spur-board 0.5.0 → 0.6.0

package/dist/cli.mjs

@@ -1,6 +1,6 @@
-import { R as configSchema, s as OPERATIONS, z as SLACK_BOT_SCOPES } from "./src-VWyX7Nwm.mjs";
-import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-BnkZmz1i.mjs";
-import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-UyXnaekw.mjs";
+import { B as SLACK_BOT_SCOPES, R as configSchema, s as OPERATIONS, z as requiredSecretKeys } from "./src-Cy74ZQfR.mjs";
+import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-Dw9ZovyI.mjs";
+import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-CeDZQlvy.mjs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
@@ -190,12 +190,7 @@ function localSecrets(config, path, ports) {
 	} catch {
 		names = {};
 	}
-	const slackConfigured = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
-	const required = [
-		"GITHUB_TOKEN",
-		...config.projects.some((project) => project.tracker.type === "jira") ? ["JIRA_EMAIL", "JIRA_API_TOKEN"] : [],
-		...slackConfigured ? ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"] : []
-	];
+	const required = requiredSecretKeys(config);
 	const missing = required.filter((name) => !names[name]);
 	return {
 		...result("secrets", missing.length === 0, `Add ${missing.join(", ")} to the private secrets.env file.`),

package/dist/{client-BnkZmz1i.mjs → client-Dw9ZovyI.mjs}

@@ -1,4 +1,4 @@
-import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-VWyX7Nwm.mjs";
+import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-Cy74ZQfR.mjs";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { request } from "node:http";

package/dist/client.mjs

@@ -1,2 +1,2 @@
-import { n as requestTokenEnrollment, t as requestOperation } from "./client-BnkZmz1i.mjs";
+import { n as requestTokenEnrollment, t as requestOperation } from "./client-Dw9ZovyI.mjs";
 export { requestOperation, requestTokenEnrollment };

package/dist/{config-UyXnaekw.mjs → config-CeDZQlvy.mjs}

@@ -1,5 +1,5 @@
-import { R as configSchema } from "./src-VWyX7Nwm.mjs";
-import { r as CliError } from "./client-BnkZmz1i.mjs";
+import { R as configSchema } from "./src-Cy74ZQfR.mjs";
+import { r as CliError } from "./client-Dw9ZovyI.mjs";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

package/dist/daemon.mjs

@@ -1,4 +1,4 @@
-import { A as taskKeySchema, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as configSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as SLACK_BOT_SCOPES } from "./src-VWyX7Nwm.mjs";
+import { A as taskKeySchema, B as SLACK_BOT_SCOPES, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as configSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as requiredSecretKeys } from "./src-Cy74ZQfR.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fstatSync, ftruncateSync, mkdirSync, openSync, readFileSync, readdirSync, writeSync } from "node:fs";
@@ -12736,6 +12736,11 @@ function retryAt(headers, now) {
 }
 //#endregion
 //#region ../adapters/src/github/client.ts
+function teamNameScopeDenied(error, query) {
+	if (error.type !== "INSUFFICIENT_SCOPES" || !query.includes("... on Team { name }")) return false;
+	if (error.path !== void 0) return error.path.includes("reviewRequests") && error.path.includes("requestedReviewer") && error.path.at(-1) === "name";
+	return /\bname\b/i.test(error.message) && /\bread:(?:org|discussion)\b/i.test(error.message);
+}
 function record$2(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new AdapterError("transient", "Malformed GitHub response");
 	return value;
@@ -12824,6 +12829,8 @@ var GithubClient = class {
 			status: 429,
 			headers: response.headers
 		}, Date.now());
+		if (errors.some((error) => teamNameScopeDenied(error, query))) throw new AdapterError("auth", "GitHub token needs read:org for team review requests");
+		if (errors.some((error) => error.type === "INSUFFICIENT_SCOPES")) throw new AdapterError("auth", "GitHub token lacks a required GraphQL read scope");
 		const data = record$2(wire.data);
 		const rate = record$2(data.rateLimit);
 		const remaining = rate.remaining;
@@ -13056,6 +13063,12 @@ function githubSources(config, options) {
 function scoped(errors, root) {
 	return errors.filter((error) => error.path?.[0] === root);
 }
+function checkAccessDenied(errors) {
+	return errors.some((error) => error.type === "FORBIDDEN" && error.path?.includes("statusCheckRollup") === true && error.path.includes("contexts"));
+}
+function requireCheckAccess(errors) {
+	if (checkAccessDenied(errors)) throw new AdapterError("auth", "GitHub token lacks Checks read permission");
+}
 function rejectUnscoped(errors, roots) {
 	if (errors.some((error) => error.path === void 0 || !roots.includes(String(error.path[0])))) throw new AdapterError("transient", "Unscoped GitHub GraphQL error");
 }
@@ -13097,6 +13110,7 @@ async function fullPr(client, pr, owner, name, number, signal, budget) {
 			}, signal);
 			budget(response.budget);
 			rejectUnscoped(response.errors, ["repository"]);
+			requireCheckAccess(response.errors);
 			if (response.errors.length > 0) return void 0;
 			const pagePr = record$2(nested(response.data, "repository", "pullRequest"));
 			const page = field === "contexts" ? contexts(pagePr) : record$2(pagePr[field]);
@@ -13154,6 +13168,7 @@ async function pollRepository({ id, repo, login, prefixes, client, ctx }) {
 	const found = discover(nodes, ctx.cursor, login);
 	const bootstrapCursor = bootstrap && discoveryOk ? latestUpdatedAt(connectionNodes(nested(response.data, "repository", "mergedBaseline")), found.cursor) ?? sourceCursorSchema.parse("1970-01-01T00:00:00.000Z") : void 0;
 	const process = async (number, wire, errors, ref) => {
+		requireCheckAccess(errors);
 		const error = errors[0];
 		if (error !== void 0) {
 			const direct = error.path === void 0 || error.path.length <= 2;
@@ -13457,6 +13472,7 @@ function createGithubIssuesAdapter(options) {
 //#endregion
 //#region ../adapters/src/jira/jira.ts
 const SEARCH_PAGE_LIMIT = 20;
+const MAX_GET_SEARCH_URL_LENGTH = 2e3;
 const OUTSIDE_BATCH_SIZE = 50;
 const FALLBACK_REQUEST_LIMIT = 100;
 const SPRINT_SCHEMA = "com.pyxis.greenhopper.jira:gh-sprint";
@@ -13571,6 +13587,7 @@ function createJiraAdapter(options) {
 			if (signal.aborted) throw new AdapterError("transient", "Jira poll aborted");
 			throw new AdapterError("transient", "Jira request failed");
 		}
+		if (response.status === 414 && options.searchMethod === "GET") throw new AdapterError("config", "Jira GET search URL is too long");
 		if (!response.ok) throw new JiraHttpError(response.status, classifyHttpFailure({
 			status: response.status,
 			headers: response.headers
@@ -13612,19 +13629,28 @@ function createJiraAdapter(options) {
 		const seen = /* @__PURE__ */ new Set();
 		for (let page = 0; page < SEARCH_PAGE_LIMIT; page += 1) {
 			beforePage?.();
-			const result = object$1(await request(tracker.baseUrl, "/rest/api/3/search/jql", signal, {
+			const fields = [
+				"summary",
+				"status",
+				"assignee",
+				"labels",
+				"updated",
+				...sprintField === null ? [] : [sprintField]
+			];
+			const body = {
 				jql,
 				maxResults: 100,
-				fields: [
-					"summary",
-					"status",
-					"assignee",
-					"labels",
-					"updated",
-					...sprintField === null ? [] : [sprintField]
-				],
+				fields,
 				...token === void 0 ? {} : { nextPageToken: token }
-			}));
+			};
+			const path = options.searchMethod === "GET" ? `/rest/api/3/search/jql?${new URLSearchParams({
+				jql,
+				maxResults: "100",
+				fields: fields.join(","),
+				...token === void 0 ? {} : { nextPageToken: token }
+			}).toString()}` : "/rest/api/3/search/jql";
+			if (options.searchMethod === "GET" && new URL(path, tracker.baseUrl).href.length > MAX_GET_SEARCH_URL_LENGTH) throw new AdapterError("config", `Jira GET search URL is too long (over ${String(MAX_GET_SEARCH_URL_LENGTH)} characters)`);
+			const result = object$1(await request(tracker.baseUrl, path, signal, options.searchMethod === "GET" ? void 0 : body));
 			issues.push(...array(result["issues"]));
 			const next = result["nextPageToken"];
 			if (next == null || next === "") {
@@ -13878,9 +13904,15 @@ function applyEntityOutcomes(input) {
 function startRunner(options) {
 	const startedAt = (options.now ?? Date.now)();
 	const sources = options.entries.map((entry) => runSource(entry, options, startedAt));
-	return { async stop() {
-		await Promise.all(sources.map((source) => source.stop()));
-	} };
+	return {
+		firstAttempts: Promise.all(sources.map(async (source) => ({
+			source: source.id,
+			outcome: await source.firstAttempt
+		}))),
+		async stop() {
+			await Promise.all(sources.map((source) => source.stop()));
+		}
+	};
 }
 function runSource(entry, options, runnerStartMs) {
 	const { adapter, reserveRemaining } = entry;
@@ -13954,7 +13986,7 @@ function runSource(entry, options, runnerStartMs) {
 		if (stopping) return;
 		pollTimer = setTimeout(() => {
 			pollTimer = void 0;
-			current = poll();
+			current = poll().then(() => void 0);
 		}, delayMs);
 	}
 	async function poll() {
@@ -14050,22 +14082,28 @@ function runSource(entry, options, runnerStartMs) {
 			now: now()
 		});
 		failures = delay.failures;
-		armDeadline();
+		if (!options.oneShot) armDeadline();
 		await report();
-		schedule(delay.delayMs);
+		if (!options.oneShot) schedule(delay.delayMs);
+		return outcome;
 	}
-	armDeadline();
-	current = poll();
-	return { async stop() {
-		stopping = true;
-		clearTimeout(pollTimer);
-		clearTimeout(deadlineTimer);
-		clearTimeout(hardBoundTimer);
-		pollTimer = deadlineTimer = hardBoundTimer = void 0;
-		controller?.abort();
-		await current;
-		await reports;
-	} };
+	if (!options.oneShot) armDeadline();
+	const firstAttempt = poll();
+	current = firstAttempt.then(() => void 0);
+	return {
+		id: source,
+		firstAttempt,
+		async stop() {
+			stopping = true;
+			clearTimeout(pollTimer);
+			clearTimeout(deadlineTimer);
+			clearTimeout(hardBoundTimer);
+			pollTimer = deadlineTimer = hardBoundTimer = void 0;
+			controller?.abort();
+			await current;
+			await reports;
+		}
+	};
 }
 /**
 * Settles with `work`, or with undefined as soon as `signal` aborts, so `stop()` never waits
@@ -14325,7 +14363,8 @@ function startAdapters(config, core, options = {}) {
 			},
 			intervalMs: config.adapters.jira.intervalMs,
 			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			warn: options.warn ?? (() => void 0)
+			warn: options.warn ?? (() => void 0),
+			...options.jiraSearchMethod === void 0 ? {} : { searchMethod: options.jiraSearchMethod }
 		}) : blindSource(id, config.adapters.jira.intervalMs, "Jira credential is missing") });
 	} else {
 		const id = `github-issues:${project.id}:${project.tracker.repo.toLowerCase()}`;
@@ -14362,12 +14401,16 @@ function startAdapters(config, core, options = {}) {
 		}) }],
 		core,
 		config,
-		...options.now === void 0 ? {} : { now: options.now }
+		...options.now === void 0 ? {} : { now: options.now },
+		...options.oneShot === void 0 ? {} : { oneShot: options.oneShot }
 	});
-	return { async stop() {
-		await runner.stop();
-		await Promise.allSettled([...notices]);
-	} };
+	return {
+		firstAttempts: runner.firstAttempts,
+		async stop() {
+			await runner.stop();
+			await Promise.allSettled([...notices]);
+		}
+	};
 }
 //#endregion
 //#region ../gateway-slack/src/api.ts
@@ -15518,11 +15561,7 @@ async function runDaemonDoctor(ctx, productVersion, fetcher = fetch) {
 	const checks = [];
 	const jiraTrackers = config.projects.flatMap((project) => project.tracker.type === "jira" ? [project.tracker] : []);
 	const slackConfigured = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
-	const missing = [
-		"GITHUB_TOKEN",
-		...jiraTrackers.length > 0 ? ["JIRA_EMAIL", "JIRA_API_TOKEN"] : [],
-		...slackConfigured ? ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"] : []
-	].filter((name) => !secrets[name]);
+	const missing = requiredSecretKeys(config).filter((name) => !secrets[name]);
 	checks.push(check("secrets", missing.length === 0, `Add ${missing.join(", ")} to the private secrets.env file.`));
 	const jiraEmail = secrets["JIRA_EMAIL"];
 	const jiraToken = secrets["JIRA_API_TOKEN"];

package/dist/mcp.mjs

@@ -1,6 +1,6 @@
-import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-VWyX7Nwm.mjs";
-import { r as CliError, t as requestOperation } from "./client-BnkZmz1i.mjs";
-import { n as loadClientConfig } from "./config-UyXnaekw.mjs";
+import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-Cy74ZQfR.mjs";
+import { r as CliError, t as requestOperation } from "./client-Dw9ZovyI.mjs";
+import { n as loadClientConfig } from "./config-CeDZQlvy.mjs";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { z } from "zod";

package/dist/{src-VWyX7Nwm.mjs → src-Cy74ZQfR.mjs}

@@ -303,6 +303,49 @@ const configSchema = z.strictObject({
 		}).prefault({})
 	}).prefault({})
 });
+/** Recognized names in the private secrets.env file; values never belong in config.yaml. */
+const SECRET_ENV_KEYS = [
+	{
+		name: "GITHUB_TOKEN",
+		requiredWhen: "always",
+		purpose: "Read GitHub repositories and check runs."
+	},
+	{
+		name: "JIRA_EMAIL",
+		requiredWhen: "jira",
+		purpose: "Jira account email."
+	},
+	{
+		name: "JIRA_API_TOKEN",
+		requiredWhen: "jira",
+		purpose: "Jira API token."
+	},
+	{
+		name: "SLACK_BOT_TOKEN",
+		requiredWhen: "slack",
+		purpose: "Slack bot Web API token."
+	},
+	{
+		name: "SLACK_APP_TOKEN",
+		requiredWhen: "slack",
+		purpose: "Slack app-level Socket Mode token."
+	},
+	{
+		name: "SLACK_APP_CONFIG_TOKEN",
+		requiredWhen: "optional",
+		purpose: "Verify the installed slash command through the Slack app manifest API."
+	},
+	{
+		name: "SLACK_API_URL",
+		requiredWhen: "optional",
+		purpose: "Override the Slack API URL for local testing."
+	}
+];
+function requiredSecretKeys(config) {
+	const jira = config.projects.some((project) => project.tracker.type === "jira");
+	const slack = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
+	return SECRET_ENV_KEYS.filter(({ requiredWhen }) => requiredWhen === "always" || requiredWhen === "jira" && jira || requiredWhen === "slack" && slack).map(({ name }) => name);
+}
 //#endregion
 //#region ../contracts/src/errors.ts
 /**
@@ -2635,4 +2678,4 @@ var AdapterError = class extends Error {
 	}
 };
 //#endregion
-export { taskKeySchema as A, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, DEFAULT_SLACK_APP_NAME as I, DEFAULT_SLACK_COMMAND as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, configSchema as R, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y, SLACK_BOT_SCOPES as z };
+export { taskKeySchema as A, SLACK_BOT_SCOPES as B, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, DEFAULT_SLACK_APP_NAME as I, DEFAULT_SLACK_COMMAND as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, configSchema as R, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y, requiredSecretKeys as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spur-board",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "license": "MIT",
   "engines": {
     "node": "^24.12.0 || ^26.0.0"