@defrex/autobuild 0.11.0 → 0.12.0

package/packages/core/src/cli/watch.ts

@@ -42,8 +42,15 @@ import type { RepositoryRecord } from '../store/types'
  */
 import type { AbEvent } from '../events/catalog'
 import type { EventType } from '../events/payloads'
-import type { RepositoryEvent, RepositoryEventType } from '../events/repository'
-import { REPOSITORY_ATTENTION_EVENTS } from '../events/repository'
+import type { RepositoryEvent } from '../events/repository'
+import {
+  mergeDecision,
+  mergeIdentity,
+  RepositoryAttention,
+  repositoryNeedsAttention,
+  type MergeDecision,
+  type PersistenceObservation,
+} from './attention'
 import type { BuildState, PrLifecycle } from '../kernel/reducer'
 import { reduceBuild } from '../kernel/reducer'
 import type { BuildOutcome, BuildStatus, Phase } from '../ontology'
@@ -84,20 +91,7 @@ const TERMINAL_STATUSES: readonly BuildStatus[] = ['done', 'aborted']
  * a watch emits exactly these — deciding what to do about a blocker or a
  * merge stays with the caller's skill.
  */
-export const BUILD_ATTENTION_EVENTS = [
-  'escalation.raised',
-  'phase.failed',
-  'infrastructure.failed',
-  'runner.setup-failed',
-  'dispatch.failed',
-  'publication.lost',
-  'finalize.completed',
-  'pr.conflicted',
-  'pr.merged',
-  'pr.closed',
-  'build.completed',
-  'build.aborted',
-] as const satisfies readonly EventType[]
+export const BUILD_ATTENTION_EVENTS = ['escalation.raised'] as const satisfies readonly EventType[]
 
 // ── Glob compilation and matching ────────────────────────────────────────────
 
@@ -121,12 +115,6 @@ function matchesBuildFilter(type: EventType, filters: readonly RegExp[]): boolea
     : (BUILD_ATTENTION_EVENTS as readonly string[]).includes(type)
 }
 
-function matchesRepositoryFilter(type: RepositoryEventType, filters: readonly RegExp[]): boolean {
-  return filters.length > 0
-    ? filters.some((regex) => regex.test(type))
-    : (REPOSITORY_ATTENTION_EVENTS as readonly string[]).includes(type)
-}
-
 // ── The cursor ───────────────────────────────────────────────────────────────
 
 interface CursorPayload {
@@ -136,10 +124,29 @@ interface CursorPayload {
   /** The repository identity (normalized origin or checkout path). */
   repo: string
   /** Per-stream watch position: build slug → seq, `#repo` → seq. */
+  deliveredAttention?: string[]
   lostRuns?: string[]
   streams: Record<string, number>
 }
 
+function validAttentionIdentity(id: unknown): boolean {
+  if (typeof id !== 'string') return false
+  if (/^(source|tick):[1-9][0-9]*$/.test(id)) return true
+  try {
+    const value: unknown = JSON.parse(id)
+    return (
+      Array.isArray(value) &&
+      value.length === 2 &&
+      typeof value[0] === 'string' &&
+      value[0].length > 0 &&
+      Number.isSafeInteger(value[1]) &&
+      value[1] > 0
+    )
+  } catch {
+    return false
+  }
+}
+
 const CURSOR_PREFIX = 'v1.'
 
 /** Opaque to callers; the format is internal, not contract. */
@@ -173,13 +180,22 @@ export function decodeCursor(
     throw malformed()
   }
   if (typeof payload !== 'object' || payload === null) throw malformed()
-  const { v, store, repo, streams, lostRuns } = payload as Record<string, unknown>
+  const { v, store, repo, streams, lostRuns, deliveredAttention } = payload as Record<
+    string,
+    unknown
+  >
   if (
     lostRuns !== undefined &&
     (!Array.isArray(lostRuns) ||
       lostRuns.some((run) => typeof run !== 'string' || run.length === 0))
   )
     throw malformed()
+  if (
+    deliveredAttention !== undefined &&
+    (!Array.isArray(deliveredAttention) ||
+      deliveredAttention.some((id) => !validAttentionIdentity(id)))
+  )
+    throw malformed()
   if (v !== 1 || typeof store !== 'string' || typeof repo !== 'string') throw malformed()
   if (typeof streams !== 'object' || streams === null || Array.isArray(streams)) throw malformed()
   for (const seq of Object.values(streams)) {
@@ -202,6 +218,9 @@ export function decodeCursor(
     store,
     repo,
     streams: streams as Record<string, number>,
+    ...(deliveredAttention === undefined
+      ? {}
+      : { deliveredAttention: deliveredAttention as string[] }),
     ...(lostRuns === undefined ? {} : { lostRuns: lostRuns as string[] }),
   }
 }
@@ -272,6 +291,36 @@ export interface WatchObservationRecord {
   cursor: string
 }
 
+export interface AttentionObservationRecord {
+  repo?: string
+  build: string | null
+  state: WatchRecordState | null
+  observation: MergeDecision | PersistenceObservation
+  cursor: string
+}
+
+export function projectAttentionRecord(
+  observation: MergeDecision | PersistenceObservation,
+  state: BuildState | null,
+  cursor: string,
+  scope: { build: string } | { repo: string },
+): AttentionObservationRecord {
+  return {
+    ...scope,
+    build: 'build' in scope ? scope.build : null,
+    state: state ? projectState(state) : null,
+    observation,
+    cursor,
+  }
+}
+
+export function renderAttentionLine(
+  observation: MergeDecision | PersistenceObservation,
+  label: string,
+): string {
+  return `${observation.observedAt}  ${singleLine(label)}  ${observation.type}  ${singleLine(JSON.stringify(observation))}`
+}
+
 export interface WatchRecord {
   /** The build slug, or null for a repository-journal event. */
   build: string | null
@@ -544,6 +593,12 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
       const lostRuns = new Set(
         opts.since ? (decodeCursor(opts.since, { store: storeRef, repo }).lostRuns ?? []) : [],
       )
+      const resumedCursor = opts.since
+        ? decodeCursor(opts.since, { store: storeRef, repo })
+        : undefined
+      const deliveredAttention = new Set(resumedCursor?.deliveredAttention ?? [])
+      const repositoryAttention = new RepositoryAttention()
+      let attentionInitialized = false
       let livenessEvents: RepositoryEvent[] = []
       let livenessSeq = 0
       let livenessInitialized = false
@@ -571,6 +626,7 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
           repo,
           streams: { ...positions },
           lostRuns: [...lostRuns],
+          deliveredAttention: [...deliveredAttention],
         })
 
       /** One record, flushed the moment it is projected. `cursor` is the watch
@@ -591,6 +647,44 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
         }
       }
 
+      const emitObservation = (
+        observation: MergeDecision | PersistenceObservation,
+        state: BuildState | null,
+        scope: { build: string } | { repo: string },
+        identity: string,
+      ): void => {
+        if (stop || deliveredAttention.has(identity)) return
+        deliveredAttention.add(identity)
+        const cursor = encodeCurrent()
+        opts.stdout(
+          opts.json
+            ? JSON.stringify(projectAttentionRecord(observation, state, cursor, scope))
+            : renderAttentionLine(observation, 'build' in scope ? scope.build : '(repository)'),
+        )
+        emitted += 1
+        if (opts.count !== undefined && emitted >= opts.count) {
+          countCursor = cursor
+          requestStop()
+        }
+      }
+      const checkPersistence = (): void => {
+        if (filters.length || !attentionInitialized || stop) return
+        for (const { identity, observation } of repositoryAttention.pending(now())) {
+          emitObservation(observation, null, { repo }, identity)
+          if (stop) return
+        }
+      }
+      const baselineMerge = (slug: string, events: AbEvent[]): void => {
+        // Old cursors already consumed finalize attention. Infer every eligible
+        // historical prefix, even if consent was subsequently armed again.
+        const prefix: AbEvent[] = []
+        for (const event of events) {
+          prefix.push(event)
+          const observation = mergeDecision(prefix, now())
+          if (observation) deliveredAttention.add(mergeIdentity(slug, observation.pr.number))
+        }
+      }
+
       const checkLiveness = async (): Promise<void> => {
         if (!followRepository || stop) return
         if (!livenessInitialized) {
@@ -665,17 +759,34 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
        * into a scratch prefix so a resumed record never leaks state from
        * events that landed after it. */
       const processBuildEvent = (stream: BuildStream, event: AbEvent, prefix: AbEvent[]): void => {
+        if (stop) return
         stream.lastSeq = event.seq
         positions[stream.slug] = event.seq
-        if (!matchesBuildFilter(event.type, filters)) return
-        emit(event, reduceBuild(prefix))
+        const state = reduceBuild(prefix)
+        if (matchesBuildFilter(event.type, filters)) emit(event, state)
+        if (!filters.length && !stop) {
+          const observation = mergeDecision(prefix, now(), state)
+          if (observation)
+            emitObservation(
+              observation,
+              state,
+              { build: stream.slug },
+              mergeIdentity(stream.slug, observation.pr.number),
+            )
+        }
       }
 
       const processRepositoryEvent = (stream: RepositoryStream, event: RepositoryEvent): void => {
+        if (stop) return
         stream.lastSeq = event.seq
         positions[REPO_STREAM_KEY] = event.seq
-        if (!matchesRepositoryFilter(event.type, filters)) return
-        emit(event, null)
+        repositoryAttention.fold(event)
+        if (
+          filters.length
+            ? filters.some((regex) => regex.test(event.type))
+            : repositoryNeedsAttention(event)
+        )
+          emit(event, null)
       }
 
       /**
@@ -705,7 +816,16 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
         }
         streams.set(slug, stream)
         positions[slug] = stream.lastSeq
-        if (resumeSeq === undefined) return true
+        if (resumeSeq === undefined) {
+          baselineMerge(slug, events)
+          return true
+        }
+        positions[slug] = resumeSeq
+        if (resumedCursor?.deliveredAttention === undefined)
+          baselineMerge(
+            slug,
+            events.filter((event) => event.seq <= resumeSeq),
+          )
         stream.lastSeq = resumeSeq
         // Replay the backlog into a scratch prefix: each record's state is
         // the reduction of the prefix ENDING at that event, never the
@@ -771,6 +891,7 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
             status,
           }
           streams.set(record.slug, stream)
+          baselineMerge(record.slug, events)
           positions[record.slug] = stream.lastSeq
         }
       }
@@ -781,35 +902,22 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
         streams.set(REPO_STREAM_KEY, stream)
         positions[REPO_STREAM_KEY] = stream.lastSeq
         try {
-          // A fresh store has no repository row; do not create one.
-          if (resumeSeq === undefined && (await store.getRepo(repo)) !== null) {
-            // Bounded baseline (AUT-534): the baseline needs only the
-            // journal's end position, and AUT-489's bounded read answers that
-            // whenever the journal contains a `dispatcher.run-started` — the
-            // tail from the latest anchor runs to the journal end, so the
-            // subset's max seq equals the journal's max seq.
-            const subset = await store.getRepoStateEvents(repo)
-            let last = subset.at(-1)?.seq ?? 0
-            if (!subset.some((event) => event.type === 'dispatcher.run-started')) {
-              // Anchor-less journal: the subset may have dropped run-scoped
-              // facts appended before any anchor, so one bounded delta read
-              // recovers the true end; its events are baselined silently,
-              // exactly as the full read baselines them. The skip condition
-              // is exact: a run-started is its own anchor or lies in a later
-              // anchor's tail, so "no run-started in the subset" means "no
-              // run-started in the journal" — the only case where the subset
-              // can trail.
-              const tail = await store.getRepoEvents(repo, last)
-              last = tail.at(-1)?.seq ?? last
+          if ((await store.getRepo(repo)) !== null) {
+            // Full bootstrap is intentional: degradation can predate run anchors.
+            const history = await store.getRepoEvents(repo)
+            const baseline = resumeSeq ?? history.at(-1)?.seq ?? 0
+            for (const event of history) {
+              if (event.seq <= baseline) repositoryAttention.fold(event)
             }
-            const input = await readDispatcherLiveness(store, repo, now(), subset)
-            livenessEvents = input.events
-            livenessSeq = Math.max(last, input.events.at(-1)?.seq ?? 0)
-            livenessInitialized = true
-            if (input.record?.lease) observedOwners.set(input.record.lease.holder, input.record)
-            stream.lastSeq = last
-            positions[REPO_STREAM_KEY] = last
-          }
+            attentionInitialized = true
+            stream.lastSeq = baseline
+            positions[REPO_STREAM_KEY] = baseline
+            for (const event of history) {
+              if (event.seq <= baseline || stop) continue
+              processRepositoryEvent(stream, event)
+            }
+            if (!stop) checkPersistence()
+          } else attentionInitialized = true
           return true
         } catch {
           return false
@@ -822,6 +930,7 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
       ): Promise<boolean> => {
         const fresh = await store.getEvents(stream.slug, stream.lastSeq, readOpts)
         for (const event of fresh) {
+          if (stop) break
           stream.events.push(event)
           processBuildEvent(stream, event, stream.events)
           if (stop) break
@@ -832,17 +941,43 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
         return true
       }
 
+      let repositoryQueue = Promise.resolve()
+      let repositoryInitialization: Promise<void> | undefined
       const pollRepository = async (
         stream: RepositoryStream,
         readOpts?: RemotePollReadOpts,
       ): Promise<boolean> => {
         // A repository row may be created mid-watch by the first dispatch.
         if ((await store.getRepo(repo)) === null) return true
-        const fresh = await store.getRepoEvents(repo, stream.lastSeq, readOpts)
-        for (const event of fresh) {
-          processRepositoryEvent(stream, event)
-          if (stop) break
+        if (!attentionInitialized) {
+          repositoryInitialization ??= (async () => {
+            const history = await store.getRepoEvents(repo)
+            const baseline = sinceStreams[REPO_STREAM_KEY] ?? history.at(-1)?.seq ?? 0
+            for (const event of history) {
+              if (event.seq <= baseline) repositoryAttention.fold(event)
+            }
+            stream.lastSeq = baseline
+            positions[REPO_STREAM_KEY] = baseline
+            attentionInitialized = true
+          })()
+          try {
+            await repositoryInitialization
+          } catch (error) {
+            repositoryInitialization = undefined
+            throw error
+          }
         }
+        const fresh = await store.getRepoEvents(repo, stream.lastSeq, readOpts)
+        const apply = repositoryQueue.then(() => {
+          for (const event of fresh) {
+            if (stop) break
+            if (event.seq <= stream.lastSeq) continue
+            processRepositoryEvent(stream, event)
+          }
+          if (!stop) checkPersistence()
+        })
+        repositoryQueue = apply.catch(() => {})
+        await apply
         return true
       }
 
@@ -1023,6 +1158,8 @@ export async function abWatch(opts: AbWatchOpts): Promise<void> {
           void remoteRunner.runDiscovery({
             step: async (): Promise<void> => {
               if (slugs.length === 0) await discoverBuilds()
+              const repositoryStream = streams.get(REPO_STREAM_KEY)
+              if (repositoryStream?.kind === 'repo' && !stop) await pollRepository(repositoryStream)
               await checkLiveness()
             },
             // Unconditional, after the catch — exactly where the inline

package/packages/core/src/config/live.ts

@@ -12,6 +12,7 @@ export const DISPATCHER_CONFIG_ARTIFACT = 'dispatcher-config'
  * behavior.
  */
 export const CONFIG_RELOAD_CLASSIFICATION = {
+  store: 'restart',
   baseBranch: 'hot',
   capacity: 'hot',
   ticketScanIntervalSeconds: 'hot',
@@ -49,6 +50,7 @@ export const CONFIG_RELOAD_CLASSIFICATION = {
 }
 
 export const RESTART_REQUIRED_CONFIG_PATHS = [
+  'store',
   'forge',
   'plugins',
   'workspace.provider',
@@ -118,6 +120,7 @@ export function composeBuildConfig(pipeline: Config, deployment: Config): Config
 export function composeReloadedConfig(startup: Config, candidate: Config): Config {
   return {
     ...candidate,
+    store: startup.store,
     forge: startup.forge,
     plugins: startup.plugins,
     workspace: startup.workspace,

package/packages/core/src/config/schema.ts

@@ -12,6 +12,7 @@
  * validated.
  */
 import { z } from 'zod'
+import { normalizeServiceURL } from '../connection'
 import { prImageHostSchema } from '../ontology'
 import { SANDBOX_FORBIDDEN_ENV } from '../ports/workspace/operator-sandbox'
 import {
@@ -60,14 +61,22 @@ function stepSection<T, C>(
   label: string,
   stepsSchema: z.ZodType<string[]>,
   tableSchema: z.ZodType<T>,
-  compose: (steps: string[], stepConfigs: Record<string, T>) => C,
+  compose: (steps: string[], stepConfigs: Record<string, T>, afterReconcile: boolean) => C,
+  allowAfterReconcile = false,
 ) {
   return z
     .unknown()
     .transform((input, ctx): C => {
       const stepConfigs: Record<string, T> = Object.create(null)
       let steps: string[] = []
+      let afterReconcile = true
       for (const [key, raw] of ownEntries(input, label, ctx)) {
+        if (key === 'afterReconcile' && allowAfterReconcile) {
+          const parsed = z.boolean().safeParse(raw)
+          if (parsed.success) afterReconcile = parsed.data
+          else forwardIssues(parsed.error.issues, ctx, [key])
+          continue
+        }
         if (key === 'steps') {
           const parsed = stepsSchema.safeParse(raw)
           if (parsed.success) steps = parsed.data
@@ -77,7 +86,7 @@ function stepSection<T, C>(
         const table = parseEntry(tableSchema, raw, key, ctx)
         if (table.ok) defineEntry(stepConfigs, key, table.value)
       }
-      return compose(steps, stepConfigs)
+      return compose(steps, stepConfigs, afterReconcile)
     })
     .prefault({})
 }
@@ -367,6 +376,7 @@ export const verifyPathGlobSchema = z.string().superRefine((pattern, ctx) => {
 })
 
 const verifyApplicabilityShape = {
+  afterReconcile: z.boolean().optional(),
   /** Any-match positive path selectors; absent means unconditional. */
   paths: z
     .array(verifyPathGlobSchema)
@@ -399,6 +409,7 @@ export const verifyStepConfigSchema = z.discriminatedUnion('kind', [
 export type VerifyStepConfig = z.infer<typeof verifyStepConfigSchema>
 
 export interface VerifyConfig {
+  afterReconcile: boolean
   /** Step order — each entry names a `verify:<step>` phase (§15.2.1). */
   steps: string[]
   /** The [verify.<step>] tables, keyed by step name. */
@@ -406,8 +417,8 @@ export interface VerifyConfig {
 }
 
 /**
- * [verify] mixes one known key (`steps`) with an open set of per-step
- * subtables, so it cannot be a strictObject; instead every non-`steps` key is
+ * [verify] mixes known scalars (`steps`, `afterReconcile`) with per-step
+ * subtables, so it cannot be a strictObject; every other key is
  * validated as a step table — nothing passes through loosely, and no step name
  * is lost to the prototype chain (see `stepSection`).
  */
@@ -415,7 +426,8 @@ export const verifySectionSchema = stepSection(
   '[verify]',
   z.array(z.string().min(1)).default([]),
   verifyStepConfigSchema,
-  (steps, stepConfigs): VerifyConfig => ({ steps, stepConfigs }),
+  (steps, stepConfigs, afterReconcile): VerifyConfig => ({ steps, stepConfigs, afterReconcile }),
+  true,
 )
 
 // ── [finalize.<step>] ────────────────────────────────────────────────────────
@@ -500,6 +512,8 @@ export const policySchema = z.strictObject({
   /** Same-finding survival threshold before auto-escalate (§10, §15.4). */
   stallRounds: z.number().int().positive().default(3),
   maxVerifyAttempts: z.number().int().positive().default(3),
+  /** Consecutive dispatch failures before human intervention is required. */
+  maxDispatchAttempts: z.number().int().positive().default(3),
   /** Consecutive workspace setup failures before human intervention is required. */
   maxSetupAttempts: z.number().int().positive().default(3),
   /** Consecutive provider lifecycle failures before recovery requires a human retry. */
@@ -573,15 +587,33 @@ export const ticketsSchema = z.strictObject({
   /** Backend team key (e.g. "ENG") — required for linear and hosted. */
   teamKey: z.string().min(1).optional(),
   /** Workflow state claim() moves an issue to (§12); Linear and hosted. */
-  claimedState: z.string().min(1).optional(),
+  claimedState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
+  /** Hosted project completion state; defaults to Done. */
+  doneState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State create() files new tickets into. Absent = the provider's default
    * (Linear: the team's default state, e.g. Backlog; file: Triage). */
-  createState: z.string().min(1).optional(),
+  createState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State the dispatcher hands tickets back to for human triage — spec-gate
    * bounces (§6.3), aborted builds, closed-unmerged PRs. Absent = the
    * provider's default (Linear: Backlog; file: Triage) — resolved by
    * defaultTriageState in src/processes/dispatcher.ts. */
-  triageState: z.string().min(1).optional(),
+  triageState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** State harvest files its synthesized proposals into (§12). Absent = the
    * triage state, which keeps the constitutional grooming gate: a proposal
    * waits for a human before it can be dispatched. Setting it to readyState
@@ -590,7 +622,11 @@ export const ticketsSchema = z.strictObject({
    * does not also redirect spec-gate bounces, aborts, and closed-unmerged PRs
    * into the ready state, where a bounce would re-dispatch itself. Resolved by
    * defaultProposalState in src/processes/dispatcher.ts. */
-  proposalState: z.string().min(1).optional(),
+  proposalState: z
+    .string()
+    .min(1)
+    .refine((value) => value.trim().length > 0, 'state must be nonblank')
+    .optional(),
   /** Directory of state dirs (`triage/ ready/ doing/ done/`) holding `<id>.md`
    * ticket files; optional — defaults to `.autobuild/tickets`, resolved
    * relative to the repo. Kept schema-optional (not `.default()`) so the
@@ -725,7 +761,18 @@ export type OrchestratorConfig = z.infer<typeof orchestratorSchema>
 
 // ── Whole file ───────────────────────────────────────────────────────────────
 
+export const storeSchema = z.strictObject({
+  url: z.string().transform((value, ctx) => {
+    try {
+      return normalizeServiceURL(value)
+    } catch (error) {
+      ctx.addIssue({ code: 'custom', message: (error as Error).message })
+      return z.NEVER
+    }
+  }),
+})
 const configRootSchema = z.strictObject({
+  store: storeSchema.optional(),
   /** Base branch builds cut from and target (§16.1). */
   baseBranch: z.string().min(1).default('main'),
   /** Concurrent builds for this repository (§16.1). */

package/packages/core/src/connection.ts

@@ -0,0 +1,86 @@
+import { normalizeGitRemoteUrl } from './kernel/origin'
+/** Public device-approval protocol. Secrets travel only in capability POST bodies. */
+export type ConnectionStatus = 'pending' | 'approved' | 'denied' | 'expired'
+export interface ConnectionProposal {
+  repo: string
+  credentialId: string
+  digest: string
+}
+export interface ConnectionOutcome {
+  repo: string
+  credentialId: string
+  status: ConnectionStatus
+}
+export interface ConnectionStarted extends ConnectionOutcome {
+  id: string
+  capability: string
+  code: string
+  verificationURL: string
+  interval: number
+  expiresAt: string
+}
+export function normalizeServiceURL(raw: string): string {
+  let url: URL
+  try {
+    url = new URL(raw)
+  } catch {
+    throw new Error('store.url must be an absolute HTTPS service URL')
+  }
+  if (
+    !raw.trim() ||
+    raw !== raw.trim() ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    !(
+      url.protocol === 'https:' ||
+      (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))
+    )
+  ) {
+    throw new Error(
+      'store.url must be HTTPS (HTTP is allowed on loopback), without credentials, query or fragment',
+    )
+  }
+  return url.href.replace(/\/+$/, '')
+}
+
+export function normalizeConnectionRepository(raw: string): string {
+  const value = raw.trim()
+  // SSH's conventional git user is transport syntax; URL passwords and HTTPS
+  // userinfo are never part of an identity (normalization would discard them).
+  if (/[\s\\?#]/.test(value) || !value || (/^[^/]*:[^/]*@/.test(value) && !value.includes('://')))
+    throw new Error('invalid repository identity')
+  if (value.includes('://')) {
+    let input: URL
+    try {
+      input = new URL(value)
+    } catch {
+      throw new Error('invalid repository identity')
+    }
+    if (input.password || (input.username && !['ssh:', 'git+ssh:'].includes(input.protocol))) {
+      throw new Error('repository identity must not contain credentials')
+    }
+    if (input.search || input.hash) throw new Error('invalid repository identity')
+  }
+  const normalized = normalizeGitRemoteUrl(value)
+  let url: URL
+  try {
+    url = new URL(normalized)
+  } catch {
+    throw new Error('invalid repository identity')
+  }
+  if (
+    url.protocol !== 'https:' ||
+    !url.hostname ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    url.pathname === '/' ||
+    /%|\\/.test(url.pathname)
+  ) {
+    throw new Error('repository identity must be a normalized HTTPS repository origin')
+  }
+  return normalized
+}