@aitne/daemon 0.1.0

package/dist/services/fts5.d.ts

@@ -0,0 +1,40 @@
+/**
+ * FTS5 query-string sanitization helpers.
+ *
+ * SQLite FTS5 MATCH accepts a small DSL with operators (`AND`, `OR`, `NOT`,
+ * `NEAR/N`), column filters (`column:term`), wildcards (`prefix*`), and
+ * quoted phrases (`"exact phrase"`). Punctuation like `"` and `:` carries
+ * meaning; unsanitized user input either changes the search semantics
+ * unintentionally (`OR` between unrelated terms) or trips
+ * `SQLITE_ERROR: fts5: syntax error` and surfaces a 5xx.
+ *
+ * The chokepoint is `buildMatchExpression`: it tokenizes the user query on
+ * whitespace, doubles any internal `"`, and wraps each token in double
+ * quotes so the FTS5 parser sees a sequence of literal phrases AND-joined
+ * (the implicit operator). Operator keywords (`OR`, `NEAR`) get the same
+ * treatment as any other token — when wrapped in `"..."` they are phrase
+ * tokens, not operators.
+ *
+ * Used by the multi-mail provider local search (`mail-search.ts`) and the
+ * `/api/docs/search` endpoint. Any future FTS5 surface that takes a raw
+ * user query MUST route through here.
+ */
+/**
+ * Quote every whitespace-separated token as an FTS5 phrase so arbitrary
+ * user input does not trip the operator grammar. Returns `null` when the
+ * query has no tokens; callers should short-circuit to an empty result
+ * (matches "nothing").
+ */
+export declare function buildMatchExpression(query: string): string | null;
+/**
+ * Returns true when every code point in `q` is in the printable ASCII
+ * range. Used by `/api/docs/search` (DOCS-QA-SEARCH-PRECISION-PLAN.md §7)
+ * to dispatch ASCII-only queries to the `unicode61` word index and CJK /
+ * mixed queries to the trigram substring index. Whitespace counts as
+ * ASCII, so a Latin-only query with leading/trailing spaces still routes
+ * to the word index. Empty input is ASCII-only by vacuous truth (the
+ * caller separately short-circuits an empty query through
+ * `buildMatchExpression`'s null return).
+ */
+export declare function isAsciiOnlyQuery(q: string): boolean;
+//# sourceMappingURL=fts5.d.ts.map

package/dist/services/fts5.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fts5.d.ts","sourceRoot":"","sources":["../../src/services/fts5.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAKnD"}

package/dist/services/fts5.js

@@ -0,0 +1,54 @@
+/**
+ * FTS5 query-string sanitization helpers.
+ *
+ * SQLite FTS5 MATCH accepts a small DSL with operators (`AND`, `OR`, `NOT`,
+ * `NEAR/N`), column filters (`column:term`), wildcards (`prefix*`), and
+ * quoted phrases (`"exact phrase"`). Punctuation like `"` and `:` carries
+ * meaning; unsanitized user input either changes the search semantics
+ * unintentionally (`OR` between unrelated terms) or trips
+ * `SQLITE_ERROR: fts5: syntax error` and surfaces a 5xx.
+ *
+ * The chokepoint is `buildMatchExpression`: it tokenizes the user query on
+ * whitespace, doubles any internal `"`, and wraps each token in double
+ * quotes so the FTS5 parser sees a sequence of literal phrases AND-joined
+ * (the implicit operator). Operator keywords (`OR`, `NEAR`) get the same
+ * treatment as any other token — when wrapped in `"..."` they are phrase
+ * tokens, not operators.
+ *
+ * Used by the multi-mail provider local search (`mail-search.ts`) and the
+ * `/api/docs/search` endpoint. Any future FTS5 surface that takes a raw
+ * user query MUST route through here.
+ */
+/**
+ * Quote every whitespace-separated token as an FTS5 phrase so arbitrary
+ * user input does not trip the operator grammar. Returns `null` when the
+ * query has no tokens; callers should short-circuit to an empty result
+ * (matches "nothing").
+ */
+export function buildMatchExpression(query) {
+    const tokens = query
+        .split(/\s+/)
+        .map((t) => t.trim())
+        .filter((t) => t.length > 0);
+    if (tokens.length === 0)
+        return null;
+    return tokens.map((t) => `"${t.replace(/"/g, '""')}"`).join(" ");
+}
+/**
+ * Returns true when every code point in `q` is in the printable ASCII
+ * range. Used by `/api/docs/search` (DOCS-QA-SEARCH-PRECISION-PLAN.md §7)
+ * to dispatch ASCII-only queries to the `unicode61` word index and CJK /
+ * mixed queries to the trigram substring index. Whitespace counts as
+ * ASCII, so a Latin-only query with leading/trailing spaces still routes
+ * to the word index. Empty input is ASCII-only by vacuous truth (the
+ * caller separately short-circuits an empty query through
+ * `buildMatchExpression`'s null return).
+ */
+export function isAsciiOnlyQuery(q) {
+    for (let i = 0; i < q.length; i += 1) {
+        if (q.charCodeAt(i) > 0x7f)
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=fts5.js.map

package/dist/services/fts5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fts5.js","sourceRoot":"","sources":["../../src/services/fts5.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,MAAM,GAAG,KAAK;SACjB,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/git-account-registry.d.ts

@@ -0,0 +1,164 @@
+/**
+ * GitAccountRegistry — resolves per-alias credentials for multi-account
+ * Git/GitHub setups (P5 of `docs/design/backlog/git-lifecycle-and-triggers.md`).
+ *
+ * Two auth modes:
+ *   • `pat-keychain`: PAT stored in the OS keychain at `git.account.<alias>`
+ *     and fetched via `SecretBroker.getScoped(...)`. Owner-supplied via the
+ *     dashboard or `PUT /api/git-accounts/:alias/token`.
+ *   • `gh-cli-profile`: token resolved on demand via `gh auth token --user
+ *     <ghProfile> --hostname <host>`. `gh` remains the credential source of
+ *     truth — token rotation, revocation, and SSO refresh continue to flow
+ *     through `gh auth login` / `gh auth refresh`.
+ *
+ * The registry exposes two APIs:
+ *   • `resolveCredentials(alias)` returns the active token for an alias
+ *     (cached per resolver instance during the surrounding poll cycle).
+ *   • `buildSpawnEnv(alias, base)` overlays the credential variables
+ *     (`GH_TOKEN`, `GITHUB_TOKEN`, `GIT_ASKPASS`, `PA_GIT_TOKEN`,
+ *     `GIT_TERMINAL_PROMPT=0`) onto a base env block so an `execFile`
+ *     against `gh` or `git` picks up the correct auth without disturbing
+ *     the user's session-level `gh auth switch` state.
+ *
+ * Direct mode only — Delegated mode currently relies on the default `gh`
+ * profile inside the spawned backend session. Plumbing per-account env
+ * through `delegated-task-runtime` is a separate change tracked by P5
+ * Decision 4 (third paragraph).
+ */
+import type { SecretBroker } from "../secrets/secret-broker.js";
+import type { GitAccountSetting } from "../settings/runtime-settings.js";
+export interface GitAccountSnapshot {
+    alias: string;
+    /** Defaults to `github.com` when unset by the user. */
+    host: string;
+    type: GitAccountSetting["type"];
+    authMode: GitAccountSetting["authMode"];
+    ghProfile?: string;
+}
+export interface GitAccountRegistryOptions {
+    dataDir: string;
+    secretBroker: SecretBroker;
+    /**
+     * Reader the registry consults at every call. The caller passes a
+     * function rather than a snapshot so config PATCHes flow through
+     * without re-instantiation.
+     */
+    getAccounts: () => Record<string, GitAccountSetting>;
+    /**
+     * Test seam — replaces the `gh auth token --user X --hostname Y` shell
+     * call. Production uses `execFile("gh", ...)`.
+     */
+    ghTokenResolver?: (account: GitAccountSnapshot) => Promise<string | null>;
+    /**
+     * Test seam — overrides the askpass helper path. When unset, the
+     * registry materializes `<dataDir>/runtime/git-askpass.{sh,cmd}` lazily
+     * on first env build.
+     */
+    askpassPath?: string;
+    /** Test seam — production uses `process.platform`. */
+    platform?: NodeJS.Platform;
+}
+export interface GitSpawnCredentials {
+    token: string;
+    host: string;
+}
+/**
+ * Output of `buildSpawnEnv`. The shape is identical to
+ * `child_process.execFile`'s `env` option (string values only) so the
+ * caller can spread directly into the options object.
+ */
+export type GitSpawnEnv = NodeJS.ProcessEnv;
+export declare class GitAccountRegistry {
+    private readonly dataDir;
+    private readonly secretBroker;
+    private readonly getAccounts;
+    private readonly ghTokenResolver;
+    private readonly platform;
+    private readonly askpassPath;
+    private askpassMaterialized;
+    constructor(opts: GitAccountRegistryOptions);
+    /**
+     * Look up an account by alias. Returns null when the alias is unknown
+     * (the caller treats this as "no per-call env" rather than an error —
+     * a stray repo config left without an alias should poll, not silently
+     * fail).
+     */
+    getAccount(alias: string): GitAccountSnapshot | null;
+    listAccounts(): GitAccountSnapshot[];
+    /**
+     * Resolve the active credential for an alias. Returns null when the
+     * alias is unknown OR the token store is empty (PAT path) or `gh auth
+     * token` exits non-zero (CLI-profile path). Callers fall back to the
+     * default `gh` profile in either case.
+     */
+    resolveCredentials(alias: string): Promise<GitSpawnCredentials | null>;
+    /**
+     * Build a spawn-env overlay for an `execFile` against `gh` or `git`.
+     * Returns `null` when the alias resolves to no credentials — callers
+     * treat null as "use default `gh` profile" (observers continue to
+     * fire under the daemon's own env). Returning a typed sentinel
+     * instead of `base` unchanged means a future caller passing a custom
+     * base cannot ambiguously confuse "no overlay" with a base that
+     * happens to carry a stray `GH_TOKEN`.
+     *
+     * The overlay sets:
+     *   • `GH_TOKEN` / `GITHUB_TOKEN` — picked up by `gh` automatically.
+     *   • `GH_HOST` — only when the account uses a non-default host (GHES).
+     *     Setting it on `github.com` is harmless but `gh` warns about it.
+     *   • `GIT_ASKPASS` + `PA_GIT_TOKEN` + `GIT_TERMINAL_PROMPT=0` — for
+     *     raw `git fetch` / `git ls-remote` against HTTPS remotes. The
+     *     askpass script reads `PA_GIT_TOKEN` from the spawn env and
+     *     writes it to stdout when git asks for a password.
+     *     `GIT_TERMINAL_PROMPT=0` ensures git fails fast instead of
+     *     blocking on a TTY prompt if the askpass script is somehow
+     *     unreadable.
+     */
+    buildSpawnEnv(alias: string | undefined, base?: GitSpawnEnv): Promise<GitSpawnEnv | null>;
+    /**
+     * Materialize the askpass helper under `<dataDir>/runtime/`. POSIX gets an
+     * executable `git-askpass.sh`; Windows gets `git-askpass.cmd`, because Git
+     * for Windows cannot execute a shebang shell script through CreateProcess.
+     * Idempotent — content is identical across runs, so re-writing on every boot
+     * is a no-op.
+     *
+     * Decision 1 (no client-side hook injection): the script lives entirely
+     * inside `~/.personal-agent/`, so `aitne uninstall` removes it cleanly
+     * when the dataDir is deleted.
+     */
+    private ensureAskpass;
+    /** Test-only: reset the materialization latch so a fresh boot path can re-write. */
+    resetAskpassForTest(): void;
+    /** Path of the askpass helper for diagnostic logging or tests. */
+    getAskpassPath(): string;
+}
+/**
+ * Probe a resolved credential by calling `gh api user --hostname X`.
+ * Used by `POST /api/git-accounts/:alias/probe` to surface mis-paired
+ * tokens before the user closes the dashboard. Returns
+ * `{ok:true, login}` on success, `{ok:false, reason}` otherwise.
+ *
+ * Exported separately from the class because a probe is a one-shot
+ * orchestration and shouldn't be reachable from random observer code —
+ * keeping it as a free function makes the audit surface obvious.
+ */
+export declare function probeGitAccount(registry: GitAccountRegistry, alias: string, options?: {
+    ghBin?: string;
+    timeoutMs?: number;
+}): Promise<{
+    ok: true;
+    login: string;
+    host: string;
+} | {
+    ok: false;
+    reason: string;
+}>;
+/** Re-export for callers that already import the type from runtime-settings. */
+export type { GitAccountSetting };
+/** Test seam — also export the askpass bodies so tests can assert them byte-for-byte. */
+export declare const __ASKPASS_BODY_FOR_TEST = "#!/bin/sh\n[ -n \"$PA_GIT_TOKEN\" ] && printf '%s\\n' \"$PA_GIT_TOKEN\"\n";
+export declare const __ASKPASS_RELATIVE_PATH_FOR_TEST = "runtime/git-askpass.sh";
+export declare const __ASKPASS_WINDOWS_BODY_FOR_TEST = "@echo off\r\nif defined PA_GIT_TOKEN echo(%PA_GIT_TOKEN%\r\n";
+export declare const __ASKPASS_WINDOWS_RELATIVE_PATH_FOR_TEST = "runtime/git-askpass.cmd";
+/** Existence check for tests that materialize a registry and then assert the file. */
+export declare function askpassFileExists(path: string): boolean;
+//# sourceMappingURL=git-account-registry.d.ts.map

package/dist/services/git-account-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-account-registry.d.ts","sourceRoot":"","sources":["../../src/services/git-account-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAmCzE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;OAIG;IACH,WAAW,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACrD;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;AAE5C,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0C;IACtE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAEJ;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,mBAAmB,CAAS;gBAExB,IAAI,EAAE,yBAAyB;IAW3C;;;;;OAKG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAYpD,YAAY,IAAI,kBAAkB,EAAE;IAapC;;;;;OAKG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAuBtC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE,WAAyB,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAqB9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IAuBrB,oFAAoF;IACpF,mBAAmB,IAAI,IAAI;IAI3B,kEAAkE;IAClE,cAAc,IAAI,MAAM;CAGzB;AAoCD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CACN;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAChC,CA4BA;AAED,gFAAgF;AAChF,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,8EAAqB,CAAC;AAC1D,eAAO,MAAM,gCAAgC,2BAA8B,CAAC;AAC5E,eAAO,MAAM,+BAA+B,iEAAuB,CAAC;AACpE,eAAO,MAAM,wCAAwC,4BACtB,CAAC;AAEhC,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/services/git-account-registry.js

@@ -0,0 +1,297 @@
+/**
+ * GitAccountRegistry — resolves per-alias credentials for multi-account
+ * Git/GitHub setups (P5 of `docs/design/backlog/git-lifecycle-and-triggers.md`).
+ *
+ * Two auth modes:
+ *   • `pat-keychain`: PAT stored in the OS keychain at `git.account.<alias>`
+ *     and fetched via `SecretBroker.getScoped(...)`. Owner-supplied via the
+ *     dashboard or `PUT /api/git-accounts/:alias/token`.
+ *   • `gh-cli-profile`: token resolved on demand via `gh auth token --user
+ *     <ghProfile> --hostname <host>`. `gh` remains the credential source of
+ *     truth — token rotation, revocation, and SSO refresh continue to flow
+ *     through `gh auth login` / `gh auth refresh`.
+ *
+ * The registry exposes two APIs:
+ *   • `resolveCredentials(alias)` returns the active token for an alias
+ *     (cached per resolver instance during the surrounding poll cycle).
+ *   • `buildSpawnEnv(alias, base)` overlays the credential variables
+ *     (`GH_TOKEN`, `GITHUB_TOKEN`, `GIT_ASKPASS`, `PA_GIT_TOKEN`,
+ *     `GIT_TERMINAL_PROMPT=0`) onto a base env block so an `execFile`
+ *     against `gh` or `git` picks up the correct auth without disturbing
+ *     the user's session-level `gh auth switch` state.
+ *
+ * Direct mode only — Delegated mode currently relies on the default `gh`
+ * profile inside the spawned backend session. Plumbing per-account env
+ * through `delegated-task-runtime` is a separate change tracked by P5
+ * Decision 4 (third paragraph).
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { createLogger } from "../logging.js";
+import { scopedSecretName } from "../secrets/secret-names.js";
+const execFileAsync = promisify(execFile);
+const logger = createLogger("git-account-registry");
+/**
+ * Wall-clock timeout for `gh auth token` resolution. The CLI is local —
+ * five seconds is generous; longer suggests a stuck OAuth refresh that
+ * should fail fast so the poll falls back to no env injection.
+ */
+const GH_TOKEN_RESOLVE_TIMEOUT_MS = 5_000;
+/**
+ * Askpass helpers echo `PA_GIT_TOKEN` followed by a single newline so
+ * `git fetch` accepts the value as the password line. PATs / OAuth tokens
+ * currently fit the character set this handles safely and have no embedded
+ * newlines; if that credential contract changes, re-check both helpers.
+ * POSIX intentionally uses `printf` instead of `echo` because some shells
+ * treat backslashes specially.
+ */
+const ASKPASS_POSIX_BODY = "#!/bin/sh\n[ -n \"$PA_GIT_TOKEN\" ] && printf '%s\\n' \"$PA_GIT_TOKEN\"\n";
+const ASKPASS_WINDOWS_BODY = "@echo off\r\nif defined PA_GIT_TOKEN echo(%PA_GIT_TOKEN%\r\n";
+const ASKPASS_POSIX_RELATIVE_PATH = "runtime/git-askpass.sh";
+const ASKPASS_WINDOWS_RELATIVE_PATH = "runtime/git-askpass.cmd";
+function askpassBodyForPlatform(platform) {
+    return platform === "win32" ? ASKPASS_WINDOWS_BODY : ASKPASS_POSIX_BODY;
+}
+function askpassRelativePathForPlatform(platform) {
+    return platform === "win32"
+        ? ASKPASS_WINDOWS_RELATIVE_PATH
+        : ASKPASS_POSIX_RELATIVE_PATH;
+}
+export class GitAccountRegistry {
+    dataDir;
+    secretBroker;
+    getAccounts;
+    ghTokenResolver;
+    platform;
+    askpassPath;
+    askpassMaterialized = false;
+    constructor(opts) {
+        this.dataDir = opts.dataDir;
+        this.secretBroker = opts.secretBroker;
+        this.getAccounts = opts.getAccounts;
+        this.ghTokenResolver = opts.ghTokenResolver ?? defaultGhTokenResolver;
+        this.platform = opts.platform ?? process.platform;
+        this.askpassPath =
+            opts.askpassPath
+                ?? resolve(opts.dataDir, askpassRelativePathForPlatform(this.platform));
+    }
+    /**
+     * Look up an account by alias. Returns null when the alias is unknown
+     * (the caller treats this as "no per-call env" rather than an error —
+     * a stray repo config left without an alias should poll, not silently
+     * fail).
+     */
+    getAccount(alias) {
+        const raw = this.getAccounts()[alias];
+        if (!raw)
+            return null;
+        return {
+            alias,
+            host: raw.host || "github.com",
+            type: raw.type,
+            authMode: raw.authMode,
+            ghProfile: raw.ghProfile,
+        };
+    }
+    listAccounts() {
+        const accounts = this.getAccounts();
+        return Object.entries(accounts)
+            .map(([alias, raw]) => ({
+            alias,
+            host: raw.host || "github.com",
+            type: raw.type,
+            authMode: raw.authMode,
+            ghProfile: raw.ghProfile,
+        }))
+            .sort((a, b) => a.alias.localeCompare(b.alias));
+    }
+    /**
+     * Resolve the active credential for an alias. Returns null when the
+     * alias is unknown OR the token store is empty (PAT path) or `gh auth
+     * token` exits non-zero (CLI-profile path). Callers fall back to the
+     * default `gh` profile in either case.
+     */
+    async resolveCredentials(alias) {
+        const account = this.getAccount(alias);
+        if (!account)
+            return null;
+        if (account.authMode === "pat-keychain") {
+            const token = await this.secretBroker.getScoped(scopedSecretName("git.account", alias));
+            if (!token)
+                return null;
+            return { token, host: account.host };
+        }
+        if (account.authMode === "gh-cli-profile") {
+            const token = await this.ghTokenResolver(account);
+            if (!token)
+                return null;
+            return { token, host: account.host };
+        }
+        // Exhaustiveness guard — narrows `account.authMode` to never. If a new
+        // mode is added to the schema this branch surfaces it at compile time.
+        /* c8 ignore next 4 */
+        const _exhaustive = account.authMode;
+        void _exhaustive;
+        return null;
+    }
+    /**
+     * Build a spawn-env overlay for an `execFile` against `gh` or `git`.
+     * Returns `null` when the alias resolves to no credentials — callers
+     * treat null as "use default `gh` profile" (observers continue to
+     * fire under the daemon's own env). Returning a typed sentinel
+     * instead of `base` unchanged means a future caller passing a custom
+     * base cannot ambiguously confuse "no overlay" with a base that
+     * happens to carry a stray `GH_TOKEN`.
+     *
+     * The overlay sets:
+     *   • `GH_TOKEN` / `GITHUB_TOKEN` — picked up by `gh` automatically.
+     *   • `GH_HOST` — only when the account uses a non-default host (GHES).
+     *     Setting it on `github.com` is harmless but `gh` warns about it.
+     *   • `GIT_ASKPASS` + `PA_GIT_TOKEN` + `GIT_TERMINAL_PROMPT=0` — for
+     *     raw `git fetch` / `git ls-remote` against HTTPS remotes. The
+     *     askpass script reads `PA_GIT_TOKEN` from the spawn env and
+     *     writes it to stdout when git asks for a password.
+     *     `GIT_TERMINAL_PROMPT=0` ensures git fails fast instead of
+     *     blocking on a TTY prompt if the askpass script is somehow
+     *     unreadable.
+     */
+    async buildSpawnEnv(alias, base = process.env) {
+        if (!alias)
+            return null;
+        const creds = await this.resolveCredentials(alias);
+        if (!creds)
+            return null;
+        this.ensureAskpass();
+        const overlay = {
+            ...base,
+            GH_TOKEN: creds.token,
+            GITHUB_TOKEN: creds.token,
+            PA_GIT_TOKEN: creds.token,
+            GIT_ASKPASS: this.askpassPath,
+            GIT_TERMINAL_PROMPT: "0",
+        };
+        if (creds.host && creds.host !== "github.com") {
+            overlay.GH_HOST = creds.host;
+        }
+        return overlay;
+    }
+    /**
+     * Materialize the askpass helper under `<dataDir>/runtime/`. POSIX gets an
+     * executable `git-askpass.sh`; Windows gets `git-askpass.cmd`, because Git
+     * for Windows cannot execute a shebang shell script through CreateProcess.
+     * Idempotent — content is identical across runs, so re-writing on every boot
+     * is a no-op.
+     *
+     * Decision 1 (no client-side hook injection): the script lives entirely
+     * inside `~/.personal-agent/`, so `aitne uninstall` removes it cleanly
+     * when the dataDir is deleted.
+     */
+    ensureAskpass() {
+        if (this.askpassMaterialized)
+            return;
+        try {
+            mkdirSync(dirname(this.askpassPath), { recursive: true });
+            writeFileSync(this.askpassPath, askpassBodyForPlatform(this.platform), {
+                encoding: "utf-8",
+            });
+            if (this.platform !== "win32") {
+                chmodSync(this.askpassPath, 0o700);
+            }
+            this.askpassMaterialized = true;
+        }
+        catch (err) {
+            // Materialization failures are non-fatal but worth logging — the
+            // observer keeps polling with no env injection (which falls back to
+            // the default gh profile). A warning surfaces the misconfig without
+            // taking down the watcher.
+            logger.warn({ err, askpassPath: this.askpassPath }, "Failed to materialize git askpass helper — falling back to default gh profile");
+        }
+    }
+    /** Test-only: reset the materialization latch so a fresh boot path can re-write. */
+    resetAskpassForTest() {
+        this.askpassMaterialized = false;
+    }
+    /** Path of the askpass helper for diagnostic logging or tests. */
+    getAskpassPath() {
+        return this.askpassPath;
+    }
+}
+/**
+ * Default `gh auth token` resolver. Returns null on any non-zero exit;
+ * callers treat that as "use default profile". Stderr is logged at debug
+ * because a missing-account error is expected when an alias is misconfigured
+ * mid-rotation.
+ */
+async function defaultGhTokenResolver(account) {
+    if (!account.ghProfile)
+        return null;
+    try {
+        const { stdout } = await execFileAsync("gh", [
+            "auth",
+            "token",
+            "--user",
+            account.ghProfile,
+            "--hostname",
+            account.host,
+        ], { timeout: GH_TOKEN_RESOLVE_TIMEOUT_MS, encoding: "utf-8" });
+        const token = stdout.trim();
+        return token.length > 0 ? token : null;
+    }
+    catch (err) {
+        logger.debug({ alias: account.alias, host: account.host, err }, "gh auth token resolution failed");
+        return null;
+    }
+}
+/**
+ * Probe a resolved credential by calling `gh api user --hostname X`.
+ * Used by `POST /api/git-accounts/:alias/probe` to surface mis-paired
+ * tokens before the user closes the dashboard. Returns
+ * `{ok:true, login}` on success, `{ok:false, reason}` otherwise.
+ *
+ * Exported separately from the class because a probe is a one-shot
+ * orchestration and shouldn't be reachable from random observer code —
+ * keeping it as a free function makes the audit surface obvious.
+ */
+export async function probeGitAccount(registry, alias, options = {}) {
+    const account = registry.getAccount(alias);
+    if (!account)
+        return { ok: false, reason: "unknown_alias" };
+    const env = await registry.buildSpawnEnv(alias);
+    if (!env || !env.GH_TOKEN) {
+        return { ok: false, reason: "no_credential" };
+    }
+    try {
+        const { stdout } = await execFileAsync(options.ghBin ?? "gh", ["api", "user", "--hostname", account.host, "--jq", ".login"], {
+            env,
+            timeout: options.timeoutMs ?? 10_000,
+            encoding: "utf-8",
+        });
+        const login = stdout.trim();
+        if (!login)
+            return { ok: false, reason: "empty_response" };
+        return { ok: true, login, host: account.host };
+    }
+    catch (err) {
+        /* c8 ignore next */
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("ENOENT"))
+            return { ok: false, reason: "gh_missing" };
+        if (message.includes("401"))
+            return { ok: false, reason: "unauthorized" };
+        if (message.includes("404"))
+            return { ok: false, reason: "not_found" };
+        return { ok: false, reason: "probe_failed" };
+    }
+}
+/** Test seam — also export the askpass bodies so tests can assert them byte-for-byte. */
+export const __ASKPASS_BODY_FOR_TEST = ASKPASS_POSIX_BODY;
+export const __ASKPASS_RELATIVE_PATH_FOR_TEST = ASKPASS_POSIX_RELATIVE_PATH;
+export const __ASKPASS_WINDOWS_BODY_FOR_TEST = ASKPASS_WINDOWS_BODY;
+export const __ASKPASS_WINDOWS_RELATIVE_PATH_FOR_TEST = ASKPASS_WINDOWS_RELATIVE_PATH;
+/** Existence check for tests that materialize a registry and then assert the file. */
+export function askpassFileExists(path) {
+    return existsSync(path);
+}
+//# sourceMappingURL=git-account-registry.js.map

package/dist/services/git-account-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-account-registry.js","sourceRoot":"","sources":["../../src/services/git-account-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,2EAA2E,CAAC;AACvG,MAAM,oBAAoB,GAAG,8DAA8D,CAAC;AAC5F,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAC7D,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEhE,SAAS,sBAAsB,CAAC,QAAyB;IACvD,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC1E,CAAC;AAED,SAAS,8BAA8B,CAAC,QAAyB;IAC/D,OAAO,QAAQ,KAAK,OAAO;QACzB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,2BAA2B,CAAC;AAClC,CAAC;AA+CD,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAS;IAChB,YAAY,CAAe;IAC3B,WAAW,CAA0C;IACrD,eAAe,CAEJ;IACX,QAAQ,CAAkB;IAC1B,WAAW,CAAS;IAC7B,mBAAmB,GAAG,KAAK,CAAC;IAEpC,YAAY,IAA+B;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAC;QACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAClD,IAAI,CAAC,WAAW;YACd,IAAI,CAAC,WAAW;mBACb,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,KAAa;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,KAAK;YACL,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,YAAY;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED,YAAY;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;aAC5B,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,KAAK;YACL,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,YAAY;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa;QAEb,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,OAAO,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAC7C,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,CACvC,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,sBAAsB;QACtB,MAAM,WAAW,GAAU,OAAO,CAAC,QAAQ,CAAC;QAC5C,KAAK,WAAW,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,aAAa,CACjB,KAAyB,EACzB,OAAoB,OAAO,CAAC,GAAG;QAE/B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,OAAO,GAAgB;YAC3B,GAAG,IAAI;YACP,QAAQ,EAAE,KAAK,CAAC,KAAK;YACrB,YAAY,EAAE,KAAK,CAAC,KAAK;YACzB,YAAY,EAAE,KAAK,CAAC,KAAK;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,mBAAmB,EAAE,GAAG;SACzB,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9C,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC/B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACK,aAAa;QACnB,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO;QACrC,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACrE,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,oEAAoE;YACpE,oEAAoE;YACpE,2BAA2B;YAC3B,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EACtC,+EAA+E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,mBAAmB;QACjB,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACnC,CAAC;IAED,kEAAkE;IAClE,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAA2B;IAE3B,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,IAAI,EACJ;YACE,MAAM;YACN,OAAO;YACP,QAAQ;YACR,OAAO,CAAC,SAAS;YACjB,YAAY;YACZ,OAAO,CAAC,IAAI;SACb,EACD,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,OAAO,EAAE,CAC5D,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,EACjD,iCAAiC,CAClC,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA4B,EAC5B,KAAa,EACb,UAAkD,EAAE;IAKpD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,OAAO,CAAC,KAAK,IAAI,IAAI,EACrB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAC7D;YACE,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM;YACpC,QAAQ,EAAE,OAAO;SAClB,CACF,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB;QACpB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC1E,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAKD,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,2BAA2B,CAAC;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AACpE,MAAM,CAAC,MAAM,wCAAwC,GACnD,6BAA6B,CAAC;AAEhC,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/services/github.d.ts

@@ -0,0 +1,49 @@
+export interface GitHubPullRequest {
+    number: number;
+    title: string;
+    state: string;
+    url: string;
+    author: string;
+    createdAt: string;
+    updatedAt: string;
+    draft: boolean;
+}
+export interface GitHubRepository {
+    owner: string;
+    repo: string;
+    fullName: string;
+    url: string;
+}
+/**
+ * GitHubService — wraps @octokit/rest for GitHub API access.
+ *
+ * Used by:
+ * - API route GET /api/github/repos (list monitored repos)
+ * - API route GET /api/github/pulls (list PRs)
+ * - API route POST /api/github/pulls/comment (comment on PRs)
+ * - Webhook handler POST /webhook/github (validate & process webhooks)
+ */
+export declare class GitHubService {
+    private readonly token;
+    private readonly webhookSecret;
+    private octokit;
+    constructor(token: string | null, webhookSecret: string | null);
+    get available(): boolean;
+    get webhookConfigured(): boolean;
+    init(): Promise<void>;
+    /** List pull requests for a repository */
+    listPullRequests(owner: string, repo: string, state?: "open" | "closed" | "all"): Promise<GitHubPullRequest[]>;
+    /** Comment on a pull request */
+    commentOnPull(owner: string, repo: string, pullNumber: number, body: string): Promise<{
+        commentId: number;
+    } | null>;
+    /** Get repository info */
+    getRepo(owner: string, repo: string): Promise<GitHubRepository | null>;
+    /**
+     * Verify a GitHub webhook signature (X-Hub-Signature-256).
+     *
+     * Used by the webhook handler to ensure the payload is from GitHub.
+     */
+    verifyWebhookSignature(payload: string, signature: string): Promise<boolean>;
+}
+//# sourceMappingURL=github.d.ts.map

package/dist/services/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/services/github.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;GAQG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAE9C,OAAO,CAAC,OAAO,CAAa;gBAG1B,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,aAAa,EAAE,MAAM,GAAG,IAAI;IAM9B,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B,0CAA0C;IACpC,gBAAgB,CACpB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,MAAM,GAAG,QAAQ,GAAG,KAAc,GACxC,OAAO,CAAC,iBAAiB,EAAE,CAAC;IA4B/B,gCAAgC;IAC1B,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAoBxC,0BAA0B;IACpB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAiBnC;;;;OAIG;IACG,sBAAsB,CAC1B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;CAgBpB"}