@cat-factory/contracts 0.292.1 → 0.293.0

package/dist/github-pat-capability.d.ts

@@ -0,0 +1,233 @@
+import * as v from 'valibot';
+/**
+ * Which credential the check looked at — the two shapes on which a PAT is what a run
+ * authenticates as. Named on the wire because the REMEDY differs: a `deployment` token is
+ * replaced by whoever runs the deployment, an `initiator` one by the signed-in user in their
+ * own settings, and a banner that could not tell them apart would send half its readers to a
+ * page they cannot act on.
+ */
+export declare const githubPatSourceSchema: v.PicklistSchema<["deployment", "initiator"], undefined>;
+export type GitHubPatSource = v.InferOutput<typeof githubPatSourceSchema>;
+/**
+ * How a token's reach was determined, mirroring `describeGitHubPatScope`'s own classification.
+ * `unknown` is a token GitHub accepted while reporting no scopes and whose prefix is not the
+ * fine-grained one, so nothing about its breadth can be stated.
+ */
+export declare const githubPatKindSchema: v.PicklistSchema<["classic", "fine_grained", "unknown"], undefined>;
+export type GitHubPatKind = v.InferOutput<typeof githubPatKindSchema>;
+/**
+ * The things a pipeline needs the token to be able to do. Kept to what actually stops work:
+ * every step from the coder onward pushes a branch, the merger opens and merges a pull
+ * request, and the coder/ci-fixer may edit `.github/workflows/*`.
+ *
+ * Read-only reach is absent on purpose. A token that cannot read the repository fails at
+ * `GET /user` or at the repo probe, which is `token_rejected` / an unreadable repo rather than
+ * a capability verdict.
+ */
+export declare const githubPatCapabilitySchema: v.PicklistSchema<["push", "pullRequests", "workflows"], undefined>;
+export type GitHubPatCapability = v.InferOutput<typeof githubPatCapabilitySchema>;
+/** Every capability, as a plain tuple — the source of truth for iteration. */
+export declare const GITHUB_PAT_CAPABILITIES: ["push", "pullRequests", "workflows"];
+/**
+ * Whether the token holds one capability.
+ *  - `granted` — positively established (a classic scope GitHub named, or a repo probe that
+ *    reported `permissions.push`).
+ *  - `missing`  — positively established as ABSENT. The only status that raises a banner.
+ *  - `unknown`  — not determinable from what GitHub exposes. NOT a synonym for either: a
+ *    fine-grained token's pull-request and workflow permissions have no endpoint that reports
+ *    them, and rendering that as `granted` would silence a real gap while rendering it as
+ *    `missing` would nag every correctly-configured fine-grained deployment forever.
+ */
+export declare const githubPatCapabilityStatusSchema: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+export type GitHubPatCapabilityStatus = v.InferOutput<typeof githubPatCapabilityStatusSchema>;
+/**
+ * The per-capability verdict. Spelled as an explicit object rather than a `v.record` over the
+ * picklist so a new capability fails the typecheck at every construction site instead of
+ * silently defaulting to absent; `githubPatCapabilities.spec.ts` pins the two lists together.
+ */
+export declare const githubPatCapabilitiesSchema: v.ObjectSchema<{
+    readonly push: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+    readonly pullRequests: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+    readonly workflows: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+}, undefined>;
+export type GitHubPatCapabilities = v.InferOutput<typeof githubPatCapabilitiesSchema>;
+/**
+ * The capabilities whose absence STOPS a pipeline, as opposed to narrowing what it may change.
+ *
+ * `workflows` is deliberately not among them, and it is the exclusion worth stating: without it
+ * a run pushes, opens its PR and merges exactly as normal, and fails only on the subset of
+ * changes that touch `.github/workflows/*`. Treating that as blocking would raise the loud
+ * banner on the many deployments whose agents never edit CI, which is how a warning surface
+ * teaches people to dismiss it unread.
+ */
+export declare const GITHUB_PAT_BLOCKING_CAPABILITIES: readonly ["push", "pullRequests"];
+/**
+ * The classic scopes a replacement token needs, and the single source of truth for them: the
+ * local facade's setup link, the SPA's re-mint link and this module's own classification all
+ * read this one list.
+ *
+ * `repo` covers cloning, pushing a branch, opening the pull request, reading the head's Actions
+ * check runs for the CI gate and merging. `workflow` is needed only to push a change that
+ * touches a workflow file, but it is pre-selected anyway: a token is minted once, and sending
+ * someone back to GitHub a second time the first time an agent edits CI is worse than the
+ * narrower grant is worth. What it costs is stated in `githubPatScope.ts`.
+ */
+export declare const GITHUB_PAT_CLASSIC_SCOPES: readonly ['repo', 'workflow'];
+/**
+ * The fine-grained REPOSITORY permissions a replacement token needs, for the banner to list.
+ * Prose rather than a query parameter because GitHub's fine-grained token form accepts no
+ * prefill: see {@link githubPatCreateUrl}.
+ */
+export declare const GITHUB_PAT_FINE_GRAINED_PERMISSIONS: readonly ['contents:write', 'pull_requests:write', 'workflows:write'];
+/**
+ * Where each token kind is minted, relative to the instance's web root. Exported because the
+ * SPA's generic connect-box link (`vcsTokenCreateUrl`, which offers no scopes) has to land on
+ * the same page this module's pre-filled link does; two spellings of GitHub's settings path
+ * would send the two surfaces to different places the day GitHub moves one.
+ */
+export declare const GITHUB_TOKEN_CREATE_PATHS: Record<GitHubPatKind, string>;
+/**
+ * The URL that mints a replacement token, pre-filled as far as GitHub allows.
+ *
+ * The KIND is carried over from the token being replaced rather than chosen for the user: a
+ * deployment that standardised on fine-grained tokens should not be pushed back to a classic
+ * one by a warning banner, and vice versa.
+ *
+ * Only the CLASSIC form takes a prefill. GitHub's fine-grained form accepts no permission query
+ * parameters at all, so that half of the fork is a bare link and the caller must render
+ * {@link GITHUB_PAT_FINE_GRAINED_PERMISSIONS} beside it — a link that silently arrived with
+ * nothing selected would read as "these are already set for you", which is precisely the
+ * misreading that produced the missing permission in the first place.
+ *
+ * `webUrl` is the instance the workspace is bound to; absent, the caller has already decided to
+ * fall back to the public host (the SPA's `vcsTokenCreateUrl` states why that is safe for a
+ * settings page and not for a repository link).
+ */
+export declare function githubPatCreateUrl(kind: GitHubPatKind, options: {
+    webUrl: string;
+    description?: string;
+}): string;
+/**
+ * What the check found about the token a workspace's runs would use.
+ *
+ * `probedRepos` / `unprobedRepoCount` exist because the fine-grained answer is a SAMPLE: the
+ * probe reads the repositories this board's services target, capped, and a reader who assumed
+ * it read all of them would take a clean verdict as a guarantee about a repository nobody
+ * looked at. Both are empty/zero for a classic token, whose scopes answer for every repository
+ * at once.
+ *
+ * The token's raw scope list is deliberately NOT here. Nothing renders it, and the one source
+ * whose scopes this endpoint could expose is `deployment` — a shared operational credential
+ * whose breadth every workspace member would then be able to read off a route that lets reads
+ * through. The per-capability verdict is what a reader can act on; the scope list is what the
+ * person who pasted the token already saw on the connect form.
+ */
+export declare const githubPatCapabilityReportSchema: v.ObjectSchema<{
+    readonly source: v.PicklistSchema<["deployment", "initiator"], undefined>;
+    readonly kind: v.PicklistSchema<["classic", "fine_grained", "unknown"], undefined>;
+    readonly capabilities: v.ObjectSchema<{
+        readonly push: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+        readonly pullRequests: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+        readonly workflows: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+    }, undefined>;
+    /** The `owner/name` of each repository the probe actually asked GitHub about. */
+    readonly probedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    /**
+     * The probed repositories GitHub answered 404 for. A subset of {@link probedRepos}, and the
+     * one detail that turns "push is missing" into something a reader can act on for a
+     * fine-grained token: these are the repositories the token was not granted (GitHub 404s
+     * rather than 403s for a repository a credential may not see, so it cannot leak existence).
+     */
+    readonly deniedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    /** Targeted repositories the probe's cap left unread, so a verdict never reads as exhaustive. */
+    readonly unprobedRepoCount: v.NumberSchema<undefined>;
+    /** The instance the token authenticates against, for the re-mint link. Null ⇒ not derivable. */
+    readonly webUrl: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type GitHubPatCapabilityReport = v.InferOutput<typeof githubPatCapabilityReportSchema>;
+/**
+ * The check's outcome. A variant rather than a nullable report because the four states need
+ * four different reactions, and three of them are not "the token lacks something":
+ *
+ *  - `not_applicable` — no PAT is in play (a GitHub App deployment, GitLab, or nothing
+ *    connected at all), or this board's services target no GitHub repository, so no run here
+ *    would ever authenticate with one. There is no token whose reach could be wrong.
+ *  - `token_rejected` — GitHub refused the token outright (401/403). Blocking, and a strictly
+ *    worse problem than a missing scope, so it gets its own state instead of collapsing into
+ *    "everything is missing". It carries `source` for the same reason the report does: the
+ *    remedy for a rejected DEPLOYMENT credential is not the one for a rejected personal token,
+ *    and this is the state in which the reader is least able to work that out for themselves.
+ *  - `probe_failed`   — GitHub could not be reached, refused to answer for now (a rate limit),
+ *    or answered in a way the probe could not read. NOT a verdict about the token: an upstream
+ *    condition must never render as a permissions problem, because the remedy it would
+ *    advertise (mint a new token) is wrong and costly.
+ *  - `checked`        — a report was produced. It may still be entirely clean.
+ */
+export declare const githubPatCheckSchema: v.VariantSchema<"state", [v.ObjectSchema<{
+    readonly state: v.LiteralSchema<"not_applicable", undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly state: v.LiteralSchema<"token_rejected", undefined>;
+    readonly status: v.NumberSchema<undefined>;
+    readonly source: v.PicklistSchema<["deployment", "initiator"], undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly state: v.LiteralSchema<"probe_failed", undefined>;
+    readonly message: v.StringSchema<undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly state: v.LiteralSchema<"checked", undefined>;
+    readonly report: v.ObjectSchema<{
+        readonly source: v.PicklistSchema<["deployment", "initiator"], undefined>;
+        readonly kind: v.PicklistSchema<["classic", "fine_grained", "unknown"], undefined>;
+        readonly capabilities: v.ObjectSchema<{
+            readonly push: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+            readonly pullRequests: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+            readonly workflows: v.PicklistSchema<["granted", "missing", "unknown"], undefined>;
+        }, undefined>;
+        /** The `owner/name` of each repository the probe actually asked GitHub about. */
+        readonly probedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+        /**
+         * The probed repositories GitHub answered 404 for. A subset of {@link probedRepos}, and the
+         * one detail that turns "push is missing" into something a reader can act on for a
+         * fine-grained token: these are the repositories the token was not granted (GitHub 404s
+         * rather than 403s for a repository a credential may not see, so it cannot leak existence).
+         */
+        readonly deniedRepos: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+        /** Targeted repositories the probe's cap left unread, so a verdict never reads as exhaustive. */
+        readonly unprobedRepoCount: v.NumberSchema<undefined>;
+        /** The instance the token authenticates against, for the re-mint link. Null ⇒ not derivable. */
+        readonly webUrl: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>;
+}, undefined>], undefined>;
+export type GitHubPatCheck = v.InferOutput<typeof githubPatCheckSchema>;
+/**
+ * The capabilities a report positively established as ABSENT, split by whether losing them
+ * stops a pipeline. `unknown` is in neither list by construction — see
+ * {@link githubPatCapabilityStatusSchema} for why it may not be folded into either.
+ *
+ * The one reduction both the banner and its tests read, so "is there anything to say" and "what
+ * do we say" can never disagree about which capability belongs on which side.
+ */
+export declare function missingGitHubPatCapabilities(report: GitHubPatCapabilityReport): {
+    blocking: GitHubPatCapability[];
+    advisory: GitHubPatCapability[];
+};
+/**
+ * WHOSE credential the check judged, or null when it judged none.
+ *
+ * The one place that answer is derived, because it decides which remedy a surface offers: a
+ * `deployment` token is replaced by whoever runs the deployment, an `initiator` one by the
+ * signed-in user in their own settings, and sending one reader to the other's remedy is worse
+ * than saying nothing. Two of the four states carry a source and two cannot have one, which is
+ * the shape a caller gets wrong by reading `report?.source` and letting the absent case fall
+ * through to whichever branch its ternary happened to end on.
+ */
+export declare function githubPatCheckSource(check: GitHubPatCheck): GitHubPatSource | null;
+/**
+ * Whether a check warrants interrupting the user with a banner.
+ *
+ * True for a rejected token and for any established BLOCKING gap. False for `probe_failed` (an
+ * outage is not a permissions problem), for `not_applicable`, and for a report whose only
+ * findings are advisory or `unknown` — those are visible in the settings surface, where someone
+ * who came to look at the connection can act on them, rather than over the board.
+ */
+export declare function githubPatCheckNeedsAttention(check: GitHubPatCheck): boolean;
+//# sourceMappingURL=github-pat-capability.d.ts.map

package/dist/github-pat-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-pat-capability.d.ts","sourceRoot":"","sources":["../src/github-pat-capability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAwB5B;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,0DAA0C,CAAA;AAC5E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEzE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,qEAAqD,CAAA;AACrF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,oEAAoD,CAAA;AAC1F,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,uCAAoC,CAAA;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,gEAAgD,CAAA;AAC5F,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;aAItC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,mCAGM,CAAA;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,YAAI,MAAM,EAAE,UAAU,CAAU,CAAA;AAEtE;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,YAC9C,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,CACT,CAAA;AAEV;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAOnE,CAAA;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,MAAM,CAWR;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;IAI1C,iFAAiF;;IAEjF;;;;;OAKG;;IAEH,iGAAiG;;IAEjG,gGAAgG;;aAEhG,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;QAlC/B,iFAAiF;;QAEjF;;;;;WAKG;;QAEH,iGAAiG;;QAEjG,gGAAgG;;;0BAgChG,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEvE;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,yBAAyB,GAAG;IAC/E,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAKA;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,GAAG,IAAI,CAYlF;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAI3E"}

package/dist/github-pat-capability.js

@@ -0,0 +1,265 @@
+import * as v from 'valibot';
+// ---------------------------------------------------------------------------
+// What the GitHub personal access token a workspace's runs authenticate with can actually
+// DO, answered once the board has loaded rather than discovered when a run fails at its push.
+//
+// A PAT is the operational credential on two deployment shapes: local mode, where one token is
+// both the sign-in identity and what every agent step clones, pushes and merges with, and a
+// hosted deployment whose run initiator stored a `github_pat`, which OUTRANKS the App
+// installation on the run path (`backend/docs/security-model.md`, Layer 3). On both, a token
+// minted without `repo` reaches its first failure several steps into a pipeline, as a 403 out
+// of a container, after the run has already spent money.
+//
+// This module holds the vocabulary BOTH sides agree about: the backend probes, the SPA renders
+// the verdict and the re-mint link, so the capability list, which capabilities are BLOCKING,
+// and the scopes a replacement token needs live here instead of being restated on each side.
+//
+// Deliberately not a boolean, and deliberately per-capability. GitHub reports a CLASSIC token's
+// scopes in the `x-oauth-scopes` header and reports nothing whatsoever for a fine-grained one,
+// whose reach is knowable only by probing a repository — which answers for push and answers
+// nothing for the rest. "Not granted" and "not knowable" are different facts with different
+// remedies, so each capability carries its own tri-state and an unknowable one says so.
+// ---------------------------------------------------------------------------
+/**
+ * Which credential the check looked at — the two shapes on which a PAT is what a run
+ * authenticates as. Named on the wire because the REMEDY differs: a `deployment` token is
+ * replaced by whoever runs the deployment, an `initiator` one by the signed-in user in their
+ * own settings, and a banner that could not tell them apart would send half its readers to a
+ * page they cannot act on.
+ */
+export const githubPatSourceSchema = v.picklist(['deployment', 'initiator']);
+/**
+ * How a token's reach was determined, mirroring `describeGitHubPatScope`'s own classification.
+ * `unknown` is a token GitHub accepted while reporting no scopes and whose prefix is not the
+ * fine-grained one, so nothing about its breadth can be stated.
+ */
+export const githubPatKindSchema = v.picklist(['classic', 'fine_grained', 'unknown']);
+/**
+ * The things a pipeline needs the token to be able to do. Kept to what actually stops work:
+ * every step from the coder onward pushes a branch, the merger opens and merges a pull
+ * request, and the coder/ci-fixer may edit `.github/workflows/*`.
+ *
+ * Read-only reach is absent on purpose. A token that cannot read the repository fails at
+ * `GET /user` or at the repo probe, which is `token_rejected` / an unreadable repo rather than
+ * a capability verdict.
+ */
+export const githubPatCapabilitySchema = v.picklist(['push', 'pullRequests', 'workflows']);
+/** Every capability, as a plain tuple — the source of truth for iteration. */
+export const GITHUB_PAT_CAPABILITIES = githubPatCapabilitySchema.options;
+/**
+ * Whether the token holds one capability.
+ *  - `granted` — positively established (a classic scope GitHub named, or a repo probe that
+ *    reported `permissions.push`).
+ *  - `missing`  — positively established as ABSENT. The only status that raises a banner.
+ *  - `unknown`  — not determinable from what GitHub exposes. NOT a synonym for either: a
+ *    fine-grained token's pull-request and workflow permissions have no endpoint that reports
+ *    them, and rendering that as `granted` would silence a real gap while rendering it as
+ *    `missing` would nag every correctly-configured fine-grained deployment forever.
+ */
+export const githubPatCapabilityStatusSchema = v.picklist(['granted', 'missing', 'unknown']);
+/**
+ * The per-capability verdict. Spelled as an explicit object rather than a `v.record` over the
+ * picklist so a new capability fails the typecheck at every construction site instead of
+ * silently defaulting to absent; `githubPatCapabilities.spec.ts` pins the two lists together.
+ */
+export const githubPatCapabilitiesSchema = v.object({
+    push: githubPatCapabilityStatusSchema,
+    pullRequests: githubPatCapabilityStatusSchema,
+    workflows: githubPatCapabilityStatusSchema,
+});
+/**
+ * The capabilities whose absence STOPS a pipeline, as opposed to narrowing what it may change.
+ *
+ * `workflows` is deliberately not among them, and it is the exclusion worth stating: without it
+ * a run pushes, opens its PR and merges exactly as normal, and fails only on the subset of
+ * changes that touch `.github/workflows/*`. Treating that as blocking would raise the loud
+ * banner on the many deployments whose agents never edit CI, which is how a warning surface
+ * teaches people to dismiss it unread.
+ */
+export const GITHUB_PAT_BLOCKING_CAPABILITIES = [
+    'push',
+    'pullRequests',
+];
+/**
+ * The classic scopes a replacement token needs, and the single source of truth for them: the
+ * local facade's setup link, the SPA's re-mint link and this module's own classification all
+ * read this one list.
+ *
+ * `repo` covers cloning, pushing a branch, opening the pull request, reading the head's Actions
+ * check runs for the CI gate and merging. `workflow` is needed only to push a change that
+ * touches a workflow file, but it is pre-selected anyway: a token is minted once, and sending
+ * someone back to GitHub a second time the first time an agent edits CI is worse than the
+ * narrower grant is worth. What it costs is stated in `githubPatScope.ts`.
+ */
+export const GITHUB_PAT_CLASSIC_SCOPES = ['repo', 'workflow'];
+/**
+ * The fine-grained REPOSITORY permissions a replacement token needs, for the banner to list.
+ * Prose rather than a query parameter because GitHub's fine-grained token form accepts no
+ * prefill: see {@link githubPatCreateUrl}.
+ */
+export const GITHUB_PAT_FINE_GRAINED_PERMISSIONS = [
+    'contents:write',
+    'pull_requests:write',
+    'workflows:write',
+];
+/**
+ * Where each token kind is minted, relative to the instance's web root. Exported because the
+ * SPA's generic connect-box link (`vcsTokenCreateUrl`, which offers no scopes) has to land on
+ * the same page this module's pre-filled link does; two spellings of GitHub's settings path
+ * would send the two surfaces to different places the day GitHub moves one.
+ */
+export const GITHUB_TOKEN_CREATE_PATHS = {
+    classic: '/settings/tokens/new',
+    fine_grained: '/settings/personal-access-tokens/new',
+    // Nothing is known about the token in play, so the form that CAN be pre-filled is the better
+    // landing place: it arrives with the right scopes ticked, and a reader who wanted the
+    // fine-grained one is one link away on the same settings page.
+    unknown: '/settings/tokens/new',
+};
+/** Strip a trailing slash so a host and a path never join into a double slash. */
+function root(webUrl) {
+    return webUrl.replace(/\/+$/, '');
+}
+/**
+ * The URL that mints a replacement token, pre-filled as far as GitHub allows.
+ *
+ * The KIND is carried over from the token being replaced rather than chosen for the user: a
+ * deployment that standardised on fine-grained tokens should not be pushed back to a classic
+ * one by a warning banner, and vice versa.
+ *
+ * Only the CLASSIC form takes a prefill. GitHub's fine-grained form accepts no permission query
+ * parameters at all, so that half of the fork is a bare link and the caller must render
+ * {@link GITHUB_PAT_FINE_GRAINED_PERMISSIONS} beside it — a link that silently arrived with
+ * nothing selected would read as "these are already set for you", which is precisely the
+ * misreading that produced the missing permission in the first place.
+ *
+ * `webUrl` is the instance the workspace is bound to; absent, the caller has already decided to
+ * fall back to the public host (the SPA's `vcsTokenCreateUrl` states why that is safe for a
+ * settings page and not for a repository link).
+ */
+export function githubPatCreateUrl(kind, options) {
+    const page = `${root(options.webUrl)}${GITHUB_TOKEN_CREATE_PATHS[kind]}`;
+    if (kind === 'fine_grained')
+        return page;
+    // Hand-built rather than via `URLSearchParams`: this package is dependency-free and compiles
+    // with neither the DOM nor the Node lib, and it is imported by the SPA, both facades and the
+    // local runtime alike — so the one place the query string is assembled cannot assume a global.
+    const query = [
+        `scopes=${encodeURIComponent(GITHUB_PAT_CLASSIC_SCOPES.join(','))}`,
+        ...(options.description ? [`description=${encodeURIComponent(options.description)}`] : []),
+    ];
+    return `${page}?${query.join('&')}`;
+}
+/**
+ * What the check found about the token a workspace's runs would use.
+ *
+ * `probedRepos` / `unprobedRepoCount` exist because the fine-grained answer is a SAMPLE: the
+ * probe reads the repositories this board's services target, capped, and a reader who assumed
+ * it read all of them would take a clean verdict as a guarantee about a repository nobody
+ * looked at. Both are empty/zero for a classic token, whose scopes answer for every repository
+ * at once.
+ *
+ * The token's raw scope list is deliberately NOT here. Nothing renders it, and the one source
+ * whose scopes this endpoint could expose is `deployment` — a shared operational credential
+ * whose breadth every workspace member would then be able to read off a route that lets reads
+ * through. The per-capability verdict is what a reader can act on; the scope list is what the
+ * person who pasted the token already saw on the connect form.
+ */
+export const githubPatCapabilityReportSchema = v.object({
+    source: githubPatSourceSchema,
+    kind: githubPatKindSchema,
+    capabilities: githubPatCapabilitiesSchema,
+    /** The `owner/name` of each repository the probe actually asked GitHub about. */
+    probedRepos: v.array(v.string()),
+    /**
+     * The probed repositories GitHub answered 404 for. A subset of {@link probedRepos}, and the
+     * one detail that turns "push is missing" into something a reader can act on for a
+     * fine-grained token: these are the repositories the token was not granted (GitHub 404s
+     * rather than 403s for a repository a credential may not see, so it cannot leak existence).
+     */
+    deniedRepos: v.array(v.string()),
+    /** Targeted repositories the probe's cap left unread, so a verdict never reads as exhaustive. */
+    unprobedRepoCount: v.number(),
+    /** The instance the token authenticates against, for the re-mint link. Null ⇒ not derivable. */
+    webUrl: v.nullable(v.string()),
+});
+/**
+ * The check's outcome. A variant rather than a nullable report because the four states need
+ * four different reactions, and three of them are not "the token lacks something":
+ *
+ *  - `not_applicable` — no PAT is in play (a GitHub App deployment, GitLab, or nothing
+ *    connected at all), or this board's services target no GitHub repository, so no run here
+ *    would ever authenticate with one. There is no token whose reach could be wrong.
+ *  - `token_rejected` — GitHub refused the token outright (401/403). Blocking, and a strictly
+ *    worse problem than a missing scope, so it gets its own state instead of collapsing into
+ *    "everything is missing". It carries `source` for the same reason the report does: the
+ *    remedy for a rejected DEPLOYMENT credential is not the one for a rejected personal token,
+ *    and this is the state in which the reader is least able to work that out for themselves.
+ *  - `probe_failed`   — GitHub could not be reached, refused to answer for now (a rate limit),
+ *    or answered in a way the probe could not read. NOT a verdict about the token: an upstream
+ *    condition must never render as a permissions problem, because the remedy it would
+ *    advertise (mint a new token) is wrong and costly.
+ *  - `checked`        — a report was produced. It may still be entirely clean.
+ */
+export const githubPatCheckSchema = v.variant('state', [
+    v.object({ state: v.literal('not_applicable') }),
+    v.object({
+        state: v.literal('token_rejected'),
+        status: v.number(),
+        source: githubPatSourceSchema,
+    }),
+    v.object({ state: v.literal('probe_failed'), message: v.string() }),
+    v.object({ state: v.literal('checked'), report: githubPatCapabilityReportSchema }),
+]);
+/**
+ * The capabilities a report positively established as ABSENT, split by whether losing them
+ * stops a pipeline. `unknown` is in neither list by construction — see
+ * {@link githubPatCapabilityStatusSchema} for why it may not be folded into either.
+ *
+ * The one reduction both the banner and its tests read, so "is there anything to say" and "what
+ * do we say" can never disagree about which capability belongs on which side.
+ */
+export function missingGitHubPatCapabilities(report) {
+    const missing = GITHUB_PAT_CAPABILITIES.filter((c) => report.capabilities[c] === 'missing');
+    const isBlocking = (c) => GITHUB_PAT_BLOCKING_CAPABILITIES.includes(c);
+    return { blocking: missing.filter(isBlocking), advisory: missing.filter((c) => !isBlocking(c)) };
+}
+/**
+ * WHOSE credential the check judged, or null when it judged none.
+ *
+ * The one place that answer is derived, because it decides which remedy a surface offers: a
+ * `deployment` token is replaced by whoever runs the deployment, an `initiator` one by the
+ * signed-in user in their own settings, and sending one reader to the other's remedy is worse
+ * than saying nothing. Two of the four states carry a source and two cannot have one, which is
+ * the shape a caller gets wrong by reading `report?.source` and letting the absent case fall
+ * through to whichever branch its ternary happened to end on.
+ */
+export function githubPatCheckSource(check) {
+    switch (check.state) {
+        case 'checked':
+            return check.report.source;
+        case 'token_rejected':
+            return check.source;
+        // Neither state judged a credential: `not_applicable` found none in play, and
+        // `probe_failed` never got an answer about the one it found.
+        case 'not_applicable':
+        case 'probe_failed':
+            return null;
+    }
+}
+/**
+ * Whether a check warrants interrupting the user with a banner.
+ *
+ * True for a rejected token and for any established BLOCKING gap. False for `probe_failed` (an
+ * outage is not a permissions problem), for `not_applicable`, and for a report whose only
+ * findings are advisory or `unknown` — those are visible in the settings surface, where someone
+ * who came to look at the connection can act on them, rather than over the board.
+ */
+export function githubPatCheckNeedsAttention(check) {
+    if (check.state === 'token_rejected')
+        return true;
+    if (check.state !== 'checked')
+        return false;
+    return missingGitHubPatCapabilities(check.report).blocking.length > 0;
+}
+//# sourceMappingURL=github-pat-capability.js.map

package/dist/github-pat-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-pat-capability.js","sourceRoot":"","sources":["../src/github-pat-capability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,0FAA0F;AAC1F,8FAA8F;AAC9F,EAAE;AACF,+FAA+F;AAC/F,4FAA4F;AAC5F,sFAAsF;AACtF,6FAA6F;AAC7F,8FAA8F;AAC9F,yDAAyD;AACzD,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,6FAA6F;AAC7F,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,4FAA4F;AAC5F,4FAA4F;AAC5F,wFAAwF;AACxF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AAG5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAA;AAGrF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;AAG1F,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,OAAO,CAAA;AAExE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;AAG5F;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,+BAA+B;IACrC,YAAY,EAAE,+BAA+B;IAC7C,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,MAAM;IACN,cAAc;CACmC,CAAA;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAU,CAAA;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,gBAAgB;IAChB,qBAAqB;IACrB,iBAAiB;CACT,CAAA;AAEV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAkC;IACtE,OAAO,EAAE,sBAAsB;IAC/B,YAAY,EAAE,sCAAsC;IACpD,6FAA6F;IAC7F,sFAAsF;IACtF,+DAA+D;IAC/D,OAAO,EAAE,sBAAsB;CAChC,CAAA;AAED,kFAAkF;AAClF,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAmB,EACnB,OAAiD;IAEjD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAA;IACxE,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAA;IACxC,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,KAAK,GAAG;QACZ,UAAU,kBAAkB,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE;QACnE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3F,CAAA;IACD,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,EAAE,qBAAqB;IAC7B,IAAI,EAAE,mBAAmB;IACzB,YAAY,EAAE,2BAA2B;IACzC,iFAAiF;IACjF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,iGAAiG;IACjG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,gGAAgG;IAChG,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC/B,CAAC,CAAA;AAGF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;IACrD,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,qBAAqB;KAC9B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;CACnF,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAiC;IAI5E,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAC3F,MAAM,UAAU,GAAG,CAAC,CAAsB,EAAW,EAAE,CACpD,gCAAmE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAClF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAClG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAqB;IACxD,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAA;QAC5B,KAAK,gBAAgB;YACnB,OAAO,KAAK,CAAC,MAAM,CAAA;QACrB,8EAA8E;QAC9E,6DAA6D;QAC7D,KAAK,gBAAgB,CAAC;QACtB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAqB;IAChE,IAAI,KAAK,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC3C,OAAO,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;AACvE,CAAC"}

package/dist/index.d.ts

@@ -59,6 +59,7 @@ export * from './bootstrap.js';
 export * from './env-config-repair.js';
 export * from './environment-test.js';
 export * from './infra-setup.js';
+export * from './github-pat-capability.js';
 export * from './snapshot.js';
 export * from './sso.js';
 export * from './board-scan.js';
@@ -120,6 +121,7 @@ export * from './api-keys.js';
 export * from './public-api-keys.js';
 export * from './public-api.js';
 export * from './public-board.js';
+export * from './public-provisioning.js';
 export * from './public-evidence.js';
 export * from './public-spec.js';
 export * from './public-merge-evidence.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AACzC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,2BAA2B,CAAA;AACzC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AACzC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,2BAA2B,CAAA;AACzC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}

package/dist/index.js

@@ -59,6 +59,7 @@ export * from './bootstrap.js';
 export * from './env-config-repair.js';
 export * from './environment-test.js';
 export * from './infra-setup.js';
+export * from './github-pat-capability.js';
 export * from './snapshot.js';
 export * from './sso.js';
 export * from './board-scan.js';
@@ -120,6 +121,7 @@ export * from './api-keys.js';
 export * from './public-api-keys.js';
 export * from './public-api.js';
 export * from './public-board.js';
+export * from './public-provisioning.js';
 export * from './public-evidence.js';
 export * from './public-spec.js';
 export * from './public-merge-evidence.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AACzC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,2BAA2B,CAAA;AACzC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,eAAe,CAAA;AAC7B,cAAc,0BAA0B,CAAA;AACxC,cAAc,cAAc,CAAA;AAC5B,cAAc,mBAAmB,CAAA;AACjC,cAAc,2BAA2B,CAAA;AACzC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,mBAAmB,CAAA;AACjC,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA;AACzB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,YAAY,CAAA;AAC1B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,qCAAqC,CAAA;AACnD,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,yBAAyB,CAAA;AACvC,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,cAAc,CAAA;AAC5B,cAAc,2BAA2B,CAAA;AACzC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,oBAAoB,CAAA;AAClC,cAAc,2BAA2B,CAAA;AACzC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,uBAAuB,CAAA;AACrC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA"}

package/dist/provider-config.d.ts

@@ -179,10 +179,10 @@ export type ProviderDescriptor = v.InferOutput<typeof providerDescriptorSchema>;
  * incident. Machine-readable, because the backend does not localize prose — the SPA maps the
  * `code` to its own copy and keeps `message` only as the untranslated last resort.
  */
-export declare const connectionWarningCodeSchema: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+export declare const connectionWarningCodeSchema: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
 export type ConnectionWarningCode = v.InferOutput<typeof connectionWarningCodeSchema>;
 export declare const connectionWarningSchema: v.ObjectSchema<{
-    readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+    readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
     /** The backend's own English account of the gap, also written to the deployment log. */
     readonly message: v.StringSchema<undefined>;
 }, undefined>;
@@ -223,7 +223,7 @@ export declare const connectionTestResultSchema: v.ObjectSchema<{
      * find out. Absent/empty ⇒ nothing to report.
      */
     readonly warnings: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-        readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable"], undefined>;
+        readonly code: v.PicklistSchema<["runner_manifest_no_release", "runner_manifest_no_status_path", "github_pat_classic_account_wide", "github_pat_scopes_beyond_need", "github_pat_scope_unreadable", "github_pat_no_scopes"], undefined>;
         /** The backend's own English account of the gap, also written to the deployment log. */
         readonly message: v.StringSchema<undefined>;
     }, undefined>, undefined>, undefined>;

package/dist/provider-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-config.d.ts","sourceRoot":"","sources":["../src/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAc5B;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,+FAOxC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEzF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,iFAAiF;;IAEjF,sCAAsC;;IAEtC,kDAAkD;;IAElD,kCAAkC;;IAElC,gEAAgE;;IAEhE,oEAAoE;;IAEpE,+CAA+C;;IAE/C,oCAAoC;;;;;IAEpC;;;;;;;OAOG;;aAEH,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;QAnCnC,iFAAiF;;QAEjF,sCAAsC;;QAEtC,kDAAkD;;QAElD,kCAAkC;;QAElC,gEAAgE;;QAEhE,oEAAoE;;QAEpE,+CAA+C;;QAE/C,oCAAoC;;;;;QAEpC;;;;;;;WAOG;;;IAiBH,yEAAyE;;IAEzE;;;;;;;OAOG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH,8FAA8F;;QA7D9F,iFAAiF;;QAEjF,sCAAsC;;QAEtC,kDAAkD;;QAElD,kCAAkC;;QAElC,gEAAgE;;QAEhE,oEAAoE;;QAEpE,+CAA+C;;QAE/C,oCAAoC;;;;;QAEpC;;;;;;;WAOG;;;IAwCH;;;;;;;;OAQG;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;OAIG;;aAEH,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,kMAetC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF,eAAO,MAAM,uBAAuB;;IAElC,wFAAwF;;aAExF,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,4LAgBvC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEvF,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B;;IAErC,oEAAoE;;IAEpE;;;;;OAKG;;IAEH;;;;OAIG;;;QAxDH,wFAAwF;;;aA0DxF,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF,2DAA2D;AAC3D,eAAO,MAAM,4BAA4B,mDAAmC,CAAA;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEvF,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB;;;IAGpC,uFAAuF;;aAEvF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF,uFAAuF;AACvF,eAAO,MAAM,0BAA0B;;;;;QANrC,uFAAuF;;;aASvF,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;IAMpC;;;OAGG;;;;;QAhCH,uFAAuF;;;aAmCvF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA"}
+{"version":3,"file":"provider-config.d.ts","sourceRoot":"","sources":["../src/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAc5B;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,+FAOxC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAEzF,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;IACpC,iFAAiF;;IAEjF,sCAAsC;;IAEtC,kDAAkD;;IAElD,kCAAkC;;IAElC,gEAAgE;;IAEhE,oEAAoE;;IAEpE,+CAA+C;;IAE/C,oCAAoC;;;;;IAEpC;;;;;;;OAOG;;aAEH,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;QAnCnC,iFAAiF;;QAEjF,sCAAsC;;QAEtC,kDAAkD;;QAElD,kCAAkC;;QAElC,gEAAgE;;QAEhE,oEAAoE;;QAEpE,+CAA+C;;QAE/C,oCAAoC;;;;;QAEpC;;;;;;;WAOG;;;IAiBH,yEAAyE;;IAEzE;;;;;;;OAOG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH,8FAA8F;;QA7D9F,iFAAiF;;QAEjF,sCAAsC;;QAEtC,kDAAkD;;QAElD,kCAAkC;;QAElC,gEAAgE;;QAEhE,oEAAoE;;QAEpE,+CAA+C;;QAE/C,oCAAoC;;;;;QAEpC;;;;;;;WAOG;;;IAwCH;;;;;;;;OAQG;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;OAIG;;aAEH,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,0NAqBtC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF,eAAO,MAAM,uBAAuB;;IAElC,wFAAwF;;aAExF,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,4LAgBvC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEvF,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B;;IAErC,oEAAoE;;IAEpE;;;;;OAKG;;IAEH;;;;OAIG;;;QAxDH,wFAAwF;;;aA0DxF,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF,2DAA2D;AAC3D,eAAO,MAAM,4BAA4B,mDAAmC,CAAA;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEvF,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB;;;IAGpC,uFAAuF;;aAEvF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF,uFAAuF;AACvF,eAAO,MAAM,0BAA0B;;;;;QANrC,uFAAuF;;;aASvF,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;IAMpC;;;OAGG;;;;;QAhCH,uFAAuF;;;aAmCvF,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA"}

package/dist/provider-config.js

@@ -148,6 +148,12 @@ export const connectionWarningCodeSchema = v.picklist([
     // its reach. Reported rather than assumed: "unknown breadth" and "narrow" are not the same
     // fact, and treating them alike is exactly how an over-broad token stays silent.
     'github_pat_scope_unreadable',
+    // GitHub returned the scope header with an EMPTY value: a classic token minted with nothing
+    // ticked. Distinct from the code above because it is the opposite fact — a positively stated
+    // "this token grants no scopes at all" rather than an unreadable one — and it is the state a
+    // reader is most likely to have produced by accident, since GitHub's form ticks nothing by
+    // default and the token still authenticates.
+    'github_pat_no_scopes',
 ]);
 export const connectionWarningSchema = v.object({
     code: connectionWarningCodeSchema,