@cat-factory/contracts 0.292.0 → 0.292.2

package/dist/github-pat-capability.d.ts

@@ -0,0 +1,233 @@
+import * as v from 'valibot';
+/**
+ * Which credential the check looked at — the two shapes on which a PAT is what a run
+ * authenticates as. Named on the wire because the REMEDY differs: a `deployment` token is
+ * replaced by whoever runs the deployment, an `initiator` one by the signed-in user in their
+ * own settings, and a banner that could not tell them apart would send half its readers to a
+ * page they cannot act on.
+ */
+export declare const githubPatSourceSchema: v.PicklistSchema<["deployment", "initiator"], undefined>;
+export type GitHubPatSource = v.InferOutput<typeof githubPatSourceSchema>;
+/**
+ * How a token's reach was determined, mirroring `describeGitHubPatScope`'s own classification.
+ * `unknown` is a token GitHub accepted while reporting no scopes and whose prefix is not the
+ * fine-grained one, so nothing about its breadth can be stated.
+ */
+export declare const githubPatKindSchema: v.PicklistSchema<["classic", "fine_grained", "unknown"], undefined>;
+export type GitHubPatKind = v.InferOutput<typeof githubPatKindSchema>;
+/**
+ * The things a pipeline needs the token to be able to do. Kept to what actually stops work:
+ * every step from the coder onward pushes a branch, the merger opens and merges a pull
+ * request, and the coder/ci-fixer may edit `.github/workflows/*`.
+ *
+ * Read-only reach is absent on purpose. A token that cannot read the repository fails at
+ * `GET /user` or at the repo probe, which is `token_rejected` / an unreadable repo rather than
+ * a capability verdict.
+ */
+export declare const githubPatCapabilitySchema: v.PicklistSchema<["push", "pullRequests", "workflows"], undefined>;
+export type GitHubPatCapability = v.InferOutput<typeof githubPatCapabilitySchema>;
+/** Every capability, as a plain tuple — the source of truth for iteration. */
+export declare const GITHUB_PAT_CAPABILITIES: ["push", "pullRequests", "workflows"];
+/**
+ * Whether the token holds one capability.
+ *  - `granted` — positively established (a classic scope GitHub named, or a repo probe that
+ *    reported `permissions.push`).
+ *  - `missing`  — positively established as ABSENT. The only status that raises a banner.
+ *  - `unknown`  — not determinable from what GitHub exposes. NOT a synonym for either: a
+ *    fine-grained token's pull-request and workflow permissions have no endpoint that reports
+ *    them, and rendering that as `granted` would silence a real gap while rendering it as
+ *    `missing` would nag every correctly-configured fine-grained deployment forever.
+ */
+export declare const githubPatCapabilityStatusSchema: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+export type GitHubPatCapabilityStatus = v.InferOutput<typeof githubPatCapabilityStatusSchema>;
+/**
+ * The per-capability verdict. Spelled as an explicit object rather than a `v.record` over the
+ * picklist so a new capability fails the typecheck at every construction site instead of
+ * silently defaulting to absent; `githubPatCapabilities.spec.ts` pins the two lists together.
+ */
+export declare const githubPatCapabilitiesSchema: v.ObjectSchema<{
+    readonly push: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+    readonly pullRequests: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+    readonly workflows: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+}, undefined>;
+export type GitHubPatCapabilities = v.InferOutput<typeof githubPatCapabilitiesSchema>;
+/**
+ * The capabilities whose absence STOPS a pipeline, as opposed to narrowing what it may change.
+ *
+ * `workflows` is deliberately not among them, and it is the exclusion worth stating: without it
+ * a run pushes, opens its PR and merges exactly as normal, and fails only on the subset of
+ * changes that touch `.github/workflows/*`. Treating that as blocking would raise the loud
+ * banner on the many deployments whose agents never edit CI, which is how a warning surface
+ * teaches people to dismiss it unread.
+ */
+export declare const GITHUB_PAT_BLOCKING_CAPABILITIES: readonly ["push", "pullRequests"];
+/**
+ * The classic scopes a replacement token needs, and the single source of truth for them: the
+ * local facade's setup link, the SPA's re-mint link and this module's own classification all
+ * read this one list.
+ *
+ * `repo` covers cloning, pushing a branch, opening the pull request, reading the head's Actions
+ * check runs for the CI gate and merging. `workflow` is needed only to push a change that
+ * touches a workflow file, but it is pre-selected anyway: a token is minted once, and sending
+ * someone back to GitHub a second time the first time an agent edits CI is worse than the
+ * narrower grant is worth. What it costs is stated in `githubPatScope.ts`.
+ */
+export declare const GITHUB_PAT_CLASSIC_SCOPES: readonly ['repo', 'workflow'];
+/**
+ * The fine-grained REPOSITORY permissions a replacement token needs, for the banner to list.
+ * Prose rather than a query parameter because GitHub's fine-grained token form accepts no
+ * prefill: see {@link githubPatCreateUrl}.
+ */
+export declare const GITHUB_PAT_FINE_GRAINED_PERMISSIONS: readonly ['contents:write', 'pull_requests:write', 'workflows:write'];
+/**
+ * Where each token kind is minted, relative to the instance's web root. Exported because the
+ * SPA's generic connect-box link (`vcsTokenCreateUrl`, which offers no scopes) has to land on
+ * the same page this module's pre-filled link does; two spellings of GitHub's settings path
+ * would send the two surfaces to different places the day GitHub moves one.
+ */
+export declare const GITHUB_TOKEN_CREATE_PATHS: Record<GitHubPatKind, string>;
+/**
+ * The URL that mints a replacement token, pre-filled as far as GitHub allows.
+ *
+ * The KIND is carried over from the token being replaced rather than chosen for the user: a
+ * deployment that standardised on fine-grained tokens should not be pushed back to a classic
+ * one by a warning banner, and vice versa.
+ *
+ * Only the CLASSIC form takes a prefill. GitHub's fine-grained form accepts no permission query
+ * parameters at all, so that half of the fork is a bare link and the caller must render
+ * {@link GITHUB_PAT_FINE_GRAINED_PERMISSIONS} beside it — a link that silently arrived with
+ * nothing selected would read as "these are already set for you", which is precisely the
+ * misreading that produced the missing permission in the first place.
+ *
+ * `webUrl` is the instance the workspace is bound to; absent, the caller has already decided to
+ * fall back to the public host (the SPA's `vcsTokenCreateUrl` states why that is safe for a
+ * settings page and not for a repository link).
+ */
+export declare function githubPatCreateUrl(kind: GitHubPatKind, options: {
+    webUrl: string;
+    description?: string;
+}): string;
+/**
+ * What the check found about the token a workspace's runs would use.
+ *
+ * `probedRepos` / `unprobedRepoCount` exist because the fine-grained answer is a SAMPLE: the
+ * probe reads the repositories this board's services target, capped, and a reader who assumed
+ * it read all of them would take a clean verdict as a guarantee about a repository nobody
+ * looked at. Both are empty/zero for a classic token, whose scopes answer for every repository
+ * at once.
+ *
+ * The token's raw scope list is deliberately NOT here. Nothing renders it, and the one source
+ * whose scopes this endpoint could expose is `deployment` — a shared operational credential
+ * whose breadth every workspace member would then be able to read off a route that lets reads
+ * through. The per-capability verdict is what a reader can act on; the scope list is what the
+ * person who pasted the token already saw on the connect form.
+ */
+export declare const githubPatCapabilityReportSchema: v.ObjectSchema<{
+    readonly source: v.PicklistSchema<["deployment", "initiator"], undefined>;
+    readonly kind: v.PicklistSchema<["classic", "fine_grained", "unknown"], undefined>;
+    readonly capabilities: v.ObjectSchema<{
+        readonly push: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+        readonly pullRequests: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+        readonly workflows: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+    }, undefined>;
+    /** The `owner/name` of each repository the probe actually asked GitHub about. */
+    readonly probedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    /**
+     * The probed repositories GitHub answered 404 for. A subset of {@link probedRepos}, and the
+     * one detail that turns "push is missing" into something a reader can act on for a
+     * fine-grained token: these are the repositories the token was not granted (GitHub 404s
+     * rather than 403s for a repository a credential may not see, so it cannot leak existence).
+     */
+    readonly deniedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    /** Targeted repositories the probe's cap left unread, so a verdict never reads as exhaustive. */
+    readonly unprobedRepoCount: v.NumberSchema<undefined>;
+    /** The instance the token authenticates against, for the re-mint link. Null ⇒ not derivable. */
+    readonly webUrl: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type GitHubPatCapabilityReport = v.InferOutput<typeof githubPatCapabilityReportSchema>;
+/**
+ * The check's outcome. A variant rather than a nullable report because the four states need
+ * four different reactions, and three of them are not "the token lacks something":
+ *
+ *  - `not_applicable` — no PAT is in play (a GitHub App deployment, GitLab, or nothing
+ *    connected at all), or this board's services target no GitHub repository, so no run here
+ *    would ever authenticate with one. There is no token whose reach could be wrong.
+ *  - `token_rejected` — GitHub refused the token outright (401/403). Blocking, and a strictly
+ *    worse problem than a missing scope, so it gets its own state instead of collapsing into
+ *    "everything is missing". It carries `source` for the same reason the report does: the
+ *    remedy for a rejected DEPLOYMENT credential is not the one for a rejected personal token,
+ *    and this is the state in which the reader is least able to work that out for themselves.
+ *  - `probe_failed`   — GitHub could not be reached, refused to answer for now (a rate limit),
+ *    or answered in a way the probe could not read. NOT a verdict about the token: an upstream
+ *    condition must never render as a permissions problem, because the remedy it would
+ *    advertise (mint a new token) is wrong and costly.
+ *  - `checked`        — a report was produced. It may still be entirely clean.
+ */
+export declare const githubPatCheckSchema: v.VariantSchema<"state", [v.ObjectSchema<{
+    readonly state: v.LiteralSchema<"not_applicable", undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly state: v.LiteralSchema<"token_rejected", undefined>;
+    readonly status: v.NumberSchema<undefined>;
+    readonly source: v.PicklistSchema<["deployment", "initiator"], undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly state: v.LiteralSchema<"probe_failed", undefined>;
+    readonly message: v.StringSchema<undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly state: v.LiteralSchema<"checked", undefined>;
+    readonly report: v.ObjectSchema<{
+        readonly source: v.PicklistSchema<["deployment", "initiator"], undefined>;
+        readonly kind: v.PicklistSchema<["classic", "fine_grained", "unknown"], undefined>;
+        readonly capabilities: v.ObjectSchema<{
+            readonly push: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+            readonly pullRequests: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+            readonly workflows: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+        }, undefined>;
+        /** The `owner/name` of each repository the probe actually asked GitHub about. */
+        readonly probedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+        /**
+         * The probed repositories GitHub answered 404 for. A subset of {@link probedRepos}, and the
+         * one detail that turns "push is missing" into something a reader can act on for a
+         * fine-grained token: these are the repositories the token was not granted (GitHub 404s
+         * rather than 403s for a repository a credential may not see, so it cannot leak existence).
+         */
+        readonly deniedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+        /** Targeted repositories the probe's cap left unread, so a verdict never reads as exhaustive. */
+        readonly unprobedRepoCount: v.NumberSchema<undefined>;
+        /** The instance the token authenticates against, for the re-mint link. Null ⇒ not derivable. */
+        readonly webUrl: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>;
+}, undefined>], undefined>;
+export type GitHubPatCheck = v.InferOutput<typeof githubPatCheckSchema>;
+/**
+ * The capabilities a report positively established as ABSENT, split by whether losing them
+ * stops a pipeline. `unknown` is in neither list by construction — see
+ * {@link githubPatCapabilityStatusSchema} for why it may not be folded into either.
+ *
+ * The one reduction both the banner and its tests read, so "is there anything to say" and "what
+ * do we say" can never disagree about which capability belongs on which side.
+ */
+export declare function missingGitHubPatCapabilities(report: GitHubPatCapabilityReport): {
+    blocking: GitHubPatCapability[];
+    advisory: GitHubPatCapability[];
+};
+/**
+ * WHOSE credential the check judged, or null when it judged none.
+ *
+ * The one place that answer is derived, because it decides which remedy a surface offers: a
+ * `deployment` token is replaced by whoever runs the deployment, an `initiator` one by the
+ * signed-in user in their own settings, and sending one reader to the other's remedy is worse
+ * than saying nothing. Two of the four states carry a source and two cannot have one, which is
+ * the shape a caller gets wrong by reading `report?.source` and letting the absent case fall
+ * through to whichever branch its ternary happened to end on.
+ */
+export declare function githubPatCheckSource(check: GitHubPatCheck): GitHubPatSource | null;
+/**
+ * Whether a check warrants interrupting the user with a banner.
+ *
+ * True for a rejected token and for any established BLOCKING gap. False for `probe_failed` (an
+ * outage is not a permissions problem), for `not_applicable`, and for a report whose only
+ * findings are advisory or `unknown` — those are visible in the settings surface, where someone
+ * who came to look at the connection can act on them, rather than over the board.
+ */
+export declare function githubPatCheckNeedsAttention(check: GitHubPatCheck): boolean;
+//# sourceMappingURL=github-pat-capability.d.ts.map

package/dist/github-pat-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-pat-capability.d.ts","sourceRoot":"","sources":["../src/github-pat-capability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAwB5B;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,0DAA0C,CAAA;AAC5E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEzE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,qEAAqD,CAAA;AACrF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,oEAAoD,CAAA;AAC1F,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,uCAAoC,CAAA;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gEAAgD,CAAA;AAC5F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;aAItC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,mCAGM,CAAA;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,YAAI,MAAM,EAAE,UAAU,CAAU,CAAA;AAEtE;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,YAC9C,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,CACT,CAAA;AAEV;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAOnE,CAAA;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,MAAM,CAWR;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;IAI1C,iFAAiF;;IAEjF;;;;;OAKG;;IAEH,iGAAiG;;IAEjG,gGAAgG;;aAEhG,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;QAlC/B,iFAAiF;;QAEjF;;;;;WAKG;;QAEH,iGAAiG;;QAEjG,gGAAgG;;;0BAgChG,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEvE;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,yBAAyB,GAAG;IAC/E,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAKA;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,GAAG,IAAI,CAYlF;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAI3E"}

package/dist/github-pat-capability.js

@@ -0,0 +1,265 @@
+import * as v from 'valibot';
+// ---------------------------------------------------------------------------
+// What the GitHub personal access token a workspace's runs authenticate with can actually
+// DO, answered once the board has loaded rather than discovered when a run fails at its push.
+//
+// A PAT is the operational credential on two deployment shapes: local mode, where one token is
+// both the sign-in identity and what every agent step clones, pushes and merges with, and a
+// hosted deployment whose run initiator stored a `github_pat`, which OUTRANKS the App
+// installation on the run path (`backend/docs/security-model.md`, Layer 3). On both, a token
+// minted without `repo` reaches its first failure several steps into a pipeline, as a 403 out
+// of a container, after the run has already spent money.
+//
+// This module holds the vocabulary BOTH sides agree about: the backend probes, the SPA renders
+// the verdict and the re-mint link, so the capability list, which capabilities are BLOCKING,
+// and the scopes a replacement token needs live here instead of being restated on each side.
+//
+// Deliberately not a boolean, and deliberately per-capability. GitHub reports a CLASSIC token's
+// scopes in the `x-oauth-scopes` header and reports nothing whatsoever for a fine-grained one,
+// whose reach is knowable only by probing a repository — which answers for push and answers
+// nothing for the rest. "Not granted" and "not knowable" are different facts with different
+// remedies, so each capability carries its own tri-state and an unknowable one says so.
+// ---------------------------------------------------------------------------
+/**
+ * Which credential the check looked at — the two shapes on which a PAT is what a run
+ * authenticates as. Named on the wire because the REMEDY differs: a `deployment` token is
+ * replaced by whoever runs the deployment, an `initiator` one by the signed-in user in their
+ * own settings, and a banner that could not tell them apart would send half its readers to a
+ * page they cannot act on.
+ */
+export const githubPatSourceSchema = v.picklist(['deployment', 'initiator']);
+/**
+ * How a token's reach was determined, mirroring `describeGitHubPatScope`'s own classification.
+ * `unknown` is a token GitHub accepted while reporting no scopes and whose prefix is not the
+ * fine-grained one, so nothing about its breadth can be stated.
+ */
+export const githubPatKindSchema = v.picklist(['classic', 'fine_grained', 'unknown']);
+/**
+ * The things a pipeline needs the token to be able to do. Kept to what actually stops work:
+ * every step from the coder onward pushes a branch, the merger opens and merges a pull
+ * request, and the coder/ci-fixer may edit `.github/workflows/*`.
+ *
+ * Read-only reach is absent on purpose. A token that cannot read the repository fails at
+ * `GET /user` or at the repo probe, which is `token_rejected` / an unreadable repo rather than
+ * a capability verdict.
+ */
+export const githubPatCapabilitySchema = v.picklist(['push', 'pullRequests', 'workflows']);
+/** Every capability, as a plain tuple — the source of truth for iteration. */
+export const GITHUB_PAT_CAPABILITIES = githubPatCapabilitySchema.options;
+/**
+ * Whether the token holds one capability.
+ *  - `granted` — positively established (a classic scope GitHub named, or a repo probe that
+ *    reported `permissions.push`).
+ *  - `missing`  — positively established as ABSENT. The only status that raises a banner.
+ *  - `unknown`  — not determinable from what GitHub exposes. NOT a synonym for either: a
+ *    fine-grained token's pull-request and workflow permissions have no endpoint that reports
+ *    them, and rendering that as `granted` would silence a real gap while rendering it as
+ *    `missing` would nag every correctly-configured fine-grained deployment forever.
+ */
+export const githubPatCapabilityStatusSchema = v.picklist(['granted', 'missing', 'unknown']);
+/**
+ * The per-capability verdict. Spelled as an explicit object rather than a `v.record` over the
+ * picklist so a new capability fails the typecheck at every construction site instead of
+ * silently defaulting to absent; `githubPatCapabilities.spec.ts` pins the two lists together.
+ */
+export const githubPatCapabilitiesSchema = v.object({
+    push: githubPatCapabilityStatusSchema,
+    pullRequests: githubPatCapabilityStatusSchema,
+    workflows: githubPatCapabilityStatusSchema,
+});
+/**
+ * The capabilities whose absence STOPS a pipeline, as opposed to narrowing what it may change.
+ *
+ * `workflows` is deliberately not among them, and it is the exclusion worth stating: without it
+ * a run pushes, opens its PR and merges exactly as normal, and fails only on the subset of
+ * changes that touch `.github/workflows/*`. Treating that as blocking would raise the loud
+ * banner on the many deployments whose agents never edit CI, which is how a warning surface
+ * teaches people to dismiss it unread.
+ */
+export const GITHUB_PAT_BLOCKING_CAPABILITIES = [
+    'push',
+    'pullRequests',
+];
+/**
+ * The classic scopes a replacement token needs, and the single source of truth for them: the
+ * local facade's setup link, the SPA's re-mint link and this module's own classification all
+ * read this one list.
+ *
+ * `repo` covers cloning, pushing a branch, opening the pull request, reading the head's Actions
+ * check runs for the CI gate and merging. `workflow` is needed only to push a change that
+ * touches a workflow file, but it is pre-selected anyway: a token is minted once, and sending
+ * someone back to GitHub a second time the first time an agent edits CI is worse than the
+ * narrower grant is worth. What it costs is stated in `githubPatScope.ts`.
+ */
+export const GITHUB_PAT_CLASSIC_SCOPES = ['repo', 'workflow'];
+/**
+ * The fine-grained REPOSITORY permissions a replacement token needs, for the banner to list.
+ * Prose rather than a query parameter because GitHub's fine-grained token form accepts no
+ * prefill: see {@link githubPatCreateUrl}.
+ */
+export const GITHUB_PAT_FINE_GRAINED_PERMISSIONS = [
+    'contents:write',
+    'pull_requests:write',
+    'workflows:write',
+];
+/**
+ * Where each token kind is minted, relative to the instance's web root. Exported because the
+ * SPA's generic connect-box link (`vcsTokenCreateUrl`, which offers no scopes) has to land on
+ * the same page this module's pre-filled link does; two spellings of GitHub's settings path
+ * would send the two surfaces to different places the day GitHub moves one.
+ */
+export const GITHUB_TOKEN_CREATE_PATHS = {
+    classic: '/settings/tokens/new',
+    fine_grained: '/settings/personal-access-tokens/new',
+    // Nothing is known about the token in play, so the form that CAN be pre-filled is the better
+    // landing place: it arrives with the right scopes ticked, and a reader who wanted the
+    // fine-grained one is one link away on the same settings page.
+    unknown: '/settings/tokens/new',
+};
+/** Strip a trailing slash so a host and a path never join into a double slash. */
+function root(webUrl) {
+    return webUrl.replace(/\/+$/, '');
+}
+/**
+ * The URL that mints a replacement token, pre-filled as far as GitHub allows.
+ *
+ * The KIND is carried over from the token being replaced rather than chosen for the user: a
+ * deployment that standardised on fine-grained tokens should not be pushed back to a classic
+ * one by a warning banner, and vice versa.
+ *
+ * Only the CLASSIC form takes a prefill. GitHub's fine-grained form accepts no permission query
+ * parameters at all, so that half of the fork is a bare link and the caller must render
+ * {@link GITHUB_PAT_FINE_GRAINED_PERMISSIONS} beside it — a link that silently arrived with
+ * nothing selected would read as "these are already set for you", which is precisely the
+ * misreading that produced the missing permission in the first place.
+ *
+ * `webUrl` is the instance the workspace is bound to; absent, the caller has already decided to
+ * fall back to the public host (the SPA's `vcsTokenCreateUrl` states why that is safe for a
+ * settings page and not for a repository link).
+ */
+export function githubPatCreateUrl(kind, options) {
+    const page = `${root(options.webUrl)}${GITHUB_TOKEN_CREATE_PATHS[kind]}`;
+    if (kind === 'fine_grained')
+        return page;
+    // Hand-built rather than via `URLSearchParams`: this package is dependency-free and compiles
+    // with neither the DOM nor the Node lib, and it is imported by the SPA, both facades and the
+    // local runtime alike — so the one place the query string is assembled cannot assume a global.
+    const query = [
+        `scopes=${encodeURIComponent(GITHUB_PAT_CLASSIC_SCOPES.join(','))}`,
+        ...(options.description ? [`description=${encodeURIComponent(options.description)}`] : []),
+    ];
+    return `${page}?${query.join('&')}`;
+}
+/**
+ * What the check found about the token a workspace's runs would use.
+ *
+ * `probedRepos` / `unprobedRepoCount` exist because the fine-grained answer is a SAMPLE: the
+ * probe reads the repositories this board's services target, capped, and a reader who assumed
+ * it read all of them would take a clean verdict as a guarantee about a repository nobody
+ * looked at. Both are empty/zero for a classic token, whose scopes answer for every repository
+ * at once.
+ *
+ * The token's raw scope list is deliberately NOT here. Nothing renders it, and the one source
+ * whose scopes this endpoint could expose is `deployment` — a shared operational credential
+ * whose breadth every workspace member would then be able to read off a route that lets reads
+ * through. The per-capability verdict is what a reader can act on; the scope list is what the
+ * person who pasted the token already saw on the connect form.
+ */
+export const githubPatCapabilityReportSchema = v.object({
+    source: githubPatSourceSchema,
+    kind: githubPatKindSchema,
+    capabilities: githubPatCapabilitiesSchema,
+    /** The `owner/name` of each repository the probe actually asked GitHub about. */
+    probedRepos: v.array(v.string()),
+    /**
+     * The probed repositories GitHub answered 404 for. A subset of {@link probedRepos}, and the
+     * one detail that turns "push is missing" into something a reader can act on for a
+     * fine-grained token: these are the repositories the token was not granted (GitHub 404s
+     * rather than 403s for a repository a credential may not see, so it cannot leak existence).
+     */
+    deniedRepos: v.array(v.string()),
+    /** Targeted repositories the probe's cap left unread, so a verdict never reads as exhaustive. */
+    unprobedRepoCount: v.number(),
+    /** The instance the token authenticates against, for the re-mint link. Null ⇒ not derivable. */
+    webUrl: v.nullable(v.string()),
+});
+/**
+ * The check's outcome. A variant rather than a nullable report because the four states need
+ * four different reactions, and three of them are not "the token lacks something":
+ *
+ *  - `not_applicable` — no PAT is in play (a GitHub App deployment, GitLab, or nothing
+ *    connected at all), or this board's services target no GitHub repository, so no run here
+ *    would ever authenticate with one. There is no token whose reach could be wrong.
+ *  - `token_rejected` — GitHub refused the token outright (401/403). Blocking, and a strictly
+ *    worse problem than a missing scope, so it gets its own state instead of collapsing into
+ *    "everything is missing". It carries `source` for the same reason the report does: the
+ *    remedy for a rejected DEPLOYMENT credential is not the one for a rejected personal token,
+ *    and this is the state in which the reader is least able to work that out for themselves.
+ *  - `probe_failed`   — GitHub could not be reached, refused to answer for now (a rate limit),
+ *    or answered in a way the probe could not read. NOT a verdict about the token: an upstream
+ *    condition must never render as a permissions problem, because the remedy it would
+ *    advertise (mint a new token) is wrong and costly.
+ *  - `checked`        — a report was produced. It may still be entirely clean.
+ */
+export const githubPatCheckSchema = v.variant('state', [
+    v.object({ state: v.literal('not_applicable') }),
+    v.object({
+        state: v.literal('token_rejected'),
+        status: v.number(),
+        source: githubPatSourceSchema,
+    }),
+    v.object({ state: v.literal('probe_failed'), message: v.string() }),
+    v.object({ state: v.literal('checked'), report: githubPatCapabilityReportSchema }),
+]);
+/**
+ * The capabilities a report positively established as ABSENT, split by whether losing them
+ * stops a pipeline. `unknown` is in neither list by construction — see
+ * {@link githubPatCapabilityStatusSchema} for why it may not be folded into either.
+ *
+ * The one reduction both the banner and its tests read, so "is there anything to say" and "what
+ * do we say" can never disagree about which capability belongs on which side.
+ */
+export function missingGitHubPatCapabilities(report) {
+    const missing = GITHUB_PAT_CAPABILITIES.filter((c) => report.capabilities[c] === 'missing');
+    const isBlocking = (c) => GITHUB_PAT_BLOCKING_CAPABILITIES.includes(c);
+    return { blocking: missing.filter(isBlocking), advisory: missing.filter((c) => !isBlocking(c)) };
+}
+/**
+ * WHOSE credential the check judged, or null when it judged none.
+ *
+ * The one place that answer is derived, because it decides which remedy a surface offers: a
+ * `deployment` token is replaced by whoever runs the deployment, an `initiator` one by the
+ * signed-in user in their own settings, and sending one reader to the other's remedy is worse
+ * than saying nothing. Two of the four states carry a source and two cannot have one, which is
+ * the shape a caller gets wrong by reading `report?.source` and letting the absent case fall
+ * through to whichever branch its ternary happened to end on.
+ */
+export function githubPatCheckSource(check) {
+    switch (check.state) {
+        case 'checked':
+            return check.report.source;
+        case 'token_rejected':
+            return check.source;
+        // Neither state judged a credential: `not_applicable` found none in play, and
+        // `probe_failed` never got an answer about the one it found.
+        case 'not_applicable':
+        case 'probe_failed':
+            return null;
+    }
+}
+/**
+ * Whether a check warrants interrupting the user with a banner.
+ *
+ * True for a rejected token and for any established BLOCKING gap. False for `probe_failed` (an
+ * outage is not a permissions problem), for `not_applicable`, and for a report whose only
+ * findings are advisory or `unknown` — those are visible in the settings surface, where someone
+ * who came to look at the connection can act on them, rather than over the board.
+ */
+export function githubPatCheckNeedsAttention(check) {
+    if (check.state === 'token_rejected')
+        return true;
+    if (check.state !== 'checked')
+        return false;
+    return missingGitHubPatCapabilities(check.report).blocking.length > 0;
+}
+//# sourceMappingURL=github-pat-capability.js.map

package/dist/github-pat-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-pat-capability.js","sourceRoot":"","sources":["../src/github-pat-capability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,0FAA0F;AAC1F,8FAA8F;AAC9F,EAAE;AACF,+FAA+F;AAC/F,4FAA4F;AAC5F,sFAAsF;AACtF,6FAA6F;AAC7F,8FAA8F;AAC9F,yDAAyD;AACzD,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,6FAA6F;AAC7F,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,4FAA4F;AAC5F,4FAA4F;AAC5F,wFAAwF;AACxF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AAG5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAA;AAGrF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;AAG1F,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,OAAO,CAAA;AAExE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;AAG5F;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,+BAA+B;IACrC,YAAY,EAAE,+BAA+B;IAC7C,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,MAAM;IACN,cAAc;CACmC,CAAA;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAU,CAAA;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,gBAAgB;IAChB,qBAAqB;IACrB,iBAAiB;CACT,CAAA;AAEV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAkC;IACtE,OAAO,EAAE,sBAAsB;IAC/B,YAAY,EAAE,sCAAsC;IACpD,6FAA6F;IAC7F,sFAAsF;IACtF,+DAA+D;IAC/D,OAAO,EAAE,sBAAsB;CAChC,CAAA;AAED,kFAAkF;AAClF,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAmB,EACnB,OAAiD;IAEjD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAA;IACxE,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAA;IACxC,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,KAAK,GAAG;QACZ,UAAU,kBAAkB,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE;QACnE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAA;IACD,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,EAAE,qBAAqB;IAC7B,IAAI,EAAE,mBAAmB;IACzB,YAAY,EAAE,2BAA2B;IACzC,iFAAiF;IACjF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,iGAAiG;IACjG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,gGAAgG;IAChG,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC/B,CAAC,CAAA;AAGF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;IACrD,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,qBAAqB;KAC9B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;CACnF,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAiC;IAI5E,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAC3F,MAAM,UAAU,GAAG,CAAC,CAAsB,EAAW,EAAE,CACpD,gCAAmE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAClF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAClG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAqB;IACxD,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAA;QAC5B,KAAK,gBAAgB;YACnB,OAAO,KAAK,CAAC,MAAM,CAAA;QACrB,8EAA8E;QAC9E,6DAA6D;QAC7D,KAAK,gBAAgB,CAAC;QACtB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAqB;IAChE,IAAI,KAAK,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC3C,OAAO,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;AACvE,CAAC"}

package/dist/index.d.ts

@@ -47,6 +47,7 @@ export * from './tasks.js';
 export * from './bug-hunt.js';
 export * from './environments.js';
 export * from './environments-kubernetes.js';
+export * from './service-account-token.js';
 export * from './preflights.js';
 export * from './compose-sources.js';
 export * from './stack-recipes.js';
@@ -58,6 +59,7 @@ export * from './bootstrap.js';
 export * from './env-config-repair.js';
 export * from './environment-test.js';
 export * from './infra-setup.js';
+export * from './github-pat-capability.js';
 export * from './snapshot.js';
 export * from './sso.js';
 export * from './board-scan.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AACzC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,2BAA2B,CAAA;AACzC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AACzC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,2BAA2B,CAAA;AACzC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}

package/dist/index.js

@@ -47,6 +47,7 @@ export * from './tasks.js';
 export * from './bug-hunt.js';
 export * from './environments.js';
 export * from './environments-kubernetes.js';
+export * from './service-account-token.js';
 export * from './preflights.js';
 export * from './compose-sources.js';
 export * from './stack-recipes.js';
@@ -58,6 +59,7 @@ export * from './bootstrap.js';
 export * from './env-config-repair.js';
 export * from './environment-test.js';
 export * from './infra-setup.js';
+export * from './github-pat-capability.js';
 export * from './snapshot.js';
 export * from './sso.js';
 export * from './board-scan.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AACzC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,2BAA2B,CAAA;AACzC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AACzC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,2BAA2B,CAAA;AACzC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}

package/dist/provider-config.d.ts

@@ -179,26 +179,51 @@ export type ProviderDescriptor = v.InferOutput<typeof providerDescriptorSchema>;
  * incident. Machine-readable, because the backend does not localize prose — the SPA maps the
  * `code` to its own copy and keeps `message` only as the untranslated last resort.
  */
-export declare const connectionWarningCodeSchema: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+export declare const connectionWarningCodeSchema: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
 export type ConnectionWarningCode = v.InferOutput<typeof connectionWarningCodeSchema>;
 export declare const connectionWarningSchema: v.ObjectSchema<{
-    readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+    readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
     /** The backend's own English account of the gap, also written to the deployment log. */
     readonly message: v.StringSchema<undefined>;
 }, undefined>;
 export type ConnectionWarning = v.InferOutput<typeof connectionWarningSchema>;
+/**
+ * The transport-level class of a connection failure, for a probe that never got an ANSWER: each
+ * member is a different fix (a stopped host, a typo'd name, an untrusted certificate, a credential
+ * that cannot become a header). Machine-readable for the same reason {@link ConnectionWarningCode}
+ * is: the backend does not localize prose, and this is the most-read prose in the connect forms,
+ * so the SPA maps the member to translated copy and keeps the backend's English account as the
+ * technical detail beside it.
+ *
+ * It lives here rather than in kernel because BOTH sides have to agree about the answer: kernel is
+ * invisible to the SPA, so the union kept there would be restated by hand on the forms. Kernel's
+ * `describeConnectionFailure` is the one producer.
+ *
+ * `unknown` is a real member, not a placeholder: it means the thrown error was read and matched
+ * nothing, which is why such a failure is reported as itself with no remedy rather than being
+ * assigned the nearest-looking one.
+ */
+export declare const connectionFailureCauseSchema: v.PicklistSchema<["refused", "dns", "timeout", "aborted", "unreachable", "reset", "tls-untrusted", "tls-expired", "tls-hostname", "tls-protocol", "invalid-header", "unknown"], undefined>;
+export type ConnectionFailureCause = v.InferOutput<typeof connectionFailureCauseSchema>;
 /** The outcome of a provider connection test (never throws to the client). */
 export declare const connectionTestResultSchema: v.ObjectSchema<{
     readonly ok: v.BooleanSchema<undefined>;
     /** Human-readable detail — a success hint or the failure reason. */
     readonly message: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /**
+     * What CLASS of transport failure this was, when the probe never got an answer. Present only on
+     * such a failure: a success has none, and so does a failure that IS an answer (an HTTP status
+     * the provider maps itself), because those carry no transport cause to name. The SPA renders the
+     * headline from this and keeps {@link message} as the untranslated detail underneath.
+     */
+    readonly failureCause: v.OptionalSchema<v.PicklistSchema<["refused", "dns", "timeout", "aborted", "unreachable", "reset", "tls-untrusted", "tls-expired", "tls-hostname", "tls-protocol", "invalid-header", "unknown"], undefined>, undefined>;
     /**
      * Gaps in the config being tested. Independent of `ok`: a warned config still connects, and
      * the test is the one moment the operator is looking at this backend, so it is where they
      * find out. Absent/empty ⇒ nothing to report.
      */
     readonly warnings: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-        readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+        readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
         /** The backend's own English account of the gap, also written to the deployment log. */
         readonly message: v.StringSchema<undefined>;
     }, undefined>, undefined>, undefined>;

package/dist/provider-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-config.d.ts","sourceRoot":"","sources":["../src/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAc5B;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,+FAOxC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEzF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,iFAAiF;;IAEjF,sCAAsC;;IAEtC,kDAAkD;;IAElD,kCAAkC;;IAElC,gEAAgE;;IAEhE,oEAAoE;;IAEpE,+CAA+C;;IAE/C,oCAAoC;;;;;IAEpC;;;;;;;OAOG;;aAEH,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;QAnCnC,iFAAiF;;QAEjF,sCAAsC;;QAEtC,kDAAkD;;QAElD,kCAAkC;;QAElC,gEAAgE;;QAEhE,oEAAoE;;QAEpE,+CAA+C;;QAE/C,oCAAoC;;;;;QAEpC;;;;;;;WAOG;;;IAiBH,yEAAyE;;IAEzE;;;;;;;OAOG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH,8FAA8F;;QA7D9F,iFAAiF;;QAEjF,sCAAsC;;QAEtC,kDAAkD;;QAElD,kCAAkC;;QAElC,gEAAgE;;QAEhE,oEAAoE;;QAEpE,+CAA+C;;QAE/C,oCAAoC;;;;;QAEpC;;;;;;;WAOG;;;IAwCH;;;;;;;;OAQG;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;OAIG;;aAEH,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,kMAetC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF,eAAO,MAAM,uBAAuB;;IAElC,wFAAwF;;aAExF,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B;;IAErC,oEAAoE;;IAEpE;;;;OAIG;;;QAdH,wFAAwF;;;aAgBxF,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF,2DAA2D;AAC3D,eAAO,MAAM,4BAA4B,mDAAmC,CAAA;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEvF,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB;;;IAGpC,uFAAuF;;aAEvF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF,uFAAuF;AACvF,eAAO,MAAM,0BAA0B;;;;;QANrC,uFAAuF;;;aASvF,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;IAMpC;;;OAGG;;;;;QAhCH,uFAAuF;;;aAmCvF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA"}
+{"version":3,"file":"provider-config.d.ts","sourceRoot":"","sources":["../src/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAc5B;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,+FAOxC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEzF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,iFAAiF;;IAEjF,sCAAsC;;IAEtC,kDAAkD;;IAElD,kCAAkC;;IAElC,gEAAgE;;IAEhE,oEAAoE;;IAEpE,+CAA+C;;IAE/C,oCAAoC;;;;;IAEpC;;;;;;;OAOG;;aAEH,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;QAnCnC,iFAAiF;;QAEjF,sCAAsC;;QAEtC,kDAAkD;;QAElD,kCAAkC;;QAElC,gEAAgE;;QAEhE,oEAAoE;;QAEpE,+CAA+C;;QAE/C,oCAAoC;;;;;QAEpC;;;;;;;WAOG;;;IAiBH,yEAAyE;;IAEzE;;;;;;;OAOG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH,8FAA8F;;QA7D9F,iFAAiF;;QAEjF,sCAAsC;;QAEtC,kDAAkD;;QAElD,kCAAkC;;QAElC,gEAAgE;;QAEhE,oEAAoE;;QAEpE,+CAA+C;;QAE/C,oCAAoC;;;;;QAEpC;;;;;;;WAOG;;;IAwCH;;;;;;;;OAQG;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;OAIG;;aAEH,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,0NAqBtC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF,eAAO,MAAM,uBAAuB;;IAElC,wFAAwF;;aAExF,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,4LAgBvC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEvF,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B;;IAErC,oEAAoE;;IAEpE;;;;;OAKG;;IAEH;;;;OAIG;;;QAxDH,wFAAwF;;;aA0DxF,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF,2DAA2D;AAC3D,eAAO,MAAM,4BAA4B,mDAAmC,CAAA;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEvF,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB;;;IAGpC,uFAAuF;;aAEvF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF,uFAAuF;AACvF,eAAO,MAAM,0BAA0B;;;;;QANrC,uFAAuF;;;aASvF,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;IAMpC;;;OAGG;;;;;QAhCH,uFAAuF;;;aAmCvF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA"}

package/dist/provider-config.js

@@ -148,17 +148,63 @@ export const connectionWarningCodeSchema = v.picklist([
     // its reach. Reported rather than assumed: "unknown breadth" and "narrow" are not the same
     // fact, and treating them alike is exactly how an over-broad token stays silent.
     'github_pat_scope_unreadable',
+    // GitHub returned the scope header with an EMPTY value: a classic token minted with nothing
+    // ticked. Distinct from the code above because it is the opposite fact — a positively stated
+    // "this token grants no scopes at all" rather than an unreadable one — and it is the state a
+    // reader is most likely to have produced by accident, since GitHub's form ticks nothing by
+    // default and the token still authenticates.
+    'github_pat_no_scopes',
 ]);
 export const connectionWarningSchema = v.object({
     code: connectionWarningCodeSchema,
     /** The backend's own English account of the gap, also written to the deployment log. */
     message: v.string(),
 });
+/**
+ * The transport-level class of a connection failure, for a probe that never got an ANSWER: each
+ * member is a different fix (a stopped host, a typo'd name, an untrusted certificate, a credential
+ * that cannot become a header). Machine-readable for the same reason {@link ConnectionWarningCode}
+ * is: the backend does not localize prose, and this is the most-read prose in the connect forms,
+ * so the SPA maps the member to translated copy and keeps the backend's English account as the
+ * technical detail beside it.
+ *
+ * It lives here rather than in kernel because BOTH sides have to agree about the answer: kernel is
+ * invisible to the SPA, so the union kept there would be restated by hand on the forms. Kernel's
+ * `describeConnectionFailure` is the one producer.
+ *
+ * `unknown` is a real member, not a placeholder: it means the thrown error was read and matched
+ * nothing, which is why such a failure is reported as itself with no remedy rather than being
+ * assigned the nearest-looking one.
+ */
+export const connectionFailureCauseSchema = v.picklist([
+    'refused',
+    'dns',
+    'timeout',
+    // Cancelled rather than timed out: a shutting-down process or a superseded request. Kept apart
+    // from `timeout` because the remedies diverge (a timeout points at a firewall or a saturated
+    // host; an abort points at nothing and simply wants re-running).
+    'aborted',
+    'unreachable',
+    'reset',
+    'tls-untrusted',
+    'tls-expired',
+    'tls-hostname',
+    'tls-protocol',
+    'invalid-header',
+    'unknown',
+]);
 /** The outcome of a provider connection test (never throws to the client). */
 export const connectionTestResultSchema = v.object({
     ok: v.boolean(),
     /** Human-readable detail — a success hint or the failure reason. */
     message: v.optional(v.string()),
+    /**
+     * What CLASS of transport failure this was, when the probe never got an answer. Present only on
+     * such a failure: a success has none, and so does a failure that IS an answer (an HTTP status
+     * the provider maps itself), because those carry no transport cause to name. The SPA renders the
+     * headline from this and keeps {@link message} as the untranslated detail underneath.
+     */
+    failureCause: v.optional(connectionFailureCauseSchema),
     /**
      * Gaps in the config being tested. Independent of `ok`: a warned config still connects, and
      * the test is the one moment the operator is looking at this backend, so it is where they

package/dist/provider-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-config.js","sourceRoot":"","sources":["../src/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,QAAQ,CAAC;IACtD,MAAM;IACN,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAA;AAGF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,iFAAiF;IACjF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,sCAAsC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,kDAAkD;IAClD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,kCAAkC;IAClC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,+CAA+C;IAC/C,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC/C,oCAAoC;IACpC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAChC,CAAC,CAAA;AAGF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAChD,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,sBAAsB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/C;;;OAGG;IACH,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/D;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D;;;;;;;;;;OAUG;IACH,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD,CAAC,CAAA;AAGF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,QAAQ,CAAC;IACpD,4BAA4B;IAC5B,gCAAgC;IAChC,4FAA4F;IAC5F,4FAA4F;IAC5F,6FAA6F;IAC7F,wFAAwF;IACxF,iCAAiC;IACjC,0FAA0F;IAC1F,kCAAkC;IAClC,+BAA+B;IAC/B,2FAA2F;IAC3F,2FAA2F;IAC3F,iFAAiF;IACjF,6BAA6B;CAC9B,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,2BAA2B;IACjC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAA;AAGF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,oEAAoE;IACpE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;CACvD,CAAC,CAAA;AAGF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;AAG5E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,uFAAuF;IACvF,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAA;AAGF,uFAAuF;AACvF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAA;AAGF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAClC;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAA"}
+{"version":3,"file":"provider-config.js","sourceRoot":"","sources":["../src/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,QAAQ,CAAC;IACtD,MAAM;IACN,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAA;AAGF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,iFAAiF;IACjF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,sCAAsC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,kDAAkD;IAClD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,kCAAkC;IAClC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,+CAA+C;IAC/C,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC/C,oCAAoC;IACpC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF;;;;;;;OAOG;IACH,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAChC,CAAC,CAAA;AAGF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAChD,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,sBAAsB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/C;;;OAGG;IACH,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,8FAA8F;IAC9F,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/D;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D;;;;;;;;;;OAUG;IACH,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD,CAAC,CAAA;AAGF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,QAAQ,CAAC;IACpD,4BAA4B;IAC5B,gCAAgC;IAChC,4FAA4F;IAC5F,4FAA4F;IAC5F,6FAA6F;IAC7F,wFAAwF;IACxF,iCAAiC;IACjC,0FAA0F;IAC1F,kCAAkC;IAClC,+BAA+B;IAC/B,2FAA2F;IAC3F,2FAA2F;IAC3F,iFAAiF;IACjF,6BAA6B;IAC7B,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,2FAA2F;IAC3F,6CAA6C;IAC7C,sBAAsB;CACvB,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,2BAA2B;IACjC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAA;AAGF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrD,SAAS;IACT,KAAK;IACL,SAAS;IACT,+FAA+F;IAC/F,6FAA6F;IAC7F,iEAAiE;IACjE,SAAS;IACT,aAAa;IACb,OAAO;IACP,eAAe;IACf,aAAa;IACb,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,SAAS;CACV,CAAC,CAAA;AAGF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,oEAAoE;IACpE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACtD;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;CACvD,CAAC,CAAA;AAGF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;AAG5E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,uFAAuF;IACvF,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAA;AAGF,uFAAuF;AACvF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAA;AAGF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAClC;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAA"}

package/dist/routes/environments.d.ts

@@ -2594,8 +2594,9 @@ export declare const testEnvironmentConnectionContract: {
         readonly 200: v.ObjectSchema<{
             readonly ok: v.BooleanSchema<undefined>;
             readonly message: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly failureCause: v.OptionalSchema<v.PicklistSchema<["refused", "dns", "timeout", "aborted", "unreachable", "reset", "tls-untrusted", "tls-expired", "tls-hostname", "tls-protocol", "invalid-header", "unknown"], undefined>, undefined>;
             readonly warnings: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+                readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
                 readonly message: v.StringSchema<undefined>;
             }, undefined>, undefined>, undefined>;
         }, undefined>;
@@ -4675,8 +4676,9 @@ export declare const testEnvironmentHandlerContract: {
         readonly 200: v.ObjectSchema<{
             readonly ok: v.BooleanSchema<undefined>;
             readonly message: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly failureCause: v.OptionalSchema<v.PicklistSchema<["refused", "dns", "timeout", "aborted", "unreachable", "reset", "tls-untrusted", "tls-expired", "tls-hostname", "tls-protocol", "invalid-header", "unknown"], undefined>, undefined>;
             readonly warnings: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+                readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
                 readonly message: v.StringSchema<undefined>;
             }, undefined>, undefined>, undefined>;
         }, undefined>;

package/dist/routes/environments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/routes/environments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA8C5B,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI3C,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK9C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIhD,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ9C,CAAA;AAEF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK5C,CAAA;AAIF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK1C,CAAA;AAIF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA;AAIF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK5C,CAAA;AAIF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAKF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAWF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI1C,CAAA;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK7C,CAAA;AAKF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKzC,CAAA;AAEF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOlD,CAAA;AAEF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAM/C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAM3C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAInC,CAAA;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKjC,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMtC,CAAA;AAOF,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMvC,CAAA;AAEF,+DAA+D;AAC/D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKrC,CAAA;AAEF,4FAA4F;AAC5F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMtC,CAAA"}
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/routes/environments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA8C5B,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI3C,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK9C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIhD,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ9C,CAAA;AAEF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK5C,CAAA;AAIF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK1C,CAAA;AAIF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA;AAIF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK5C,CAAA;AAIF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAKF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAWF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI1C,CAAA;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK7C,CAAA;AAKF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKzC,CAAA;AAEF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOlD,CAAA;AAEF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAM/C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAM3C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAInC,CAAA;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKjC,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMtC,CAAA;AAOF,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMvC,CAAA;AAEF,+DAA+D;AAC/D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKrC,CAAA;AAEF,4FAA4F;AAC5F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMtC,CAAA"}

package/dist/routes/github.d.ts

@@ -905,4 +905,67 @@ export declare const commentGitHubIssueContract: {
         readonly 204: typeof ContractNoBody;
     };
 };
+/**
+ * What the personal access token this workspace's runs would authenticate with can actually do
+ * (see `github-pat-capability.ts`). A READ, so it passes the controller's writes-only
+ * `integrations.manage` mount and any member can call it — deliberately, because on a hosted
+ * deployment the token under judgement is the CALLER'S OWN stored `github_pat`, and the person
+ * who has to re-mint it is exactly the person an admin-gated route would hide it from.
+ *
+ * Answers `not_applicable` rather than 404ing when no PAT is in play, so the SPA has one call to
+ * make on board load regardless of how the deployment authenticates.
+ */
+export declare const getGitHubPatCheckContract: {
+    readonly method: "get";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: v.VariantSchema<"state", [v.ObjectSchema<{
+            readonly state: v.LiteralSchema<"not_applicable", undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly state: v.LiteralSchema<"token_rejected", undefined>;
+            readonly status: v.NumberSchema<undefined>;
+            readonly source: v.PicklistSchema<["deployment", "initiator"], undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly state: v.LiteralSchema<"probe_failed", undefined>;
+            readonly message: v.StringSchema<undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly state: v.LiteralSchema<"checked", undefined>;
+            readonly report: v.ObjectSchema<{
+                readonly source: v.PicklistSchema<["deployment", "initiator"], undefined>;
+                readonly kind: v.PicklistSchema<["classic", "fine_grained", "unknown"], undefined>;
+                readonly capabilities: v.ObjectSchema<{
+                    readonly push: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+                    readonly pullRequests: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+                    readonly workflows: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+                }, undefined>;
+                readonly probedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+                readonly deniedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+                readonly unprobedRepoCount: v.NumberSchema<undefined>;
+                readonly webUrl: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>;
+        }, undefined>], undefined>;
+    };
+};
 //# sourceMappingURL=github.d.ts.map

package/dist/routes/github.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/routes/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqC,MAAM,yBAAyB,CAAA;AAC3F,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA6D5B,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAItC,CAAA;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAItC,CAAA;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI1C,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKhC,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ3C,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMxC,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMrC,CAAA;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKtC,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAInC,CAAA;AAIF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK/B,CAAA;AAIF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIlC,CAAA;AAKF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI9C,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKrC,CAAA;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIlC,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAInC,CAAA;AAIF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKnC,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMrC,CAAA;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMpC,CAAA;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMxC,CAAA;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMzC,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOrC,CAAA"}
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/routes/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqC,MAAM,yBAAyB,CAAA;AAC3F,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA8D5B,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAItC,CAAA;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAItC,CAAA;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI1C,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKhC,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ3C,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKvC,CAAA;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMxC,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMrC,CAAA;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKtC,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAInC,CAAA;AAIF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK/B,CAAA;AAIF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIlC,CAAA;AAKF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI9C,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKrC,CAAA;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIlC,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAInC,CAAA;AAIF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKnC,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMrC,CAAA;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMpC,CAAA;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMxC,CAAA;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMzC,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOrC,CAAA;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIpC,CAAA"}

package/dist/routes/github.js

@@ -1,6 +1,7 @@
 import { ContractNoBody, defineApiContract, withObjectKeys } from '@toad-contracts/valibot';
 import * as v from 'valibot';
 import { branchProtectionReportSchema, commentSchema, commitFilesSchema, createBranchSchema, createRepoRequestSchema, githubAvailableRepoSchema, githubBranchSchema, githubConnectionSchema, githubInstallationOptionSchema, githubIssueSchema, githubPullRequestSchema, githubRepoSchema, linkReposSchema, mergePullRequestSchema, openPullRequestSchema, provisionedRepoSchema, repoTreeEntrySchema, resyncRequestSchema, setRepoMonorepoSchema, } from '../github.js';
+import { githubPatCheckSchema } from '../github-pat-capability.js';
 import { errorResponses, singleStringParam } from './_shared.js';
 // ---------------------------------------------------------------------------
 // Workspace-scoped GitHub route contracts. Mounted under `/workspaces/:workspaceId`,
@@ -172,4 +173,19 @@ export const commentGitHubIssueContract = defineApiContract({
     requestBodySchema: commentSchema,
     responsesByStatusCode: { 204: ContractNoBody, ...errorResponses },
 });
+/**
+ * What the personal access token this workspace's runs would authenticate with can actually do
+ * (see `github-pat-capability.ts`). A READ, so it passes the controller's writes-only
+ * `integrations.manage` mount and any member can call it — deliberately, because on a hosted
+ * deployment the token under judgement is the CALLER'S OWN stored `github_pat`, and the person
+ * who has to re-mint it is exactly the person an admin-gated route would hide it from.
+ *
+ * Answers `not_applicable` rather than 404ing when no PAT is in play, so the SPA has one call to
+ * make on board load regardless of how the deployment authenticates.
+ */
+export const getGitHubPatCheckContract = defineApiContract({
+    method: 'get',
+    pathResolver: () => '/github/pat-check',
+    responsesByStatusCode: { 200: githubPatCheckSchema, ...errorResponses },
+});
 //# sourceMappingURL=github.js.map

package/dist/routes/github.js.map

@@ -1 +1 @@
-{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/routes/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC3F,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhE,8EAA8E;AAC9E,qFAAqF;AACrF,uEAAuE;AACvE,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAE9D,oEAAoE;AACpE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACtD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAA;AACzF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;CACvD,CAAC,CAAA;AACF,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;AACnE,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;AACvD,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;AAChD,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;AACpD,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;AAC9D,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;AAClD,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;AAC1D,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACxD,qFAAqF;AACrF,+EAA+E;AAC/E,iDAAiD;AACjD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,kBAAkB,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;CAC3E,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAA;AAC5D,MAAM,oBAAoB,GAAG,cAAc,CACzC,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC3D,CAAA;AAED,8EAA8E;AAE9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;IAC3D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;IACzC,qBAAqB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE;CACpE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;IAC3D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACxC,qBAAqB,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,cAAc,EAAE;CACxE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,iBAAiB,CAAC;IAC/D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,cAAc,EAAE;CAC3E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;IACrD,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB;IACrC,iBAAiB,EAAE,aAAa;IAChC,qBAAqB,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,cAAc,EAAE;CAC1E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAC;IAChE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAC7C,0EAA0E;IAC1E,mFAAmF;IACnF,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC3D,qBAAqB,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE;CAC5E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;IAC5D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;IAC7D,MAAM,EAAE,OAAO;IACf,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,EAAE;IACnE,iBAAiB,EAAE,qBAAqB;IACxC,qBAAqB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE;CACpE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;IAC1D,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,OAAO;IACxE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC9D,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CACtE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;IAC3D,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,QAAQ;IACzE,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CACtE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;IACxD,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACxC,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;IACpD,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;IACpC,iBAAiB,EAAE,mBAAmB;IACtC,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CAC/F,CAAC,CAAA;AAEF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;IACvD,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;IACnC,qBAAqB,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE;CAC5E,CAAC,CAAA;AAEF,8FAA8F;AAC9F,+FAA+F;AAC/F,iEAAiE;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAG,iBAAiB,CAAC;IACnE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,2BAA2B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,cAAc,EAAE;CAChF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;IAC1D,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,WAAW;IAC5E,qBAAqB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE;CACpE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;IACvD,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;IACnC,qBAAqB,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,cAAc,EAAE;CACzE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;IACxD,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;IACpC,qBAAqB,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE;CACnE,CAAC,CAAA;AAEF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;IACxD,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;IACnC,iBAAiB,EAAE,uBAAuB;IAC1C,qBAAqB,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,cAAc,EAAE;CACzE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;IAC1D,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,WAAW;IAC5E,iBAAiB,EAAE,kBAAkB;IACrC,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CACtE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;IACzD,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,UAAU;IAC3E,iBAAiB,EAAE,iBAAiB;IACpC,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CACtE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;IAC7D,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,QAAQ;IACzE,iBAAiB,EAAE,qBAAqB;IACxC,qBAAqB,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,cAAc,EAAE;CAC3E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,oBAAoB;IAC7C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,UAAU,MAAM,QAAQ;IACjG,iBAAiB,EAAE,sBAAsB;IACzC,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;IAC1D,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,oBAAoB;IAC7C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CACzC,iBAAiB,YAAY,WAAW,MAAM,WAAW;IAC3D,iBAAiB,EAAE,aAAa;IAChC,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA"}
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/routes/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC3F,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,4BAA4B,EAC5B,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhE,8EAA8E;AAC9E,qFAAqF;AACrF,uEAAuE;AACvE,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAE9D,oEAAoE;AACpE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACtD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAA;AACzF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;CACvD,CAAC,CAAA;AACF,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;AACnE,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;AACvD,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;AAChD,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;AACpD,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;AAC9D,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;AAClD,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;AAC1D,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACxD,qFAAqF;AACrF,+EAA+E;AAC/E,iDAAiD;AACjD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,kBAAkB,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;CAC3E,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAA;AAC5D,MAAM,oBAAoB,GAAG,cAAc,CACzC,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC3D,CAAA;AAED,8EAA8E;AAE9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;IAC3D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,qBAAqB;IACzC,qBAAqB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE;CACpE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;IAC3D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACxC,qBAAqB,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,cAAc,EAAE;CACxE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,iBAAiB,CAAC;IAC/D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,cAAc,EAAE;CAC3E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;IACrD,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB;IACrC,iBAAiB,EAAE,aAAa;IAChC,qBAAqB,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,cAAc,EAAE;CAC1E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAC;IAChE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAC7C,0EAA0E;IAC1E,mFAAmF;IACnF,wFAAwF;IACxF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC3D,qBAAqB,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE;CAC5E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;IAC5D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;IAC7D,MAAM,EAAE,OAAO;IACf,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,EAAE;IACnE,iBAAiB,EAAE,qBAAqB;IACxC,qBAAqB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE;CACpE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;IAC1D,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,OAAO;IACxE,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC9D,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CACtE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;IAC3D,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,QAAQ;IACzE,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CACtE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;IACxD,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACxC,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;IACpD,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;IACpC,iBAAiB,EAAE,mBAAmB;IACtC,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CAC/F,CAAC,CAAA;AAEF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;IACvD,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;IACnC,qBAAqB,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,cAAc,EAAE;CAC5E,CAAC,CAAA;AAEF,8FAA8F;AAC9F,+FAA+F;AAC/F,iEAAiE;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAG,iBAAiB,CAAC;IACnE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,2BAA2B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,cAAc,EAAE;CAChF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;IAC1D,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,WAAW;IAC5E,qBAAqB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE;CACpE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;IACvD,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;IACnC,qBAAqB,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,cAAc,EAAE;CACzE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;IACxD,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;IACpC,qBAAqB,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE;CACnE,CAAC,CAAA;AAEF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;IACxD,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;IACnC,iBAAiB,EAAE,uBAAuB;IAC1C,qBAAqB,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,cAAc,EAAE;CACzE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;IAC1D,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,WAAW;IAC5E,iBAAiB,EAAE,kBAAkB;IACrC,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CACtE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;IACzD,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,UAAU;IAC3E,iBAAiB,EAAE,iBAAiB;IACpC,qBAAqB,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,cAAc,EAAE;CACtE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;IAC7D,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,kBAAkB;IAC3C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,QAAQ;IACzE,iBAAiB,EAAE,qBAAqB;IACxC,qBAAqB,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,GAAG,cAAc,EAAE;CAC3E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,uBAAuB,EAAE,oBAAoB;IAC7C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,iBAAiB,YAAY,UAAU,MAAM,QAAQ;IACjG,iBAAiB,EAAE,sBAAsB;IACzC,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;IAC1D,MAAM,EAAE,MAAM;IACd,uBAAuB,EAAE,oBAAoB;IAC7C,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CACzC,iBAAiB,YAAY,WAAW,MAAM,WAAW;IAC3D,iBAAiB,EAAE,aAAa;IAChC,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;IACzD,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,mBAAmB;IACvC,qBAAqB,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,cAAc,EAAE;CACxE,CAAC,CAAA"}

package/dist/routes/runners.d.ts

@@ -1759,8 +1759,9 @@ export declare const testRunnerPoolConnectionContract: {
         readonly 200: v.ObjectSchema<{
             readonly ok: v.BooleanSchema<undefined>;
             readonly message: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly failureCause: v.OptionalSchema<v.PicklistSchema<["refused", "dns", "timeout", "aborted", "unreachable", "reset", "tls-untrusted", "tls-expired", "tls-hostname", "tls-protocol", "invalid-header", "unknown"], undefined>, undefined>;
             readonly warnings: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+                readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
                 readonly message: v.StringSchema<undefined>;
             }, undefined>, undefined>, undefined>;
         }, undefined>;

package/dist/routes/runners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/routes/runners.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAoB5B,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI1C,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKrC,CAAA;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK1C,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIvC,CAAA;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO7C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA"}
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/routes/runners.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAoB5B,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI1C,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKrC,CAAA;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK1C,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIvC,CAAA;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO7C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK3C,CAAA"}

package/dist/routes/user-secret.d.ts

@@ -225,8 +225,9 @@ export declare const testUserSecretContract: {
         readonly 200: v.ObjectSchema<{
             readonly ok: v.BooleanSchema<undefined>;
             readonly message: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly failureCause: v.OptionalSchema<v.PicklistSchema<["refused", "dns", "timeout", "aborted", "unreachable", "reset", "tls-untrusted", "tls-expired", "tls-hostname", "tls-protocol", "invalid-header", "unknown"], undefined>, undefined>;
             readonly warnings: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+                readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
                 readonly message: v.StringSchema<undefined>;
             }, undefined>, undefined>, undefined>;
         }, undefined>;

package/dist/routes/user-secret.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-secret.d.ts","sourceRoot":"","sources":["../../src/routes/user-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAyB5B,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIlC,CAAA;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK1C,CAAA;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMlC,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKnC,CAAA;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMjC,CAAA"}
+{"version":3,"file":"user-secret.d.ts","sourceRoot":"","sources":["../../src/routes/user-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAyB5B,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIlC,CAAA;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK1C,CAAA;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMlC,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKnC,CAAA;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMjC,CAAA"}

package/dist/service-account-token.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What is wrong with a pasted ServiceAccount token, or `null` when nothing is.
+ *
+ * Split by SEVERITY, because the two halves earn different treatment:
+ *
+ * - `whitespace` is IMPOSSIBLE, not merely suspicious. No bearer token contains a space, tab or
+ *   line break, and an HTTP header value structurally cannot carry one, so this is refused
+ *   outright at both ends.
+ * - `base64-encoded` and `not-a-jwt` are SUSPICIOUS. A Kubernetes ServiceAccount token is a JWT
+ *   today, but the same field also serves any apiserver that accepts a static bearer token (a
+ *   `--token-auth-file` cluster), whose tokens are arbitrary strings. So these are surfaced as a
+ *   warning the operator can overrule, never as a refusal: a check that cannot be sure must not
+ *   be the thing that blocks a legitimate cluster.
+ */
+export type ServiceAccountTokenProblem = 'whitespace' | 'base64-encoded' | 'not-a-jwt';
+/** Whether a problem makes the token unusable (as opposed to merely unusual). */
+export declare function isFatalServiceAccountTokenProblem(problem: ServiceAccountTokenProblem): boolean;
+/**
+ * Classify a pasted ServiceAccount token, or `null` when it looks fine (and for an EMPTY value,
+ * which is the field's own required-ness question and not this rule's).
+ *
+ * Checked against the value with SURROUNDING whitespace trimmed, because leading/trailing padding
+ * is both harmless and universally stripped before use. It is whitespace that survives the trim,
+ * i.e. inside the token, that can never be right.
+ */
+export declare function classifyServiceAccountToken(raw: string): ServiceAccountTokenProblem | null;
+//# sourceMappingURL=service-account-token.d.ts.map

package/dist/service-account-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-token.d.ts","sourceRoot":"","sources":["../src/service-account-token.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,0BAA0B,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,CAAA;AAEtF,iFAAiF;AACjF,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAE9F;AAgBD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CAO1F"}

package/dist/service-account-token.js

@@ -0,0 +1,51 @@
+// The shape rule for a pasted Kubernetes ServiceAccount bearer token, shared by the SPA (which
+// flags a bad paste on the field, before the operator ever clicks Test) and the backend (which
+// refuses an unusable one before it can become an `authorization` header).
+//
+// It lives in contracts rather than kernel because BOTH sides have to agree about the answer:
+// kernel is invisible to the SPA, so a rule kept there would be restated by hand on the form and
+// the two would drift. What the backend must NOT do is phrase the verdict, so this returns a
+// machine-readable code and the SPA maps it to a translated message (the CLAUDE.md rule for a
+// localizable condition).
+//
+// Why it earns its place: the guided `cat-factory k3s` flow ends with "copy this token out of your
+// terminal and paste it", and a terminal wraps long lines. A token copied across that wrap carries
+// a newline in the MIDDLE, which is invisible in a password field, survives `.trim()`, and reaches
+// undici as a header value it refuses to build. The operator sees a generic failure and has no way
+// to tell it apart from a wrong token or a stopped cluster.
+/** Whether a problem makes the token unusable (as opposed to merely unusual). */
+export function isFatalServiceAccountTokenProblem(problem) {
+    return problem === 'whitespace';
+}
+/** A JWT: three non-empty base64url segments separated by dots. */
+const JWT_SHAPE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;
+/**
+ * The base64 of a JWT always begins `eyJ` encoded, i.e. `ZXlK`. This is the `kubectl get secret
+ * … -o jsonpath={.data.token}` value pasted WITHOUT the `| base64 -d`, which is a distinct mistake
+ * from a malformed token and has a different fix, so it gets its own code rather than collapsing
+ * into `not-a-jwt`.
+ */
+const BASE64_JWT_PREFIX = /^ZXlK/;
+/** Any whitespace, including the line break a wrapped terminal copy introduces. */
+const ANY_WHITESPACE = /\s/;
+/**
+ * Classify a pasted ServiceAccount token, or `null` when it looks fine (and for an EMPTY value,
+ * which is the field's own required-ness question and not this rule's).
+ *
+ * Checked against the value with SURROUNDING whitespace trimmed, because leading/trailing padding
+ * is both harmless and universally stripped before use. It is whitespace that survives the trim,
+ * i.e. inside the token, that can never be right.
+ */
+export function classifyServiceAccountToken(raw) {
+    const token = raw.trim();
+    if (!token)
+        return null;
+    if (ANY_WHITESPACE.test(token))
+        return 'whitespace';
+    if (BASE64_JWT_PREFIX.test(token))
+        return 'base64-encoded';
+    if (!JWT_SHAPE.test(token))
+        return 'not-a-jwt';
+    return null;
+}
+//# sourceMappingURL=service-account-token.js.map

package/dist/service-account-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-token.js","sourceRoot":"","sources":["../src/service-account-token.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,8FAA8F;AAC9F,iGAAiG;AACjG,6FAA6F;AAC7F,8FAA8F;AAC9F,0BAA0B;AAC1B,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,4DAA4D;AAkB5D,iFAAiF;AACjF,MAAM,UAAU,iCAAiC,CAAC,OAAmC;IACnF,OAAO,OAAO,KAAK,YAAY,CAAA;AACjC,CAAC;AAED,mEAAmE;AACnE,MAAM,SAAS,GAAG,kDAAkD,CAAA;AAEpE;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAEjC,mFAAmF;AACnF,MAAM,cAAc,GAAG,IAAI,CAAA;AAE3B;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IACxB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAA;IACnD,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAA;IAC1D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAA;IAC9C,OAAO,IAAI,CAAA;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/contracts",
-  "version": "0.292.0",
+  "version": "0.292.2",
   "description": "Valibot wire contract shared between the Agent Architecture Board frontend and backend.",
   "repository": {
     "type": "git",