fix(pm-discovery): promote JIRA baseUrl from config into discovery credentials

[zbigniewsobiecki]

Summary

• Fixes production "Internal server error" on the JIRA wizard's Select Project step in edit mode (reproed today on ua-store).
• Adds a generic configToCredentials(config) manifest hook so providers can promote non-secret connection fields from project_integrations.config into the discovery credentials bag — JIRA wires it to promote baseUrl → base_url.
• Preserves the spec-009 "new provider touches zero shared files" invariant (new-provider-surface.test.ts still green).

Root cause

Regression from spec 010/2 (generic pm.discovery.discover). JIRA's baseUrl lives on project_integrations.config, not project_credentials. The resolver only iterated credentialRoles → returned {email, api_token} with no base_url. createDiscoveryProvider then built new Version3Client({ host: '' }) → jira.js threw "Couldn't parse the host URL."

Legacy jiraProjectsByProject (deleted in 010/2) read baseUrl directly from integration config. The generic replacement lost that step.

First-time wizard setup was unaffected (wizard passes credentials: { email, api_token, base_url } explicitly). Edit-mode re-verification broke.

Fix shape

New optional manifest field:

readonly configToCredentials?: (config: unknown) => Record<string, string>;

• Invoked on projectId path of resolvePMCredentials, not on the explicit-credentials path.
• project_credentials values win on key collision — DB secret always beats config-derived default.
• Malformed hook returns / throws are caught + logged; one bad provider can't take down discovery for all.

JIRA implementation:

configToCredentials: (config) => {
  if (!config || typeof config !== 'object') return {};
  const baseUrl = (config as { baseUrl?: unknown }).baseUrl;
  return typeof baseUrl === 'string' && baseUrl.length > 0
    ? { base_url: baseUrl }
    : {};
}

Extracted helpers (promoteConfigCredentials, loadIntegrationAndManifest) keep resolvePMCredentials under biome's cognitive-complexity threshold.

Tests (11 new cases, all green)

• tests/unit/api/pm-discovery.test.ts — 4 router cases: hook is merged, DB creds win on collision, no-hook providers still work, hook not invoked on explicit-credentials path.
• tests/unit/pm/jira/manifest-config-to-credentials.test.ts — 7 unit cases pinning the JIRA hook contract (missing / empty / non-string / null / nested / unrelated fields).

Hygiene

• Fixed all 12 pre-existing biome warnings surfaced by my changes (complexity + test non-null-assertions).
• Documented configToCredentials in src/integrations/README.md.
• npm run lint, npm run typecheck, and npx vitest run --project unit-api --project unit-core all clean (6398 tests pass).

Test plan

• Unit: 6398 tests pass locally
• Lint: 0 errors, 0 warnings
• Typecheck: clean
• PM conformance harness: 72/72 passing for all providers
• CI green
• Manual verification on prod: reopen ua-store JIRA wizard → Select Project loads project list instead of "Internal server error"

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 62.12121% with 25 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/api/routers/pm-discovery.ts	58.33%	24 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!