@cat-factory/kernel 0.6.0

package/dist/ports/runner-transport.d.ts

@@ -0,0 +1,119 @@
+import type { CloudProvider, InstanceSize, StepSubtasks } from '../domain/types.js';
+import type { LlmToolSpan } from './llm-trace-sink.js';
+/** Live subtask counts a running job reports (from the coding tool's todo list). */
+export type RunnerJobProgress = StepSubtasks;
+/** The structured work product a finished job records. */
+export interface RunnerJobResult {
+    prUrl?: string;
+    branch?: string;
+    summary?: string;
+    error?: string;
+    /** A Blueprinter job's decomposition tree (the `/blueprint` endpoint's product). */
+    service?: unknown;
+    /** A spec-writer job's prescriptive specification doc (the `/spec` endpoint's product). */
+    spec?: unknown;
+    /** A bootstrap job's pushed default branch (the `/bootstrap` endpoint's product). */
+    defaultBranch?: string;
+    /** A `merger` job's PR assessment (the `/merge` endpoint's product). */
+    assessment?: unknown;
+    /** An `on-call` job's release-regression assessment (the `/on-call` endpoint's product). */
+    onCallAssessment?: unknown;
+    /** A `ci-fixer` job's outcome: whether it pushed a fix to the PR branch. */
+    pushed?: boolean;
+    /**
+     * A conflict-resolver job's outcome: whether the PR branch is now mergeable (the
+     * `/resolve-conflicts` endpoint's product). `false` means conflicts remain.
+     */
+    resolved?: boolean;
+    /** A `tester` job's structured test report (the `/test` endpoint's product). */
+    report?: unknown;
+    /**
+     * Token usage the harness lifted from the agent CLI's own event stream. Reported
+     * by the subscription harnesses (Claude Code / Codex), whose traffic bypasses the
+     * LLM proxy — so this is the only usage signal for them. The dispatch path folds
+     * it into the leased subscription token's rolling-window counters (usage-aware
+     * rotation) and the telemetry sink. Absent for the proxy-metered Pi harness.
+     */
+    usage?: {
+        inputTokens: number;
+        outputTokens: number;
+    };
+}
+/**
+ * Which harness agent a dispatch targets (a coding run, a blueprint run, a
+ * read-only repo exploration, a repo-bootstrap run, a CI fix, a merge-conflict
+ * resolution, or a merge assessment). All are dispatched + polled identically
+ * through this transport; `kind` travels in the job body to the harness's single
+ * `POST /jobs` endpoint, which reads it to pick the right agent. The Cloudflare
+ * backend serves all of them, and so does a self-hosted pool: it runs the same
+ * executor-harness image, and runtime parity is the default (the "keep the runtimes
+ * symmetric" guideline), so a pool serves every kind with no opt-in allow-list — a
+ * new harness kind reaches it automatically, never silently diverging from Cloudflare.
+ */
+export type RunnerDispatchKind = 'run' | 'blueprint' | 'spec' | 'explore' | 'bootstrap' | 'ci-fix' | 'resolve-conflicts' | 'merge' | 'on-call' | 'test' | 'fix-tests';
+/**
+ * Optional, transport-level provisioning hints resolved per-service at dispatch.
+ * A self-hosted pool forwards `instanceTypeId` (and `provider`) so it can provision
+ * the right size on its own cloud; the local Docker backend maps `instanceSize` to
+ * container resource limits. The Cloudflare backend ignores these — its Container
+ * instance type is fixed per class by `wrangler.toml` (no per-dispatch sizing).
+ */
+export interface RunnerDispatchOptions {
+    /** Concrete instance-type id for the target (see `resolveInstanceTypeId`). */
+    instanceTypeId?: string;
+    /** The cloud provider the service selected, for a self-provisioning pool. */
+    provider?: CloudProvider;
+    /**
+     * The abstract t-shirt size the service selected, forwarded verbatim so a
+     * resource-sizing transport (the local Docker/Podman backend) can map it to
+     * concrete `--memory` / `--cpus` limits without reverse-engineering a cloud
+     * instance-type id.
+     */
+    instanceSize?: InstanceSize;
+}
+/** A job's current state, as the harness/pool reports it. */
+export interface RunnerJobView {
+    state: 'running' | 'done' | 'failed';
+    /** Present while running once the agent has touched its todo list. */
+    progress?: RunnerJobProgress;
+    result?: RunnerJobResult;
+    error?: string;
+    /**
+     * Tool spans the harness buffered SINCE THE LAST POLL (drain-on-read): the executor
+     * forwards them to the optional trace sink as child spans under the run trace. Empty/
+     * absent on most polls. Best-effort observability — never affects the job lifecycle.
+     */
+    spans?: LlmToolSpan[];
+}
+/**
+ * Addresses one runner job: the run (execution) it belongs to plus the job's own id.
+ * See the file header for why the two are distinct — `runId` scopes the per-run
+ * container, `jobId` identifies the step's job uniquely within that run.
+ */
+export interface RunnerJobRef {
+    /** The run (execution) the job belongs to; addresses the per-run container. */
+    runId: string;
+    /** The job's own id, unique within the run (one per pipeline step). */
+    jobId: string;
+}
+export interface RunnerTransport {
+    /**
+     * Start the job `ref.jobId` (in run `ref.runId`) with the harness job `spec`, or
+     * re-attach to one already running for that ref. Must be idempotent per ref so a
+     * replayed dispatch never starts a duplicate. `kind` selects which harness agent
+     * runs (`run` by default, `blueprint` for a Blueprinter job, `bootstrap` for a
+     * repo-bootstrap job, …) and is carried in the job body; all are polled identically
+     * via {@link poll}.
+     */
+    dispatch(ref: RunnerJobRef, spec: Record<string, unknown>, kind?: RunnerDispatchKind, options?: RunnerDispatchOptions): Promise<void>;
+    /** Poll the job's current state. */
+    poll(ref: RunnerJobRef): Promise<RunnerJobView>;
+    /**
+     * Optionally reclaim a run's runner resources: the per-run container on backends
+     * that share one across the run (Cloudflare, local Docker), and any of the run's
+     * still-running jobs on a per-job backend (a self-hosted pool cancels `ref.jobId`).
+     * Best-effort and idempotent — releasing an already-gone run/job is a no-op.
+     */
+    release?(ref: RunnerJobRef): Promise<void>;
+}
+//# sourceMappingURL=runner-transport.d.ts.map

package/dist/ports/runner-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-transport.d.ts","sourceRoot":"","sources":["../../src/ports/runner-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAyBtD,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAE5C,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gFAAgF;IAChF,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CACtD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAC1B,KAAK,GACL,WAAW,GACX,MAAM,GAGN,SAAS,GACT,WAAW,GACX,QAAQ,GACR,mBAAmB,GACnB,OAAO,GAGP,SAAS,GAGT,MAAM,GAGN,WAAW,CAAA;AAEf;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,aAAa,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAA;IACpC,sEAAsE;IACtE,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IAC5B,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,WAAW,EAAE,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,QAAQ,CACN,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,oCAAoC;IACpC,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC/C;;;;;OAKG;IACH,OAAO,CAAC,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C"}

package/dist/ports/runner-transport.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runner-transport.js.map

package/dist/ports/runner-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-transport.js","sourceRoot":"","sources":["../../src/ports/runner-transport.ts"],"names":[],"mappings":""}

package/dist/ports/runtime.d.ts

@@ -0,0 +1,9 @@
+/** Produces unique ids (e.g. `blk_a1b2c3`). */
+export interface IdGenerator {
+    next(prefix?: string): string;
+}
+/** Wall-clock access. */
+export interface Clock {
+    now(): number;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/ports/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/ports/runtime.ts"],"names":[],"mappings":"AAIA,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC9B;AAED,yBAAyB;AACzB,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,MAAM,CAAA;CACd"}

package/dist/ports/runtime.js

@@ -0,0 +1,5 @@
+// Ambient runtime ports. Injected rather than imported so the domain stays
+// deterministic under test: a counting IdGenerator makes ids reproducible, and a
+// fixed Clock removes wall-clock flakiness.
+export {};
+//# sourceMappingURL=runtime.js.map

package/dist/ports/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/ports/runtime.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,iFAAiF;AACjF,4CAA4C"}

package/dist/ports/sandbox-repositories.d.ts

@@ -0,0 +1,39 @@
+import type { SandboxExperiment, SandboxExperimentStatus, SandboxFixture, SandboxGrade, SandboxPromptVersion, SandboxRun, SandboxRunStatus } from '../domain/types.js';
+/** Stored candidate prompt-version lineages (baselines are NOT stored — see contracts). */
+export interface SandboxPromptVersionRepository {
+    get(workspaceId: string, id: string): Promise<SandboxPromptVersion | null>;
+    /** All non-archived candidate versions for a workspace, newest first. */
+    list(workspaceId: string): Promise<SandboxPromptVersion[]>;
+    /** All non-archived candidate versions for one agent kind. */
+    listByKind(workspaceId: string, agentKind: string): Promise<SandboxPromptVersion[]>;
+    upsert(workspaceId: string, version: SandboxPromptVersion): Promise<void>;
+    /** Soft-archive a version (hidden from the default listing). */
+    archive(workspaceId: string, id: string, at: number): Promise<void>;
+}
+export interface SandboxFixtureRepository {
+    get(workspaceId: string, id: string): Promise<SandboxFixture | null>;
+    list(workspaceId: string): Promise<SandboxFixture[]>;
+    upsert(workspaceId: string, fixture: SandboxFixture): Promise<void>;
+    remove(workspaceId: string, id: string): Promise<void>;
+}
+export interface SandboxExperimentRepository {
+    get(workspaceId: string, id: string): Promise<SandboxExperiment | null>;
+    list(workspaceId: string): Promise<SandboxExperiment[]>;
+    upsert(workspaceId: string, experiment: SandboxExperiment): Promise<void>;
+    setStatus(workspaceId: string, id: string, status: SandboxExperimentStatus): Promise<void>;
+}
+export interface SandboxRunRepository {
+    get(workspaceId: string, id: string): Promise<SandboxRun | null>;
+    /** All cells of an experiment (the results grid). */
+    listByExperiment(workspaceId: string, experimentId: string): Promise<SandboxRun[]>;
+    /** Queued cells of an experiment, oldest first (for the durable fan-out driver). */
+    listQueued(workspaceId: string, experimentId: string): Promise<SandboxRun[]>;
+    upsert(workspaceId: string, run: SandboxRun): Promise<void>;
+    setStatus(workspaceId: string, id: string, status: SandboxRunStatus): Promise<void>;
+}
+export interface SandboxGradeRepository {
+    getByRun(workspaceId: string, runId: string): Promise<SandboxGrade | null>;
+    listByExperiment(workspaceId: string, experimentId: string): Promise<SandboxGrade[]>;
+    upsert(workspaceId: string, grade: SandboxGrade): Promise<void>;
+}
+//# sourceMappingURL=sandbox-repositories.d.ts.map

package/dist/ports/sandbox-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/sandbox-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EACjB,MAAM,oBAAoB,CAAA;AAQ3B,2FAA2F;AAC3F,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;IAC1E,yEAAyE;IACzE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAC1D,8DAA8D;IAC9D,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IACnF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzE,gEAAgE;IAChE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IACpE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;IACpD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACvE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACvD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3F;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAChE,qDAAqD;IACrD,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAClF,oFAAoF;IACpF,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC5E,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC1E,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IACpF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChE"}

package/dist/ports/sandbox-repositories.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandbox-repositories.js.map

package/dist/ports/sandbox-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-repositories.js","sourceRoot":"","sources":["../../src/ports/sandbox-repositories.ts"],"names":[],"mappings":""}

package/dist/ports/secret-cipher.d.ts

@@ -0,0 +1,7 @@
+export interface SecretCipher {
+    /** Encrypt plaintext into an opaque, self-describing envelope string. */
+    encrypt(plaintext: string): Promise<string>;
+    /** Decrypt an envelope produced by {@link encrypt}. Throws if tampered/invalid. */
+    decrypt(envelope: string): Promise<string>;
+}
+//# sourceMappingURL=secret-cipher.d.ts.map

package/dist/ports/secret-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-cipher.d.ts","sourceRoot":"","sources":["../../src/ports/secret-cipher.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,mFAAmF;IACnF,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3C"}

package/dist/ports/secret-cipher.js

@@ -0,0 +1,7 @@
+// Port for authenticated encryption of credentials at rest. The core depends
+// only on this interface; the worker supplies a Web Crypto (AES-256-GCM)
+// implementation keyed by a service-level master secret. Used to protect the
+// per-tenant management-API secret bundle and the per-environment access creds
+// before they are written to D1, and to decrypt them in-memory at call time.
+export {};
+//# sourceMappingURL=secret-cipher.js.map

package/dist/ports/secret-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-cipher.js","sourceRoot":"","sources":["../../src/ports/secret-cipher.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E"}

package/dist/ports/service-fragment-default-repositories.d.ts

@@ -0,0 +1,7 @@
+export interface ServiceFragmentDefaultsRepository {
+    /** The workspace's default fragment ids (empty array when none set). */
+    get(workspaceId: string): Promise<string[]>;
+    /** Replace the workspace's default fragment ids wholesale. */
+    set(workspaceId: string, fragmentIds: string[]): Promise<void>;
+}
+//# sourceMappingURL=service-fragment-default-repositories.d.ts.map

package/dist/ports/service-fragment-default-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-fragment-default-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/service-fragment-default-repositories.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iCAAiC;IAChD,wEAAwE;IACxE,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC3C,8DAA8D;IAC9D,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/D"}

package/dist/ports/service-fragment-default-repositories.js

@@ -0,0 +1,6 @@
+// Persistence port for a workspace's default service-fragment selection — the
+// best-practice prompt fragment ids that new services inherit. The Cloudflare facade
+// implements it against D1, the Node facade against Postgres; tests supply an
+// in-memory fake. Stored as one list per workspace; empty when none set.
+export {};
+//# sourceMappingURL=service-fragment-default-repositories.js.map

package/dist/ports/service-fragment-default-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-fragment-default-repositories.js","sourceRoot":"","sources":["../../src/ports/service-fragment-default-repositories.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,qFAAqF;AACrF,8EAA8E;AAC9E,yEAAyE"}

package/dist/ports/service-repositories.d.ts

@@ -0,0 +1,68 @@
+import type { Service, WorkspaceMount } from '../domain/types.js';
+/** Fields of a service that may be patched (its id and frame are immutable). */
+export type ServicePatch = Partial<Pick<Service, 'accountId' | 'installationId' | 'repoGithubId' | 'directory'>>;
+export interface ServiceRepository {
+    get(id: string): Promise<Service | null>;
+    /** The service that owns a given frame block, or null. */
+    getByFrameBlock(frameBlockId: string): Promise<Service | null>;
+    /**
+     * Every service owned by an account (the org catalog a workspace mounts from).
+     * `null` lists the legacy/unscoped org (the auth-disabled path), matching services
+     * whose `accountId` is NULL.
+     */
+    listByAccount(accountId: string | null): Promise<Service[]>;
+    /**
+     * Services by id, in a single (chunked) query. Used to resolve every service a workspace
+     * mounts when composing its board, without one round-trip per mount. Empty input → empty.
+     */
+    listByIds(ids: string[]): Promise<Service[]>;
+    /** The service linked to a repo (installation + github id), or null. */
+    getByRepo(installationId: number, repoGithubId: number): Promise<Service | null>;
+    insert(service: Service): Promise<void>;
+    update(id: string, patch: ServicePatch): Promise<void>;
+    delete(id: string): Promise<void>;
+    /**
+     * Delete a set of services in a single (chunked) query — the batched form of
+     * {@link ServiceRepository.delete} used when a frame deletion dooms one or more services at
+     * once. Empty input → no-op.
+     */
+    deleteMany(ids: string[]): Promise<void>;
+}
+/** Fields of a mount that may be patched (the per-workspace layout override). */
+export type WorkspaceMountPatch = Partial<Pick<WorkspaceMount, 'position' | 'size'>>;
+export interface WorkspaceMountRepository {
+    /** Services mounted onto a workspace board (with their layout overrides). */
+    listByWorkspace(workspaceId: string): Promise<WorkspaceMount[]>;
+    /**
+     * Workspaces a service is mounted onto — used to fan real-time events out to
+     * every board that shows the changed service.
+     */
+    listByService(serviceId: string): Promise<WorkspaceMount[]>;
+    /**
+     * The workspace ids that mount the service owning `blockId` (homed in `originWorkspaceId`),
+     * resolved in a SINGLE join — the real-time fan-out's hot path. Folds the
+     * "block → its service → the workspaces mounting it" lookup into one query instead of
+     * resolving the block's service and then its mounts on every event. Empty when the block has
+     * no service (the caller then delivers to the origin only). The origin is NOT implied — the
+     * caller unions it in.
+     */
+    listWorkspaceIdsMountingBlock(originWorkspaceId: string, blockId: string): Promise<string[]>;
+    /**
+     * Mount counts for a set of services in a single query, keyed by service id (services with
+     * no mounts are absent). Backs the org catalog's "Shared" badge without an N+1
+     * {@link WorkspaceMountRepository.listByService} per service on the snapshot hot path.
+     */
+    countByServiceIds(serviceIds: string[]): Promise<Record<string, number>>;
+    get(workspaceId: string, serviceId: string): Promise<WorkspaceMount | null>;
+    upsert(mount: WorkspaceMount): Promise<void>;
+    update(workspaceId: string, serviceId: string, patch: WorkspaceMountPatch): Promise<void>;
+    /** Remove a service from a workspace board (does NOT delete the service). */
+    remove(workspaceId: string, serviceId: string): Promise<void>;
+    /**
+     * Remove EVERY workspace's mount of the given services in a single (chunked) query — the
+     * batched form of {@link WorkspaceMountRepository.remove} used when a frame deletion dooms a
+     * service: its mounts must be cleaned off every board at once. Empty input → no-op.
+     */
+    removeByServices(serviceIds: string[]): Promise<void>;
+}
+//# sourceMappingURL=service-repositories.d.ts.map

package/dist/ports/service-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/service-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAYjE,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG,OAAO,CAChC,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,gBAAgB,GAAG,cAAc,GAAG,WAAW,CAAC,CAC7E,CAAA;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACxC,0DAA0D;IAC1D,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC9D;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3D;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,wEAAwE;IACxE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAChF,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC;AAED,iFAAiF;AACjF,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC,CAAA;AAEpF,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;IAC/D;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;IAC3D;;;;;;;OAOG;IACH,6BAA6B,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5F;;;;OAIG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACxE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IAC3E,MAAM,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzF,6EAA6E;IAC7E,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D;;;;OAIG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD"}

package/dist/ports/service-repositories.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service-repositories.js.map

package/dist/ports/service-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-repositories.js","sourceRoot":"","sources":["../../src/ports/service-repositories.ts"],"names":[],"mappings":""}

package/dist/ports/slack-repositories.d.ts

@@ -0,0 +1,61 @@
+import type { SlackMemberMappingEntry, SlackNotificationSettings } from '../domain/types.js';
+/**
+ * An account's Slack connection: the installed team metadata + the encrypted bot
+ * token. The token is decrypted only in-memory, at delivery time, by the channel.
+ */
+export interface SlackConnectionRecord {
+    accountId: string;
+    teamId: string;
+    teamName: string;
+    teamIconUrl: string | null;
+    botUserId: string | null;
+    /** OAuth scopes granted to the bot token, as a JSON array string (or null). */
+    scopesJson: string | null;
+    /** Ciphertext of the bot token (SecretCipher envelope); never plaintext. */
+    tokenCipher: string;
+    createdAt: number;
+    /** Set when the account disconnects Slack (tombstone). */
+    deletedAt: number | null;
+}
+export interface SlackConnectionRepository {
+    /** The account's live connection, or null if not connected. */
+    getByAccount(accountId: string): Promise<SlackConnectionRecord | null>;
+    /**
+     * The live connection bound to a Slack team, or null — used to guard against a
+     * team being claimed by a second account (mirrors the GitHub-installation guard).
+     */
+    getByTeam(teamId: string): Promise<SlackConnectionRecord | null>;
+    /** Create or replace the live connection for an account. */
+    upsert(record: SlackConnectionRecord): Promise<void>;
+    /** Tombstone the account's connection. */
+    softDelete(accountId: string, at: number): Promise<void>;
+}
+/** A workspace's Slack notification routing (persisted settings). */
+export interface SlackSettingsRecord {
+    workspaceId: string;
+    /** The `SlackNotificationSettings.routes` map, serialized as JSON. */
+    routesJson: string;
+    /** Whether to resolve @-mentions from the account member map (0/1 on D1). */
+    mentionsEnabled: boolean;
+    updatedAt: number;
+}
+export interface SlackSettingsRepository {
+    /** A workspace's settings, or null when never configured (defaults apply). */
+    getByWorkspace(workspaceId: string): Promise<SlackSettingsRecord | null>;
+    /** Create or replace a workspace's settings. */
+    upsert(record: SlackSettingsRecord): Promise<void>;
+}
+/**
+ * An account's opt-in GitHub-user-id → Slack-member-id map. The repository returns
+ * the decoded `SlackMemberMappingEntry[]` directly (each store serializes it to its
+ * own JSON column), so there is no separate persisted-record shape here.
+ */
+export interface SlackMemberMappingRepository {
+    /** An account's mapping entries (empty when none configured). */
+    getByAccount(accountId: string): Promise<SlackMemberMappingEntry[]>;
+    /** Create or replace an account's mapping. */
+    upsert(accountId: string, entries: SlackMemberMappingEntry[], at: number): Promise<void>;
+}
+/** Re-exported for repository implementations that map the persisted settings. */
+export type { SlackNotificationSettings };
+//# sourceMappingURL=slack-repositories.d.ts.map

package/dist/ports/slack-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/slack-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAW5F;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAA;IACtE;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAA;IAChE,4DAA4D;IAC5D,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,0CAA0C;IAC1C,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzD;AAED,qEAAqE;AACrE,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,eAAe,EAAE,OAAO,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IACxE,gDAAgD;IAChD,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnD;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,iEAAiE;IACjE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAA;IACnE,8CAA8C;IAC9C,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzF;AAED,kFAAkF;AAClF,YAAY,EAAE,yBAAyB,EAAE,CAAA"}

package/dist/ports/slack-repositories.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=slack-repositories.js.map

package/dist/ports/slack-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-repositories.js","sourceRoot":"","sources":["../../src/ports/slack-repositories.ts"],"names":[],"mappings":""}

package/dist/ports/task-repositories.d.ts

@@ -0,0 +1,61 @@
+import type { TaskSourceKind, TaskComment } from '../domain/types.js';
+import type { TaskCredentials } from './task-source.js';
+/**
+ * A workspace's connection to one task source, including its credential bag.
+ * Credentials are infrastructure detail (never sent on the wire); they live here
+ * so the import path can authenticate against the source for this workspace.
+ */
+export interface TaskConnectionRecord {
+    workspaceId: string;
+    source: TaskSourceKind;
+    credentials: TaskCredentials;
+    /** Human-friendly label for the connection (site URL). */
+    label: string;
+    createdAt: number;
+    /** Set when the workspace disconnects (tombstone). */
+    deletedAt: number | null;
+}
+export interface TaskConnectionRepository {
+    /** The workspace's live connection for a source, or null if not connected. */
+    getByWorkspace(workspaceId: string, source: TaskSourceKind): Promise<TaskConnectionRecord | null>;
+    /** Every live connection the workspace holds, across sources. */
+    listByWorkspace(workspaceId: string): Promise<TaskConnectionRecord[]>;
+    /** Create or replace the live connection for a (workspace, source). */
+    upsert(record: TaskConnectionRecord): Promise<void>;
+    /** Tombstone the workspace's connection to a source. */
+    softDelete(workspaceId: string, source: TaskSourceKind, at: number): Promise<void>;
+}
+/**
+ * An issue projected locally for a workspace as a structured record. The cached
+ * fields back both the agent-context injection and the list/preview rendering;
+ * `linkedBlockId` records the board block this issue is attached to, if any.
+ */
+export interface TaskRecord {
+    workspaceId: string;
+    source: TaskSourceKind;
+    externalId: string;
+    title: string;
+    url: string;
+    status: string;
+    type: string;
+    assignee: string | null;
+    priority: string | null;
+    labels: string[];
+    description: string;
+    comments: TaskComment[];
+    excerpt: string;
+    linkedBlockId: string | null;
+    syncedAt: number;
+    deletedAt: number | null;
+}
+export interface TaskRepository {
+    upsert(record: TaskRecord): Promise<void>;
+    get(workspaceId: string, source: TaskSourceKind, externalId: string): Promise<TaskRecord | null>;
+    /** Every live issue imported into the workspace, across sources. */
+    listByWorkspace(workspaceId: string): Promise<TaskRecord[]>;
+    /** Live issues attached to a board block (resolved during execution). */
+    listByBlock(workspaceId: string, blockId: string): Promise<TaskRecord[]>;
+    /** Attach an issue to a board block (or detach with null). */
+    linkBlock(workspaceId: string, source: TaskSourceKind, externalId: string, blockId: string | null): Promise<void>;
+}
+//# sourceMappingURL=task-repositories.d.ts.map

package/dist/ports/task-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/task-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAOvD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,cAAc,CAAA;IACtB,WAAW,EAAE,eAAe,CAAA;IAC5B,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,8EAA8E;IAC9E,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;IACjG,iEAAiE;IACjE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IACrE,uEAAuE;IACvE,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,wDAAwD;IACxD,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnF;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,cAAc,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,WAAW,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAChG,oEAAoE;IACpE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3D,yEAAyE;IACzE,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IACxE,8DAA8D;IAC9D,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,IAAI,CAAC,CAAA;CACjB"}

package/dist/ports/task-repositories.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=task-repositories.js.map

package/dist/ports/task-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-repositories.js","sourceRoot":"","sources":["../../src/ports/task-repositories.ts"],"names":[],"mappings":""}

package/dist/ports/task-source.d.ts

@@ -0,0 +1,69 @@
+import type { TaskSourceKind, TaskSourceDescriptor, TaskComment, TaskSearchResult } from '../domain/types.js';
+/** A source's per-workspace credentials, as a flat key→value bag. */
+export type TaskCredentials = Record<string, string>;
+export type { TaskComment };
+/** An issue fetched from a source, as a structured record. */
+export interface TaskContent {
+    /** The source's canonical key for the issue (e.g. `PROJ-123`). */
+    externalId: string;
+    /** Canonical web URL of the issue. */
+    url: string;
+    /** Issue summary / title. */
+    title: string;
+    /** Workflow status name, e.g. `In Progress`. */
+    status: string;
+    /** Issue type name, e.g. `Bug`. */
+    type: string;
+    /** Assignee display name, or null when unassigned. */
+    assignee: string | null;
+    /** Priority name, or null when none. */
+    priority: string | null;
+    /** Issue labels. */
+    labels: string[];
+    /** Description normalized to lightweight Markdown. */
+    description: string;
+    /** Recent comments (oldest→newest), bodies normalized to Markdown. */
+    comments: TaskComment[];
+}
+/** The result of validating + normalizing connect credentials. */
+export interface NormalizedTaskConnection {
+    /** The credential bag to persist (trimmed/normalized). */
+    credentials: TaskCredentials;
+    /** A human-friendly label for the connection (site URL). */
+    label: string;
+}
+export interface TaskSourceProvider {
+    /** Which source this provider serves. */
+    readonly kind: TaskSourceKind;
+    /** Self-description so the UI can render the connect/import forms generically. */
+    readonly descriptor: TaskSourceDescriptor;
+    /**
+     * Validate the supplied credentials and return the bag to persist plus a
+     * display label. Throws a ValidationError on anything missing/unsafe.
+     */
+    normalizeConnection(input: TaskCredentials): NormalizedTaskConnection;
+    /** Resolve a stable issue key from raw user input (a bare key or an issue URL); null if unparseable. */
+    parseRef(input: string): string | null;
+    /** Fetch a single issue by its key using the connection credentials. */
+    fetchTask(credentials: TaskCredentials, externalId: string): Promise<TaskContent>;
+    /**
+     * Search the tracker by free text and return lean hits (no description/
+     * comments). Optional: a provider that only supports paste-a-URL import omits
+     * it (and its descriptor sets `searchable: false`). The provider builds the
+     * query and maps the response; the returned `externalId`s are valid import refs.
+     *
+     * `workspaceId` is the workspace whose connection is searching, so a provider
+     * that authenticates per-workspace out-of-band (e.g. the GitHub App, which
+     * ignores `credentials`) can scope the search to that workspace's installation
+     * instead of leaking across tenants.
+     */
+    search?(credentials: TaskCredentials, query: string, workspaceId: string): Promise<TaskSearchResult[]>;
+}
+/** A lookup of the providers wired for this deployment, keyed by source. */
+export interface TaskSourceRegistry {
+    /** The provider for a source, or undefined if that source isn't configured. */
+    get(kind: TaskSourceKind): TaskSourceProvider | undefined;
+    /** Every configured provider (drives the source list exposed to the UI). */
+    list(): TaskSourceProvider[];
+}
+//# sourceMappingURL=task-source.d.ts.map

package/dist/ports/task-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-source.d.ts","sourceRoot":"","sources":["../../src/ports/task-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EACjB,MAAM,oBAAoB,CAAA;AAe3B,qEAAqE;AACrE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEpD,YAAY,EAAE,WAAW,EAAE,CAAA;AAE3B,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAA;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,wCAAwC;IACxC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,oBAAoB;IACpB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAA;IACnB,sEAAsE;IACtE,QAAQ,EAAE,WAAW,EAAE,CAAA;CACxB;AAED,kEAAkE;AAClE,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,WAAW,EAAE,eAAe,CAAA;IAC5B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC;;;OAGG;IACH,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,wBAAwB,CAAA;IACrE,wGAAwG;IACxG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACtC,wEAAwE;IACxE,SAAS,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACjF;;;;;;;;;;OAUG;IACH,MAAM,CAAC,CACL,WAAW,EAAE,eAAe,EAC5B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,kBAAkB,GAAG,SAAS,CAAA;IACzD,4EAA4E;IAC5E,IAAI,IAAI,kBAAkB,EAAE,CAAA;CAC7B"}

package/dist/ports/task-source.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=task-source.js.map

package/dist/ports/task-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-source.js","sourceRoot":"","sources":["../../src/ports/task-source.ts"],"names":[],"mappings":""}

package/dist/ports/ticket-tracker.d.ts

@@ -0,0 +1,19 @@
+export interface CreateTicketRequest {
+    workspaceId: string;
+    /** The service frame the run belongs to (used to resolve the GitHub repo). */
+    frameId: string;
+    title: string;
+    /** Markdown body (the analysis report). */
+    body: string;
+}
+/** The filed ticket. */
+export interface CreatedTicket {
+    /** Canonical external id (e.g. "owner/repo#123" or "ENG-42"). */
+    externalId: string;
+    url: string;
+}
+export interface TicketTrackerProvider {
+    /** File a ticket, or return null when no tracker is configured for the workspace. */
+    createTicket(request: CreateTicketRequest): Promise<CreatedTicket | null>;
+}
+//# sourceMappingURL=ticket-tracker.d.ts.map

package/dist/ports/ticket-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ticket-tracker.d.ts","sourceRoot":"","sources":["../../src/ports/ticket-tracker.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAwB;AACxB,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,qBAAqB;IACpC,qFAAqF;IACrF,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CAC1E"}

package/dist/ports/ticket-tracker.js

@@ -0,0 +1,8 @@
+// Issue-tracker write port. The tech-debt recurring pipeline's `tracker` step
+// asks this provider to file a ticket (a GitHub issue or a Jira ticket) for the
+// analysis it just produced, before implementation starts. The concrete provider
+// resolves the workspace's tracker selection, credentials and (for GitHub) the
+// service's repository itself; it returns null when no tracker is configured, so
+// the step passes through.
+export {};
+//# sourceMappingURL=ticket-tracker.js.map

package/dist/ports/ticket-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ticket-tracker.js","sourceRoot":"","sources":["../../src/ports/ticket-tracker.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,2BAA2B"}