@cat-factory/kernel 0.6.0

package/dist/ports/fragment-selector.d.ts

@@ -0,0 +1,64 @@
+import type { AgentKind, BlockType } from '../domain/types.js';
+/** A catalog entry as the selector sees it: metadata only, no body. */
+export interface SelectableFragment {
+    id: string;
+    title: string;
+    summary: string;
+    category?: string;
+    tags?: string[];
+    appliesTo?: {
+        blockTypes?: BlockType[];
+        agentKinds?: AgentKind[];
+    };
+}
+/** What the selector knows about the run it is choosing fragments for. */
+export interface FragmentSelectionContext {
+    /** The workspace the run belongs to, for resolving the scoped model provider. */
+    workspaceId: string;
+    agentKind: AgentKind;
+    blockType: BlockType;
+    blockTitle: string;
+    blockDescription: string;
+    /**
+     * Free-form signals the selector may reason over — e.g. the prior step's
+     * output (a coder's summary), or changed file paths when available. Kept
+     * generic so the engine need not fetch a diff to make selection useful.
+     */
+    signals: string[];
+}
+export interface FragmentSelector {
+    /** Return the ids of `candidates` relevant to `context`. */
+    select(candidates: SelectableFragment[], context: FragmentSelectionContext): Promise<string[]>;
+}
+/** A fragment resolved for injection: just the id and the body to fold in. */
+export interface ResolvedRunFragment {
+    id: string;
+    body: string;
+}
+export interface FragmentResolverInput {
+    workspaceId: string;
+    agentKind: AgentKind;
+    blockType: BlockType;
+    blockTitle: string;
+    blockDescription: string;
+    /** Fragment ids pinned manually on the block (an authoritative override). */
+    manualIds: string[];
+    /** Free-form signals handed to the selector (see {@link FragmentSelectionContext}). */
+    signals: string[];
+}
+export interface FragmentRunSelection {
+    /** The fragments (id + body) to fold into the system prompt, in catalog order. */
+    fragments: ResolvedRunFragment[];
+    /** The ids that were selected (manual ∪ selector pick), for the execution step. */
+    selectedIds: string[];
+}
+/**
+ * The execution engine's view of the fragment library: resolve the fragments to
+ * inject for one agent run. A no-op-safe optional dependency — when the library
+ * module is not configured the engine never calls it and falls back to the
+ * static built-in catalog via the block's manual `fragmentIds`.
+ */
+export interface FragmentResolver {
+    resolveForRun(input: FragmentResolverInput): Promise<FragmentRunSelection>;
+}
+//# sourceMappingURL=fragment-selector.d.ts.map

package/dist/ports/fragment-selector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragment-selector.d.ts","sourceRoot":"","sources":["../../src/ports/fragment-selector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAgB9D,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,SAAS,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;KAAE,CAAA;CACnE;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,SAAS,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,MAAM,CAAC,UAAU,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;CAC/F;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,SAAS,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,uFAAuF;IACvF,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,SAAS,EAAE,mBAAmB,EAAE,CAAA;IAChC,mFAAmF;IACnF,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;CAC3E"}

package/dist/ports/fragment-selector.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fragment-selector.js.map

package/dist/ports/fragment-selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragment-selector.js","sourceRoot":"","sources":["../../src/ports/fragment-selector.ts"],"names":[],"mappings":""}

package/dist/ports/github-client.d.ts

@@ -0,0 +1,226 @@
+import type { CommitFilesInput, GitHubBranch, GitHubCheckRun, GitHubCommit, GitHubIssue, GitHubPullRequest, GitHubRepo, MergePullRequestInput, OpenPullRequestInput } from '../domain/types.js';
+export interface GitHubRepoRef {
+    owner: string;
+    repo: string;
+}
+/** A page of results plus the conditional-request ETag and a rate-limit reading. */
+export interface Paged<T> {
+    items: T[];
+    /** ETag to store and replay as `If-None-Match` on the next conditional GET. */
+    etag?: string;
+    /** `true` when GitHub answered 304 Not Modified (items will be empty). */
+    notModified?: boolean;
+    rateLimit?: RateLimitSnapshot;
+}
+/** A single observation of GitHub's rate-limit headers for one call. */
+export interface RateLimitSnapshot {
+    installationId: number;
+    /** e.g. 'core' / 'graphql' / 'search'. */
+    resource: string;
+    limit: number | null;
+    remaining: number | null;
+    /** When the window resets (epoch ms). */
+    resetAt: number | null;
+    observedAt: number;
+}
+export interface ListOptions {
+    /** ISO-8601 lower bound for delta listing (GitHub `since`). */
+    since?: string;
+    /** ETag from a prior response for a conditional request. */
+    etag?: string;
+}
+export interface CommitFilesResult {
+    /** SHA of the new commit. */
+    sha: string;
+}
+/** A single root-level entry of a repository's tree (file or directory). */
+export interface RepoEntry {
+    /** Path relative to the repo root, e.g. `README.md` or `src`. */
+    path: string;
+    /** GitHub content type: `file` | `dir` | `symlink` | `submodule`. */
+    type: string;
+}
+/** A directory listing entry from the contents API, carrying the blob/tree sha. */
+export interface RepoContentEntry {
+    /** Path relative to the repo root, e.g. `guidelines/backend.md`. */
+    path: string;
+    /** Base name, e.g. `backend.md`. */
+    name: string;
+    /** `file` | `dir` | `symlink` | `submodule`. */
+    type: string;
+    /** Blob sha (file) or tree sha (dir) — powers the cheap "changed?" check. */
+    sha: string;
+}
+/** A single file's decoded UTF-8 content plus its blob sha. */
+export interface RepoFileContent {
+    content: string;
+    sha: string;
+}
+/** A single comment on an issue, as returned by {@link GitHubClient.getIssue}. */
+export interface GitHubIssueComment {
+    /** Commenter login, or '' when unknown. */
+    author: string;
+    /** GitHub-supplied ISO creation timestamp. */
+    createdAt: string;
+    /** Comment body (GitHub Markdown, used as-is). */
+    body: string;
+}
+/**
+ * One issue's full content — body + recent comments + metadata — for linking an
+ * issue to a board block as agent context. Distinct from the lean
+ * {@link GitHubIssue} projection (which omits the body/comments): this is fetched
+ * on demand by the task-source provider, never bulk-synced.
+ */
+export interface GitHubIssueDetail {
+    number: number;
+    title: string;
+    /** Workflow state, e.g. `open` / `closed`. */
+    state: string;
+    /** Canonical web URL (GitHub `html_url`). */
+    url: string;
+    /** Issue author login, or null when unknown. */
+    author: string | null;
+    /** Assignee login, or null when unassigned. */
+    assignee: string | null;
+    labels: string[];
+    /** Issue body (GitHub Markdown). */
+    body: string;
+    /** Comments oldest→newest. */
+    comments: GitHubIssueComment[];
+}
+/** A single hit from searching issues across an installation's repos. */
+export interface GitHubIssueSearchHit {
+    owner: string;
+    repo: string;
+    number: number;
+    title: string;
+    /** Workflow state, e.g. `open` / `closed`. */
+    state: string;
+    /** Canonical web URL (GitHub `html_url`). */
+    url: string;
+}
+/** A single hit from code-searching an installation's repos for a file. */
+export interface GitHubCodeSearchHit {
+    owner: string;
+    repo: string;
+    /** Path relative to the repo root, e.g. `docs/architecture.md`. */
+    path: string;
+    /** Canonical web URL of the file on its default branch. */
+    url: string;
+}
+/** Installation metadata captured at connect time (needs the app JWT). */
+export interface InstallationMeta {
+    accountLogin: string;
+    targetType: 'Organization' | 'User';
+    /**
+     * Which configured App owns this installation (ADR 0005). The adapter probes
+     * the registered Apps to find the owner, so the binding records the App used
+     * for this installation's tokens.
+     */
+    appId: string;
+}
+/** One installation of the App, as listed via the app JWT (GET /app/installations). */
+export interface InstallationSummary {
+    installationId: number;
+    accountLogin: string;
+    targetType: 'Organization' | 'User';
+    /** The installing account's avatar, for display in the connect picker. */
+    accountAvatarUrl: string | null;
+}
+export interface GitHubClient {
+    /** Fetch an installation's account login + type (used by the connect flow). */
+    getInstallation(installationId: number): Promise<InstallationMeta>;
+    /** List every installation of the App (used by the connect discovery picker). */
+    listInstallations(): Promise<InstallationSummary[]>;
+    /** List every repository the installation can access (for backfill/reconcile). */
+    listInstallationRepos(installationId: number): Promise<Paged<GitHubRepo>>;
+    getRepo(installationId: number, ref: GitHubRepoRef): Promise<GitHubRepo>;
+    listBranches(installationId: number, ref: GitHubRepoRef, etag?: string): Promise<Paged<GitHubBranch>>;
+    /**
+     * List a repository's root-level entries. Returns an empty array for an empty
+     * repository (GitHub answers 404 with no default branch there). Used by repo
+     * bootstrapping to tell an empty/boilerplate-only target from one with real
+     * content before it pushes the initial commit.
+     */
+    listRootEntries(installationId: number, ref: GitHubRepoRef): Promise<RepoEntry[]>;
+    /**
+     * List a directory's entries on a ref via the contents API, each with its blob
+     * (file) or tree (dir) sha. Returns `[]` for a missing path/empty repo (404).
+     * Used by the fragment library to read a repo of Markdown guidelines and detect
+     * which files changed since the last sync.
+     */
+    listDirectory(installationId: number, ref: GitHubRepoRef, path: string, gitRef?: string): Promise<RepoContentEntry[]>;
+    /** Read a file's decoded UTF-8 content + blob sha on a ref, or null if absent. */
+    getFileContent(installationId: number, ref: GitHubRepoRef, path: string, gitRef?: string): Promise<RepoFileContent | null>;
+    listPullRequests(installationId: number, ref: GitHubRepoRef, opts?: ListOptions): Promise<Paged<GitHubPullRequest>>;
+    listIssues(installationId: number, ref: GitHubRepoRef, opts?: ListOptions): Promise<Paged<GitHubIssue>>;
+    /**
+     * Fetch a single issue's full content (body + comments) for linking it to a
+     * board block as agent context. Throws (GitHubApiError) if the issue or repo
+     * is not visible to the installation.
+     */
+    getIssue(installationId: number, ref: GitHubRepoRef, issueNumber: number): Promise<GitHubIssueDetail>;
+    /**
+     * Search issues visible to the installation by free text. `query` is the raw
+     * GitHub search text; the adapter scopes it to issues (`is:issue`) and bounds
+     * the result count. Used by the GitHub-issues task source's search box.
+     */
+    searchIssues(installationId: number, query: string, limit?: number): Promise<GitHubIssueSearchHit[]>;
+    /**
+     * Code-search files visible to the installation. `query` is the raw GitHub
+     * code-search text and MUST already carry an `org:`/`user:`/`repo:` scope
+     * qualifier (GitHub's code-search API rejects unscoped queries); the caller
+     * builds it from the installation's account. Used by the GitHub repo-doc
+     * document source's search box.
+     */
+    searchCode(installationId: number, query: string, limit?: number): Promise<GitHubCodeSearchHit[]>;
+    listCommits(installationId: number, ref: GitHubRepoRef, opts?: ListOptions & {
+        sha?: string;
+    }): Promise<Paged<GitHubCommit>>;
+    listCheckRuns(installationId: number, ref: GitHubRepoRef, sha: string): Promise<Paged<GitHubCheckRun>>;
+    createBranch(installationId: number, ref: GitHubRepoRef, name: string, fromSha: string): Promise<void>;
+    /** Create a commit on a branch via the Git Data API (blob → tree → commit → ref). */
+    commitFiles(installationId: number, ref: GitHubRepoRef, input: CommitFilesInput): Promise<CommitFilesResult>;
+    /**
+     * Create an issue. Used by the recurring tech-debt pipeline's `tracker` step to
+     * file the issue it raises before implementation. Returns the new issue's number
+     * and canonical web URL.
+     */
+    createIssue(installationId: number, ref: GitHubRepoRef, input: {
+        title: string;
+        body: string;
+    }): Promise<{
+        number: number;
+        url: string;
+    }>;
+    openPullRequest(installationId: number, ref: GitHubRepoRef, input: OpenPullRequestInput): Promise<GitHubPullRequest>;
+    updatePullRequest(installationId: number, ref: GitHubRepoRef, number: number, patch: {
+        title?: string;
+        body?: string;
+        state?: 'open' | 'closed';
+        base?: string;
+    }): Promise<GitHubPullRequest>;
+    /**
+     * Read a PR's lazily-computed mergeability. GitHub computes `mergeable` /
+     * `mergeable_state` asynchronously, so `mergeable` is `null` until it is ready;
+     * `mergeableState === 'dirty'` is its signal that the PR conflicts with its base.
+     * `headSha` is the PR head commit (null when the PR can't be read).
+     */
+    getPullRequestMergeability(installationId: number, ref: GitHubRepoRef, number: number): Promise<{
+        mergeable: boolean | null;
+        mergeableState: string;
+        headSha: string | null;
+    }>;
+    mergePullRequest(installationId: number, ref: GitHubRepoRef, number: number, input?: MergePullRequestInput): Promise<void>;
+    /**
+     * Delete a branch (`heads/<branch>` ref). Used to tear down a work branch once its
+     * PR has merged, so a later re-run of the same task starts fresh from base instead
+     * of resuming on already-merged commits (which a squash/rebase merge would otherwise
+     * re-introduce, since those commits are not ancestors of base). Idempotent from the
+     * caller's view: a missing branch (already deleted) is not an error.
+     */
+    deleteBranch(installationId: number, ref: GitHubRepoRef, branch: string): Promise<void>;
+    /** Add a comment to an issue or pull request (they share the issue-comment API). */
+    comment(installationId: number, ref: GitHubRepoRef, issueOrPrNumber: number, body: string): Promise<void>;
+}
+//# sourceMappingURL=github-client.d.ts.map

package/dist/ports/github-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-client.d.ts","sourceRoot":"","sources":["../../src/ports/github-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,oBAAoB,CAAA;AAc3B,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAED,oFAAoF;AACpF,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,EAAE,CAAA;IACV,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,yCAAyC;IACzC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAA;CACb;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAA;IACd,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAA;IACX,gDAAgD;IAChD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,8BAA8B;IAC9B,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAC/B;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,cAAc,GAAG,MAAM,CAAA;IACnC;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,cAAc,GAAG,MAAM,CAAA;IACnC,0EAA0E;IAC1E,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAED,MAAM,WAAW,YAAY;IAE3B,+EAA+E;IAC/E,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClE,iFAAiF;IACjF,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IACnD,kFAAkF;IAClF,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IAGzE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACxE,YAAY,CACV,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;IAC/B;;;;;OAKG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IACjF;;;;;OAKG;IACH,aAAa,CACX,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC9B,kFAAkF;IAClF,cAAc,CACZ,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAClC,gBAAgB,CACd,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;IACpC,UAAU,CACR,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CACN,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7B;;;;OAIG;IACH,YAAY,CACV,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAClC;;;;;;OAMG;IACH,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IACjG,WAAW,CACT,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE,WAAW,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;IAC/B,aAAa,CACX,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;IAGjC,YAAY,CACV,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,qFAAqF;IACrF,WAAW,CACT,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7B;;;;OAIG;IACH,WAAW,CACT,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,eAAe,CACb,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7B,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjF,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7B;;;;;OAKG;IACH,0BAA0B,CACxB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;IACzF,gBAAgB,CACd,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB;;;;;;OAMG;IACH,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvF,oFAAoF;IACpF,OAAO,CACL,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,aAAa,EAClB,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAAA;CACjB"}

package/dist/ports/github-client.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=github-client.js.map

package/dist/ports/github-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-client.js","sourceRoot":"","sources":["../../src/ports/github-client.ts"],"names":[],"mappings":""}

package/dist/ports/github-provisioning.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The permissions an installation token was actually granted, as reported by
+ * `POST /app/installations/{id}/access_tokens`. This is the intersection of the
+ * App's requested permissions and what the installing account approved, so it —
+ * not the App's registration — is the source of truth for "can this credential
+ * do X". Values are GitHub's permission levels; an absent key means "not
+ * granted".
+ */
+export interface InstallationPermissions {
+    /** Repository administration — required to create repositories. */
+    administration?: 'read' | 'write';
+    /** Organization-level administration, granted to some App profiles. */
+    organization_administration?: 'read' | 'write';
+    contents?: 'read' | 'write';
+    [permission: string]: 'read' | 'write' | 'admin' | undefined;
+}
+export interface CreateRepoInput {
+    /** The organization login to create the repository under. */
+    org: string;
+    name: string;
+    private?: boolean;
+    description?: string;
+    /** Seed the repo with an initial commit (so it has a default branch). */
+    autoInit?: boolean;
+}
+/** Identifying details of a freshly-created repository. */
+export interface ProvisionedRepo {
+    githubId: number;
+    owner: string;
+    name: string;
+    defaultBranch: string | null;
+    private: boolean;
+}
+export interface GitHubProvisioningClient {
+    /**
+     * The permissions the installation token actually carries. Read this before a
+     * privileged action so the caller can choose a path (or refuse) without
+     * provoking a guaranteed 403.
+     */
+    getGrantedPermissions(installationId: number): Promise<InstallationPermissions>;
+    /**
+     * Create a repository under an organization. Requires the installation to hold
+     * `administration: write`; otherwise GitHub answers 403.
+     */
+    createRepoInOrg(installationId: number, input: CreateRepoInput): Promise<ProvisionedRepo>;
+}
+//# sourceMappingURL=github-provisioning.d.ts.map

package/dist/ports/github-provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-provisioning.d.ts","sourceRoot":"","sources":["../../src/ports/github-provisioning.ts"],"names":[],"mappings":"AAWA;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACjC,uEAAuE;IACvE,2BAA2B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC9C,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC/E;;;OAGG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CAC1F"}

package/dist/ports/github-provisioning.js

@@ -0,0 +1,12 @@
+// ---------------------------------------------------------------------------
+// GitHubProvisioningClient port: the *privileged* slice of the GitHub REST API
+// used to create repositories and to introspect what an installation may
+// actually do. Deliberately separate from `GitHubClient` (the read/write slice
+// every workspace uses) because repo creation needs the elevated
+// `Administration: write` grant that only the privileged App tier carries — see
+// ADR 0005. Splitting the port keeps the common client implementable without
+// the elevated grant, and lets the provisioner reason about capability *before*
+// it acts rather than discovering a 403 mid-flight.
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=github-provisioning.js.map

package/dist/ports/github-provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-provisioning.js","sourceRoot":"","sources":["../../src/ports/github-provisioning.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,+EAA+E;AAC/E,yEAAyE;AACzE,+EAA+E;AAC/E,iEAAiE;AACjE,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,oDAAoD;AACpD,8EAA8E"}

package/dist/ports/github-repositories.d.ts

@@ -0,0 +1,136 @@
+import type { GitHubBranch, GitHubCheckRun, GitHubCommit, GitHubIssue, GitHubPullRequest, GitHubRepo } from '../domain/types.js';
+import type { RateLimitSnapshot } from './github-client.js';
+/**
+ * A GitHub App installation binding. An installation is bound to an *account*
+ * (migration 0017), so every workspace in that account shares it; `workspaceId`
+ * records the workspace that connected it (and is the binding key on the
+ * auth-disabled path, where `accountId` is null). The token fields are
+ * infrastructure detail (never sent on the wire); they live here so the auth
+ * adapter can read/write the cache in the same row.
+ */
+export interface GitHubInstallation {
+    installationId: number;
+    workspaceId: string;
+    /** The account this installation is bound to, or null on the auth-disabled path. */
+    accountId: string | null;
+    accountLogin: string;
+    targetType: 'Organization' | 'User';
+    /**
+     * Which GitHub App registration owns this installation (ADR 0005). null for
+     * rows created before the multi-App tier — treated as the default App. An
+     * installation id belongs to exactly one App on GitHub, so this is immutable.
+     */
+    appId: string | null;
+    /** Cached installation access token, or null if none/expired. */
+    cachedToken: string | null;
+    /** Token expiry (epoch ms), or null. */
+    tokenExpiresAt: number | null;
+    createdAt: number;
+    /** Set when the installation is suspended/uninstalled (tombstone). */
+    deletedAt: number | null;
+}
+export interface GitHubInstallationRepository {
+    getByInstallationId(installationId: number): Promise<GitHubInstallation | null>;
+    /**
+     * The installation backing a workspace: its own direct binding, or one shared
+     * via its account. Returns null when neither exists or is tombstoned.
+     */
+    getByWorkspace(workspaceId: string): Promise<GitHubInstallation | null>;
+    /**
+     * Every workspace that an installation's webhooks should fan out to: the
+     * connector workspace plus all workspaces in the installation's account.
+     */
+    listWorkspacesForInstallation(installationId: number): Promise<string[]>;
+    /** List every live installation across accounts (used by the cron pass). */
+    listActive(): Promise<GitHubInstallation[]>;
+    upsert(installation: GitHubInstallation): Promise<void>;
+    updateCachedToken(installationId: number, token: string, expiresAt: number): Promise<void>;
+    softDelete(installationId: number, at: number): Promise<void>;
+}
+/** Which entity kind a sync cursor tracks for a repo. */
+export type SyncCursorKind = 'branches' | 'pulls' | 'issues' | 'commits' | 'checks';
+export interface SyncCursor {
+    etag: string | null;
+    lastSyncedAt: number | null;
+    sinceIso: string | null;
+}
+/** A repo whose projection has gone stale and should be reconciled. */
+export interface StaleRepoRef {
+    workspaceId: string;
+    githubId: number;
+    installationId: number;
+    owner: string;
+    name: string;
+}
+export interface RepoProjectionRepository {
+    upsertMany(workspaceId: string, repos: GitHubRepo[]): Promise<void>;
+    list(workspaceId: string): Promise<GitHubRepo[]>;
+    get(workspaceId: string, githubId: number): Promise<GitHubRepo | null>;
+    /** Tombstone repos for this installation whose id is not in `seenGithubIds`. */
+    tombstoneMissing(workspaceId: string, installationId: number, seenGithubIds: number[], at: number): Promise<void>;
+    /** Link a projected repo to a board block (does not touch other fields). */
+    linkBlock(workspaceId: string, githubId: number, blockId: string | null): Promise<void>;
+    /**
+     * Flag (or unflag) a projected repo as a monorepo (does not touch other fields).
+     * Like {@link RepoProjectionRepository.linkBlock} this is board-owned state that
+     * sync preserves rather than overwrites.
+     */
+    setMonorepo(workspaceId: string, githubId: number, isMonorepo: boolean): Promise<void>;
+    /** Live repos whose `synced_at` is older than the cutoff, across all workspaces. */
+    listStale(olderThanEpochMs: number): Promise<StaleRepoRef[]>;
+    /**
+     * Of the given candidate workspaces, those that currently link this repo — a single
+     * (chunked) query backing the sync fan-out (which workspaces a one-per-org fetch must
+     * update), instead of one `get` per candidate. Empty input → empty result.
+     */
+    linkedWorkspaces(repoGithubId: number, candidateWorkspaceIds: string[]): Promise<string[]>;
+    /**
+     * Incremental-sync cursors are keyed by **installation** + repo (not workspace):
+     * a repo is fetched from GitHub once per org and the result fanned out to every
+     * workspace that links it, so two teams sharing a repo don't each burn an API
+     * round-trip. See {@link GitHubSyncService}.
+     */
+    getCursor(installationId: number, repoGithubId: number, kind: SyncCursorKind): Promise<SyncCursor | null>;
+    setCursor(installationId: number, repoGithubId: number, kind: SyncCursorKind, cursor: SyncCursor): Promise<void>;
+}
+export interface BranchProjectionRepository {
+    upsertMany(workspaceId: string, branches: GitHubBranch[]): Promise<void>;
+    listByRepo(workspaceId: string, repoGithubId: number): Promise<GitHubBranch[]>;
+}
+export interface PullRequestProjectionRepository {
+    upsertMany(workspaceId: string, pulls: GitHubPullRequest[]): Promise<void>;
+    listByRepo(workspaceId: string, repoGithubId: number): Promise<GitHubPullRequest[]>;
+    listByWorkspace(workspaceId: string): Promise<GitHubPullRequest[]>;
+}
+export interface IssueProjectionRepository {
+    upsertMany(workspaceId: string, issues: GitHubIssue[]): Promise<void>;
+    listByRepo(workspaceId: string, repoGithubId: number): Promise<GitHubIssue[]>;
+    listByWorkspace(workspaceId: string): Promise<GitHubIssue[]>;
+}
+export interface CommitProjectionRepository {
+    upsertMany(workspaceId: string, commits: GitHubCommit[]): Promise<void>;
+    listByRepo(workspaceId: string, repoGithubId: number, limit?: number): Promise<GitHubCommit[]>;
+    /**
+     * Retention: delete commits authored before `epochMs` (exclusive), returning
+     * how many were removed. Unlike the other projections this table has no
+     * `deleted_at` tombstone and grows step-wise during backfills, so a periodic
+     * pass reclaims old rows (the backfill is bounded to the same horizon, so it
+     * won't re-fetch what this prunes). Rows with no `authored_at` are kept.
+     */
+    deleteOlderThan(epochMs: number): Promise<number>;
+}
+export interface CheckRunProjectionRepository {
+    upsertMany(workspaceId: string, checks: GitHubCheckRun[]): Promise<void>;
+    listBySha(workspaceId: string, repoGithubId: number, headSha: string): Promise<GitHubCheckRun[]>;
+}
+export interface RateLimitRepository {
+    /** Append one observed rate-limit snapshot (best-effort; never throws fatally). */
+    record(snapshot: RateLimitSnapshot): Promise<void>;
+    /**
+     * Retention: delete snapshots observed before `epochMs` (exclusive), returning
+     * how many were removed. This is pure operational telemetry whose only consumer
+     * cares about recent headroom, so it gets the most aggressive retention window.
+     */
+    deleteOlderThan(epochMs: number): Promise<number>;
+}
+//# sourceMappingURL=github-repositories.d.ts.map

package/dist/ports/github-repositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-repositories.d.ts","sourceRoot":"","sources":["../../src/ports/github-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,UAAU,EACX,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAQ3D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,oFAAoF;IACpF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,cAAc,GAAG,MAAM,CAAA;IACnC;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,iEAAiE;IACjE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,wCAAwC;IACxC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAC/E;;;OAGG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IACvE;;;OAGG;IACH,6BAA6B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,4EAA4E;IAC5E,UAAU,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC3C,MAAM,CAAC,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1F,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEnF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACtE,gFAAgF;IAChF,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,aAAa,EAAE,MAAM,EAAE,EACvB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,4EAA4E;IAC5E,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvF;;;;OAIG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtF,oFAAoF;IACpF,SAAS,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC5D;;;;OAIG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1F;;;;;OAKG;IACH,SAAS,CACP,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAC7B,SAAS,CACP,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAAA;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CAC/E;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1E,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACnF,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;CACnE;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7E,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC9F;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;CACjG;AAED,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,MAAM,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAClD"}

package/dist/ports/github-repositories.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=github-repositories.js.map

package/dist/ports/github-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-repositories.js","sourceRoot":"","sources":["../../src/ports/github-repositories.ts"],"names":[],"mappings":""}

package/dist/ports/incident-enrichment.d.ts

@@ -0,0 +1,40 @@
+export interface IncidentMatchQuery {
+    workspaceId: string;
+    /**
+     * The monitor/SLO ids the regression fired on. A provider PREFERS an active incident
+     * whose text references one of these (the precise match), falling back to the most
+     * recent active incident in the window when none reference a signal (these systems
+     * don't reliably carry the originating monitor id).
+     */
+    signalIds: string[];
+    /** Release marker time (epoch ms); only incidents active since then match. */
+    since: number;
+}
+/** The investigation update posted onto a matched incident. */
+export interface IncidentUpdate {
+    /** Short headline. */
+    title: string;
+    /** Markdown investigation summary (suspect PR, evidence, recommendation). */
+    body: string;
+    /** Web URL of the suspect PR, when known. */
+    prUrl?: string;
+}
+export interface IncidentEnrichmentProvider {
+    /**
+     * Find the active incident matching the regression and post the investigation update
+     * onto it, atomically per provider. A no-op when no matching incident exists. Should
+     * never throw for an expected miss; the caller treats any throw as best-effort.
+     */
+    enrich(query: IncidentMatchQuery, update: IncidentUpdate): Promise<void>;
+}
+/**
+ * Fans an enrichment out across several providers (PagerDuty + incident.io). Each is
+ * matched + posted independently and isolated: one provider throwing (or not matching)
+ * never blocks the others.
+ */
+export declare class CompositeIncidentEnrichmentProvider implements IncidentEnrichmentProvider {
+    private readonly providers;
+    constructor(providers: IncidentEnrichmentProvider[]);
+    enrich(query: IncidentMatchQuery, update: IncidentUpdate): Promise<void>;
+}
+//# sourceMappingURL=incident-enrichment.d.ts.map

package/dist/ports/incident-enrichment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-enrichment.d.ts","sourceRoot":"","sources":["../../src/ports/incident-enrichment.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAA;CACd;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,sBAAsB;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAA;IACZ,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzE;AAED;;;;GAIG;AACH,qBAAa,mCAAoC,YAAW,0BAA0B;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,0BAA0B,EAAE,EAAI;IAElE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7E;CACF"}

package/dist/ports/incident-enrichment.js

@@ -0,0 +1,30 @@
+// Optional port for ENRICHING (not creating) an incident that an external
+// incident-management system (PagerDuty / incident.io) already opened from the
+// same Datadog monitors/SLOs the post-release-health gate watches. On a regression
+// the on-call agent's investigation is posted onto that incident so responders see
+// "which PR, what evidence, recommended action" — the one thing those systems can't
+// derive themselves. Best-effort: a missing/unmatched incident is a no-op, never
+// blocking the run or the in-app notification. NOT a notification channel: those
+// systems already page off the same signals, so re-alerting them would duplicate.
+/**
+ * Fans an enrichment out across several providers (PagerDuty + incident.io). Each is
+ * matched + posted independently and isolated: one provider throwing (or not matching)
+ * never blocks the others.
+ */
+export class CompositeIncidentEnrichmentProvider {
+    providers;
+    constructor(providers) {
+        this.providers = providers;
+    }
+    async enrich(query, update) {
+        await Promise.all(this.providers.map(async (provider) => {
+            try {
+                await provider.enrich(query, update);
+            }
+            catch {
+                // best-effort: isolate each provider
+            }
+        }));
+    }
+}
+//# sourceMappingURL=incident-enrichment.js.map

package/dist/ports/incident-enrichment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-enrichment.js","sourceRoot":"","sources":["../../src/ports/incident-enrichment.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,+EAA+E;AAC/E,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAkClF;;;;GAIG;AACH,MAAM,OAAO,mCAAmC;IACjB,SAAS;IAAtC,YAA6B,SAAuC;yBAAvC,SAAS;IAAiC,CAAC;IAExE,KAAK,CAAC,MAAM,CAAC,KAAyB,EAAE,MAAsB;QAC5D,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC,CAAC,CACH,CAAA;IACH,CAAC;CACF"}