth.connect().then((ready) => {
+    if (!ready) {
+      logger.info(
+        "[atlassian] not signed in yet \u2014 use the Atlassian settings card or /atlassian login"
+      );
+    }
+  });
+}
+export {
+  apply,
+  inject,
+  name
+};
+//# sourceMappingURL=index.js.map