@atolis-hq/wake 0.2.97 → 0.3.1

package/dist/src/integrations/github/application/inbound-translator.js

@@ -0,0 +1,231 @@
+/* eslint-disable max-lines */
+import { createPullRequestService, } from '../../../activities/index.js';
+import { UlidIdGenerator, } from '../../../kernel/index.js';
+import { BuiltInResourceCapability, BuiltInResourceKind, ResourceCorrelationRole, resourceId, } from '../../../resources/index.js';
+import { workItemId } from '../../../work/index.js';
+import { admitObservedWork } from '../../application/work-admission.js';
+import { concludeObservedWork } from '../../application/work-conclusion.js';
+import { evaluateIntakeRules } from '../../contracts/intake-rules.js';
+import { GitHubEventType, selectGitHubAdapterEvent } from '../contracts/events.js';
+import { GitHubAdapter } from '../contracts/vocabulary.js';
+import { commandContext } from './inbound-context.js';
+import { applyReviewSignal } from './inbound-review-signals.js';
+import { applyWatchGateVerdictSignal } from './inbound-watch-gate-signals.js';
+import { gitHubIntakeFacts, gitHubIntakeRules } from './intake-policy.js';
+import { observePullRequest } from './pull-request-translation.js';
+export class InboundTranslator {
+    journal;
+    checkpoints;
+    work;
+    resources;
+    minted = new Map();
+    translate(payload) {
+        const { resourceId: resourceIdValue, workItemId: workItemIdValue } = this.newIdentity({
+            adapter: this.adapter,
+            key: payload.externalKey,
+        });
+        const commands = [
+            {
+                kind: 'discover-resource',
+                resourceId: resourceIdValue,
+                externalKey: { adapter: this.adapter, key: payload.externalKey },
+                revision: payload.revision,
+            },
+            { kind: 'create-work-item', workItemId: workItemIdValue, objective: payload.title },
+            { kind: 'correlate-resource', resourceId: resourceIdValue, workItemId: workItemIdValue },
+        ];
+        if (payload.kind === 'pull-request') {
+            commands.push({
+                kind: 'pr.observe',
+                input: observePullRequest(resourceIdValue, workItemIdValue, payload),
+            });
+        }
+        return commands;
+    }
+    constructor(journal, checkpoints, work, resources, dependencies = {}) {
+        this.journal = journal;
+        this.checkpoints = checkpoints;
+        this.work = work;
+        this.resources = resources;
+        this.pullRequests = dependencies.pullRequests;
+        this.ids = dependencies.ids ?? new UlidIdGenerator();
+        this.lookup = dependencies.lookup;
+        this.adapter = dependencies.adapter ?? GitHubAdapter;
+        this.orchestration = dependencies.orchestration;
+        this.runs = dependencies.runs;
+        this.routing = dependencies.routing;
+        this.intake = gitHubIntakeRules(dependencies.intake ?? []);
+        this.conclusion = dependencies.conclusion;
+    }
+    pullRequests;
+    ids;
+    lookup;
+    adapter;
+    orchestration;
+    runs;
+    routing;
+    intake;
+    conclusion;
+    // Adapter filtering, checkpointing, and typed event dispatch must stay together.
+    // eslint-disable-next-line complexity
+    async runOnce(limit = 100) {
+        if (this.journal === undefined ||
+            this.checkpoints === undefined ||
+            this.work === undefined ||
+            this.resources === undefined) {
+            throw new Error('InboundTranslator services are required to run evidence translation');
+        }
+        const checkpoint = `reactor:integration.${this.adapter}.inbound`;
+        const position = await this.checkpoints.load(checkpoint);
+        const events = await this.journal.readAll(position, limit);
+        for (const event of events) {
+            const owned = selectGitHubAdapterEvent(event);
+            if (owned?.stream.id === this.adapter && owned.eventType === GitHubEventType.WorkObserved)
+                await this.apply(owned);
+            if (owned?.stream.id === this.adapter &&
+                owned.eventType === GitHubEventType.CommentObserved) {
+                await applyReviewSignal({
+                    event: owned,
+                    journal: this.journal,
+                    resources: this.resources,
+                    work: this.work,
+                    lookup: this.lookup,
+                    pullRequests: this.pullRequests,
+                    ids: this.ids,
+                    adapter: this.adapter,
+                    orchestration: this.orchestration,
+                });
+                await applyWatchGateVerdictSignal({
+                    event: owned,
+                    runs: this.runs,
+                    orchestration: this.orchestration,
+                });
+            }
+            await this.checkpoints.save(checkpoint, event.globalPosition);
+        }
+        return events.length;
+    }
+    async apply(event) {
+        if (this.work === undefined || this.resources === undefined)
+            return;
+        const payload = event.payload;
+        const context = commandContext(event);
+        const pullRequests = this.pullRequests ?? createPullRequestService(this.journal, this.work, this.resources);
+        const intake = evaluateIntakeRules(this.intake, gitHubIntakeFacts(payload));
+        const identity = await this.resolveIdentity({ adapter: this.adapter, key: payload.externalKey }, intake.admitted);
+        if (identity === null)
+            return;
+        if (!identity.created) {
+            await this.applyReobservation({
+                payload,
+                context,
+                pullRequests,
+                resourceId: identity.resourceId,
+                workItemId: identity.workItemId,
+            });
+            return;
+        }
+        const { resourceId: resourceIdValue, workItemId: workItemIdValue } = identity;
+        const isPullRequest = payload.kind === 'pull-request';
+        await admitObservedWork(this.admissionServices(), {
+            adapter: this.adapter,
+            resourceId: resourceIdValue,
+            workItemId: workItemIdValue,
+            kind: isPullRequest ? BuiltInResourceKind.PullRequest : BuiltInResourceKind.Issue,
+            externalKey: { adapter: this.adapter, key: payload.externalKey },
+            capabilities: isPullRequest
+                ? [
+                    BuiltInResourceCapability.Commentable,
+                    BuiltInResourceCapability.Reviewable,
+                    BuiltInResourceCapability.Revisioned,
+                ]
+                : [BuiltInResourceCapability.Commentable],
+            objective: payload.title,
+            tags: intake.tags,
+            revision: payload.revision,
+            title: payload.title,
+        }, context, isPullRequest
+            ? async () => {
+                await pullRequests.observe(observePullRequest(resourceIdValue, workItemIdValue, payload), context);
+            }
+            : undefined);
+    }
+    async applyReobservation(input) {
+        const { payload, context, pullRequests, resourceId: resourceIdValue, workItemId: workItemIdValue, } = input;
+        const current = await this.resources.get(resourceIdValue);
+        if (current === null)
+            throw new Error(`Resource ${resourceIdValue} could not be loaded`);
+        if (current.revision !== payload.revision) {
+            await this.resources.discover({
+                resourceId: current.resourceId,
+                kind: current.kind,
+                externalKey: current.externalKey,
+                capabilities: current.capabilities,
+                revision: payload.revision,
+                ...(current.title === undefined ? {} : { title: current.title }),
+            }, context);
+            if (payload.outcome !== undefined && this.conclusion !== undefined) {
+                await concludeObservedWork({ work: this.work, conclusion: this.conclusion }, {
+                    workItemId: workItemIdValue,
+                    outcome: payload.outcome,
+                    reason: `${this.adapter} ${payload.externalKey} closed`,
+                });
+            }
+        }
+        if (payload.kind === 'pull-request')
+            await pullRequests.observe(observePullRequest(current.resourceId, workItemIdValue, payload), context);
+    }
+    mintIdentity(externalKey) {
+        const key = `${externalKey.adapter}:${externalKey.key}`;
+        const existing = this.minted.get(key);
+        if (existing !== undefined)
+            return existing;
+        const identity = this.newIdentity(externalKey);
+        this.minted.set(key, identity);
+        return identity;
+    }
+    newIdentity(_externalKey) {
+        return {
+            resourceId: resourceId(this.ids.next('resource')),
+            workItemId: workItemId(this.ids.next('work')),
+        };
+    }
+    admissionServices() {
+        if (this.work === undefined ||
+            this.resources === undefined ||
+            this.orchestration === undefined ||
+            this.routing === undefined)
+            throw new Error('InboundTranslator requires work, resources, orchestration, and routing');
+        return {
+            work: this.work,
+            resources: this.resources,
+            orchestration: this.orchestration,
+            routing: this.routing,
+        };
+    }
+    async resolveIdentity(externalKey, admitted) {
+        const key = `${externalKey.adapter}:${externalKey.key}`;
+        const inBatch = this.minted.get(key);
+        if (inBatch !== undefined)
+            return { ...inBatch, created: false };
+        if (this.lookup === undefined)
+            throw new Error('InboundTranslator lookup is required');
+        const resourceIdValue = await this.lookup.resourceIdForExternalKey(externalKey);
+        if (resourceIdValue !== null) {
+            if (this.resources === undefined)
+                throw new Error('InboundTranslator resources are required');
+            const correlation = (await this.resources.correlations(resourceIdValue)).find((value) => value.role === ResourceCorrelationRole.Primary);
+            // A deleted WorkItem retracts its primary correlation while retaining the external
+            // resource as a durable tombstone. Do not remint it or let it block later intake.
+            if (correlation === undefined)
+                return null;
+            const identity = { resourceId: resourceIdValue, workItemId: correlation.workItemId };
+            this.minted.set(key, identity);
+            return { ...identity, created: false };
+        }
+        // An ineligible object Wake has never seen produces no WorkItem, Run, or effect.
+        if (!admitted)
+            return null;
+        return { ...this.mintIdentity(externalKey), created: true };
+    }
+}

package/dist/src/integrations/github/application/inbound-watch-gate-signals.js

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+import { ActivityOutcomeKind } from '../../../activities/index.js';
+import { runId, RunStatus } from '../../../execution/index.js';
+import { ApprovalAuthorityKind, WatchGateVerdictSignal, watchId, } from '../../../orchestration/index.js';
+import { commandContext } from './inbound-context.js';
+const markerSchema = z
+    .object({
+    wake: z
+        .object({
+        watchGateVerdict: z
+            .object({
+            runId: z.string().min(1),
+            outcome: z.enum(['DONE', 'REJECTED', 'BLOCKED', 'FAILED']),
+        })
+            .strict(),
+    })
+        .strict(),
+})
+    .strict();
+function extractMarker(body) {
+    for (const match of body.matchAll(/```json\s*([\s\S]*?)```/g)) {
+        if (match[1] === undefined)
+            continue;
+        try {
+            const parsed = markerSchema.safeParse(JSON.parse(match[1]));
+            if (parsed.success)
+                return parsed.data.wake.watchGateVerdict;
+        }
+        catch {
+            // Other JSON fences are ordinary comment content, not necessarily Wake markers.
+        }
+    }
+    return null;
+}
+function translateOutcome(outcome) {
+    if (outcome === 'DONE')
+        return ActivityOutcomeKind.Done;
+    if (outcome === 'REJECTED')
+        return ActivityOutcomeKind.Rejected;
+    return null;
+}
+export async function applyWatchGateVerdictSignal(input) {
+    const { event, runs, orchestration } = input;
+    if (runs === undefined || orchestration === undefined)
+        return;
+    const marker = extractMarker(event.payload.body);
+    if (marker === null)
+        return;
+    const outcome = translateOutcome(marker.outcome);
+    if (outcome === null)
+        return;
+    const verdict = await verifyWatchGateVerdict({ marker, outcome, runs, orchestration });
+    if (verdict === null)
+        return;
+    await orchestration.acceptSignal(verdict.parentWorkflowInstanceId, {
+        kind: WatchGateVerdictSignal,
+        outcome: verdict.outcome,
+        authority: { kind: ApprovalAuthorityKind.Watch, watch: verdict.childWatchId },
+        actorId: event.payload.actor.id,
+        actorDecision: { authorized: true, evidenceId: event.eventId },
+        providerEventId: event.eventId,
+    }, commandContext(event));
+}
+async function verifyWatchGateVerdict(input) {
+    const { marker, outcome, runs, orchestration } = input;
+    const run = (await runs.load(runId(marker.runId))).view;
+    if (run === null)
+        return null;
+    if (run.status !== RunStatus.Succeeded || run.outcome?.kind !== outcome)
+        return null;
+    const workflows = await orchestration.listAll();
+    const child = workflows.find((workflow) => workflow.workflowInstanceId === run.workflowInstanceId);
+    if (child?.parentWorkflowInstanceId === undefined || child.watchId === undefined)
+        return null;
+    const childWatchId = watchId(child.watchId);
+    const parent = workflows.find((workflow) => workflow.workflowInstanceId === child.parentWorkflowInstanceId);
+    if (!isWaitingForChildWatch(parent, childWatchId))
+        return null;
+    return { parentWorkflowInstanceId: child.parentWorkflowInstanceId, outcome, childWatchId };
+}
+function isWaitingForChildWatch(parent, childWatchId) {
+    return (parent?.waitingFor?.signalKind === WatchGateVerdictSignal &&
+        parent.waitingFor.from?.some((authority) => authority.kind === ApprovalAuthorityKind.Watch && authority.watch === childWatchId) === true);
+}

package/dist/src/integrations/github/application/intake-policy.js

@@ -0,0 +1,23 @@
+import { GitHubIntakeFacet } from '../contracts/vocabulary.js';
+// GitHub's `where` vocabulary translated onto provider-neutral facets. Eligibility and
+// tagging semantics live in integrations/contracts; only the vocabulary is GitHub's.
+export function gitHubIntakeRules(configured) {
+    return configured.map((rule) => ({
+        where: {
+            ...(rule.where.kind === undefined ? {} : { [GitHubIntakeFacet.Kind]: [rule.where.kind] }),
+            [GitHubIntakeFacet.Label]: rule.where.labels,
+            [GitHubIntakeFacet.Assignee]: rule.where.requiredAssignees,
+            [GitHubIntakeFacet.Author]: rule.where.requiredAuthors,
+        },
+        matchMode: rule.matchMode,
+        tags: rule.tags,
+    }));
+}
+export function gitHubIntakeFacts(payload) {
+    return {
+        [GitHubIntakeFacet.Kind]: [payload.kind],
+        [GitHubIntakeFacet.Label]: payload.labels ?? [],
+        [GitHubIntakeFacet.Assignee]: payload.assignees ?? [],
+        [GitHubIntakeFacet.Author]: [payload.actor.id],
+    };
+}

package/dist/src/integrations/github/application/outbound-translator.js

@@ -0,0 +1,47 @@
+import { BuiltInResourceKind } from '../../../resources/index.js';
+import { DeliveryIntentKind } from '../../delivery/contracts/vocabulary.js';
+import { parseGitHubResourceKey } from '../contracts/external-key.js';
+import { GitHubAdapter, GitHubOutboundAction, } from '../contracts/vocabulary.js';
+import { formatAgentRunComment } from './agent-run-comment.js';
+export function translateGitHubOutbound(resource, intent) {
+    if (resource.externalKey.adapter !== GitHubAdapter)
+        throw new Error('Resource is not a GitHub resource');
+    const { owner, repo, number } = parseGitHubResourceKey(resource.externalKey.key);
+    return {
+        owner,
+        repo,
+        ...(resource.kind === BuiltInResourceKind.PullRequest
+            ? { pull_number: number }
+            : { issue_number: number }),
+        action: outboundAction(intent),
+        idempotencyKey: intent.intentEventId,
+        ...('report' in intent.payload
+            ? {
+                body: formatAgentRunComment({
+                    idempotencyKey: intent.intentEventId,
+                    ...intent.payload.report,
+                }),
+            }
+            : 'body' in intent.payload
+                ? { body: intent.payload.body }
+                : {}),
+        ...('revision' in intent.payload ? { sha: intent.payload.revision } : {}),
+        ...('method' in intent.payload ? { merge_method: intent.payload.method } : {}),
+    };
+}
+function outboundAction(intent) {
+    switch (intent.kind) {
+        case DeliveryIntentKind.PrApprove:
+            return GitHubOutboundAction.Approve;
+        case DeliveryIntentKind.PrMerge:
+            return 'autoMerge' in intent.payload && intent.payload.autoMerge
+                ? GitHubOutboundAction.EnableAutoMerge
+                : GitHubOutboundAction.Merge;
+        case DeliveryIntentKind.StatusPublish:
+            return GitHubOutboundAction.Status;
+        case DeliveryIntentKind.ReplyPublish:
+        case DeliveryIntentKind.AgentRunPublish:
+            return GitHubOutboundAction.Reply;
+    }
+    throw new Error(`Unknown delivery intent kind: ${intent.kind}`);
+}

package/dist/src/integrations/github/application/poll-service.js

@@ -0,0 +1,29 @@
+import { EventSourceKind } from '../../../kernel/index.js';
+import { integrationStream } from '../../contracts/streams.js';
+import { GitHubEventType } from '../contracts/events.js';
+import { GitHubAdapter } from '../contracts/vocabulary.js';
+const gitHubEventTypes = new Set(Object.values(GitHubEventType));
+export class PollService {
+    journal;
+    source;
+    constructor(journal, source) {
+        this.journal = journal;
+        this.source = source;
+    }
+    async pollOnce(signal) {
+        const drafts = await this.source.poll(signal);
+        for (const draft of drafts) {
+            if (draft.source.kind !== EventSourceKind.Adapter || draft.source.id !== 'github') {
+                throw new Error('PollService accepts GitHub adapter evidence only');
+            }
+            if (!gitHubEventTypes.has(draft.eventType)) {
+                throw new Error('PollService cannot append canonical domain events');
+            }
+        }
+        if (drafts.length === 0)
+            return;
+        const stream = integrationStream(GitHubAdapter);
+        const existing = await this.journal.readStream(stream);
+        await this.journal.append(stream, existing.length, drafts.map((draft) => ({ ...draft, stream })));
+    }
+}

package/dist/src/integrations/github/application/pull-request-translation.js

@@ -0,0 +1,10 @@
+export function observePullRequest(resourceId, workItemId, payload) {
+    return {
+        resourceId,
+        workItemId,
+        state: payload.state,
+        headRevision: payload.headRevision ?? payload.revision,
+        baseRevision: payload.baseRevision ?? 'unknown',
+        checks: payload.checks ?? 'unknown',
+    };
+}

package/dist/src/integrations/github/application/resource-links.js

@@ -0,0 +1,8 @@
+const issueOrPullRequestLocator = /^(?<owner>[^/]+)\/(?<repo>[^#]+)#(?<number>[1-9]\d*)$/;
+export const resolveGitHubResourceUrl = (externalKey) => {
+    const match = issueOrPullRequestLocator.exec(externalKey.key);
+    if (match?.groups === undefined)
+        return null;
+    const { owner, repo, number } = match.groups;
+    return `https://github.com/${owner}/${repo}/issues/${number}`;
+};

package/dist/src/integrations/github/application/review-command-translator.js

@@ -0,0 +1,16 @@
+import { ReviewDecisionKind, } from '../../../activities/index.js';
+export function translateGitHubReviewCommand(input) {
+    const command = input.body.trim();
+    if (command !== '/accepted' && command !== '/changes')
+        return null;
+    return {
+        resourceId: input.resourceId,
+        revision: input.revision,
+        actorId: input.actorId,
+        actorKind: input.actorKind,
+        resourceAuthorId: input.resourceAuthorId,
+        authorization: input.authorization,
+        providerEventId: input.providerEventId,
+        kind: command === '/accepted' ? ReviewDecisionKind.Accepted : ReviewDecisionKind.ChangesRequested,
+    };
+}

package/dist/src/integrations/github/application/wake-labels.js

@@ -0,0 +1,95 @@
+import { WorkflowStatus } from '../../../orchestration/index.js';
+import { WorkStatus } from '../../../work/index.js';
+import { GitHubWakeStatusLabel, isGitHubWakeMarker, } from '../contracts/vocabulary.js';
+export function reconcileGitHubWakeLabels(current, desired) {
+    const userLabels = current.filter((label) => !isGitHubWakeMarker(label));
+    return [...userLabels, ...desired];
+}
+export function isGitHubWakeEcho(input) {
+    return (input.authorLogin.toLowerCase() === input.authenticatedLogin.toLowerCase() ||
+        input.body.includes('<!-- wake:agent -->') ||
+        input.labels.some(isGitHubWakeMarker));
+}
+export function createGitHubWakeLabelReconciler(input) {
+    const openWorkItemIds = async (workItemIds) => {
+        const open = new Set();
+        for (const workItemId of workItemIds) {
+            const item = await input.work.get(workItemId);
+            if (item?.state === WorkStatus.Open)
+                open.add(workItemId);
+        }
+        return open;
+    };
+    return {
+        async runOnce() {
+            const workflows = await input.orchestration.listAll();
+            // Closed/cancelled is terminal for a WorkItem — there is no reopen path
+            // (see work-item.spec.md) — so once synced, a concluded issue's labels
+            // never need checking again. Without this, listAll() keeps returning
+            // every WorkItem ever created and this loop keeps making a live
+            // getLabels call per item, every cycle, forever.
+            const open = await openWorkItemIds(new Set(workflows.map((workflow) => workflow.workItemId)));
+            // A watch's spawned child shares its parent's work item (and so its GitHub
+            // resource) but is not the canonical state for that issue — only the
+            // top-level (non-child) workflow instance drives its stage/status labels.
+            // An active child instead surfaces as the watching marker below, so the
+            // issue's own progress labels stay stable while a background review runs.
+            for (const workflow of workflows) {
+                if (workflow.parentWorkflowInstanceId !== undefined)
+                    continue;
+                if (!open.has(workflow.workItemId))
+                    continue;
+                const watching = workflows.some((candidate) => candidate.parentWorkflowInstanceId === workflow.workflowInstanceId &&
+                    candidate.status !== WorkflowStatus.Completed);
+                const desired = desiredWakeLabels(workflow, watching);
+                for (const correlation of await input.resources.correlationsForWork(workflow.workItemId)) {
+                    const resource = await input.resources.get(correlation.resourceId);
+                    if (resource?.externalKey.adapter !== 'github')
+                        continue;
+                    const locator = parseGitHubIssueKey(resource.externalKey.key);
+                    if (locator === null)
+                        continue;
+                    const current = await input.getLabels(locator.owner, locator.repo, locator.number);
+                    const next = reconcileGitHubWakeLabels(current, desired);
+                    if (!sameLabels(current, next))
+                        await input.setLabels(locator.owner, locator.repo, locator.number, next);
+                }
+            }
+        },
+    };
+}
+function desiredWakeLabels(workflow, watching) {
+    return [
+        `wake:status.${statusLabel(workflow.status)}`,
+        `wake:stage.${workflow.currentStage}`,
+        `wake:workflow.${workflow.workflowName}`,
+        ...(watching ? ['wake:watching'] : []),
+    ];
+}
+function statusLabel(status) {
+    switch (status) {
+        case WorkflowStatus.Active:
+            return GitHubWakeStatusLabel.Working;
+        case WorkflowStatus.Waiting:
+            return GitHubWakeStatusLabel.AwaitingApproval;
+        case WorkflowStatus.Blocked:
+            return GitHubWakeStatusLabel.Blocked;
+        case WorkflowStatus.Completed:
+            return GitHubWakeStatusLabel.Completed;
+        case WorkflowStatus.Superseded:
+            return GitHubWakeStatusLabel.Failed;
+    }
+}
+function parseGitHubIssueKey(key) {
+    const match = /^(?<owner>[^/]+)\/(?<repo>[^#]+)#(?<number>[1-9]\d*)$/.exec(key);
+    if (match?.groups === undefined)
+        return null;
+    return {
+        owner: match.groups.owner,
+        repo: match.groups.repo,
+        number: Number(match.groups.number),
+    };
+}
+function sameLabels(left, right) {
+    return left.length === right.length && left.every((label, index) => label === right[index]);
+}

package/dist/src/integrations/github/contracts/config.js

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+import { MatchMode } from '../../../kernel/index.js';
+import { isGitHubWakeMarker } from './vocabulary.js';
+const repositorySchema = z
+    .object({ owner: z.string().trim().min(1), repo: z.string().trim().min(1) })
+    .strict();
+const intakeTag = z
+    .string()
+    .trim()
+    .min(1)
+    .refine((tag) => !isGitHubWakeMarker(tag), {
+    message: 'intake tags must not come from a Wake-owned marker family; Wake would observe its own marker and re-route',
+});
+const intakeRuleSchema = z
+    .object({
+    where: z
+        .object({
+        kind: z.enum(['issue', 'pull-request']).optional(),
+        requiredAssignees: z.array(z.string().trim().min(1)).default([]),
+        requiredAuthors: z.array(z.string().trim().min(1)).default([]),
+        labels: z.array(z.string().trim().min(1)).default([]),
+    })
+        .strict(),
+    matchMode: z.enum([MatchMode.Any, MatchMode.All]).default(MatchMode.Any),
+    tags: z.array(intakeTag).default([]),
+})
+    .strict();
+export const gitHubConfigSchema = z
+    .object({
+    enabled: z.boolean(),
+    token: z.string().trim().min(1).optional(),
+    repositories: z.array(repositorySchema).min(1),
+    polling: z
+        .object({
+        maxPerRepo: z.number().int().positive().default(25),
+        commentPageSize: z.number().int().positive().max(100).default(25),
+        lookbackMs: z.number().int().nonnegative().default(60_000),
+    })
+        .strict()
+        .default({ maxPerRepo: 25, commentPageSize: 25, lookbackMs: 60_000 }),
+    intake: z.array(intakeRuleSchema).default([]),
+    publication: z
+        .object({ postStatusComments: z.boolean().default(true) })
+        .strict()
+        .default({ postStatusComments: true }),
+})
+    .strict();