@ascenda-one/github-collector 0.1.4

package/README.md

@@ -0,0 +1,81 @@
+# @ascenda-one/github-collector
+
+The collaboration signal family (consolidated report §4.2): review load and
+pull-request activity, collected from a code forge.
+
+## What it emits
+
+| Event | Meaning | Workload leg |
+|---|---|---|
+| `review_requested_of_me` | someone asked **you** to review | supervision |
+| `review_given` | **you** submitted a review | supervision |
+| `pull_request_opened` | **you** opened a pull request | creation |
+
+The two review events are the report's *verification overload* concern — the
+checking burden that concentrates on senior engineers as a team adopts AI.
+
+## The rule that shapes the whole package
+
+**Only your own activity is ever emitted.** An event is produced when the
+payload says you did the thing or you were asked; a payload about two other
+people produces nothing at all. `ASCENDA_FORGE_LOGIN` is required and the
+collector refuses to run without it, because falling back to the payload's
+actor would silently start recording colleagues.
+
+This is not squeamishness. "Who reviews for whom" is a map of a team, and a
+wellbeing rail that assembles one has become a management tool. Concentration
+of checking load is still answerable — it shows up in *your own* supervision
+share, and in cohort aggregates the org rail already suppresses below its
+minimum cohort size.
+
+### What never travels
+
+No repository name, PR title, branch, PR number, review body, or any other
+person's login. The repository is reduced to an 8-character hash so that "is it
+always the same repository" stays answerable without naming it. There is no
+field on the emitted metadata that a title or a body could be placed in, and a
+test asserts each of those strings is absent from what gets sent.
+
+### Withdrawal is not derivable, deliberately
+
+There is no "did not review" event and there must never be one. Reviewing less
+is exactly the signal the report says must never be machine-interpreted — a
+quiet week has too many innocent explanations. Nothing here counts absence.
+
+## Consent
+
+Collaboration events ride **`workflow_telemetry`**, not `ide_telemetry`, and the
+collector has its own tool type (`github_collector`). Both are deliberate: a
+pull request is not an IDE event, and someone may be willing to share how they
+work in their editor and not how they work with their team. The two are
+separately revocable.
+
+## Use in GitHub Actions
+
+```yaml
+name: ascenda-collaboration
+on:
+  pull_request:
+    types: [opened, review_requested]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  collect:
+    runs-on: ubuntu-latest
+    steps:
+      - run: npx @ascenda-one/github-collector
+        env:
+          ASCENDA_TOOL_INSTALLATION_ID: ${{ secrets.ASCENDA_TOOL_INSTALLATION_ID }}
+          ASCENDA_EVENT_WRITE_TOKEN: ${{ secrets.ASCENDA_EVENT_WRITE_TOKEN }}
+          ASCENDA_FORGE_LOGIN: ${{ github.actor }}
+```
+
+The step exits 0 on every path that is not a configuration error, including
+"nothing to emit". A telemetry step must never be the reason a build goes red.
+
+Locally, pipe a payload instead:
+
+```bash
+cat examples/sample-review-submitted.json | ascenda-forge-collect pull_request_review
+```

package/dist/cli.js

@@ -0,0 +1,982 @@
+#!/usr/bin/env node
+import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../packages/tool-kit/out/commandClassifier.js
+var require_commandClassifier = __commonJS({
+  "../packages/tool-kit/out/commandClassifier.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.classifyCommand = classifyCommand;
+    exports.isVerificationCommand = isVerificationCommand;
+    function classifyCommand(command) {
+      if (!command)
+        return "unknown";
+      const value = command.toLowerCase().trim();
+      if (/\b(test|jest|vitest|mocha|pytest|rspec|go test|cargo test|dotnet test|xcodebuild test)\b/.test(value) || /\bnpm\s+(run\s+)?test\b/.test(value) || /\byarn\s+test\b/.test(value) || /\bpnpm\s+(run\s+)?test\b/.test(value))
+        return "test";
+      if (/\b(lint|eslint|ruff|flake8|pylint|rubocop)\b/.test(value) || /\bnpm\s+(run\s+)?lint\b/.test(value))
+        return "lint";
+      if (/\b(tsc|typecheck|mypy|pyright|sorbet|flow)\b/.test(value) || /\bnpm\s+(run\s+)?typecheck\b/.test(value))
+        return "typecheck";
+      if (/\b(build|webpack|vite build|next build|turbo build|cargo build|go build|dotnet build|xcodebuild)\b/.test(value) || /\bnpm\s+(run\s+)?build\b/.test(value))
+        return "build";
+      if (/\b(git)\b/.test(value))
+        return "git";
+      if (/\b(npm install|yarn install|pnpm install|bun install|pip install|poetry install|bundle install)\b/.test(value))
+        return "install";
+      if (/\b(npm start|npm run dev|yarn dev|pnpm dev|next dev|vite|node|python|tsx|ts-node)\b/.test(value))
+        return "run";
+      return "unknown";
+    }
+    function isVerificationCommand(commandClass) {
+      return commandClass === "test" || commandClass === "lint" || commandClass === "typecheck" || commandClass === "build";
+    }
+  }
+});
+
+// ../packages/tool-kit/out/gitActionClassifier.js
+var require_gitActionClassifier = __commonJS({
+  "../packages/tool-kit/out/gitActionClassifier.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.classifyGitAction = classifyGitAction;
+    exports.isReworkGitAction = isReworkGitAction;
+    function classifyGitAction(command) {
+      if (!command)
+        return void 0;
+      const value = command.toLowerCase().trim();
+      if (!/\bgit\b/.test(value))
+        return void 0;
+      if (/\bgit\s+commit\b[^\n]*--amend\b/.test(value))
+        return "amend";
+      if (/\bgit\s+revert\b/.test(value))
+        return "revert";
+      if (/\bgit\s+reset\b[^\n]*--hard\b/.test(value))
+        return "reset_hard";
+      if (/\bgit\s+restore\b/.test(value) && !/--staged\b/.test(value))
+        return "restore";
+      if (/\bgit\s+checkout\b[^\n]*\s--\s/.test(value))
+        return "restore";
+      if (/\bgit\s+push\b/.test(value))
+        return "push";
+      if (/\bgit\s+commit\b/.test(value))
+        return "commit";
+      return void 0;
+    }
+    function isReworkGitAction(action) {
+      return action === "revert" || action === "reset_hard" || action === "restore";
+    }
+  }
+});
+
+// ../packages/tool-kit/out/workMilestoneClassifier.js
+var require_workMilestoneClassifier = __commonJS({
+  "../packages/tool-kit/out/workMilestoneClassifier.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.classifyWorkMilestone = classifyWorkMilestone;
+    exports.invitesDebrief = invitesDebrief;
+    function classifyWorkMilestone(command) {
+      if (!command)
+        return void 0;
+      const value = command.toLowerCase().trim();
+      if (!/\bgh\b/.test(value))
+        return void 0;
+      if (/\bgh\s+pr\s+merge\b/.test(value))
+        return "pr_merged";
+      if (/\bgh\s+issue\s+close\b/.test(value))
+        return "issue_closed";
+      if (/\bgh\s+pr\s+create\b/.test(value))
+        return "pr_opened";
+      return void 0;
+    }
+    function invitesDebrief(kind) {
+      return kind === "pr_merged" || kind === "issue_closed";
+    }
+  }
+});
+
+// ../packages/tool-kit/out/buckets.js
+var require_buckets = __commonJS({
+  "../packages/tool-kit/out/buckets.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.bucketLinesChanged = bucketLinesChanged;
+    exports.bucketDurationMs = bucketDurationMs;
+    function bucketLinesChanged(count) {
+      if (count <= 0)
+        return "0";
+      if (count <= 10)
+        return "1-10";
+      if (count <= 50)
+        return "10-50";
+      if (count <= 200)
+        return "50-200";
+      return "200+";
+    }
+    function bucketDurationMs(durationMs) {
+      if (typeof durationMs !== "number" || !Number.isFinite(durationMs) || durationMs < 0)
+        return void 0;
+      const minutes = durationMs / 6e4;
+      if (minutes <= 1)
+        return "0-1m";
+      if (minutes <= 5)
+        return "1-5m";
+      if (minutes <= 10)
+        return "5-10m";
+      if (minutes <= 30)
+        return "10-30m";
+      if (minutes <= 60)
+        return "30-60m";
+      return "60m+";
+    }
+  }
+});
+
+// ../packages/tool-kit/out/afterHours.js
+var require_afterHours = __commonJS({
+  "../packages/tool-kit/out/afterHours.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.isAfterHours = isAfterHours;
+    function isAfterHours(now = /* @__PURE__ */ new Date(), start = "19:00", end = "07:00") {
+      const currentMinutes = now.getHours() * 60 + now.getMinutes();
+      const startMinutes = parseTimeToMinutes(start, 19 * 60);
+      const endMinutes = parseTimeToMinutes(end, 7 * 60);
+      if (startMinutes === endMinutes)
+        return false;
+      if (startMinutes < endMinutes)
+        return currentMinutes >= startMinutes && currentMinutes < endMinutes;
+      return currentMinutes >= startMinutes || currentMinutes < endMinutes;
+    }
+    function parseTimeToMinutes(value, fallback) {
+      const match = /^(\d{1,2}):(\d{2})$/.exec(value.trim());
+      if (!match)
+        return fallback;
+      const hours = Number(match[1]);
+      const minutes = Number(match[2]);
+      if (Number.isNaN(hours) || Number.isNaN(minutes))
+        return fallback;
+      return Math.max(0, Math.min(23, hours)) * 60 + Math.max(0, Math.min(59, minutes));
+    }
+  }
+});
+
+// ../packages/tool-kit/out/payload.js
+var require_payload = __commonJS({
+  "../packages/tool-kit/out/payload.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.getString = getString;
+    exports.getNumber = getNumber;
+    exports.getNested = getNested;
+    exports.getNestedString = getNestedString;
+    exports.getNestedNumber = getNestedNumber;
+    exports.inferOutcome = inferOutcome;
+    exports.looksLikeCorrection = looksLikeCorrection;
+    function getString(input, keys) {
+      for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "string" && value.trim())
+          return value;
+      }
+      return void 0;
+    }
+    function getNumber(input, keys) {
+      for (const key of keys) {
+        const value = input[key];
+        if (typeof value === "number" && Number.isFinite(value))
+          return value;
+      }
+      return void 0;
+    }
+    function getNested(input, path) {
+      let current = input;
+      for (const segment of path) {
+        if (!current || typeof current !== "object")
+          return void 0;
+        current = current[segment];
+      }
+      return current;
+    }
+    function getNestedString(input, paths) {
+      for (const path of paths) {
+        const value = getNested(input, path);
+        if (typeof value === "string" && value.trim())
+          return value;
+      }
+      return void 0;
+    }
+    function getNestedNumber(input, paths) {
+      for (const path of paths) {
+        const value = getNested(input, path);
+        if (typeof value === "number" && Number.isFinite(value))
+          return value;
+      }
+      return void 0;
+    }
+    function inferOutcome(input) {
+      const exitCode = getNumber(input, ["exitCode", "exit_code", "status"]) ?? getNestedNumber(input, [["tool_response", "exitCode"], ["tool_response", "exit_code"], ["result", "exitCode"], ["result", "exit_code"]]);
+      if (typeof exitCode === "number")
+        return exitCode === 0 ? "success" : "failure";
+      const error = getString(input, ["error", "errorMessage"]) ?? getNestedString(input, [["tool_response", "error"], ["result", "error"]]);
+      if (error)
+        return "failure";
+      return "unknown";
+    }
+    function looksLikeCorrection(text) {
+      if (!text)
+        return false;
+      return /\b(wrong|incorrect|try again|fix|not what i asked|that's not|that is not|redo|regenerate|you missed|doesn't work|does not work)\b/i.test(text);
+    }
+  }
+});
+
+// ../packages/tool-contract/out/index.js
+var require_out = __commonJS({
+  "../packages/tool-contract/out/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ASCENDA_SEMANTIC_PROVENANCE = exports.ASCENDA_COLLABORATION_CONSENT_SCOPE = exports.ASCENDA_SEMANTIC_CONSENT_SCOPE = exports.ASCENDA_PROVENANCE = exports.ASCENDA_CONSENT_SCOPE = exports.EVENT_WORKLOAD_CATEGORY = exports.COLLABORATION_EVENT_TYPES = exports.SEMANTIC_WORK_SIGNAL_EVENT_TYPES = void 0;
+    exports.SEMANTIC_WORK_SIGNAL_EVENT_TYPES = [
+      "approach_churn_detected",
+      "goal_drift_detected",
+      "progress_stalled",
+      "progress_recovered",
+      "session_intention_declared",
+      "scope_change_declared"
+    ];
+    exports.COLLABORATION_EVENT_TYPES = [
+      "review_requested_of_me",
+      "review_given",
+      "pull_request_opened"
+    ];
+    exports.EVENT_WORKLOAD_CATEGORY = {
+      create_focus_session: "creation",
+      ai_prompt_submitted: "creation",
+      ai_generation_completed: "creation",
+      ai_file_write: "creation",
+      ai_file_edit: "creation",
+      editor_verification_activity: "verification",
+      compile_diagnostic: "verification",
+      editor_correction_activity: "supervision",
+      ai_correction_prompt: "supervision",
+      supervis_meeting_load: "supervision",
+      ai_tool_call_started: "supervision",
+      ai_tool_call_completed: "supervision",
+      ai_tool_call_failed: "supervision",
+      // Collaboration (the report's §4.2 collaboration family). Both review
+      // events are supervision: being asked to check work, and checking it, are
+      // the load the report's "verification overload" concern is about — the one
+      // that concentrates on senior engineers as a team adopts AI. Opening a pull
+      // request is creation: it is the point your own work leaves your hands.
+      review_requested_of_me: "supervision",
+      review_given: "supervision",
+      pull_request_opened: "creation",
+      context_pressure_high: "risk",
+      agent_loop_long: "risk",
+      after_hours_ai_session: "risk",
+      compile_error: "risk",
+      tool_failure: "risk",
+      recovery_offline_period: "neutral",
+      context_compression_manual: "neutral",
+      context_compression_auto: "neutral",
+      editor_activity: "neutral",
+      // Semantic (agent-observed) — see SEMANTIC_WORK_SIGNAL_EVENT_TYPES.
+      approach_churn_detected: "risk",
+      goal_drift_detected: "risk",
+      progress_stalled: "risk",
+      progress_recovered: "neutral",
+      session_intention_declared: "neutral",
+      scope_change_declared: "neutral"
+    };
+    exports.ASCENDA_CONSENT_SCOPE = "ide_telemetry";
+    exports.ASCENDA_PROVENANCE = "ai_work_telemetry";
+    exports.ASCENDA_SEMANTIC_CONSENT_SCOPE = "semantic_work_signals";
+    exports.ASCENDA_COLLABORATION_CONSENT_SCOPE = "workflow_telemetry";
+    exports.ASCENDA_SEMANTIC_PROVENANCE = "semantic_work_signals";
+  }
+});
+
+// ../packages/tool-kit/out/http.js
+var require_http = __commonJS({
+  "../packages/tool-kit/out/http.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.AscendaApiError = void 0;
+    exports.createPairingSession = createPairingSession;
+    exports.getPairingStatus = getPairingStatus;
+    exports.renewToolToken = renewToolToken;
+    exports.postToolEvent = postToolEvent;
+    exports.postToolEventsBatch = postToolEventsBatch;
+    exports.parseIngestResponse = parseIngestResponse;
+    var AscendaApiError = class extends Error {
+      status;
+      errorCode;
+      constructor(status, errorCode, body) {
+        super(body ?? `Ascenda API error ${status}`);
+        this.status = status;
+        this.errorCode = errorCode;
+        this.name = "AscendaApiError";
+      }
+    };
+    exports.AscendaApiError = AscendaApiError;
+    async function createPairingSession(apiBaseUrl, toolInstallationId, toolType, displayName) {
+      const response = await fetch(`${apiBaseUrl}/v1/tool-pairing-sessions`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ toolInstallationId, toolType, displayName })
+      });
+      if (!response.ok)
+        throw new AscendaApiError(response.status, void 0, await response.text());
+      return await response.json();
+    }
+    async function getPairingStatus(apiBaseUrl, pairingSessionId) {
+      const response = await fetch(`${apiBaseUrl}/v1/tool-pairing-sessions/${encodeURIComponent(pairingSessionId)}/status`, {
+        method: "GET",
+        headers: { Accept: "application/json" }
+      });
+      if (!response.ok)
+        throw new AscendaApiError(response.status, void 0, await response.text());
+      return await response.json();
+    }
+    async function renewToolToken(apiBaseUrl, eventWriteToken, signal) {
+      const response = await fetch(`${apiBaseUrl}/v1/tool-events/renew-token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${eventWriteToken}` },
+        signal
+      });
+      if (response.status === 401)
+        return null;
+      if (!response.ok)
+        throw new AscendaApiError(response.status, void 0, await response.text());
+      return await response.json();
+    }
+    async function postToolEvent(apiBaseUrl, eventWriteToken, payload, signal) {
+      const response = await fetch(`${apiBaseUrl}/v1/tool-events`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${eventWriteToken}` },
+        body: JSON.stringify(payload),
+        signal
+      });
+      return parseIngestResponse(response);
+    }
+    async function postToolEventsBatch(apiBaseUrl, eventWriteToken, payloads) {
+      const response = await fetch(`${apiBaseUrl}/v1/tool-events/batch`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${eventWriteToken}` },
+        body: JSON.stringify({ events: payloads })
+      });
+      return parseIngestResponse(response);
+    }
+    async function parseIngestResponse(response) {
+      if (response.ok)
+        return "accepted";
+      const body = await response.text();
+      let errorCode;
+      try {
+        errorCode = JSON.parse(body).error;
+      } catch {
+        errorCode = void 0;
+      }
+      if (response.status === 401)
+        return "auth_failed";
+      if (response.status === 403 && errorCode === "consent_missing_or_expired")
+        return "consent_missing";
+      if (response.status === 400 || response.status === 422)
+        return "validation_failed";
+      throw new AscendaApiError(response.status, errorCode, body);
+    }
+  }
+});
+
+// ../packages/tool-kit/out/tokenStore.js
+var require_tokenStore = __commonJS({
+  "../packages/tool-kit/out/tokenStore.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.defaultTokenFilePath = defaultTokenFilePath2;
+    exports.persistEventWriteToken = persistEventWriteToken2;
+    exports.readTokenFile = readTokenFile2;
+    var fs = __importStar(__require("fs"));
+    var os = __importStar(__require("os"));
+    var path = __importStar(__require("path"));
+    function defaultTokenFilePath2(toolInstallationId) {
+      return path.join(os.homedir(), ".ascenda", "tokens", sanitizeFilePart(toolInstallationId));
+    }
+    function persistEventWriteToken2(tokenFilePath, token) {
+      const dir = path.dirname(tokenFilePath);
+      fs.mkdirSync(dir, { recursive: true, mode: 448 });
+      fs.writeFileSync(tokenFilePath, token, { encoding: "utf8", mode: 384 });
+      if (process.platform !== "win32") {
+        fs.chmodSync(dir, 448);
+        fs.chmodSync(tokenFilePath, 384);
+      }
+    }
+    function readTokenFile2(tokenFilePath) {
+      try {
+        if (!fs.existsSync(tokenFilePath))
+          return void 0;
+        const value = fs.readFileSync(tokenFilePath, "utf8").trim();
+        return value || void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    function sanitizeFilePart(value) {
+      return value.replace(/[^a-zA-Z0-9._-]/g, "_");
+    }
+  }
+});
+
+// ../packages/tool-kit/out/eventSender.js
+var require_eventSender = __commonJS({
+  "../packages/tool-kit/out/eventSender.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.AscendaEventSender = exports.AscendaSemanticEventError = void 0;
+    var tool_contract_1 = require_out();
+    var http_1 = require_http();
+    var tokenStore_1 = require_tokenStore();
+    var AscendaSemanticEventError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "AscendaSemanticEventError";
+      }
+    };
+    exports.AscendaSemanticEventError = AscendaSemanticEventError;
+    var AscendaEventSender2 = class {
+      config;
+      eventWriteToken;
+      constructor(config) {
+        this.config = config;
+        this.eventWriteToken = config.eventWriteToken;
+      }
+      async send(mapped) {
+        const payload = {
+          toolInstallationId: this.config.toolInstallationId,
+          source: this.config.source,
+          occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          sessionId: this.config.sessionId ?? void 0,
+          workspaceHash: this.config.workspaceHash ?? void 0,
+          consentScope: tool_contract_1.ASCENDA_CONSENT_SCOPE,
+          provenance: tool_contract_1.ASCENDA_PROVENANCE,
+          privacyMode: "metadata_only",
+          ...mapped,
+          metadata: mapped.metadata ?? {}
+        };
+        return this.post(payload);
+      }
+      /**
+       * Sends one of the six agent-observed types (dark-flow-gap-analysis §2.1).
+       * Distinct from {@link send} rather than an option on it, because the
+       * differences are non-negotiable, not caller preference:
+       *
+       *  - `consentScope`/`provenance` are always the semantic pair — a lease on
+       *    `ide_telemetry` alone does not cover these.
+       *  - `severity` is always `"low"`. The emitter has no baseline to judge
+       *    against; an elevated reading can only come from the backend's own
+       *    z-scored evaluation, never from this payload.
+       *  - `metadata.skillVersion` is required by the type, not merely
+       *    documented, and checked again here in case a caller building the
+       *    object dynamically bypasses the type system.
+       *
+       * Rejects locally (never reaches the network) for an eventType outside
+       * {@link SEMANTIC_WORK_SIGNAL_EVENT_TYPES} or a missing/blank
+       * `skillVersion` — a malformed semantic event is a bug in the caller, not
+       * something the backend should have to catch.
+       */
+      async sendSemanticSignal(mapped) {
+        if (!tool_contract_1.SEMANTIC_WORK_SIGNAL_EVENT_TYPES.includes(mapped.eventType)) {
+          throw new AscendaSemanticEventError(`"${mapped.eventType}" is not a semantic work-signal type. Use send() for a deterministic host event.`);
+        }
+        if (!mapped.metadata.skillVersion || !mapped.metadata.skillVersion.trim()) {
+          throw new AscendaSemanticEventError(`metadata.skillVersion is required for semantic event "${mapped.eventType}".`);
+        }
+        const payload = {
+          toolInstallationId: this.config.toolInstallationId,
+          source: this.config.source,
+          eventType: mapped.eventType,
+          occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          severity: "low",
+          sessionId: this.config.sessionId ?? void 0,
+          workspaceHash: this.config.workspaceHash ?? void 0,
+          consentScope: tool_contract_1.ASCENDA_SEMANTIC_CONSENT_SCOPE,
+          provenance: tool_contract_1.ASCENDA_SEMANTIC_PROVENANCE,
+          privacyMode: "metadata_only",
+          metadata: mapped.metadata
+        };
+        return this.post(payload);
+      }
+      /**
+       * Sends a collaboration event under `workflow_telemetry`.
+       *
+       * A separate method rather than an option on {@link send}, for the same
+       * reason {@link sendSemanticSignal} is: the consent scope is a property of
+       * what the event *is*, and an options bag would let the wrong one be passed
+       * by accident. Rejects locally for anything outside
+       * {@link COLLABORATION_EVENT_TYPES}.
+       */
+      async sendCollaborationSignal(mapped) {
+        if (!tool_contract_1.COLLABORATION_EVENT_TYPES.includes(mapped.eventType)) {
+          throw new AscendaSemanticEventError(`"${mapped.eventType}" is not a collaboration event type. Use send() for a deterministic host event.`);
+        }
+        const payload = {
+          toolInstallationId: this.config.toolInstallationId,
+          source: this.config.source,
+          eventType: mapped.eventType,
+          occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          severity: "low",
+          sessionId: this.config.sessionId ?? void 0,
+          workspaceHash: this.config.workspaceHash ?? void 0,
+          consentScope: tool_contract_1.ASCENDA_COLLABORATION_CONSENT_SCOPE,
+          provenance: tool_contract_1.ASCENDA_PROVENANCE,
+          privacyMode: "metadata_only",
+          metadata: mapped.metadata ?? {}
+        };
+        return this.post(payload);
+      }
+      async post(payload) {
+        let result = await (0, http_1.postToolEvent)(this.config.apiBaseUrl, this.eventWriteToken, payload, this.signal());
+        if (result === "auth_failed") {
+          const renewed = await this.renewEventToken();
+          if (!renewed)
+            return "auth_failed";
+          result = await (0, http_1.postToolEvent)(this.config.apiBaseUrl, this.eventWriteToken, payload, this.signal());
+        }
+        return result;
+      }
+      async renewEventToken() {
+        const renewed = await (0, http_1.renewToolToken)(this.config.apiBaseUrl, this.eventWriteToken, this.signal());
+        if (!renewed)
+          return false;
+        this.eventWriteToken = renewed.eventWriteToken;
+        (0, tokenStore_1.persistEventWriteToken)(this.config.tokenFilePath, renewed.eventWriteToken);
+        return true;
+      }
+      signal() {
+        return this.config.timeoutMs ? AbortSignal.timeout(this.config.timeoutMs) : void 0;
+      }
+    };
+    exports.AscendaEventSender = AscendaEventSender2;
+  }
+});
+
+// ../packages/tool-kit/out/salt.js
+var require_salt = __commonJS({
+  "../packages/tool-kit/out/salt.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.machineSaltFilePath = machineSaltFilePath;
+    exports.readOrCreateMachineSalt = readOrCreateMachineSalt;
+    exports.hashWithMachineSalt = hashWithMachineSalt;
+    var crypto = __importStar(__require("crypto"));
+    var fs = __importStar(__require("fs"));
+    var os = __importStar(__require("os"));
+    var path = __importStar(__require("path"));
+    function machineSaltFilePath() {
+      return path.join(os.homedir(), ".ascenda", "salt");
+    }
+    var cache = /* @__PURE__ */ new Map();
+    function readOrCreateMachineSalt(saltFilePath = machineSaltFilePath()) {
+      const hit = cache.get(saltFilePath);
+      if (hit)
+        return hit;
+      const dir = path.dirname(saltFilePath);
+      fs.mkdirSync(dir, { recursive: true, mode: 448 });
+      let salt;
+      try {
+        salt = crypto.randomBytes(32).toString("hex");
+        fs.writeFileSync(saltFilePath, salt, { encoding: "utf8", mode: 384, flag: "wx" });
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+        salt = fs.readFileSync(saltFilePath, "utf8").trim();
+      }
+      if (process.platform !== "win32") {
+        fs.chmodSync(dir, 448);
+        fs.chmodSync(saltFilePath, 384);
+      }
+      cache.set(saltFilePath, salt);
+      return salt;
+    }
+    function hashWithMachineSalt(value, saltFilePath) {
+      if (!value)
+        return null;
+      return crypto.createHash("sha256").update(readOrCreateMachineSalt(saltFilePath)).update("\0").update(value).digest("hex").slice(0, 16);
+    }
+  }
+});
+
+// ../packages/tool-kit/out/index.js
+var require_out2 = __commonJS({
+  "../packages/tool-kit/out/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.parseIngestResponse = exports.postToolEventsBatch = exports.postToolEvent = exports.renewToolToken = exports.getPairingStatus = exports.createPairingSession = exports.AscendaApiError = exports.hashWithMachineSalt = exports.readOrCreateMachineSalt = exports.machineSaltFilePath = exports.readTokenFile = exports.persistEventWriteToken = exports.defaultTokenFilePath = exports.AscendaSemanticEventError = exports.AscendaEventSender = exports.looksLikeCorrection = exports.inferOutcome = exports.getNestedNumber = exports.getNestedString = exports.getNested = exports.getNumber = exports.getString = exports.isAfterHours = exports.bucketDurationMs = exports.bucketLinesChanged = exports.invitesDebrief = exports.classifyWorkMilestone = exports.isReworkGitAction = exports.classifyGitAction = exports.isVerificationCommand = exports.classifyCommand = void 0;
+    var commandClassifier_1 = require_commandClassifier();
+    Object.defineProperty(exports, "classifyCommand", { enumerable: true, get: function() {
+      return commandClassifier_1.classifyCommand;
+    } });
+    Object.defineProperty(exports, "isVerificationCommand", { enumerable: true, get: function() {
+      return commandClassifier_1.isVerificationCommand;
+    } });
+    var gitActionClassifier_1 = require_gitActionClassifier();
+    Object.defineProperty(exports, "classifyGitAction", { enumerable: true, get: function() {
+      return gitActionClassifier_1.classifyGitAction;
+    } });
+    Object.defineProperty(exports, "isReworkGitAction", { enumerable: true, get: function() {
+      return gitActionClassifier_1.isReworkGitAction;
+    } });
+    var workMilestoneClassifier_1 = require_workMilestoneClassifier();
+    Object.defineProperty(exports, "classifyWorkMilestone", { enumerable: true, get: function() {
+      return workMilestoneClassifier_1.classifyWorkMilestone;
+    } });
+    Object.defineProperty(exports, "invitesDebrief", { enumerable: true, get: function() {
+      return workMilestoneClassifier_1.invitesDebrief;
+    } });
+    var buckets_1 = require_buckets();
+    Object.defineProperty(exports, "bucketLinesChanged", { enumerable: true, get: function() {
+      return buckets_1.bucketLinesChanged;
+    } });
+    Object.defineProperty(exports, "bucketDurationMs", { enumerable: true, get: function() {
+      return buckets_1.bucketDurationMs;
+    } });
+    var afterHours_1 = require_afterHours();
+    Object.defineProperty(exports, "isAfterHours", { enumerable: true, get: function() {
+      return afterHours_1.isAfterHours;
+    } });
+    var payload_1 = require_payload();
+    Object.defineProperty(exports, "getString", { enumerable: true, get: function() {
+      return payload_1.getString;
+    } });
+    Object.defineProperty(exports, "getNumber", { enumerable: true, get: function() {
+      return payload_1.getNumber;
+    } });
+    Object.defineProperty(exports, "getNested", { enumerable: true, get: function() {
+      return payload_1.getNested;
+    } });
+    Object.defineProperty(exports, "getNestedString", { enumerable: true, get: function() {
+      return payload_1.getNestedString;
+    } });
+    Object.defineProperty(exports, "getNestedNumber", { enumerable: true, get: function() {
+      return payload_1.getNestedNumber;
+    } });
+    Object.defineProperty(exports, "inferOutcome", { enumerable: true, get: function() {
+      return payload_1.inferOutcome;
+    } });
+    Object.defineProperty(exports, "looksLikeCorrection", { enumerable: true, get: function() {
+      return payload_1.looksLikeCorrection;
+    } });
+    var eventSender_1 = require_eventSender();
+    Object.defineProperty(exports, "AscendaEventSender", { enumerable: true, get: function() {
+      return eventSender_1.AscendaEventSender;
+    } });
+    Object.defineProperty(exports, "AscendaSemanticEventError", { enumerable: true, get: function() {
+      return eventSender_1.AscendaSemanticEventError;
+    } });
+    var tokenStore_1 = require_tokenStore();
+    Object.defineProperty(exports, "defaultTokenFilePath", { enumerable: true, get: function() {
+      return tokenStore_1.defaultTokenFilePath;
+    } });
+    Object.defineProperty(exports, "persistEventWriteToken", { enumerable: true, get: function() {
+      return tokenStore_1.persistEventWriteToken;
+    } });
+    Object.defineProperty(exports, "readTokenFile", { enumerable: true, get: function() {
+      return tokenStore_1.readTokenFile;
+    } });
+    var salt_1 = require_salt();
+    Object.defineProperty(exports, "machineSaltFilePath", { enumerable: true, get: function() {
+      return salt_1.machineSaltFilePath;
+    } });
+    Object.defineProperty(exports, "readOrCreateMachineSalt", { enumerable: true, get: function() {
+      return salt_1.readOrCreateMachineSalt;
+    } });
+    Object.defineProperty(exports, "hashWithMachineSalt", { enumerable: true, get: function() {
+      return salt_1.hashWithMachineSalt;
+    } });
+    var http_1 = require_http();
+    Object.defineProperty(exports, "AscendaApiError", { enumerable: true, get: function() {
+      return http_1.AscendaApiError;
+    } });
+    Object.defineProperty(exports, "createPairingSession", { enumerable: true, get: function() {
+      return http_1.createPairingSession;
+    } });
+    Object.defineProperty(exports, "getPairingStatus", { enumerable: true, get: function() {
+      return http_1.getPairingStatus;
+    } });
+    Object.defineProperty(exports, "renewToolToken", { enumerable: true, get: function() {
+      return http_1.renewToolToken;
+    } });
+    Object.defineProperty(exports, "postToolEvent", { enumerable: true, get: function() {
+      return http_1.postToolEvent;
+    } });
+    Object.defineProperty(exports, "postToolEventsBatch", { enumerable: true, get: function() {
+      return http_1.postToolEventsBatch;
+    } });
+    Object.defineProperty(exports, "parseIngestResponse", { enumerable: true, get: function() {
+      return http_1.parseIngestResponse;
+    } });
+  }
+});
+
+// src/cli.ts
+var import_tool_kit2 = __toESM(require_out2(), 1);
+import { readFile } from "node:fs/promises";
+
+// src/config.ts
+var import_tool_kit = __toESM(require_out2(), 1);
+var ASCENDA_TOOL_TYPE = "github_collector";
+function loadConfigFromEnv() {
+  const apiBaseUrl = (process.env.ASCENDA_API_BASE_URL ?? "https://api.ascenda.one").replace(/\/$/, "");
+  const toolInstallationIdRaw = process.env.ASCENDA_TOOL_INSTALLATION_ID;
+  if (!toolInstallationIdRaw) throw new Error("Missing ASCENDA_TOOL_INSTALLATION_ID");
+  const toolInstallationId = normalizeToolInstallationId(toolInstallationIdRaw);
+  const viewerLogin = process.env.ASCENDA_FORGE_LOGIN?.trim();
+  if (!viewerLogin) {
+    throw new Error(
+      "Missing ASCENDA_FORGE_LOGIN \u2014 the collector only ever emits your own review activity, so it cannot run without knowing whose it is."
+    );
+  }
+  const tokenFilePath = process.env.ASCENDA_EVENT_WRITE_TOKEN_FILE ?? (0, import_tool_kit.defaultTokenFilePath)(toolInstallationId);
+  const fileToken = (0, import_tool_kit.readTokenFile)(tokenFilePath);
+  const eventWriteToken = fileToken ?? process.env.ASCENDA_EVENT_WRITE_TOKEN;
+  if (!eventWriteToken) throw new Error("Missing ASCENDA_EVENT_WRITE_TOKEN (or token file)");
+  if (!fileToken) (0, import_tool_kit.persistEventWriteToken)(tokenFilePath, eventWriteToken);
+  return { apiBaseUrl, toolInstallationId, eventWriteToken, tokenFilePath, viewerLogin };
+}
+function normalizeToolInstallationId(value) {
+  const trimmed = value.trim();
+  return trimmed.includes(":") ? trimmed : `${ASCENDA_TOOL_TYPE}:${trimmed}`;
+}
+
+// src/mapForgeEvent.ts
+function mapForgeEvent(eventName, payload, viewerLogin) {
+  if (!eventName || !viewerLogin) return [];
+  const action = str(payload["action"]);
+  const viewer = viewerLogin.toLowerCase();
+  if (eventName === "pull_request") {
+    const pr = obj(payload["pull_request"]);
+    const author = str(obj(pr["user"])["login"])?.toLowerCase();
+    if (action === "opened" && author === viewer) {
+      return [{
+        eventType: "pull_request_opened",
+        severity: "low",
+        metadata: base(payload)
+      }];
+    }
+    if (action === "review_requested") {
+      const requested = str(obj(payload["requested_reviewer"])["login"])?.toLowerCase();
+      if (requested === viewer) {
+        return [{
+          eventType: "review_requested_of_me",
+          severity: "low",
+          metadata: base(payload)
+        }];
+      }
+    }
+    return [];
+  }
+  if (eventName === "pull_request_review" && action === "submitted") {
+    const review = obj(payload["review"]);
+    const reviewer = str(obj(review["user"])["login"])?.toLowerCase();
+    if (reviewer !== viewer) return [];
+    return [{
+      eventType: "review_given",
+      severity: "low",
+      metadata: {
+        ...base(payload),
+        // The verdict is a property of the checking work, not of the author,
+        // and it is the closest thing to a "how heavy was this review" signal
+        // that carries no content. `commented` and `changes_requested` are
+        // more work than `approved`.
+        outcome: reviewState(str(review["state"]))
+      }
+    }];
+  }
+  return [];
+}
+function base(payload) {
+  const repo = str(obj(payload["repository"])["full_name"]);
+  return {
+    host: "github",
+    // Hashed, never the name. "Is it always the same repository" stays
+    // answerable; which repository does not travel.
+    ...repo ? { projectHash: hash(repo) } : {}
+  };
+}
+function reviewState(state) {
+  return state?.toLowerCase() === "approved" ? "success" : "unknown";
+}
+function hash(value) {
+  let h = 2166136261;
+  for (let i = 0; i < value.length; i++) {
+    h ^= value.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
+function obj(value) {
+  return value && typeof value === "object" ? value : {};
+}
+function str(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+
+// src/cli.ts
+async function main() {
+  const config = loadConfigFromEnv();
+  const eventName = process.env.GITHUB_EVENT_NAME ?? process.argv[2];
+  const payload = await readPayload();
+  if (!payload) return;
+  const events = mapForgeEvent(eventName, payload, config.viewerLogin);
+  if (events.length === 0) return;
+  const sender = new import_tool_kit2.AscendaEventSender({
+    apiBaseUrl: config.apiBaseUrl,
+    toolInstallationId: config.toolInstallationId,
+    source: "code_forge",
+    eventWriteToken: config.eventWriteToken,
+    tokenFilePath: config.tokenFilePath
+  });
+  for (const event of events) {
+    const result = await sender.sendCollaborationSignal(event);
+    if (result === "consent_missing") {
+      console.error("Ascenda telemetry rejected: renew workflow telemetry consent in the Ascenda app.");
+      return;
+    }
+    if (result === "auth_failed") {
+      console.error("Ascenda telemetry rejected: event write token invalid or revoked.");
+      return;
+    }
+    if (result !== "accepted") {
+      console.error(`Ascenda telemetry rejected: ${result}`);
+      return;
+    }
+  }
+}
+async function readPayload() {
+  const path = process.env.GITHUB_EVENT_PATH;
+  const raw = path ? await readFile(path, "utf8") : await readStdin();
+  if (!raw.trim()) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : void 0;
+  } catch {
+    console.error("Ascenda collector: unreadable event payload, nothing emitted.");
+    return void 0;
+  }
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf8");
+}
+main().catch((error) => {
+  console.error(`Ascenda collector: ${error instanceof Error ? error.message : String(error)}`);
+  process.exit(0);
+});

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,aAAa,EAAgB,MAAM,oBAAoB,CAAC;AAEjE;;;;;;;;;GASG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhC,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC;QACpC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,MAAM,EAAE,YAAY;QACpB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC,CAAC;IAEH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,sBAAsB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9F,2EAA2E;IAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config.js

@@ -0,0 +1,31 @@
+import { defaultTokenFilePath, persistEventWriteToken, readTokenFile } from "@ascenda-one/tool-kit";
+export const ASCENDA_TOOL_TYPE = "github_collector";
+export function loadConfigFromEnv() {
+    const apiBaseUrl = (process.env.ASCENDA_API_BASE_URL ?? "https://api.ascenda.one").replace(/\/$/, "");
+    const toolInstallationIdRaw = process.env.ASCENDA_TOOL_INSTALLATION_ID;
+    if (!toolInstallationIdRaw)
+        throw new Error("Missing ASCENDA_TOOL_INSTALLATION_ID");
+    const toolInstallationId = normalizeToolInstallationId(toolInstallationIdRaw);
+    // The whole collector is first-person, so without knowing who "I" am there
+    // is nothing it may legitimately emit. Failing here is the point: defaulting
+    // to the payload's actor would silently start recording other people.
+    const viewerLogin = process.env.ASCENDA_FORGE_LOGIN?.trim();
+    if (!viewerLogin) {
+        throw new Error("Missing ASCENDA_FORGE_LOGIN — the collector only ever emits your own " +
+            "review activity, so it cannot run without knowing whose it is.");
+    }
+    const tokenFilePath = process.env.ASCENDA_EVENT_WRITE_TOKEN_FILE
+        ?? defaultTokenFilePath(toolInstallationId);
+    const fileToken = readTokenFile(tokenFilePath);
+    const eventWriteToken = fileToken ?? process.env.ASCENDA_EVENT_WRITE_TOKEN;
+    if (!eventWriteToken)
+        throw new Error("Missing ASCENDA_EVENT_WRITE_TOKEN (or token file)");
+    if (!fileToken)
+        persistEventWriteToken(tokenFilePath, eventWriteToken);
+    return { apiBaseUrl, toolInstallationId, eventWriteToken, tokenFilePath, viewerLogin };
+}
+function normalizeToolInstallationId(value) {
+    const trimmed = value.trim();
+    return trimmed.includes(":") ? trimmed : `${ASCENDA_TOOL_TYPE}:${trimmed}`;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEpG,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAUpD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtG,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACvE,IAAI,CAAC,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpF,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,qBAAqB,CAAC,CAAC;IAE9E,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACvE,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B;WAC3D,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAE9C,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3E,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,SAAS;QAAE,sBAAsB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAEvE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,IAAI,OAAO,EAAE,CAAC;AAC7E,CAAC"}

package/dist/mapForgeEvent.js

@@ -0,0 +1,115 @@
+/**
+ * Maps a code-forge event to Ascenda's collaboration events (§4.2's
+ * collaboration family).
+ *
+ * ## The one rule that shapes everything here
+ *
+ * **Only the viewer's own activity is ever emitted.** `viewerLogin` is the
+ * person whose installation this is, and an event is produced only when the
+ * payload says *they* did the thing or *they* were asked. A payload about two
+ * other people produces nothing at all.
+ *
+ * That is not squeamishness. "Who reviews for whom" is a map of a team, and a
+ * wellbeing rail that assembles one has become a management tool. The report's
+ * verification-overload concern — checking load concentrating on senior
+ * engineers — is still answerable, because it shows up in that person's own
+ * supervision share and in cohort aggregates the org rail already suppresses
+ * below its minimum cohort size.
+ *
+ * ## What never travels
+ *
+ * No repository name, PR title, branch name, PR number, or any other person's
+ * login. The repository is reduced to an opaque hash so that "always the same
+ * repo" stays answerable without naming it, and nothing else about the change
+ * is carried. There is no field on the emitted metadata that a title or a body
+ * could be placed in.
+ */
+export function mapForgeEvent(eventName, payload, viewerLogin) {
+    if (!eventName || !viewerLogin)
+        return [];
+    const action = str(payload["action"]);
+    const viewer = viewerLogin.toLowerCase();
+    if (eventName === "pull_request") {
+        const pr = obj(payload["pull_request"]);
+        const author = str(obj(pr["user"])["login"])?.toLowerCase();
+        if (action === "opened" && author === viewer) {
+            return [{
+                    eventType: "pull_request_opened",
+                    severity: "low",
+                    metadata: base(payload)
+                }];
+        }
+        // A review request naming the viewer. The requester is not recorded: what
+        // matters to this rail is that checking work arrived, not who sent it.
+        if (action === "review_requested") {
+            const requested = str(obj(payload["requested_reviewer"])["login"])?.toLowerCase();
+            if (requested === viewer) {
+                return [{
+                        eventType: "review_requested_of_me",
+                        severity: "low",
+                        metadata: base(payload)
+                    }];
+            }
+        }
+        return [];
+    }
+    if (eventName === "pull_request_review" && action === "submitted") {
+        const review = obj(payload["review"]);
+        const reviewer = str(obj(review["user"])["login"])?.toLowerCase();
+        if (reviewer !== viewer)
+            return [];
+        return [{
+                eventType: "review_given",
+                severity: "low",
+                metadata: {
+                    ...base(payload),
+                    // The verdict is a property of the checking work, not of the author,
+                    // and it is the closest thing to a "how heavy was this review" signal
+                    // that carries no content. `commented` and `changes_requested` are
+                    // more work than `approved`.
+                    outcome: reviewState(str(review["state"]))
+                }
+            }];
+    }
+    return [];
+}
+function base(payload) {
+    const repo = str(obj(payload["repository"])["full_name"]);
+    return {
+        host: "github",
+        // Hashed, never the name. "Is it always the same repository" stays
+        // answerable; which repository does not travel.
+        ...(repo ? { projectHash: hash(repo) } : {})
+    };
+}
+/**
+ * A review verdict, mapped onto the shared outcome vocabulary. An approval is
+ * a success; anything asking for more work is not a *failure* of the reviewer,
+ * so it maps to unknown rather than borrowing a word that would read as blame
+ * in an aggregate.
+ */
+function reviewState(state) {
+    return state?.toLowerCase() === "approved" ? "success" : "unknown";
+}
+/**
+ * FNV-1a. Not a security boundary and not pretending to be one — the
+ * repository name is low-entropy and a determined holder of the data could
+ * guess it. Its job is to keep names out of the payload and stable across
+ * events, which is what makes "the same repository" answerable without
+ * recording which one.
+ */
+function hash(value) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < value.length; i++) {
+        h ^= value.charCodeAt(i);
+        h = Math.imul(h, 0x01000193) >>> 0;
+    }
+    return h.toString(16).padStart(8, "0");
+}
+function obj(value) {
+    return value && typeof value === "object" ? value : {};
+}
+function str(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=mapForgeEvent.js.map

package/dist/mapForgeEvent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapForgeEvent.js","sourceRoot":"","sources":["../src/mapForgeEvent.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,aAAa,CAC3B,SAA6B,EAC7B,OAAqB,EACrB,WAA+B;IAE/B,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAE5D,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,CAAC;oBACN,SAAS,EAAE,qBAAqB;oBAChC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;iBACxB,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAClF,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,OAAO,CAAC;wBACN,SAAS,EAAE,wBAAwB;wBACnC,QAAQ,EAAE,KAAK;wBACf,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;qBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,SAAS,KAAK,qBAAqB,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClE,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;QAEnC,OAAO,CAAC;gBACN,SAAS,EAAE,cAAc;gBACzB,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE;oBACR,GAAG,IAAI,CAAC,OAAO,CAAC;oBAChB,qEAAqE;oBACrE,sEAAsE;oBACtE,mEAAmE;oBACnE,6BAA6B;oBAC7B,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC3C;aACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,IAAI,CAAC,OAAqB;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,mEAAmE;QACnE,gDAAgD;QAChD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAyB;IAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,IAAI,CAAC,KAAa;IACzB,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC"}

package/examples/sample-review-requested.json

@@ -0,0 +1,6 @@
+{
+  "action": "review_requested",
+  "repository": { "full_name": "acme/payments-service" },
+  "pull_request": { "user": { "login": "another-dev" }, "number": 42 },
+  "requested_reviewer": { "login": "octocat" }
+}

package/examples/sample-review-submitted.json

@@ -0,0 +1,8 @@
+{
+  "action": "submitted",
+  "repository": { "full_name": "acme/payments-service" },
+  "review": {
+    "user": { "login": "octocat" },
+    "state": "changes_requested"
+  }
+}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "publishConfig": { "access": "public" },
+  "name": "@ascenda-one/github-collector",
+  "version": "0.1.4",
+  "description": "Code-forge collaboration collector for Ascenda work telemetry — first-person review and pull-request signals.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ascendaone-com/ai-engineer-tools.git",
+    "directory": "ascenda-github-collector"
+  },
+  "type": "module",
+  "files": ["dist", "examples"],
+  "bin": {
+    "ascenda-forge-collect": "./dist/cli.js"
+  },
+  "scripts": {
+    "build": "tsc -p ./ && npm run bundle",
+    "watch": "tsc -w -p ./",
+    "bundle": "esbuild src/cli.ts --bundle --platform=node --format=esm --banner:js=\"import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);\" --outfile=dist/cli.js",
+    "test": "node --test"
+  },
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.10",
+    "typescript": "^5.5.0",
+    "@ascenda-one/tool-contract": "*",
+    "@ascenda-one/tool-kit": "*"
+  }
+}