@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-S2XIMQJQ.js

@@ -0,0 +1,681 @@
+import {
+  inspectCiLocation,
+  inspectPullRequestTrigger,
+  resolveProjectCiPlan,
+  workflowRunsProjectVerification
+} from "./chunk-RPHUWJ3K.js";
+import {
+  DEFAULT_LOCAL_CI_STATUS_CONTEXT
+} from "./chunk-VBENAHDA.js";
+
+// src/core/ci/integration/inspect.ts
+import { createHash } from "crypto";
+import { existsSync, readdirSync, readFileSync } from "fs";
+import path from "path";
+import { parse as parseYaml } from "yaml";
+
+// src/core/git/github-inspection.ts
+import { execFile } from "child_process";
+function createDefaultInspectionRunner() {
+  return {
+    run(command, args, options) {
+      return new Promise((resolve) => {
+        execFile(
+          command,
+          args,
+          {
+            cwd: options?.cwd,
+            timeout: options?.timeoutMs,
+            maxBuffer: 16 * 1024 * 1024,
+            encoding: "utf8"
+          },
+          (error, stdout, stderr) => {
+            const out = typeof stdout === "string" ? stdout : "";
+            const err = typeof stderr === "string" ? stderr : "";
+            if (error) {
+              const code = error.code;
+              const exitCode = typeof code === "number" ? code : null;
+              resolve({
+                exitCode,
+                stdout: out,
+                stderr: err || (error.message ?? "")
+              });
+              return;
+            }
+            resolve({ exitCode: 0, stdout: out, stderr: err });
+          }
+        );
+      });
+    }
+  };
+}
+async function ghApiGet(runner, repoRoot, endpoint) {
+  const result = await runner.run("gh", ["api", endpoint], { cwd: repoRoot });
+  if (result.exitCode === null || isSpawnFailure(result.stderr)) {
+    return { kind: "missing" };
+  }
+  if (result.exitCode === 0) {
+    try {
+      return { kind: "ok", json: JSON.parse(result.stdout) };
+    } catch {
+      return { kind: "error", message: "gh returned output that was not valid JSON" };
+    }
+  }
+  const status = parseHttpStatus(result.stderr);
+  if (status !== null) {
+    return { kind: "http", status, message: firstLine(result.stderr) };
+  }
+  return { kind: "error", message: firstLine(result.stderr) || `gh exited ${result.exitCode}` };
+}
+function parseHttpStatus(stderr) {
+  const match = /\(HTTP (\d{3})\)/.exec(stderr ?? "");
+  return match ? Number(match[1]) : null;
+}
+function isSpawnFailure(stderr) {
+  const text = (stderr ?? "").toLowerCase();
+  return text.includes("enoent") || text.includes("command not found") || text.includes("executable file not found") || text.includes("no such file");
+}
+function firstLine(text) {
+  return (text ?? "").split("\n").find((line) => line.trim().length > 0)?.trim() ?? "";
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : null;
+}
+function asString(value) {
+  return typeof value === "string" ? value : null;
+}
+function ghFailureNote(result) {
+  switch (result.kind) {
+    case "missing":
+      return "the GitHub CLI (gh) is not installed or could not be launched";
+    case "http":
+      return `gh api returned HTTP ${result.status}${result.message ? ` (${result.message})` : ""}`;
+    case "error":
+      return result.message || "gh api failed";
+  }
+}
+function classifyClassicProtection(result, context) {
+  if (result.kind !== "ok") {
+    if (result.kind === "http" && (result.status === 403 || result.status === 404)) {
+      return {
+        readable: false,
+        requiresContext: false,
+        strict: false,
+        uninterpretable: false,
+        note: result.status === 403 ? "not readable without admin (HTTP 403)" : "branch is not classic-protected or endpoint unavailable (HTTP 404)"
+      };
+    }
+    return {
+      readable: false,
+      requiresContext: false,
+      strict: false,
+      uninterpretable: false,
+      note: ghFailureNote(result)
+    };
+  }
+  const root = asRecord(result.json);
+  const rsc = root ? asRecord(root.required_status_checks) : null;
+  if (!rsc) {
+    return {
+      readable: true,
+      requiresContext: false,
+      strict: false,
+      uninterpretable: false,
+      note: "readable; no required status checks configured"
+    };
+  }
+  const contexts = collectClassicContexts(rsc);
+  const requires = contexts.includes(context);
+  const strict = rsc.strict === true;
+  return {
+    readable: true,
+    requiresContext: requires,
+    strict,
+    uninterpretable: false,
+    note: requires ? `readable; requires '${context}' (strict=${strict})` : "readable; does not require the guard context"
+  };
+}
+var GITHUB_ACTIONS_APP_ID = 15368;
+function collectClassicContexts(rsc) {
+  const checks = asArray(rsc.checks);
+  if (checks) {
+    const out2 = [];
+    for (const c of checks) {
+      const rec = asRecord(c);
+      if (!rec) continue;
+      const s = asString(rec.context);
+      if (!s) continue;
+      const appId = typeof rec.app_id === "number" ? rec.app_id : null;
+      if (appId !== null && appId !== GITHUB_ACTIONS_APP_ID) continue;
+      out2.push(s);
+    }
+    return out2;
+  }
+  const out = [];
+  const contexts = asArray(rsc.contexts);
+  if (contexts) {
+    for (const c of contexts) {
+      const s = asString(c);
+      if (s) out.push(s);
+    }
+  }
+  return out;
+}
+function classifyRulesets(result, context) {
+  if (result.kind !== "ok") {
+    if (result.kind === "http" && (result.status === 403 || result.status === 404)) {
+      return {
+        readable: false,
+        requiresContext: false,
+        strict: false,
+        uninterpretable: false,
+        note: result.status === 404 ? "no active rules for this branch (HTTP 404)" : "not readable (HTTP 403)"
+      };
+    }
+    return {
+      readable: false,
+      requiresContext: false,
+      strict: false,
+      uninterpretable: false,
+      note: ghFailureNote(result)
+    };
+  }
+  const rules = asArray(result.json);
+  if (!rules) {
+    return {
+      readable: true,
+      requiresContext: false,
+      strict: false,
+      uninterpretable: true,
+      note: "readable but the payload was not the expected array of active rules"
+    };
+  }
+  if (rules.length === 0) {
+    return {
+      readable: true,
+      requiresContext: false,
+      strict: false,
+      uninterpretable: false,
+      note: "readable; no active rules apply to this branch"
+    };
+  }
+  let requires = false;
+  let strict = false;
+  let sawRequiredChecksRule = false;
+  let sawMergeQueue = false;
+  let opaqueRequiredChecks = false;
+  for (const raw of rules) {
+    const rule = asRecord(raw);
+    if (!rule) continue;
+    const type = asString(rule.type);
+    if (type === "merge_queue") {
+      sawMergeQueue = true;
+      continue;
+    }
+    if (type !== "required_status_checks") continue;
+    sawRequiredChecksRule = true;
+    const params = asRecord(rule.parameters);
+    if (!params) {
+      opaqueRequiredChecks = true;
+      continue;
+    }
+    if (params.strict_required_status_checks_policy === true) strict = true;
+    const required = asArray(params.required_status_checks);
+    if (!required) {
+      opaqueRequiredChecks = true;
+      continue;
+    }
+    for (const entry of required) {
+      const rec = asRecord(entry);
+      if (!rec) continue;
+      const ctx = asString(rec.context);
+      if (ctx !== context) continue;
+      const integrationId = typeof rec.integration_id === "number" ? rec.integration_id : null;
+      if (integrationId !== null && integrationId !== GITHUB_ACTIONS_APP_ID) continue;
+      requires = true;
+    }
+  }
+  if (requires) {
+    return {
+      readable: true,
+      requiresContext: true,
+      strict,
+      uninterpretable: false,
+      note: `readable; a required_status_checks rule requires '${context}' (strict=${strict})`
+    };
+  }
+  const uninterpretable = sawMergeQueue || opaqueRequiredChecks;
+  return {
+    readable: true,
+    requiresContext: false,
+    strict,
+    uninterpretable,
+    note: uninterpretable ? sawMergeQueue ? "a merge_queue rule is active but its required checks are not visible via this endpoint" : "a required_status_checks rule is present but its parameters could not be interpreted" : sawRequiredChecksRule ? "readable; required_status_checks rules do not include the guard context" : "readable; no required_status_checks rule applies"
+  };
+}
+
+// src/core/ci/integration/github.ts
+function empty(repository) {
+  return {
+    repository,
+    pullRequests: "unknown",
+    availableWorkflows: [],
+    inventoryKnown: false,
+    requiredContexts: [],
+    workflows: [],
+    localRequired: "unknown",
+    rulesets: [],
+    notes: []
+  };
+}
+function classicAbsent(result) {
+  return result.kind === "http" && result.status === 404 && /branch not protected/i.test(result.message);
+}
+function requiredState(classic, rules, context) {
+  const a = classifyClassicProtection(classic, context);
+  const b = classifyRulesets(rules, context);
+  if (a.requiresContext || b.requiresContext) return "required";
+  const classicRoot = classic.kind === "ok" ? asRecord(classic.json) : null;
+  if ((!classicRoot || !Object.hasOwn(classicRoot, "required_status_checks")) && !classicAbsent(classic))
+    return "unknown";
+  if (!b.readable || a.uninterpretable || b.uninterpretable) return "unknown";
+  return "missing";
+}
+function upToDatePolicy(classic, rules, contexts) {
+  if (!contexts.length) return void 0;
+  const inspected = contexts.flatMap((context) => [
+    classifyClassicProtection(classic, context),
+    classifyRulesets(rules, context)
+  ]);
+  if (inspected.some((policy) => policy.strict)) return true;
+  if (!inspected.some((policy) => policy.uninterpretable) && (classicAbsent(classic) || classifyClassicProtection(classic, contexts[0]).readable) && classifyRulesets(rules, contexts[0]).readable)
+    return false;
+  return void 0;
+}
+function pullRequestState(classic, rules) {
+  const a = classic.kind === "ok" ? asRecord(classic.json) : null;
+  const b = rules.kind === "ok" ? asArray(rules.json) : null;
+  if (asRecord(a?.required_pull_request_reviews) || b?.some((r) => asRecord(r)?.type === "pull_request"))
+    return "required";
+  if ((!a || !Object.hasOwn(a, "required_pull_request_reviews")) && !classicAbsent(classic))
+    return "unknown";
+  if (!b || b.some((rule) => typeof asRecord(rule)?.type !== "string")) return "unknown";
+  return "missing";
+}
+function completeCollection(result, key) {
+  if (result.kind !== "ok") return void 0;
+  const object = asRecord(result.json);
+  const values = asArray(object?.[key]);
+  const total = object?.total_count;
+  if (!values || typeof total !== "number" || total > values.length) return void 0;
+  return values;
+}
+function contextIsActionsBound(classic, rules, name) {
+  const root = classic.kind === "ok" ? asRecord(classic.json) : null;
+  const checks = asArray(asRecord(root?.required_status_checks)?.checks) ?? [];
+  if (checks.some(
+    (raw) => asRecord(raw)?.context === name && asRecord(raw)?.app_id === GITHUB_ACTIONS_APP_ID
+  ))
+    return true;
+  const rows = rules.kind === "ok" ? asArray(rules.json) ?? [] : [];
+  return rows.some(
+    (raw) => (asArray(asRecord(asRecord(raw)?.parameters)?.required_status_checks) ?? []).some(
+      (check) => asRecord(check)?.context === name && asRecord(check)?.integration_id === GITHUB_ACTIONS_APP_ID
+    )
+  );
+}
+async function inspectGitHubCi(root, repository, workflowPaths, intent, suppliedRunner, localStatusContext = DEFAULT_LOCAL_CI_STATUS_CONTEXT) {
+  const underlying = suppliedRunner ?? createDefaultInspectionRunner();
+  const runner = {
+    run: (command, args, options) => underlying.run(command, args, { ...options, timeoutMs: 8e3 })
+  };
+  const get = (endpoint) => ghApiGet(runner, root, endpoint).catch(() => ({
+    kind: "error",
+    message: "GitHub inspection unavailable."
+  }));
+  const prefix = `repos/${repository}`;
+  const snapshot = empty(repository);
+  const repoResult = await get(prefix);
+  const repo = repoResult.kind === "ok" ? asRecord(repoResult.json) : null;
+  const branch = asString(repo?.default_branch);
+  if (!branch || asString(repo?.full_name)?.toLowerCase() !== repository.toLowerCase()) {
+    snapshot.notes.push("GitHub repository metadata could not be confirmed.");
+    return snapshot;
+  }
+  snapshot.defaultBranch = branch;
+  snapshot.visibility = asString(repo?.visibility) ?? void 0;
+  const branchPath = `${prefix}/branches/${encodeURIComponent(branch)}`;
+  const [headResult, inventoryResult, classic, rules, permissions] = await Promise.all([
+    get(branchPath),
+    get(`${prefix}/actions/workflows?per_page=100`),
+    get(`${branchPath}/protection`),
+    get(`${prefix}/rules/branches/${encodeURIComponent(branch)}`),
+    get(`${prefix}/actions/permissions`)
+  ]);
+  const head = headResult.kind === "ok" ? asRecord(headResult.json) : null;
+  const sha = asString(asRecord(head?.commit)?.sha);
+  snapshot.headSha = sha && /^[a-f0-9]{40}$/i.test(sha) ? sha : void 0;
+  snapshot.pullRequests = pullRequestState(classic, rules);
+  if (localStatusContext !== null) {
+    snapshot.localRequired = requiredState(classic, rules, localStatusContext);
+    snapshot.localStrict = upToDatePolicy(classic, rules, [localStatusContext]);
+  }
+  const actionsEnabled = permissions.kind === "ok" ? asRecord(permissions.json)?.enabled : void 0;
+  if (typeof actionsEnabled !== "boolean")
+    snapshot.notes.push(
+      "Repository Actions permission is not readable; current activation is unconfirmed."
+    );
+  const classicData = classic.kind === "ok" ? asRecord(classic.json) : null;
+  if (asRecord(classicData?.enforce_admins)?.enabled === false)
+    snapshot.notes.push("Classic branch protection permits administrator bypass.");
+  const ruleRows = rules.kind === "ok" ? asArray(rules.json) : null;
+  const statusRules = asRecord(classicData?.required_status_checks);
+  snapshot.requiredContexts = [
+    .../* @__PURE__ */ new Set([
+      ...asArray(statusRules?.checks)?.flatMap((c) => {
+        const name = asString(asRecord(c)?.context);
+        return name ? [name] : [];
+      }) ?? asArray(statusRules?.contexts)?.filter((c) => typeof c === "string") ?? [],
+      ...(ruleRows ?? []).flatMap((r) => {
+        const required = asArray(asRecord(asRecord(r)?.parameters)?.required_status_checks);
+        return required?.flatMap((c) => {
+          const name = asString(asRecord(c)?.context);
+          return name ? [name] : [];
+        }) ?? [];
+      })
+    ])
+  ];
+  if (ruleRows?.some((r) => asRecord(r)?.type === "merge_queue")) {
+    snapshot.notes.push("Merge queue is configured; queue execution is not assessed.");
+  }
+  const ids = [
+    ...new Set(
+      (ruleRows ?? []).flatMap((r) => {
+        const id = asRecord(r)?.ruleset_id;
+        return typeof id === "number" && Number.isSafeInteger(id) && id > 0 ? [id] : [];
+      })
+    )
+  ];
+  snapshot.rulesets = await Promise.all(
+    ids.slice(0, 10).map(async (id) => {
+      const detail = await get(`${prefix}/rulesets/${id}`);
+      const data = detail.kind === "ok" ? asRecord(detail.json) : null;
+      return {
+        id,
+        name: asString(data?.name) ?? void 0,
+        bypasses: asArray(data?.bypass_actors)?.length
+      };
+    })
+  );
+  for (const layer of snapshot.rulesets) {
+    if (layer.bypasses === void 0)
+      snapshot.notes.push(`Bypass details for ruleset ${layer.name ?? layer.id} are unknown.`);
+    else if (layer.bypasses > 0)
+      snapshot.notes.push(
+        `Ruleset ${layer.name ?? layer.id} has ${layer.bypasses} bypass entries.`
+      );
+  }
+  if (ids.length > 10) snapshot.notes.push("Additional ruleset details were not inspected.");
+  const inventory = completeCollection(inventoryResult, "workflows");
+  snapshot.inventoryKnown = inventory !== void 0;
+  if (!inventory) snapshot.notes.push("Workflow inventory is unavailable or incomplete.");
+  snapshot.availableWorkflows = inventory?.flatMap((w) => {
+    const file = asString(asRecord(w)?.path);
+    return file ? [file] : [];
+  }) ?? [];
+  const selected = intent?.primary === "github-actions" ? intent.githubActions?.workflows ?? [] : workflowPaths;
+  for (const file of selected.slice(0, 10)) {
+    const definition = inventory?.map(asRecord).find((w) => w?.path === file);
+    const evidence = {
+      path: file,
+      active: inventory && typeof actionsEnabled === "boolean" ? actionsEnabled && definition?.state === "active" : void 0,
+      checks: [],
+      requiredChecks: "unknown",
+      strict: void 0,
+      prEvidence: "unknown"
+    };
+    snapshot.workflows.push(evidence);
+    const id = definition?.id;
+    if (typeof id !== "number" || !snapshot.headSha) continue;
+    const [runResult, prResult] = await Promise.all([
+      get(`${prefix}/actions/workflows/${id}/runs?head_sha=${snapshot.headSha}&per_page=1`),
+      get(`${prefix}/actions/workflows/${id}/runs?event=pull_request&per_page=1`)
+    ]);
+    const prData = prResult.kind === "ok" ? asRecord(prResult.json) : null;
+    const prRuns = asArray(prData?.workflow_runs);
+    if (prData?.total_count === 0 && prRuns?.length === 0) evidence.prEvidence = "not-observed";
+    else if (prRuns?.some((r) => asRecord(r)?.event === "pull_request"))
+      evidence.prEvidence = "observed";
+    const runData = runResult.kind === "ok" ? asRecord(runResult.json) : null;
+    const mainRun = asRecord(asArray(runData?.workflow_runs)?.[0]);
+    const prRun = asRecord(prRuns?.[0]);
+    const run = mainRun?.head_sha === snapshot.headSha ? mainRun : prRun?.event === "pull_request" ? prRun : null;
+    const runSha = asString(run?.head_sha);
+    if (!run || !runSha || !/^[a-f0-9]{40}$/i.test(runSha) || typeof run.id !== "number") continue;
+    evidence.run = {
+      sha: runSha,
+      event: asString(run.event) ?? "unknown",
+      status: asString(run.status) ?? "unknown",
+      conclusion: asString(run.conclusion),
+      url: asString(run.html_url) ?? void 0
+    };
+    const jobs = completeCollection(
+      await get(`${prefix}/actions/runs/${run.id}/jobs?per_page=100`),
+      "jobs"
+    );
+    if (!jobs) {
+      snapshot.notes.push(`Job inventory for ${file} is unavailable or incomplete.`);
+      continue;
+    }
+    evidence.checks = jobs.flatMap((raw) => {
+      const job = asRecord(raw);
+      const name = asString(job?.name);
+      return name ? [
+        {
+          name,
+          status: asString(job?.status) ?? "unknown",
+          conclusion: asString(job?.conclusion)
+        }
+      ] : [];
+    });
+    const names = intent?.primary === "github-actions" ? intent.githubActions?.selectedChecks ?? [] : evidence.checks.map((c) => c.name);
+    const requirements = names.map((name) => requiredState(classic, rules, name));
+    evidence.requiredChecks = requirements.length === 0 ? "unknown" : requirements.includes("missing") ? "missing" : requirements.includes("unknown") ? "unknown" : "required";
+    if (names.some(
+      (name) => requiredState(classic, rules, name) === "required" && !contextIsActionsBound(classic, rules, name)
+    )) {
+      snapshot.notes.push(
+        `Some required checks for ${file} accept any producer; review the GitHub Actions source binding.`
+      );
+    }
+    if (evidence.checks.some(
+      (check) => check.conclusion === "skipped" || check.conclusion === "neutral"
+    )) {
+      snapshot.notes.push(
+        `Some checks for ${file} were skipped or neutral; that is not proof their validation commands ran.`
+      );
+    }
+    evidence.strict = upToDatePolicy(classic, rules, names);
+  }
+  const observed = /* @__PURE__ */ new Map();
+  for (const workflow of snapshot.workflows)
+    for (const check of workflow.checks)
+      observed.set(check.name, (observed.get(check.name) ?? 0) + 1);
+  for (const name of intent?.githubActions?.selectedChecks ?? []) {
+    if (!observed.has(name))
+      snapshot.notes.push(`Selected check '${name}' was not observed in the inspected run's jobs.`);
+    else if ((observed.get(name) ?? 0) > 1)
+      snapshot.notes.push(`Selected check '${name}' is ambiguous across workflows.`);
+  }
+  if (selected.length > 10) snapshot.notes.push("Additional workflows were not inspected.");
+  return snapshot;
+}
+
+// src/core/ci/integration/inspect.ts
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function workflowFiles(root, commands) {
+  const directory = path.join(root, ".github/workflows");
+  const workflows = [], notes = [];
+  if (!existsSync(directory)) return { workflows, notes };
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    if (!entry.isFile() || !/\.ya?ml$/.test(entry.name)) continue;
+    const relative = `.github/workflows/${entry.name}`;
+    try {
+      const body = readFileSync(path.join(directory, entry.name), "utf8");
+      const yaml = record(parseYaml(body));
+      const jobs = record(yaml?.jobs);
+      if (!jobs) throw new Error("No jobs");
+      const trigger = inspectPullRequestTrigger(yaml?.on);
+      const runs = Object.values(jobs).flatMap((value) => {
+        const steps = record(value)?.steps;
+        return Array.isArray(steps) ? steps.flatMap((step) => {
+          const run = record(step)?.run;
+          return typeof run === "string" ? [run] : [];
+        }) : [];
+      });
+      workflows.push({
+        path: relative,
+        name: typeof yaml?.name === "string" ? yaml.name : entry.name,
+        validation: trigger.present && workflowRunsProjectVerification(runs, commands),
+        pullRequests: trigger.present,
+        filtered: trigger.filtered,
+        conditionalJobs: Object.values(jobs).some((job) => record(job)?.if !== void 0),
+        fingerprint: createHash("sha256").update(body).digest("hex")
+      });
+    } catch {
+      notes.push(`${relative} could not be interpreted; review it before adoption.`);
+    }
+  }
+  return { workflows: workflows.sort((a, b) => a.path.localeCompare(b.path)), notes };
+}
+async function inspectCiIntegration(input, options = {}) {
+  const location = await inspectCiLocation(input, options.repository);
+  const root = location.root;
+  const snapshot = {
+    root,
+    repository: location.repository,
+    remotes: location.remotes,
+    primary: location.intent?.primary ?? "unknown",
+    intent: location.intent,
+    intentError: location.intentError,
+    local: { ...location.hook, enabled: true, commands: [] },
+    workflows: [],
+    notes: location.notes
+  };
+  try {
+    const plan = resolveProjectCiPlan(root);
+    snapshot.local.enabled = plan.enabled;
+    snapshot.local.statusContext = plan.statusContext;
+    snapshot.local.commands = plan.commands;
+    const files = workflowFiles(root, plan);
+    snapshot.workflows = files.workflows;
+    snapshot.notes.push(...files.notes);
+  } catch {
+    snapshot.notes.push("The project verification plan could not be resolved.");
+    try {
+      const files = workflowFiles(root, {
+        commands: []
+      });
+      snapshot.workflows = files.workflows;
+      snapshot.notes.push(...files.notes);
+    } catch {
+    }
+  }
+  if (!snapshot.intent && snapshot.local.installed && snapshot.local.enabled)
+    snapshot.primary = "local";
+  if (options.remote && snapshot.repository) {
+    snapshot.remote = await inspectGitHubCi(
+      root,
+      snapshot.repository,
+      snapshot.workflows.filter((w) => w.validation).map((w) => w.path),
+      snapshot.intent,
+      options.runner,
+      snapshot.local.statusContext ?? null
+    );
+    if (!snapshot.intent && snapshot.remote.localRequired === "required")
+      snapshot.primary = "local";
+    else if (!snapshot.intent && snapshot.primary === "unknown" && snapshot.remote.workflows.some((w) => w.active))
+      snapshot.primary = "github-actions";
+  }
+  return snapshot;
+}
+function renderCiIntegration(snapshot, verbose = false) {
+  const lines = [];
+  if (snapshot.repository)
+    lines.push(
+      `CI repository: ${snapshot.repository}${snapshot.remote?.defaultBranch ? ` (${snapshot.remote.defaultBranch})` : ""}`
+    );
+  if (snapshot.intentError) lines.push(`CI configuration: ${snapshot.intentError}`);
+  lines.push(
+    `Local CI: ${snapshot.local.installed ? snapshot.local.executable ? "hook installed" : "hook is not executable" : "hook not installed"}${snapshot.local.enabled ? "" : "; disabled in configuration"}.`
+  );
+  if (snapshot.remote) {
+    for (const workflow of snapshot.remote.workflows) {
+      lines.push(
+        `GitHub Actions: ${workflow.path} (${workflow.active === void 0 ? "unknown" : workflow.active ? "active" : "not active"}).`
+      );
+      if (workflow.run)
+        lines.push(
+          `${workflow.run.event === "pull_request" ? "Observed PR run" : "Default-branch run"}: ${workflow.run.conclusion ?? workflow.run.status} at ${workflow.run.sha.slice(0, 12)} (${workflow.run.event}).`
+        );
+      else lines.push("Default-branch execution: not observed for the current head.");
+      lines.push(
+        `PR execution: ${workflow.prEvidence === "observed" ? "a PR run is recorded; this does not certify every current PR" : workflow.prEvidence === "not-observed" ? "not observed yet" : "unknown"}.`
+      );
+      lines.push(
+        `Selected CI checks: ${workflow.requiredChecks === "required" ? "required" : workflow.requiredChecks === "missing" ? "not required" : "requirements unknown"}${workflow.strict === void 0 ? "" : workflow.strict ? "; up-to-date policy observed" : "; up-to-date policy not observed"}.`
+      );
+      if (verbose && workflow.checks.length)
+        lines.push(
+          `Checks: ${workflow.checks.map((c) => `${c.name}: ${c.conclusion ?? c.status}`).join(", ")}`
+        );
+    }
+    if (snapshot.primary === "local" || snapshot.local.installed || snapshot.remote.localRequired === "required")
+      lines.push(
+        `Local CI check (checkout): ${snapshot.local.statusContext ?? "unknown"}; ${snapshot.remote.localRequired === "required" ? "required on GitHub" : snapshot.remote.localRequired === "missing" ? "not required on GitHub" : "GitHub requirement unknown"}${snapshot.remote.localStrict === void 0 ? "; up-to-date policy unknown" : snapshot.remote.localStrict ? "; up-to-date policy observed" : "; up-to-date policy not observed"}.`
+      );
+    lines.push(
+      `Pull requests: ${snapshot.remote.pullRequests === "required" ? "required" : snapshot.remote.pullRequests === "missing" ? "not required" : "requirement unknown"}.`
+    );
+    const layers = snapshot.remote.rulesets.map((r) => r.name ?? String(r.id));
+    if (layers.length)
+      lines.push(
+        `Host policy: ruleset ${layers.join(", ")}; owner changes must preserve other requirements.`
+      );
+    if (verbose && snapshot.remote.requiredContexts.length)
+      lines.push(`Existing required contexts: ${snapshot.remote.requiredContexts.join(", ")}`);
+    if (snapshot.remote.pullRequests !== "required" || snapshot.remote.workflows.some((w) => w.requiredChecks !== "required") || snapshot.primary === "local" && snapshot.remote.localRequired !== "required")
+      lines.push("Next: review CI and the remaining owner-controlled GitHub steps in build init.");
+    lines.push(...snapshot.remote.notes.map((n) => `Info: ${n}`));
+  } else if (snapshot.workflows.length) {
+    lines.push(
+      `CI workflow definitions: ${snapshot.workflows.map((w) => w.path).join(", ")}. GitHub activity and merge requirements not checked.`
+    );
+  } else lines.push("CI workflow: none detected; build init can review the available setup.");
+  if (verbose && snapshot.local.commands.length)
+    lines.push(`Local commands: ${snapshot.local.commands.join(" | ")}`);
+  lines.push(...snapshot.notes.map((note) => `Info: ${note}`));
+  return lines;
+}
+
+export {
+  createDefaultInspectionRunner,
+  ghApiGet,
+  isSpawnFailure,
+  firstLine,
+  asRecord,
+  asArray,
+  asString,
+  ghFailureNote,
+  classifyClassicProtection,
+  classifyRulesets,
+  inspectGitHubCi,
+  inspectCiIntegration,
+  renderCiIntegration
+};
+//# sourceMappingURL=chunk-S2XIMQJQ.js.map