@ever-works/github-actions-build-plugin 1.0.0

package/dist/index.js

@@ -0,0 +1,2271 @@
+import { APP_BUILD_WORKFLOW_PATH, APP_BUILD_RESTRICTED_VALUE_LITERAL, APP_BUILD_CHECK_NAME_PREFIX, sha256Hex, APP_BUILD_BRANCH_SLUG_MAX_CHARS, APP_BUILD_IMAGE_NAME, APP_BUILD_SECRET_PREFIX, APP_BUILD_CHECKS_MAX, APP_BUILD_VERIFY_PLAN_INPUT, resolveBuildServiceKind, resolveBuildServiceEnv, evaluateBuildServicePort, BUILD_SERVICE_DEFAULTS, APP_BUILD_VERIFY_TIMEOUT_MINUTES, APP_BUILD_RESULT_ARTIFACT_RETENTION_DAYS, APP_BUILD_RESULT_ARTIFACT_NAME, APP_BUILD_RESULT_ARTIFACT_FILE, APP_BUILD_WORKFLOW_BRANCH, APP_BUILD_VERIFY_PROMPTED_SECRET, APP_BUILD_SECRET_MAX_BYTES, computeBuildInputsHash, APP_BUILD_MAX_VALUES, APP_BUILD_DEPLOYABLE_TRIGGERS, APP_BUILD_CHECKS_MAX_PARALLEL, APP_BUILD_RESULT_MAX_BYTES, APP_BUILD_RUNNERS, appBuildRunnerCapacity, APP_BUILD_RUNNER_HEADROOM_GIB, APP_BUILD_CHECKS_JOB_ID } from '@ever-works/contracts';
+import { Octokit } from 'octokit';
+import { unzipSync } from 'fflate';
+import { createRequire } from 'module';
+
+// src/github-actions-build.plugin.ts
+
+// src/runs/actions-runs.port.ts
+function octokitActionsRunsPort(octokit) {
+  const asArray = (data, key) => {
+    const bag = data;
+    const list = bag?.[key];
+    return Array.isArray(list) ? list : [];
+  };
+  return {
+    async dispatchWorkflow({ repository, workflowFile, ref, inputs }) {
+      await octokit.request("POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches", {
+        owner: repository.owner,
+        repo: repository.repo,
+        workflow_id: workflowFile,
+        ref,
+        inputs
+      });
+    },
+    async listWorkflowRuns({ repository, workflowFile, perPage, headSha, event }) {
+      const params = {
+        owner: repository.owner,
+        repo: repository.repo,
+        workflow_id: workflowFile,
+        per_page: perPage
+      };
+      if (headSha) params.head_sha = headSha;
+      if (event) params.event = event;
+      const { data } = await octokit.request(
+        "GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs",
+        params
+      );
+      return asArray(data, "workflow_runs");
+    },
+    async getWorkflowRun({ repository, runId }) {
+      try {
+        const { data } = await octokit.request("GET /repos/{owner}/{repo}/actions/runs/{run_id}", {
+          owner: repository.owner,
+          repo: repository.repo,
+          run_id: runId
+        });
+        return data ?? null;
+      } catch (error) {
+        if (error.status === 404) return null;
+        throw error;
+      }
+    },
+    async listRunJobs({ repository, runId }) {
+      const { data } = await octokit.request("GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs", {
+        owner: repository.owner,
+        repo: repository.repo,
+        run_id: runId,
+        per_page: 100
+      });
+      return asArray(data, "jobs");
+    },
+    async cancelWorkflowRun({ repository, runId }) {
+      try {
+        await octokit.request("POST /repos/{owner}/{repo}/actions/runs/{run_id}/cancel", {
+          owner: repository.owner,
+          repo: repository.repo,
+          run_id: runId
+        });
+      } catch (error) {
+        if (error.status === 409) return;
+        throw error;
+      }
+    },
+    async listRunArtifacts({ repository, runId }) {
+      const { data } = await octokit.request("GET /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts", {
+        owner: repository.owner,
+        repo: repository.repo,
+        run_id: runId,
+        per_page: 100
+      });
+      return asArray(data, "artifacts");
+    },
+    async downloadJobLogTail({ repository, jobId, maxBytes }) {
+      const response = await octokit.request("GET /repos/{owner}/{repo}/actions/jobs/{job_id}/logs", {
+        owner: repository.owner,
+        repo: repository.repo,
+        job_id: jobId,
+        // A request, not a guarantee — the reader cuts again on arrival.
+        headers: { range: `bytes=-${maxBytes}` }
+      });
+      const data = response.data;
+      if (data === null || data === void 0) return null;
+      const bytes = typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
+      return { bytes, partial: response.status === 206 };
+    },
+    async downloadArtifactZip({ repository, artifactId }) {
+      const { data } = await octokit.request(
+        "GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/{archive_format}",
+        {
+          owner: repository.owner,
+          repo: repository.repo,
+          artifact_id: artifactId,
+          archive_format: "zip"
+        }
+      );
+      return new Uint8Array(data);
+    }
+  };
+}
+
+// src/runs/run-correlator.ts
+var DISPATCH_CLOCK_SKEW_MS = 5e3;
+var ADOPTION_WINDOW_MS = 3e5;
+var CORRELATION_PAGE_SIZE = 20;
+function titleNamesBuild(run, buildId) {
+  const title = (run.display_title ?? "").trim();
+  return title.length > 0 && buildId.length > 0 && title.includes(buildId);
+}
+function createdAtMs(run) {
+  const raw = run.created_at ?? run.run_started_at ?? null;
+  if (!raw) return null;
+  const at = Date.parse(raw);
+  return Number.isNaN(at) ? null : at;
+}
+async function correlateDispatchedRun(port, input) {
+  const runs = await port.listWorkflowRuns({
+    repository: input.repository,
+    workflowFile: input.workflowFile,
+    perPage: CORRELATION_PAGE_SIZE
+  });
+  const named = runs.filter((run) => titleNamesBuild(run, input.buildId));
+  if (named.length === 0) {
+    return { providerRunId: null, reason: "noMatch" };
+  }
+  const earliest = input.dispatchedAtMs - DISPATCH_CLOCK_SKEW_MS;
+  const latest = input.dispatchedAtMs + ADOPTION_WINDOW_MS;
+  for (const run of named) {
+    const created = createdAtMs(run);
+    if (created === null) continue;
+    if (created >= earliest && created <= latest) {
+      return { providerRunId: String(run.id) };
+    }
+  }
+  return { providerRunId: null, reason: "outsideWindow" };
+}
+var BUILD_JOB_NAME = "build";
+function isCheckJob(job) {
+  return (job.name ?? "").startsWith(APP_BUILD_CHECK_NAME_PREFIX);
+}
+function jobBillableMinutes(job) {
+  if (!job.started_at || !job.completed_at) return 0;
+  const started = Date.parse(job.started_at);
+  const completed = Date.parse(job.completed_at);
+  if (Number.isNaN(started) || Number.isNaN(completed) || completed <= started) return 0;
+  return Math.ceil((completed - started) / 6e4);
+}
+function toBuildRunStatus(status, conclusion) {
+  if (status !== "completed") {
+    return status === "in_progress" ? "running" : "queued";
+  }
+  switch (conclusion) {
+    case "success":
+      return "succeeded";
+    case "cancelled":
+      return "cancelled";
+    case null:
+    case void 0:
+      return "running";
+    default:
+      return "failed";
+  }
+}
+function toTrigger(run, mode) {
+  if (run.event === "push") return "push";
+  if (run.event === "pull_request") return "pull_request";
+  return mode === "verify" ? "verification" : "manual";
+}
+function failingStep(job) {
+  const step = (job?.steps ?? []).find(
+    (candidate) => candidate.conclusion === "failure" || candidate.conclusion === "timed_out"
+  );
+  if (!step) return null;
+  return { name: (step.name ?? "").trim(), number: Number(step.number ?? 0) };
+}
+function observeRun({ run, jobs, mode }) {
+  const buildJob2 = jobs.find((job) => job.name === BUILD_JOB_NAME);
+  const checkJobs = jobs.filter(isCheckJob);
+  const status = buildJob2 ? toBuildRunStatus(buildJob2.status ?? null, buildJob2.conclusion ?? null) : toBuildRunStatus(run.status ?? null, run.conclusion ?? null);
+  const billableMinutes = jobs.reduce((total, job) => total + jobBillableMinutes(job), 0);
+  const checksBillableMinutes = checkJobs.reduce((total, job) => total + jobBillableMinutes(job), 0);
+  const pullRequestNumber = (run.pull_requests ?? []).find((pr) => typeof pr?.number === "number")?.number;
+  const snapshot = {
+    providerRunId: String(run.id),
+    runAttempt: Number(run.run_attempt ?? 1),
+    status,
+    trigger: toTrigger(run, mode),
+    branch: run.head_branch ?? "",
+    // A pull-request run's `head_sha` IS the PR head — the commit the member
+    // pushed, and the one the image is built from.
+    commitSha: run.head_sha ?? ""
+  };
+  const conclusion = buildJob2 ? buildJob2.conclusion : run.conclusion;
+  if (conclusion) snapshot.conclusion = conclusion;
+  if (typeof pullRequestNumber === "number") snapshot.pullRequestNumber = pullRequestNumber;
+  if (run.run_started_at) snapshot.startedAt = run.run_started_at;
+  if (run.status === "completed" && run.updated_at) snapshot.completedAt = run.updated_at;
+  if (billableMinutes > 0) snapshot.billableMinutes = billableMinutes;
+  if (checkJobs.length > 0) snapshot.checksBillableMinutes = checksBillableMinutes;
+  const runnerLabel = (buildJob2?.labels ?? []).find((label) => label.trim().length > 0);
+  if (runnerLabel) snapshot.runnerLabel = runnerLabel;
+  if (run.html_url) snapshot.logsUrl = run.html_url;
+  return snapshot;
+}
+var RESULT_ARTIFACT_MAX_ZIP_BYTES = 65536;
+var RESULT_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+var ALLOWED_KEYS = /* @__PURE__ */ new Set(["digest", "imageRepository", "tags", "secretCheck", "smoke"]);
+function parseResultArtifact(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return { ok: false, refusal: "malformedJson" };
+  }
+  const bag = value;
+  const unknown = Object.keys(bag).filter((key) => !ALLOWED_KEYS.has(key));
+  if (unknown.length > 0) {
+    return { ok: false, refusal: "unknownKeys" };
+  }
+  const digest = typeof bag.digest === "string" ? bag.digest.trim() : "";
+  if (!RESULT_DIGEST_PATTERN.test(digest)) {
+    return { ok: false, refusal: "badDigest" };
+  }
+  const result = { digest };
+  if (typeof bag.imageRepository === "string" && bag.imageRepository.trim().length > 0) {
+    result.imageRepository = bag.imageRepository.trim();
+  }
+  if (Array.isArray(bag.tags)) {
+    result.tags = bag.tags.filter((tag) => typeof tag === "string");
+  }
+  if (bag.secretCheck === "passed" || bag.secretCheck === "failed" || bag.secretCheck === "not_needed") {
+    result.secretCheck = bag.secretCheck;
+  }
+  if (Array.isArray(bag.smoke)) {
+    result.smoke = bag.smoke.filter((row) => typeof row === "object" && row !== null).map((row) => ({ name: String(row.name ?? ""), passed: row.passed === true }));
+  }
+  return { ok: true, result };
+}
+async function readResultArtifact(port, input) {
+  const artifacts = await port.listRunArtifacts(input);
+  const artifact = artifacts.find((candidate) => candidate.name === APP_BUILD_RESULT_ARTIFACT_NAME);
+  if (!artifact) {
+    return { ok: false, refusal: "absent" };
+  }
+  if (artifact.expired === true) {
+    return { ok: false, refusal: "expired" };
+  }
+  if (typeof artifact.size_in_bytes === "number" && artifact.size_in_bytes > RESULT_ARTIFACT_MAX_ZIP_BYTES) {
+    return { ok: false, refusal: "zipTooLarge" };
+  }
+  const zip = await port.downloadArtifactZip({
+    repository: input.repository,
+    artifactId: artifact.id
+  });
+  if (zip.byteLength > RESULT_ARTIFACT_MAX_ZIP_BYTES) {
+    return { ok: false, refusal: "zipTooLarge" };
+  }
+  let entries;
+  try {
+    entries = unzipSync(zip);
+  } catch {
+    return { ok: false, refusal: "malformedJson" };
+  }
+  const entry = entries[APP_BUILD_RESULT_ARTIFACT_FILE];
+  if (!entry) {
+    return { ok: false, refusal: "entryMissing" };
+  }
+  if (entry.byteLength > APP_BUILD_RESULT_MAX_BYTES) {
+    return { ok: false, refusal: "entryTooLarge" };
+  }
+  let decoded;
+  try {
+    decoded = JSON.parse(new TextDecoder().decode(entry));
+  } catch {
+    return { ok: false, refusal: "malformedJson" };
+  }
+  return parseResultArtifact(decoded);
+}
+
+// src/runs/failure-classifier.ts
+var EXCERPT_MAX_LINES = 20;
+var EXCERPT_MAX_LINE_CHARS = 300;
+var MISSING_VALUE = /EW_MISSING:([A-Za-z0-9_]+)/g;
+var SECRET_IN_IMAGE = /EW_SECRET_IN_IMAGE:([A-Za-z0-9_]+)/g;
+var GIT_OBJECT_ID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+var BUILDKIT_STEP = /^#\d+\s+\[([^\]]*?)\s+(\d+)\/(\d+)\]\s+(.*)$/;
+var SIGNALS = [
+  { cls: "timeout", patterns: [/exceeded the maximum execution time/i] },
+  {
+    cls: "outOfMemory",
+    patterns: [
+      /exit code:\s*137/i,
+      /^\s*Killed\s*$/im,
+      /JavaScript heap out of memory/i,
+      /Reached heap limit/i,
+      /\bENOMEM\b/i
+    ]
+  },
+  { cls: "diskFull", patterns: [/No space left on device/i, /\bENOSPC\b/i] },
+  {
+    cls: "dependencyDownloadFailed",
+    patterns: [
+      /\bETIMEDOUT\b/i,
+      /\bECONNRESET\b/i,
+      /\bEAI_AGAIN\b/i,
+      /TLS handshake timeout/i,
+      /429 Too Many Requests/i,
+      /\btoomanyrequests\b/i
+    ]
+  },
+  { cls: "dockerfileError", patterns: [/ERROR: failed to solve/i, /dockerfile parse error/i] }
+];
+function namesIn(log, pattern) {
+  const names = /* @__PURE__ */ new Set();
+  for (const match of log.matchAll(pattern)) {
+    if (match[1]) names.add(match[1]);
+  }
+  return [...names];
+}
+function lineIndexOf(lines, patterns) {
+  for (let index = 0; index < lines.length; index += 1) {
+    if (patterns.some((pattern) => pattern.test(lines[index]))) return index;
+  }
+  return -1;
+}
+function buildExcerpt(lines, matchedIndex, redact) {
+  const end = matchedIndex >= 0 ? matchedIndex + 1 : lines.length;
+  const start = Math.max(0, end - EXCERPT_MAX_LINES);
+  return lines.slice(start, end).map((line) => line.slice(0, EXCERPT_MAX_LINE_CHARS)).map((line) => maskSecretShapes(redact(line)));
+}
+function maskSecretShapes(line) {
+  return line.replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "***").replace(/\bgithub_pat_[A-Za-z0-9_]{20,}/g, "***").replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{16,}/gi, "$1 ***").replace(/\b([A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|APIKEY|API_KEY)[A-Z0-9_]*)\s*[=:]\s*\S+/gi, "$1=***").replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s:/@]+:[^\s:/@]+@/gi, "$1***:***@").replace(/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, (run) => GIT_OBJECT_ID.test(run) ? run : "***");
+}
+function classifyFailure(input, redact = (text) => text) {
+  const log = input.log ?? "";
+  const lines = log.split(/\r?\n/);
+  const missing = namesIn(log, MISSING_VALUE);
+  if (missing.length > 0) {
+    return {
+      class: "missingBuildValue",
+      detail: { names: missing },
+      excerpt: buildExcerpt(lines, lineIndexOf(lines, [/EW_MISSING:/]), redact)
+    };
+  }
+  const leaked = namesIn(log, SECRET_IN_IMAGE);
+  if (leaked.length > 0) {
+    return {
+      class: "secretInImage",
+      detail: { names: leaked },
+      excerpt: buildExcerpt(lines, lineIndexOf(lines, [/EW_SECRET_IN_IMAGE:/]), redact)
+    };
+  }
+  const timedOutByConclusion = input.jobConclusion === "timed_out";
+  const timedOutByMessage = lineIndexOf(lines, [/exceeded the maximum execution time/i]);
+  if (timedOutByConclusion || timedOutByMessage >= 0) {
+    return {
+      class: "timeout",
+      ...typeof input.minutes === "number" ? { detail: { minutes: input.minutes } } : {},
+      excerpt: buildExcerpt(lines, timedOutByMessage, redact)
+    };
+  }
+  if (input.runConclusion === "startup_failure" || input.jobCount === 0) {
+    return { class: "workflowInvalid", excerpt: buildExcerpt(lines, -1, redact) };
+  }
+  for (const { cls, patterns } of SIGNALS) {
+    if (cls === "timeout") continue;
+    const index = lineIndexOf(lines, patterns);
+    if (index < 0) continue;
+    if (cls === "dockerfileError") {
+      return {
+        class: "dockerfileError",
+        detail: dockerfileDetail(lines),
+        excerpt: buildExcerpt(lines, index, redact)
+      };
+    }
+    return { class: cls, excerpt: buildExcerpt(lines, index, redact) };
+  }
+  if ((input.failingStepName ?? "").toLowerCase().includes("verify in the runner") && input.verification && input.verification.failed > 0) {
+    return {
+      class: "verificationFailed",
+      detail: { failed: input.verification.failed, total: input.verification.total },
+      excerpt: buildExcerpt(lines, -1, redact)
+    };
+  }
+  return { class: "unknown", excerpt: buildExcerpt(lines, -1, redact) };
+}
+function dockerfileDetail(lines) {
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const match = BUILDKIT_STEP.exec(lines[index].trim());
+    if (!match) continue;
+    return {
+      dockerfile: match[1],
+      step: Number(match[2]),
+      total: Number(match[3]),
+      command: match[4].slice(0, 120)
+    };
+  }
+  return {};
+}
+
+// src/runs/log-tail.ts
+var LOG_TAIL_MAX_BYTES = 2 * 1024 * 1024;
+async function readJobLogTail(port, input) {
+  if (typeof port.downloadJobLogTail !== "function") {
+    return "";
+  }
+  let tail;
+  try {
+    tail = await port.downloadJobLogTail({ ...input, maxBytes: LOG_TAIL_MAX_BYTES });
+  } catch {
+    return "";
+  }
+  if (!tail || tail.bytes.byteLength === 0) return "";
+  const bounded = tail.bytes.byteLength > LOG_TAIL_MAX_BYTES ? tail.bytes.slice(tail.bytes.byteLength - LOG_TAIL_MAX_BYTES) : tail.bytes;
+  const text = new TextDecoder("utf-8", { fatal: false }).decode(bounded);
+  if (!tail.partial) return text;
+  const firstBreak = text.indexOf("\n");
+  return firstBreak === -1 ? "" : text.slice(firstBreak + 1);
+}
+
+// src/runs/push-digest.ts
+var PUSH_STEP_SCRIPT_FIRST_LINE = 'docker push --all-tags "$EW_IMAGE"';
+var GROUP_PREFIX = "##[group]";
+var PUSH_STEP_HEADER = `${GROUP_PREFIX}Run ${PUSH_STEP_SCRIPT_FIRST_LINE}`;
+var RUNNER_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z /;
+var PUSH_DIGEST_LINE = /^(\S+): digest: (sha256:[a-f0-9]{64}) size: \d+$/;
+var FULL_SHA = /^[a-f0-9]{40}$/;
+function extractPushLogDigest(log, sha) {
+  if (!FULL_SHA.test(sha) || log.length === 0) return void 0;
+  const tag = `sha-${sha}`;
+  const digests = /* @__PURE__ */ new Set();
+  let inPushSection = false;
+  for (const line of log.split(/\r?\n/).map(contentOf)) {
+    if (line.startsWith(GROUP_PREFIX)) {
+      inPushSection = line === PUSH_STEP_HEADER;
+      continue;
+    }
+    if (!inPushSection) continue;
+    const match = PUSH_DIGEST_LINE.exec(line);
+    if (match && match[1] === tag) digests.add(match[2]);
+  }
+  return digests.size === 1 ? [...digests][0] : void 0;
+}
+function contentOf(raw) {
+  return raw.replace(/^\uFEFF/, "").replace(RUNNER_TIMESTAMP, "").trimEnd();
+}
+
+// src/registry/ghcr-access.ts
+var GITHUB_API_HOST = "https://api.github.com";
+var GHCR_HOST = "https://ghcr.io";
+var REQUIRED_PULL_TOKEN_SCOPE = "read:packages";
+var GHCR_TOKEN_USERNAME = "x-access-token";
+var MANIFEST_ACCEPT = [
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.oci.image.manifest.v1+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json",
+  "application/vnd.docker.distribution.manifest.v2+json"
+].join(", ");
+async function checkPullToken(token, fetchImpl) {
+  const response = await fetchImpl(`${GITHUB_API_HOST}/user`, {
+    method: "GET",
+    headers: {
+      authorization: `Bearer ${token}`,
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28"
+    },
+    redirect: "manual"
+  });
+  if (response.status === 401 || response.status === 403) {
+    return { ok: false, refusal: "pullTokenCannotRead" };
+  }
+  const raw = response.headers.get("x-oauth-scopes");
+  if (raw === null) {
+    return { ok: false, refusal: "pullTokenFineGrained" };
+  }
+  const scopes = raw.split(",").map((scope) => scope.trim()).filter((scope) => scope.length > 0);
+  if (scopes.length !== 1 || scopes[0] !== REQUIRED_PULL_TOKEN_SCOPE) {
+    return { ok: false, refusal: "pullTokenTooBroad" };
+  }
+  return { ok: true, expiresAt: response.headers.get("github-authentication-token-expiration") };
+}
+async function requestRegistryToken(name, fetchImpl, pullToken) {
+  const query = new URLSearchParams({ service: "ghcr.io", scope: `repository:${name}:pull` });
+  const headers = { accept: "application/json" };
+  if (pullToken) {
+    headers.authorization = `Basic ${Buffer.from(`${GHCR_TOKEN_USERNAME}:${pullToken}`, "utf-8").toString("base64")}`;
+  }
+  const response = await fetchImpl(`${GHCR_HOST}/token?${query.toString()}`, {
+    method: "GET",
+    headers,
+    redirect: "manual"
+  });
+  if (response.status !== 200) return null;
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    return null;
+  }
+  const candidate = body;
+  const token = candidate?.token ?? candidate?.access_token;
+  return typeof token === "string" && token.length > 0 ? token : null;
+}
+function headManifest(path, registryToken, fetchImpl) {
+  return fetchImpl(`${GHCR_HOST}${path}`, {
+    method: "HEAD",
+    headers: { accept: MANIFEST_ACCEPT, authorization: `Bearer ${registryToken}` },
+    redirect: "manual"
+  });
+}
+async function checkImageAccess(input, fetchImpl) {
+  const reference = parseGhcrReference(input.imageRepository, input.tag);
+  if (!reference) {
+    return { visibility: "unknown", readable: false };
+  }
+  const path = registryManifestPath(reference);
+  const anonymousToken = await requestRegistryToken(reference.name, fetchImpl);
+  const anonymous = anonymousToken ? await headManifest(path, anonymousToken, fetchImpl) : null;
+  if (anonymous?.status === 200) {
+    const digest2 = anonymous.headers.get("docker-content-digest");
+    return {
+      visibility: "public",
+      readable: true,
+      ...digest2 ? { digest: digest2 } : {}
+    };
+  }
+  if (!input.pullToken) {
+    return { visibility: "private", readable: false };
+  }
+  const tokenCheck = await checkPullToken(input.pullToken, fetchImpl);
+  const registryToken = await requestRegistryToken(reference.name, fetchImpl, input.pullToken);
+  const authenticated = registryToken ? await headManifest(path, registryToken, fetchImpl) : null;
+  const readable = authenticated?.status === 200;
+  const digest = readable ? authenticated.headers.get("docker-content-digest") : null;
+  return {
+    visibility: "private",
+    readable,
+    tokenScopesOk: tokenCheck.ok,
+    tokenExpiresAt: tokenCheck.ok ? tokenCheck.expiresAt : null,
+    ...digest ? { digest } : {}
+  };
+}
+function parseGhcrReference(imageRepository, tag) {
+  const repository = (imageRepository ?? "").trim().toLowerCase();
+  const reference = (tag ?? "").trim();
+  if (repository.length === 0 || reference.length === 0) return null;
+  const prefix = "ghcr.io/";
+  if (!repository.startsWith(prefix)) return null;
+  const name = repository.slice(prefix.length);
+  if (!/^[a-z0-9._-]+(\/[a-z0-9._-]+)+$/.test(name)) return null;
+  if (!/^[A-Za-z0-9._-]+$/.test(reference)) return null;
+  return { name, tag: reference };
+}
+function registryManifestPath(reference) {
+  return `/v2/${reference.name}/manifests/${reference.tag}`;
+}
+var RUNNER_TOO_SMALL = "runnerTooSmall";
+function largerRunnerOf(input) {
+  const label = (input.settings?.largerRunnerLabel ?? "").trim();
+  const memoryGiB = Number(input.settings?.largerRunnerMemoryGiB ?? 0);
+  if (label.length === 0 || !Number.isFinite(memoryGiB) || memoryGiB <= 0) {
+    return null;
+  }
+  const vcpu = Number(input.settings?.largerRunnerVcpu ?? 0);
+  return {
+    label,
+    runnerClass: "github-larger",
+    vcpu: Number.isFinite(vcpu) && vcpu > 0 ? vcpu : 0,
+    memoryGiB,
+    usableMemoryGiB: memoryGiB - APP_BUILD_RUNNER_HEADROOM_GIB
+  };
+}
+function hostedRunner(key) {
+  const runner = APP_BUILD_RUNNERS[key];
+  return {
+    label: runner.label,
+    runnerClass: runner.runnerClass,
+    vcpu: runner.vcpu,
+    memoryGiB: runner.memoryGiB,
+    usableMemoryGiB: appBuildRunnerCapacity(runner).memoryGiB
+  };
+}
+function selectRunner(input) {
+  const runner = input.visibility === "public" ? hostedRunner("githubPublic") : largerRunnerOf(input) ?? hostedRunner("githubPrivate");
+  const declaredMemory = input.resources?.memoryGiB;
+  const needsMemory = typeof declaredMemory === "number" && Number.isFinite(declaredMemory) && declaredMemory > 0;
+  if (needsMemory && declaredMemory > runner.usableMemoryGiB) {
+    return {
+      ok: false,
+      blocked: { reason: RUNNER_TOO_SMALL, needed: declaredMemory, max: runner.usableMemoryGiB }
+    };
+  }
+  const declaredVcpu = input.resources?.vcpu;
+  const overDeclaresCpu = typeof declaredVcpu === "number" && Number.isFinite(declaredVcpu) && runner.vcpu > 0 && declaredVcpu > runner.vcpu;
+  return {
+    ok: true,
+    runner: overDeclaresCpu ? { ...runner, cpuOverDeclared: { needed: declaredVcpu, max: runner.vcpu } } : runner
+  };
+}
+var RESOLVED_ON = "2026-09-18";
+var ACTION_PINS = {
+  /** `actions/checkout@v7.0.1`. */
+  checkout: {
+    action: "actions/checkout",
+    tag: "v7.0.1",
+    sha: "3d3c42e5aac5ba805825da76410c181273ba90b1",
+    resolvedOn: RESOLVED_ON
+  },
+  /** `docker/setup-buildx-action@v4.4.1`. */
+  setupBuildx: {
+    action: "docker/setup-buildx-action",
+    tag: "v4.4.1",
+    sha: "f87e5991a6d7451dcb8d9637bfbc97413f497069",
+    resolvedOn: RESOLVED_ON
+  },
+  /** `docker/login-action@v4.6.0`. */
+  login: {
+    action: "docker/login-action",
+    tag: "v4.6.0",
+    sha: "dbcb813823bdd20940b903addbd779551569679f",
+    resolvedOn: RESOLVED_ON
+  },
+  /** `docker/build-push-action@v7.4.0`. */
+  buildPush: {
+    action: "docker/build-push-action",
+    tag: "v7.4.0",
+    sha: "c3c9e263c25d99ce0380d002d59b67737d91b0dc",
+    resolvedOn: RESOLVED_ON
+  },
+  /** `actions/upload-artifact@v7.0.1`. */
+  uploadArtifact: {
+    action: "actions/upload-artifact",
+    tag: "v7.0.1",
+    sha: "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
+    resolvedOn: RESOLVED_ON
+  }
+};
+var ACTION_PIN_SHA_PATTERN = /^[0-9a-f]{40}$/;
+function actionPin(pin) {
+  return `${pin.action}@${pin.sha} # ${pin.tag}`;
+}
+function actionPinReference(pin) {
+  return `${pin.action}@${pin.sha}`;
+}
+function canonicalActionPins() {
+  const keys = Object.keys(ACTION_PINS).sort();
+  const canonical = {};
+  for (const key of keys) canonical[key] = actionPinReference(ACTION_PINS[key]);
+  return canonical;
+}
+var GENERATOR_RESERVED_LITERALS = [APP_BUILD_RESTRICTED_VALUE_LITERAL, APP_BUILD_CHECK_NAME_PREFIX];
+var CANONICAL_INPUT_FIELDS = [
+  "generator",
+  "bootstrap",
+  "trackedBranch",
+  "repository",
+  "appSpecHash",
+  "build",
+  "values",
+  "runner",
+  "settings",
+  "pins",
+  "verifyEnabled",
+  "checks",
+  "verifyRunnerScriptSha256"
+];
+function checkTimeoutMinutes(timeoutSeconds) {
+  return Math.max(1, Math.ceil(timeoutSeconds / 60));
+}
+function canonicalCheck(check) {
+  return {
+    name: check.name,
+    required: check.required,
+    timeoutMinutes: checkTimeoutMinutes(check.timeoutSeconds),
+    commandSha256: sha256Hex(check.command)
+  };
+}
+function canonicaliseWorkflowInputs(inputs) {
+  const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+  return {
+    ...inputs,
+    build: inputs.build === null ? null : {
+      ...inputs.build,
+      args: [...inputs.build.args].sort(
+        (left, right) => compare(left.name, right.name) || compare(left.value ?? "", right.value ?? "") || compare(left.fromEnv ?? "", right.fromEnv ?? "")
+      ),
+      services: [...inputs.build.services].map((service) => ({
+        ...service,
+        env: [...service.env].sort((left, right) => compare(left.name, right.name))
+      })).sort((left, right) => compare(left.name, right.name))
+    },
+    values: [...inputs.values].sort(
+      (left, right) => compare(left.name, right.name) || Number(left.secret) - Number(right.secret) || Number(left.fromBuildService) - Number(right.fromBuildService)
+    ),
+    checks: [...inputs.checks].sort((left, right) => compare(left.name, right.name)),
+    pins: canonicalActionPins()
+  };
+}
+function canonicalWorkflowJson(inputs) {
+  const canonical = canonicaliseWorkflowInputs(inputs);
+  const ordered = {};
+  for (const field of CANONICAL_INPUT_FIELDS) ordered[field] = canonical[field];
+  return JSON.stringify(ordered);
+}
+function computeWorkflowInputsHash(inputs) {
+  return `sha256:${sha256Hex(canonicalWorkflowJson(inputs))}`;
+}
+
+// src/workflow/checks-job.ts
+var CHECK_COMMAND_B64_ENV = "EW_CHECK_COMMAND_B64";
+function checkCommandB64(command) {
+  return Buffer.from(command, "utf8").toString("base64");
+}
+function checksJobName(name) {
+  return `${APP_BUILD_CHECK_NAME_PREFIX}${name}`;
+}
+function expressionStringLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function checksJobCondition(trackedBranch) {
+  return [
+    `github.event_name == 'pull_request'`,
+    `github.event.pull_request.head.repo.full_name == github.repository`,
+    `github.event.pull_request.base.ref == ${expressionStringLiteral(trackedBranch)}`
+  ].join(" && ");
+}
+function checkMatrixRow(check) {
+  return {
+    name: check.name,
+    required: check.required,
+    timeoutMinutes: checkTimeoutMinutes(check.timeoutSeconds),
+    commandB64: checkCommandB64(check.command)
+  };
+}
+function checksMatrix(checks) {
+  return checks.slice(0, APP_BUILD_CHECKS_MAX).map(checkMatrixRow);
+}
+function checksJob(input) {
+  const rows = checksMatrix(input.checks);
+  const lines = [];
+  lines.push(`  ${APP_BUILD_CHECKS_JOB_ID}:`);
+  lines.push(`    if: ${checksJobCondition(input.trackedBranch)}`);
+  lines.push(`    name: ${yamlString(checksJobName("${{ matrix.check.name }}"))}`);
+  lines.push(`    runs-on: ${yamlString(input.runnerLabel)}`);
+  lines.push(`    timeout-minutes: \${{ matrix.check.timeoutMinutes }}`);
+  lines.push(`    continue-on-error: \${{ !matrix.check.required }}`);
+  lines.push("    permissions: { contents: read }");
+  lines.push("    strategy:");
+  lines.push("      fail-fast: false");
+  lines.push(`      max-parallel: ${APP_BUILD_CHECKS_MAX_PARALLEL}`);
+  lines.push("      matrix:");
+  lines.push("        check:");
+  for (const row of rows) {
+    lines.push(
+      `          - { name: ${yamlString(row.name)}, required: ${row.required}, timeoutMinutes: ${row.timeoutMinutes}, commandB64: ${yamlString(row.commandB64)} }`
+    );
+  }
+  lines.push("    steps:");
+  lines.push(`      - uses: ${actionPin(ACTION_PINS.checkout)}`);
+  lines.push("        with:");
+  lines.push(
+    `          ref: ${yamlString("${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}")}`
+  );
+  lines.push("          fetch-depth: 1");
+  lines.push("          persist-credentials: false");
+  lines.push("          lfs: false");
+  lines.push("      - name: Run check");
+  lines.push("        env:");
+  lines.push(`          ${CHECK_COMMAND_B64_ENV}: ${yamlString("${{ matrix.check.commandB64 }}")}`);
+  lines.push(
+    `        run: printf '%s' "$${CHECK_COMMAND_B64_ENV}" | base64 -d > "$RUNNER_TEMP/ew-check.sh" && bash -e "$RUNNER_TEMP/ew-check.sh"`
+  );
+  return lines;
+}
+
+// src/workflow/verify-runner.sh.ts
+var EMBEDDED_VERIFY_RUNNER_SCRIPT = [
+  "set -euo pipefail",
+  'echo "EW_VERIFY_NOT_IMPLEMENTED: the runner verification script is not embedded yet (APW-05 T15, plan \xA74.10)." >&2',
+  "exit 70"
+].join("\n");
+
+// src/workflow/generator.ts
+function yamlString(value) {
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(
+    /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g,
+    (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+  return `"${escaped}"`;
+}
+function scalarBlock(lines, indent) {
+  const pad = " ".repeat(indent);
+  return lines.map((line) => line.length === 0 ? "" : `${pad}${line}`);
+}
+function branchSlug(branch) {
+  return branch.toLowerCase().replace(/[^a-z0-9._-]/g, "-").replace(/-{2,}/g, "-").slice(0, APP_BUILD_BRANCH_SLUG_MAX_CHARS);
+}
+function buildImageRepository(repository) {
+  return `ghcr.io/${repository.owner.toLowerCase()}/${repository.repo.toLowerCase()}/${APP_BUILD_IMAGE_NAME}`;
+}
+function secretNamesFor(values) {
+  return values.filter((value) => value.secret && !value.fromBuildService).map((value) => `${APP_BUILD_SECRET_PREFIX}${value.name}`).sort();
+}
+function fromEnvNames(build) {
+  return build.args.map((arg) => arg.fromEnv).filter((name) => typeof name === "string");
+}
+function normaliseBuildBlock(build) {
+  return {
+    strategy: build.strategy,
+    context: build.context?.trim() || ".",
+    dockerfile: build.dockerfile?.trim() || "Dockerfile",
+    ...build.target?.trim() ? { target: build.target.trim() } : {},
+    args: build.args.map((arg) => ({
+      name: arg.name,
+      ...arg.value === void 0 ? {} : { value: arg.value },
+      ...arg.fromEnv === void 0 ? {} : { fromEnv: arg.fromEnv }
+    })),
+    services: build.services.map((service) => ({
+      name: service.name,
+      image: service.image,
+      ...service.port === void 0 ? {} : { port: service.port },
+      env: (service.env ?? []).map((entry) => ({ name: entry.name, value: entry.value }))
+    })),
+    resources: {
+      cpu: build.resources.cpu,
+      ...build.resources.memoryGiB === void 0 ? {} : { memoryGiB: build.resources.memoryGiB },
+      timeoutMinutes: build.resources.timeoutMinutes
+    }
+  };
+}
+function canonicalInputsFor(input, verifyRunnerScript) {
+  const bootstrap = input.bootstrap === true;
+  const build = input.build ? normaliseBuildBlock(input.build) : null;
+  return {
+    generator: 1,
+    bootstrap,
+    trackedBranch: input.trackedBranch,
+    repository: input.repository,
+    appSpecHash: input.appSpecHash,
+    build: bootstrap ? null : build,
+    values: input.values.map((value) => ({
+      name: value.name,
+      secret: value.secret,
+      fromBuildService: value.fromBuildService
+    })),
+    runner: input.runner,
+    settings: {
+      reclaimDisk: input.settings?.reclaimDisk !== false,
+      // Plan §4.5/§4.4: attestations is **effective** — a private repository
+      // never gets the permissions, whatever the setting says (`APW05-G07`).
+      attestations: input.settings?.attestations === true && input.repository.visibility === "public",
+      allowBuildValuesOnPullRequests: input.settings?.allowBuildValuesOnPullRequests === true,
+      verificationPromptedValuesRequireApproval: input.settings?.verificationPromptedValuesRequireApproval !== false
+    },
+    pins: {},
+    verifyEnabled: input.verifyEnabled,
+    checks: (input.checks ?? []).slice(0, APP_BUILD_CHECKS_MAX).map(canonicalCheck),
+    verifyRunnerScriptSha256: sha256Hex(verifyRunnerScript)
+  };
+}
+function workflowHeader(inputsHash) {
+  return [
+    "# Generated by Ever Works from .works/works.yml. Do not edit: hand edits are never overwritten;",
+    "# Ever Works proposes changes to this file as pull requests.",
+    `# ever-works-build generator=1 inputs=${inputsHash}`
+  ];
+}
+function checksOnlyFile(input) {
+  if (input.bootstrap === true) return false;
+  const strategy = input.build?.strategy ?? null;
+  return strategy === null || strategy === "image" || strategy === "none";
+}
+function generateWorkflow(input) {
+  const verifyRunnerScript = input.verifyRunnerScript ?? EMBEDDED_VERIFY_RUNNER_SCRIPT;
+  const canonical = canonicalInputsFor(input, verifyRunnerScript);
+  const inputHash = computeWorkflowInputsHash(canonical);
+  const build = canonical.build;
+  const bootstrap = canonical.bootstrap;
+  const slug = branchSlug(canonical.trackedBranch);
+  const image = buildImageRepository(canonical.repository);
+  const runnerLabel = canonical.runner.label;
+  const secretNames = secretNamesFor(input.values);
+  const checks = bootstrap ? [] : input.checks ?? [];
+  if (checksOnlyFile(input)) {
+    if (checks.length === 0) return "";
+    return checksOnlyWorkflow({ inputHash, trackedBranch: canonical.trackedBranch, checks, runnerLabel });
+  }
+  const lines = [...workflowHeader(inputHash)];
+  lines.push("name: Ever Works build");
+  lines.push(
+    `run-name: ${yamlString("Ever Works build ${{ inputs.ew_build_id || github.event.pull_request.head.sha || github.sha }}")}`
+  );
+  lines.push("on:");
+  if (!bootstrap) {
+    lines.push("  push:");
+    lines.push(`    branches: [${yamlString(canonical.trackedBranch)}]`);
+    lines.push("  pull_request:");
+    lines.push(`    branches: [${yamlString(canonical.trackedBranch)}]`);
+    lines.push("    types: [opened, synchronize, reopened]");
+  }
+  lines.push("  workflow_dispatch:");
+  lines.push("    inputs:");
+  lines.push("      ew_build_id:");
+  lines.push("        type: string");
+  lines.push("        required: true");
+  lines.push("      ew_sha:");
+  lines.push("        type: string");
+  lines.push("        required: true");
+  lines.push("      ew_mode:");
+  lines.push("        type: choice");
+  lines.push("        options: [build, verify]");
+  lines.push("        default: build");
+  lines.push(`      ${APP_BUILD_VERIFY_PLAN_INPUT}:`);
+  lines.push("        type: string");
+  lines.push("        required: false");
+  lines.push(`        default: ${yamlString("")}`);
+  lines.push("      ew_reuse_digest:");
+  lines.push("        type: string");
+  lines.push("        required: false");
+  lines.push(`        default: ${yamlString("")}`);
+  lines.push("permissions: {}");
+  lines.push(...concurrencyLines("dispatch"));
+  lines.push("jobs:");
+  if (!bootstrap && build) {
+    lines.push(...buildJob({ canonical, build, image, slug, runnerLabel, secretNames, verifyRunnerScript }));
+  }
+  lines.push(...verifyJob({ build, image, runnerLabel, verifyRunnerScript }));
+  if (checks.length > 0) {
+    lines.push(...checksJob({ checks, trackedBranch: canonical.trackedBranch, runnerLabel }));
+  }
+  return `${lines.join("\n")}
+`;
+}
+function concurrencyLines(shape) {
+  if (shape === "checksOnly") {
+    return [
+      "concurrency:",
+      `  group: ${yamlString(
+        "ever-works-build-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('push-{0}', github.sha) }}"
+      )}`,
+      // `true` as the draft has it: a checks-only file runs for pull requests
+      // only, so a newer run of the same pull request always supersedes the one
+      // in flight — which is what the full file's `github.event_name ==
+      // 'pull_request'` expression amounts to for that trigger set.
+      "  cancel-in-progress: true"
+    ];
+  }
+  return [
+    "concurrency:",
+    `  group: ${yamlString(
+      "${{ inputs.ew_mode == 'verify' && format('verify-{0}', inputs.ew_build_id) || format('ever-works-build-{0}', github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref_name) }}"
+    )}`,
+    `  cancel-in-progress: \${{ github.event_name == 'pull_request' }}`
+  ];
+}
+function checksOnlyWorkflow(input) {
+  const lines = [...workflowHeader(input.inputHash)];
+  lines.push("name: Ever Works build");
+  lines.push("on:");
+  lines.push("  pull_request:");
+  lines.push(`    branches: [${yamlString(input.trackedBranch)}]`);
+  lines.push("    types: [opened, synchronize, reopened]");
+  lines.push("permissions: {}");
+  lines.push(...concurrencyLines("checksOnly"));
+  lines.push("jobs:");
+  lines.push(
+    ...checksJob({
+      checks: input.checks,
+      trackedBranch: input.trackedBranch,
+      runnerLabel: input.runnerLabel
+    })
+  );
+  return `${lines.join("\n")}
+`;
+}
+function buildJob(job) {
+  const { canonical, build, image, slug, runnerLabel, secretNames } = job;
+  const lines = [];
+  const attestations = canonical.settings.attestations;
+  const fromEnv = build.args.map((arg) => arg.fromEnv).filter((name) => typeof name === "string");
+  const restricted = !canonical.settings.allowBuildValuesOnPullRequests;
+  lines.push("  build:");
+  lines.push(
+    `    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && inputs.ew_mode != 'verify'`
+  );
+  lines.push(`    runs-on: ${yamlString(runnerLabel)}`);
+  lines.push(`    timeout-minutes: ${build.resources.timeoutMinutes}`);
+  lines.push(
+    `    permissions: { contents: read, packages: write${attestations ? ", attestations: write, id-token: write" : ""} }`
+  );
+  if (build.services.length > 0) {
+    lines.push("    services:");
+    for (const service of build.services) lines.push(...serviceLines(service));
+  }
+  lines.push("    env:");
+  lines.push(`      EW_IMAGE: ${yamlString(image)}`);
+  lines.push(
+    `      EW_SHA: ${yamlString("${{ inputs.ew_sha || github.event.pull_request.head.sha || github.sha }}")}`
+  );
+  lines.push(`      EW_SECRET_NAMES: ${yamlString(secretNames.join(" "))}`);
+  lines.push("    steps:");
+  if (fromEnv.length > 0) {
+    lines.push("      - name: Check build values");
+    if (restricted) lines.push(`        if: github.event_name != 'pull_request'`);
+    lines.push("        env:");
+    for (const name of fromEnv) {
+      lines.push(
+        `          ${APP_BUILD_SECRET_PREFIX}${name}: ${yamlString(`\${{ secrets.${APP_BUILD_SECRET_PREFIX}${name} }}`)}`
+      );
+    }
+    lines.push("        run: |");
+    const checkNames = fromEnv.map((name) => `${APP_BUILD_SECRET_PREFIX}${name}`).join(" ");
+    lines.push(
+      ...scalarBlock(
+        [
+          "set -euo pipefail",
+          `for name in ${checkNames}; do`,
+          '  [ -n "${!name:-}" ] || { echo "EW_MISSING:${name#EW_}"; exit 78; }',
+          "done"
+        ],
+        10
+      )
+    );
+  }
+  lines.push(`      - uses: ${actionPin(ACTION_PINS.checkout)}`);
+  lines.push("        with:");
+  lines.push(`          ref: ${yamlString("${{ env.EW_SHA }}")}`);
+  lines.push("          fetch-depth: 1");
+  lines.push("          persist-credentials: false");
+  lines.push("          lfs: false");
+  if (canonical.settings.reclaimDisk) {
+    lines.push("      - name: Reclaim runner disk");
+    lines.push(
+      "        run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL"
+    );
+  }
+  const waitPorts = build.services.filter((service) => resolveBuildServiceKind(service.image) === null).map((service) => service.port).filter((port) => typeof port === "number");
+  if (waitPorts.length > 0) {
+    lines.push("      - name: Wait for the build services");
+    lines.push("        run: |");
+    lines.push(
+      ...scalarBlock(
+        [
+          "set -euo pipefail",
+          `for port in ${waitPorts.join(" ")}; do`,
+          "  deadline=$((SECONDS + 60))",
+          '  until (echo > "/dev/tcp/127.0.0.1/$port") 2>/dev/null; do',
+          '    [ "$SECONDS" -lt "$deadline" ] || { echo "EW_SERVICE_TIMEOUT:$port"; exit 78; }',
+          "  done",
+          "done"
+        ],
+        10
+      )
+    );
+  }
+  lines.push(`      - uses: ${actionPin(ACTION_PINS.setupBuildx)}`);
+  if (build.services.length > 0) {
+    lines.push("        with:");
+    lines.push(`          buildkitd-flags: ${yamlString("--allow-insecure-entitlement network.host")}`);
+  }
+  lines.push(`      - uses: ${actionPin(ACTION_PINS.login)}`);
+  lines.push("        with:");
+  lines.push("          registry: ghcr.io");
+  lines.push(`          username: ${yamlString("${{ github.actor }}")}`);
+  lines.push(`          password: ${yamlString("${{ secrets.GITHUB_TOKEN }}")}`);
+  lines.push("      - id: build");
+  lines.push(`        if: inputs.ew_mode != 'verify'`);
+  lines.push(`        uses: ${actionPin(ACTION_PINS.buildPush)}`);
+  lines.push("        with:");
+  lines.push(`          context: ${yamlString(build.context)}`);
+  lines.push(`          file: ${yamlString(`${build.context}/${build.dockerfile}`)}`);
+  if (build.target) lines.push(`          target: ${yamlString(build.target)}`);
+  lines.push("          load: true");
+  lines.push("          push: false");
+  lines.push("          provenance: false");
+  if (build.services.length > 0) {
+    lines.push("          network: host");
+    lines.push("          allow: network.host");
+  }
+  if (build.args.length > 0) {
+    lines.push("          build-args: |");
+    lines.push(
+      ...scalarBlock(
+        build.args.map(
+          (arg) => arg.fromEnv === void 0 ? `${arg.name}=${arg.value ?? ""}` : `${arg.name}=${restrictedValueExpression(arg.fromEnv, restricted)}`
+        ),
+        12
+      )
+    );
+  }
+  lines.push("          tags: |");
+  lines.push(
+    ...scalarBlock(
+      [
+        `\${{ env.EW_IMAGE }}:sha-\${{ env.EW_SHA }}`,
+        `\${{ env.EW_IMAGE }}:\${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'branch-${slug}' }}`
+      ],
+      12
+    )
+  );
+  lines.push("          labels: |");
+  lines.push(
+    ...scalarBlock(
+      [
+        "org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}",
+        "org.opencontainers.image.revision=${{ env.EW_SHA }}",
+        `io.ever-works.app-spec-hash=${canonical.appSpecHash}`
+      ],
+      12
+    )
+  );
+  lines.push("          cache-from: type=registry,ref=${{ env.EW_IMAGE }}:buildcache");
+  lines.push(
+    `          cache-to: \${{ github.event_name == 'push' && format('type=registry,ref={0}:buildcache,mode=max', env.EW_IMAGE) || '' }}`
+  );
+  if (secretNames.length > 0) {
+    lines.push("      - name: Check the image for secret build values");
+    lines.push("        id: secretcheck");
+    lines.push(`        if: inputs.ew_mode != 'verify'`);
+    lines.push("        env:");
+    for (const name of secretNames) {
+      lines.push(`          ${name}: ${yamlString(`\${{ secrets.${name} }}`)}`);
+    }
+    lines.push("        run: |");
+    lines.push(
+      ...scalarBlock(
+        [
+          "set -euo pipefail",
+          `docker image inspect "$EW_IMAGE:sha-$EW_SHA" > "$RUNNER_TEMP/ew-image.json"`,
+          `docker history --no-trunc --format '{{.CreatedBy}}' "$EW_IMAGE:sha-$EW_SHA" >> "$RUNNER_TEMP/ew-image.json"`,
+          "for name in $EW_SECRET_NAMES; do",
+          '  value="${!name:-}"',
+          '  [ "${#value}" -ge 8 ] || continue',
+          '  if grep -qF -- "$value" "$RUNNER_TEMP/ew-image.json"; then echo "EW_SECRET_IN_IMAGE:${name#EW_}"; exit 79; fi',
+          "done",
+          'echo "secret-check: passed"'
+        ],
+        10
+      )
+    );
+  }
+  lines.push("      - name: Push");
+  lines.push(`        if: inputs.ew_mode != 'verify'`);
+  lines.push("        run: |");
+  lines.push(
+    ...scalarBlock(
+      [
+        'docker push --all-tags "$EW_IMAGE"',
+        `docker image inspect --format '{{index .RepoDigests 0}}' "$EW_IMAGE:sha-$EW_SHA" > ew-digest.txt`
+      ],
+      10
+    )
+  );
+  lines.push(...verifyInRunnerStep(job.verifyRunnerScript));
+  lines.push(...resultStep("build", secretNames.length > 0));
+  lines.push(...uploadArtifactStep());
+  return lines;
+}
+function restrictedValueExpression(name, restricted) {
+  const secret = `secrets.${APP_BUILD_SECRET_PREFIX}${name}`;
+  return restricted ? `\${{ github.event_name == 'pull_request' && '${APP_BUILD_RESTRICTED_VALUE_LITERAL}' || ${secret} }}` : `\${{ ${secret} }}`;
+}
+function serviceLines(service) {
+  const kind = resolveBuildServiceKind(service.image);
+  const lines = [`      ${service.name}:`, `        image: ${yamlString(service.image)}`];
+  const env = kind === null ? Object.fromEntries(service.env.map((entry) => [entry.name, entry.value])) : resolveBuildServiceEnv(kind, service.env);
+  const names = Object.keys(env).sort();
+  if (names.length > 0) {
+    lines.push("        env:");
+    for (const name of names) lines.push(`          ${name}: ${yamlString(env[name])}`);
+  }
+  const port = evaluateBuildServicePort(service);
+  if (!port.ok) {
+    lines.push("        ports: []");
+    return lines;
+  }
+  lines.push(`        ports: [${yamlString(port.published)}]`);
+  if (kind === null) return lines;
+  const health = BUILD_SERVICE_DEFAULTS[kind].health;
+  const command = health.kind === "command" ? health.command.replace("<user>", env.POSTGRES_USER ?? "").replace("<db>", env.POSTGRES_DB ?? "") : `curl -fsS http://localhost:${BUILD_SERVICE_DEFAULTS[kind].containerPort}${health.kind === "http" ? health.path : ""}`;
+  lines.push(
+    `        options: ${yamlString(
+      `--health-cmd "${command}" --health-interval 10s --health-timeout 5s --health-retries 5`
+    )}`
+  );
+  return lines;
+}
+function verifyJob(job) {
+  const { build, image, runnerLabel, verifyRunnerScript } = job;
+  const buildTimeout = build?.resources.timeoutMinutes ?? 0;
+  const services = build?.services ?? [];
+  const lines = [];
+  lines.push("  verify:");
+  lines.push(`    if: github.event_name == 'workflow_dispatch' && inputs.ew_mode == 'verify'`);
+  lines.push(`    runs-on: ${yamlString(runnerLabel)}`);
+  lines.push(`    timeout-minutes: ${buildTimeout + APP_BUILD_VERIFY_TIMEOUT_MINUTES}`);
+  lines.push("    permissions: { contents: read, packages: read }");
+  lines.push("    env:");
+  lines.push(`      EW_IMAGE: ${yamlString(image)}`);
+  lines.push(`      EW_SHA: ${yamlString("${{ inputs.ew_sha }}")}`);
+  lines.push(`      EW_REUSE_DIGEST: ${yamlString("${{ inputs.ew_reuse_digest }}")}`);
+  lines.push("    steps:");
+  lines.push(`      - uses: ${actionPin(ACTION_PINS.checkout)}`);
+  lines.push("        with:");
+  lines.push(`          ref: ${yamlString("${{ inputs.ew_sha }}")}`);
+  lines.push("          fetch-depth: 1");
+  lines.push("          persist-credentials: false");
+  lines.push("          lfs: false");
+  lines.push(`      - uses: ${actionPin(ACTION_PINS.setupBuildx)}`);
+  if (services.length > 0) {
+    lines.push("        with:");
+    lines.push(`          buildkitd-flags: ${yamlString("--allow-insecure-entitlement network.host")}`);
+  }
+  lines.push(`      - uses: ${actionPin(ACTION_PINS.login)}`);
+  lines.push("        with:");
+  lines.push("          registry: ghcr.io");
+  lines.push(`          username: ${yamlString("${{ github.actor }}")}`);
+  lines.push(`          password: ${yamlString("${{ secrets.GITHUB_TOKEN }}")}`);
+  lines.push("      - name: Take the image to verify");
+  lines.push("        run: |");
+  lines.push(
+    ...scalarBlock(
+      [
+        "set -euo pipefail",
+        'plan="$RUNNER_TEMP/ew-verify-plan.json"',
+        `plan_b64="$(printf '%s' "\${{ inputs.${APP_BUILD_VERIFY_PLAN_INPUT} }}" | tr '_-' '/+')"`,
+        'case $(( ${#plan_b64} % 4 )) in 2) plan_b64="${plan_b64}==" ;; 3) plan_b64="${plan_b64}=" ;; esac',
+        `printf '%s' "$plan_b64" | base64 -d > "$plan"`,
+        `printf 'EW_VERIFY_BUILD=%s\\n' "$(jq -r '.build // empty | @base64' "$plan")" >> "$GITHUB_ENV"`,
+        'if [ -n "$EW_REUSE_DIGEST" ]; then',
+        '  docker pull "$EW_IMAGE@$EW_REUSE_DIGEST"',
+        "  exit 0",
+        "fi",
+        '[ -n "$EW_VERIFY_BUILD" ] || { echo "EW_VERIFY_NO_BUILD"; exit 78; }',
+        `context="$(jq -r '.build.context // "."' "$plan")"`,
+        `dockerfile="$(jq -r '.build.dockerfile // "Dockerfile"' "$plan")"`,
+        `target="$(jq -r '.build.target // empty' "$plan")"`,
+        'buildx_args=(--load --file "$context/$dockerfile" --cache-from "$EW_IMAGE:buildcache" --tag ew-verify:local)',
+        'if [ -n "$target" ]; then buildx_args+=(--target "$target"); fi',
+        "while IFS= read -r entry; do",
+        '  [ -n "$entry" ] || continue',
+        '  buildx_args+=(--build-arg "$entry")',
+        `done < <(jq -r '(.build.args // [])[] | select(.value != null) | "\\(.name)=\\(.value)"' "$plan")`,
+        'docker buildx build "${buildx_args[@]}" "$context"'
+      ],
+      10
+    )
+  );
+  lines.push(...verifyInRunnerStep(verifyRunnerScript));
+  lines.push(...resultStep("verify", false));
+  lines.push(...uploadArtifactStep());
+  return lines;
+}
+function verifyInRunnerStep(verifyRunnerScript) {
+  return [
+    "      - name: Verify in the runner",
+    `        if: inputs.${APP_BUILD_VERIFY_PLAN_INPUT} != ''`,
+    `        timeout-minutes: ${APP_BUILD_VERIFY_TIMEOUT_MINUTES}`,
+    "        run: |",
+    ...scalarBlock(verifyRunnerScript.replace(/\n+$/, "").split("\n"), 10)
+  ];
+}
+function resultStep(job, secretCheckPresent) {
+  const script = job === "build" ? [
+    "set -euo pipefail",
+    'digest=""',
+    `[ ! -f ew-digest.txt ] || digest="$(tr -d '[:space:]' < ew-digest.txt)"`,
+    `secret_check="not_needed"`,
+    ...secretCheckPresent ? [
+      `if [ -n "$EW_SECRET_NAMES" ]; then`,
+      `  secret_check="passed"`,
+      `  [ "\${{ steps.secretcheck.outcome }}" != "failure" ] || secret_check="failed"`,
+      `fi`
+    ] : [],
+    `jq -n --arg buildId "\${{ inputs.ew_build_id }}" --arg sha "$EW_SHA" \\`,
+    `  --arg imageRepository "$EW_IMAGE" --arg digest "$digest" --arg secretCheck "$secret_check" \\`,
+    `  --arg tag "$EW_IMAGE:sha-$EW_SHA" \\`,
+    `  '{schema:"ever-works-build-result",version:1,buildId:$buildId,sha:$sha,imageRepository:$imageRepository,'`,
+    `    digest:$digest,tags:[$tag],secretCheck:$secretCheck,verification:{jobs:[],smoke:[]}}' > ${APP_BUILD_RESULT_ARTIFACT_FILE}`
+  ] : [
+    "set -euo pipefail",
+    `reused_digest="$EW_REUSE_DIGEST"`,
+    `local_build=true`,
+    `[ -z "$reused_digest" ] || local_build=false`,
+    `jq -n --arg buildId "\${{ inputs.ew_build_id }}" --arg sha "$EW_SHA" \\`,
+    `  --arg imageRepository "$EW_IMAGE" --arg reusedDigest "$reused_digest" \\`,
+    `  --argjson localBuild "$local_build" \\`,
+    `  '{schema:"ever-works-build-result",version:1,buildId:$buildId,sha:$sha,imageRepository:$imageRepository,'`,
+    `    reusedDigest:$reusedDigest,localBuild:$localBuild,verification:{jobs:[],smoke:[]}}' > ${APP_BUILD_RESULT_ARTIFACT_FILE}`
+  ];
+  return ["      - name: Write result", "        if: always()", "        run: |", ...scalarBlock(script, 10)];
+}
+function uploadArtifactStep() {
+  return [
+    `      - uses: ${actionPin(ACTION_PINS.uploadArtifact)}`,
+    "        if: always()",
+    "        with:",
+    `          name: ${yamlString(APP_BUILD_RESULT_ARTIFACT_NAME)}`,
+    `          path: ${yamlString(APP_BUILD_RESULT_ARTIFACT_FILE)}`,
+    `          retention-days: ${APP_BUILD_RESULT_ARTIFACT_RETENTION_DAYS}`,
+    "          if-no-files-found: ignore"
+  ];
+}
+
+// src/repo/branch-protection.ts
+var BRANCH_RULES_PAGE_SIZE = 100;
+var BRANCH_RULES_MAX_PAGES = 10;
+var BRANCH_PROTECTION_RULE_TYPES = ["pull_request", "required_status_checks"];
+function isActiveRule(rule) {
+  return rule.enforcement === void 0 || rule.enforcement === "active";
+}
+async function isBranchProtected(port, coordinates) {
+  const classic = await port.readBranchProtection(coordinates);
+  if (!classic.ok && classic.status === 403) return { protected: true, decision: "forbidden" };
+  if (classic.ok) {
+    if (classic.data?.required_pull_request_reviews !== void 0 && classic.data?.required_pull_request_reviews !== null) {
+      return { protected: true, decision: "requiredPullRequestReviews" };
+    }
+    if (classic.data?.required_status_checks !== void 0 && classic.data?.required_status_checks !== null) {
+      return { protected: true, decision: "requiredStatusChecks" };
+    }
+  }
+  for (let page = 1; page <= BRANCH_RULES_MAX_PAGES; page += 1) {
+    const rules = await port.readBranchRules({ ...coordinates, page });
+    if (!rules.ok) return { protected: false, decision: "none" };
+    const page1 = rules.data ?? [];
+    for (const rule of page1) {
+      if (!isActiveRule(rule)) continue;
+      if (rule.type === "pull_request") return { protected: true, decision: "rulesetPullRequest" };
+      if (rule.type === "required_status_checks") return { protected: true, decision: "rulesetStatusChecks" };
+    }
+    if (page1.length < BRANCH_RULES_PAGE_SIZE) break;
+  }
+  return { protected: false, decision: "none" };
+}
+
+// src/repo/workflow-writer.ts
+var WORKFLOW_COMMIT_MESSAGE_ADD = "Add Ever Works build workflow";
+var WORKFLOW_COMMIT_MESSAGE_UPDATE = "Update Ever Works build workflow";
+var WORKFLOW_COMMIT_MESSAGE_REMOVE = "Remove Ever Works build workflow";
+var WORKFLOW_PULL_REQUEST_TITLE = "Add Ever Works build workflow";
+var WORKFLOW_REMOVAL_PULL_REQUEST_TITLE = "Remove the Ever Works build workflow";
+var WORKFLOW_PULL_REQUEST_BODY = "Ever Works generated this workflow from the App spec. It builds the image for this App Work on GitHub-hosted runners and publishes it to GHCR. Hand edits to this file are never overwritten: Ever Works proposes its changes as pull requests.";
+var WORKFLOW_REMOVAL_PULL_REQUEST_BODY = "Ever Works generated this workflow from the App spec. The App spec no longer declares a build or a check, so this pull request removes every job from it. Merge it to remove the workflow, or delete the file outright \u2014 Ever Works never writes to the tracked branch to remove a file.";
+var WORKFLOW_WRITE_MAX_ATTEMPTS = 3;
+var WORKFLOW_READ_BACK_ATTEMPTS = 2;
+function decodeFileContent(file) {
+  return file.encoding === "base64" ? Buffer.from(file.content, "base64").toString("utf-8") : file.content;
+}
+async function readFileSha256(writer, path, ref) {
+  const file = await writer.getFileContent(path, ref);
+  if (!file) return null;
+  return sha256Hex(decodeFileContent(file));
+}
+async function readBranchHead(writer, branch) {
+  const existing = await writer.createBranch(branch, branch);
+  return existing.commit;
+}
+function repositoryWriteErrorCode(error) {
+  const candidate = error;
+  for (const value of [candidate?.code, candidate?.reason]) {
+    if (value === "nonFastForward" || value === "refRejectedByRule" || value === "pullRequestExists") return value;
+  }
+  return null;
+}
+var PULL_REQUEST_ALREADY_EXISTS = /pull request already exists/i;
+function isPullRequestAlreadyExistsError(error) {
+  if (repositoryWriteErrorCode(error) === "pullRequestExists") return true;
+  const candidate = error;
+  if (candidate?.status !== 422) return false;
+  const messages = [candidate.message, candidate.response?.data?.message];
+  const errors = candidate.response?.data?.errors;
+  if (Array.isArray(errors)) {
+    for (const entry of errors) messages.push(entry?.message);
+  }
+  return messages.some((message) => typeof message === "string" && PULL_REQUEST_ALREADY_EXISTS.test(message));
+}
+function commitFile(path, content) {
+  return { path, content, encoding: "utf-8" };
+}
+var DELIVERY_COPY = {
+  commitMessage: WORKFLOW_COMMIT_MESSAGE_UPDATE,
+  title: WORKFLOW_PULL_REQUEST_TITLE,
+  body: WORKFLOW_PULL_REQUEST_BODY
+};
+var REMOVAL_COPY = {
+  commitMessage: WORKFLOW_COMMIT_MESSAGE_REMOVE,
+  title: WORKFLOW_REMOVAL_PULL_REQUEST_TITLE,
+  body: WORKFLOW_REMOVAL_PULL_REQUEST_BODY
+};
+async function writeWorkflow(input, writer, protection) {
+  const path = input.workflowPath ?? APP_BUILD_WORKFLOW_PATH;
+  const { owner, repo, trackedBranch, createdByAppWork } = input.repository;
+  const contentSha256 = sha256Hex(input.content);
+  const currentSha256 = await readFileSha256(writer, path);
+  const existsOnTrackedBranch = currentSha256 !== null;
+  if (existsOnTrackedBranch && currentSha256 === contentSha256) {
+    return { state: "unchanged", storedWorkflowSha256: contentSha256 };
+  }
+  const handEdited = existsOnTrackedBranch && currentSha256 !== input.lastWrittenWorkflowSha256 && currentSha256 !== contentSha256;
+  const removal = input.content === "";
+  if (removal) {
+    if (!existsOnTrackedBranch) return { state: "unchanged", storedWorkflowSha256: null };
+    return pullRequestDelivery(input, writer, path, contentSha256, handEdited, REMOVAL_COPY);
+  }
+  const verdict = createdByAppWork && !handEdited && protection ? await isBranchProtected(protection, { owner, repo, branch: trackedBranch }) : { protected: false};
+  const pullRequestPath = !createdByAppWork || handEdited || verdict.protected;
+  if (pullRequestPath) {
+    return pullRequestDelivery(input, writer, path, contentSha256, handEdited);
+  }
+  return directDelivery(input, writer, path, contentSha256, existsOnTrackedBranch);
+}
+async function directDelivery(input, writer, path, contentSha256, existsOnTrackedBranch) {
+  const { trackedBranch } = input.repository;
+  const message = existsOnTrackedBranch ? WORKFLOW_COMMIT_MESSAGE_UPDATE : WORKFLOW_COMMIT_MESSAGE_ADD;
+  let attempts = 0;
+  while (attempts < WORKFLOW_WRITE_MAX_ATTEMPTS) {
+    attempts += 1;
+    const baseSha = input.resolveTrackedHead ? await input.resolveTrackedHead() : await readBranchHead(writer, trackedBranch);
+    const commit = {
+      branch: trackedBranch,
+      baseSha,
+      message,
+      files: [commitFile(path, input.content)]
+    };
+    try {
+      const { commitSha } = await writer.commitFiles(commit);
+      const readBack = await readBackMatches(writer, path, commitSha, contentSha256);
+      if (!readBack) return workflowWriteFailed("readBackMismatch");
+      return { state: "committed", commitSha, storedWorkflowSha256: contentSha256 };
+    } catch (error) {
+      const code = repositoryWriteErrorCode(error);
+      if (code === "refRejectedByRule") {
+        return pullRequestDelivery(input, writer, path, contentSha256, false);
+      }
+      if (code === "nonFastForward" && attempts < WORKFLOW_WRITE_MAX_ATTEMPTS) continue;
+      if (code === "nonFastForward") return workflowWriteFailed("nonFastForward");
+      throw error;
+    }
+  }
+  return workflowWriteFailed("nonFastForward");
+}
+async function pullRequestDelivery(input, writer, path, contentSha256, handEdited, copy = DELIVERY_COPY) {
+  const { trackedBranch } = input.repository;
+  try {
+    const branch = await writer.createBranch(APP_BUILD_WORKFLOW_BRANCH, trackedBranch);
+    const branchSha256 = await readFileSha256(writer, path, branch.name);
+    if (branchSha256 !== contentSha256) {
+      const { commitSha } = await writer.commitFiles({
+        branch: branch.name,
+        baseSha: branch.commit,
+        message: copy.commitMessage,
+        files: [commitFile(path, input.content)]
+      });
+      const readBack = await readBackMatches(writer, path, commitSha, contentSha256);
+      if (!readBack) return workflowWriteFailed("readBackMismatch");
+    }
+    try {
+      const pullRequest = await writer.createPullRequest({
+        title: copy.title,
+        head: APP_BUILD_WORKFLOW_BRANCH,
+        base: trackedBranch,
+        body: copy.body
+      });
+      return {
+        state: handEdited ? "editedByHand" : "pullRequestOpened",
+        pullRequestNumber: pullRequest.number,
+        pullRequestUrl: pullRequest.url,
+        storedWorkflowSha256: null
+      };
+    } catch (error) {
+      if (!isPullRequestAlreadyExistsError(error)) throw error;
+      return {
+        state: handEdited ? "editedByHand" : "pullRequestUpdated",
+        ...input.pullRequestNumber != null ? { pullRequestNumber: input.pullRequestNumber } : {},
+        ...input.pullRequestUrl ? { pullRequestUrl: input.pullRequestUrl } : {},
+        storedWorkflowSha256: null
+      };
+    }
+  } catch (error) {
+    if (repositoryWriteErrorCode(error) === "refRejectedByRule") return workflowWriteFailed("branchRules");
+    throw error;
+  }
+}
+async function readBackMatches(writer, path, commitSha, contentSha256) {
+  for (let attempt = 0; attempt < WORKFLOW_READ_BACK_ATTEMPTS; attempt += 1) {
+    if (await readFileSha256(writer, path, commitSha) === contentSha256) return true;
+  }
+  return false;
+}
+function workflowWriteFailed(cause) {
+  return {
+    state: "blocked",
+    storedWorkflowSha256: null,
+    blocked: { reason: "workflowWriteFailed", detail: { cause } }
+  };
+}
+var GITHUB_SECRET_NAME_PATTERN = /^[A-Z_][A-Z0-9_]{0,254}$/;
+function isValidGitHubSecretName(name) {
+  return GITHUB_SECRET_NAME_PATTERN.test(name) && !name.startsWith("GITHUB_");
+}
+function buildSecretName(valueName) {
+  return `${APP_BUILD_SECRET_PREFIX}${valueName}`;
+}
+var sodiumPromise;
+function loadSodium() {
+  sodiumPromise ??= (async () => {
+    try {
+      const imported = await import('libsodium-wrappers');
+      if (imported.default) return imported.default;
+    } catch {
+    }
+    const require2 = createRequire(typeof __filename === "string" ? __filename : import.meta.url);
+    return require2("libsodium-wrappers");
+  })();
+  return sodiumPromise;
+}
+async function sealSecretValue(value, publicKey) {
+  const _sodium = await loadSodium();
+  await _sodium.ready;
+  const binaryKey = _sodium.from_base64(publicKey, _sodium.base64_variants.ORIGINAL);
+  const binarySecret = _sodium.from_string(value);
+  const sealed = _sodium.crypto_box_seal(binarySecret, binaryKey);
+  return _sodium.to_base64(sealed, _sodium.base64_variants.ORIGINAL);
+}
+function byteLength(value) {
+  return Buffer.byteLength(value, "utf-8");
+}
+function isSecretLimitError(error) {
+  const candidate = error;
+  const message = typeof candidate?.message === "string" ? candidate.message : "";
+  if (!/secret/i.test(message)) return false;
+  if (candidate?.status === 422 && /limit/i.test(message)) return true;
+  return /secret(s)? limit/i.test(message);
+}
+function isSecretNotFoundError(error) {
+  return error?.status === 404;
+}
+function createBuildValueSecretSync(dependencies) {
+  const { port, logger } = dependencies;
+  const seal = dependencies.seal ?? sealSecretValue;
+  async function put(name, value, publicKey) {
+    if (!isValidGitHubSecretName(name)) {
+      throw new Error(
+        `Invalid secret name "${name}": must be 1-255 characters, contain only uppercase letters, digits, and underscores, start with a letter or underscore, and must not begin with "GITHUB_".`
+      );
+    }
+    await port.putRepoSecret({
+      name,
+      encryptedValue: await seal(value, publicKey.key),
+      keyId: publicKey.key_id
+    });
+    logger?.debug?.("build value sealed and written", { name });
+  }
+  return {
+    async syncBuildValues(input) {
+      const buildInputsHash = computeBuildInputsHash(
+        input.values.map((value) => ({ name: value.name, fingerprint: value.fingerprint }))
+      );
+      if (input.values.length > APP_BUILD_MAX_VALUES) {
+        return {
+          secretsWritten: [],
+          secretsRemoved: [],
+          buildInputsHash,
+          blocked: {
+            reason: "tooManyBuildValues",
+            detail: { count: input.values.length, max: APP_BUILD_MAX_VALUES }
+          }
+        };
+      }
+      for (const value of input.values) {
+        const name = buildSecretName(value.name);
+        if (name === APP_BUILD_VERIFY_PROMPTED_SECRET) {
+          return {
+            secretsWritten: [],
+            secretsRemoved: [],
+            buildInputsHash,
+            blocked: { reason: "buildValueNameReserved", detail: { name } }
+          };
+        }
+        if (byteLength(value.value) > APP_BUILD_SECRET_MAX_BYTES) {
+          return {
+            secretsWritten: [],
+            secretsRemoved: [],
+            buildInputsHash,
+            blocked: { reason: "buildValueTooLarge", detail: { name } }
+          };
+        }
+      }
+      const written = [];
+      const publicKey = await port.getRepoPublicKey();
+      try {
+        for (const value of input.values) {
+          const name = buildSecretName(value.name);
+          await put(name, value.value, publicKey);
+          written.push(name);
+        }
+      } catch (error) {
+        if (isSecretLimitError(error)) {
+          return {
+            secretsWritten: [],
+            secretsRemoved: [],
+            buildInputsHash,
+            blocked: { reason: "secretLimitReached", detail: { count: input.values.length } }
+          };
+        }
+        throw error;
+      }
+      const referenced = new Set(written);
+      const removed = [];
+      for (const name of new Set(input.previouslyWrittenSecretNames)) {
+        if (referenced.has(name)) continue;
+        try {
+          await port.deleteRepoSecret({ name });
+          logger?.debug?.("build value secret removed", { name });
+        } catch (error) {
+          if (!isSecretNotFoundError(error)) throw error;
+          logger?.debug?.("build value secret already absent", { name });
+        }
+        removed.push(name);
+      }
+      logger?.info?.("build values synced", { written: written.length, removed: removed.length });
+      return { secretsWritten: written, secretsRemoved: removed, buildInputsHash };
+    },
+    async writeVerifyPromptedSecret(values) {
+      const payload = {};
+      for (const value of values) payload[value.name] = value.value;
+      const json = JSON.stringify(payload);
+      const bytes = byteLength(json);
+      if (bytes > APP_BUILD_SECRET_MAX_BYTES) {
+        return {
+          name: APP_BUILD_VERIFY_PROMPTED_SECRET,
+          bytes,
+          blocked: { reason: "buildValueTooLarge", detail: { name: APP_BUILD_VERIFY_PROMPTED_SECRET } }
+        };
+      }
+      await put(APP_BUILD_VERIFY_PROMPTED_SECRET, json, await port.getRepoPublicKey());
+      return { name: APP_BUILD_VERIFY_PROMPTED_SECRET, bytes };
+    },
+    async deleteVerifyPromptedSecret() {
+      try {
+        await port.deleteRepoSecret({ name: APP_BUILD_VERIFY_PROMPTED_SECRET });
+      } catch (error) {
+        if (!isSecretNotFoundError(error)) throw error;
+        logger?.debug?.("verification prompted secret already absent", {
+          name: APP_BUILD_VERIFY_PROMPTED_SECRET
+        });
+        return { deleted: false };
+      }
+      logger?.debug?.("verification prompted secret removed", { name: APP_BUILD_VERIFY_PROMPTED_SECRET });
+      return { deleted: true };
+    }
+  };
+}
+
+// src/settings.schema.ts
+var LARGER_RUNNER_LABEL_PATTERN = "^[A-Za-z0-9._-]{1,64}$";
+var LARGER_RUNNER_MEMORY_MIN_GIB = 8;
+var LARGER_RUNNER_MEMORY_MAX_GIB = 256;
+var LARGER_RUNNER_VCPU_MIN = 2;
+var LARGER_RUNNER_VCPU_MAX = 64;
+var GITHUB_ACTIONS_BUILD_SETTING_KEYS = [
+  "largerRunnerLabel",
+  "largerRunnerMemoryGiB",
+  "largerRunnerVcpu",
+  "reclaimDisk",
+  "attestations",
+  "pullToken",
+  "pullTokenExpiresAt",
+  "allowBuildValuesOnPullRequests",
+  "verificationPromptedValuesRequireApproval"
+];
+var GITHUB_ACTIONS_BUILD_PLATFORM_MANAGED_KEYS = ["pullToken", "pullTokenExpiresAt"];
+var PREPARATION_STATE_KEYS = [
+  "workflowSha256",
+  "workflowPullRequestNumber",
+  "webhookId",
+  "runsEtag",
+  "repositoryBlock"
+];
+var GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS = {
+  largerRunnerLabel: "",
+  largerRunnerMemoryGiB: 0,
+  largerRunnerVcpu: 0,
+  reclaimDisk: true,
+  attestations: false,
+  allowBuildValuesOnPullRequests: false,
+  verificationPromptedValuesRequireApproval: true
+};
+var gitHubActionsBuildSettingsSchema = {
+  type: "object",
+  properties: {
+    largerRunnerLabel: {
+      type: "string",
+      title: "Larger runner label",
+      default: GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS.largerRunnerLabel,
+      pattern: LARGER_RUNNER_LABEL_PATTERN,
+      description: "Label of a larger GitHub-hosted runner to use for private repositories, when one is configured. Leave blank to use the standard runner."
+    },
+    largerRunnerMemoryGiB: {
+      type: "integer",
+      title: "Larger runner memory (GiB)",
+      default: GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS.largerRunnerMemoryGiB,
+      minimum: LARGER_RUNNER_MEMORY_MIN_GIB,
+      maximum: LARGER_RUNNER_MEMORY_MAX_GIB,
+      description: 'Memory the larger runner provides. Required when a larger runner label is set \u2014 the memory check cannot run without it. 0 means "no larger runner".'
+    },
+    largerRunnerVcpu: {
+      type: "integer",
+      title: "Larger runner vCPU",
+      default: GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS.largerRunnerVcpu,
+      minimum: LARGER_RUNNER_VCPU_MIN,
+      maximum: LARGER_RUNNER_VCPU_MAX,
+      description: "CPU the larger runner provides. Informational: a declared CPU above it produces a warning, never a blocked Build."
+    },
+    reclaimDisk: {
+      type: "boolean",
+      title: "Reclaim runner disk before building",
+      default: GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS.reclaimDisk,
+      description: "Removes preinstalled toolchains the build does not need, so a large image fits on the runner."
+    },
+    attestations: {
+      type: "boolean",
+      title: "Publish build provenance attestations",
+      default: GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS.attestations,
+      description: "Public repositories only. On a private repository this is ignored: the generated workflow grants the attestation permissions only when the repository is public.",
+      "x-scope": "work"
+    },
+    pullToken: {
+      type: "string",
+      title: "Registry pull token",
+      description: "Written by Ever Works after the token is validated against the built image; never typed here and never returned by an endpoint.",
+      "x-secret": true,
+      "x-scope": "work",
+      "x-widget": "password",
+      "x-platformManaged": true
+    },
+    pullTokenExpiresAt: {
+      type: "string",
+      title: "Registry pull token expires at",
+      description: "Recorded by Ever Works from the token provider when the token was saved. Read-only.",
+      "x-scope": "work",
+      "x-platformManaged": true
+    },
+    allowBuildValuesOnPullRequests: {
+      type: "boolean",
+      title: "Send stored build values to pull requests",
+      default: GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS.allowBuildValuesOnPullRequests,
+      description: "When on, a pull request from this repository receives the stored build values \u2014 which means whatever code the pull request contains can read them. Leave off unless the build genuinely needs a stored value on a pull request.",
+      "x-scope": "work"
+    },
+    verificationPromptedValuesRequireApproval: {
+      type: "boolean",
+      title: "Require approval before a verification uses prompted values",
+      default: GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS.verificationPromptedValuesRequireApproval,
+      description: "When on, a verification receives owner-set prompted values only when the change under verification touches no build-affecting file, or the owner approved it.",
+      "x-scope": "work"
+    }
+  },
+  // plan §4.4: `largerRunnerMemoryGiB` is "required when the label is set (the
+  // memory check needs it)". JSON Schema is the only place this can be stated
+  // before a Build exists, and the platform's validator runs with
+  // `useDefaults: false`, so an absent key stays absent and this `required`
+  // really fires.
+  allOf: [
+    {
+      if: { properties: { largerRunnerLabel: { minLength: 1 } }, required: ["largerRunnerLabel"] },
+      then: { required: ["largerRunnerMemoryGiB"] }
+    }
+  ]
+};
+
+// src/github-actions-build.plugin.ts
+var GitHubActionsBuildPlugin = class {
+  constructor() {
+    this.id = "github-actions-build";
+    this.name = "GitHub Actions builds";
+    this.version = "1.0.0";
+    /**
+     * Plan §4.3: the `build` category — appended to `PLUGIN_CATEGORIES` by APW-05
+     * T3 (`packages/plugin/src/contracts/plugin-manifest.types.ts`), so the
+     * loader's own `isPluginCategory` gate accepts this manifest.
+     */
+    this.category = "build";
+    /** Plan §4.3: exactly one capability. `isBuildPlugin` resolves this plugin on it. */
+    this.capabilities = ["build"];
+    /** Plan §4.3. `AppBuildKind` — a closed union in `@ever-works/contracts`. */
+    this.buildKind = "github-actions";
+    /**
+     * Plan §4.1/R-13: `dockerfile` only.
+     *
+     * `auto` is deliberately absent: the zero-config builder is a provider-internal
+     * choice this plugin does not have, so the strategy gate leaves that Build
+     * unstarted (`strategyNotSupported`) rather than half-built. `image` and `none`
+     * are absent for the same reason — they need no build at all, and the prepare
+     * runner handles them before a build plugin is asked (plan §7.2).
+     */
+    this.supportedStrategies = ["dockerfile"];
+    /** Work-scoped settings, like the other per-Work provider plugins. */
+    this.configurationMode = "user-required";
+    /** Plan §4.4, exactly. */
+    this.settingsSchema = gitHubActionsBuildSettingsSchema;
+  }
+  async onLoad(context) {
+    context.logger.log("GitHub Actions build plugin loaded");
+  }
+  async onUnload() {
+  }
+  /**
+   * The Actions API this plugin talks to, bound per call from the caller's auth.
+   *
+   * `protected` and a method, not a constructor seam: the loader constructs a
+   * plugin with **no arguments** (`PluginLoaderService.loadPluginModule` —
+   * `new PluginClass()`), so anything a spec wants to replace has to be
+   * replaceable on the instance. A spec subclasses and overrides this; production
+   * gets Octokit, which is the official SDK and already this package's dependency.
+   *
+   * A fresh client per call, deliberately: `auth.token` is resolved per call by
+   * the facade (plan §4.1) and may be a different member's installation token
+   * from one call to the next. Caching one would be caching a credential.
+   */
+  actionsPort(auth) {
+    return octokitActionsRunsPort(new Octokit({ auth: auth.token }));
+  }
+  /** The clock, as a seam, so the correlation window is provable without waiting. */
+  now() {
+    return Date.now();
+  }
+  getManifest() {
+    return {
+      id: this.id,
+      name: this.name,
+      version: this.version,
+      description: "Builds the App Work's container image on GitHub-hosted runners, through the workflow Ever Works writes into the repository's tracked branch",
+      category: this.category,
+      capabilities: [...this.capabilities],
+      author: { name: "Ever Works Team" },
+      license: "AGPL-3.0",
+      builtIn: true,
+      autoEnable: true,
+      visibility: "user-only"
+    };
+  }
+  // IBuildPlugin -----------------------------------------------------------
+  // Every member is declared and none pretends: see the class docstring for the
+  // task each one waits on.
+  /**
+   * APW-05 §4.6 — put the workflow (and the build values) where a Build can use them.
+   *
+   * Four steps, in this order, and the order is the point: nothing is written to a
+   * member's repository until it is known the Build could run at all.
+   *
+   *  1. **Select the runner** (T11). A declared memory the chosen runner cannot
+   *     give is `runnerTooSmall`, and it BLOCKS here — before a commit, before a
+   *     secret, before anything reaches GitHub. The alternative is writing a
+   *     workflow that is guaranteed to be OOM-killed minutes into its first run.
+   *  2. **Generate the file** (T8), with the checks job (T41) when the spec
+   *     declares checks and the verify job when the App Work can verify.
+   *  3. **Deliver it** (T9): unchanged, committed, or a pull request for a
+   *     repository that is not ours to write into (R-4). A hand-edited file is
+   *     `editedByHand` and is never overwritten.
+   *  4. **Sync the build values** (T10), and only then — a secret written for a
+   *     workflow that was never delivered is a secret nobody will clean up.
+   *
+   * ## The two failure shapes, kept apart
+   *
+   * A `blocked` result is a Build that will not start and a member who is told
+   * why. A THROW is this plugin failing at its own job. `writeWorkflow`'s own
+   * `'blocked'` state is mapped onto `PrepareRepositoryResult.blocked` rather than
+   * passed through, because that state is the writer's and is not one of the five
+   * the contract's `workflow.state` allows — the writer's docstring says so, and
+   * storing it would put a value in the database that no reader understands.
+   *
+   * ## `contentSha256` is stored only after a matching read-back
+   *
+   * `storedWorkflowSha256` is `null` until the writer has PROVEN the tracked
+   * branch holds the generated bytes (FR-8). Reporting the hash of what we sent,
+   * rather than of what is there, is how a failed write becomes an unnoticed
+   * hand-edit detection failure on the next preparation.
+   */
+  async prepareRepository(input, auth, writer) {
+    const settings = input.settings ?? {};
+    const selection = selectRunner({
+      visibility: input.repository.visibility,
+      resources: resourcesOf(input.build ?? null),
+      settings
+    });
+    if (!selection.ok) {
+      return {
+        workflow: { state: "unchanged", contentSha256: "" },
+        secretsWritten: [],
+        secretsRemoved: [],
+        buildInputsHash: computeBuildInputsHash(input.values ?? []),
+        blocked: {
+          reason: selection.blocked.reason,
+          detail: { needed: selection.blocked.needed, max: selection.blocked.max }
+        }
+      };
+    }
+    const content = generateWorkflow({
+      trackedBranch: input.repository.trackedBranch,
+      repository: {
+        owner: input.repository.owner,
+        repo: input.repository.repo,
+        visibility: input.repository.visibility
+      },
+      appSpecHash: input.appSpecHash,
+      build: input.build ?? null,
+      values: input.values ?? [],
+      runner: { label: selection.runner.label, class: selection.runner.runnerClass },
+      settings: {
+        reclaimDisk: settings.reclaimDisk,
+        attestations: settings.attestations,
+        allowBuildValuesOnPullRequests: settings.allowBuildValuesOnPullRequests,
+        verificationPromptedValuesRequireApproval: settings.verificationPromptedValuesRequireApproval
+      },
+      // A Build that has no `build` block cannot be verified in the runner; the
+      // verify job would have nothing to run.
+      verifyEnabled: Boolean(input.build),
+      checks: input.checks ?? []
+    });
+    const written = await writeWorkflow(
+      {
+        repository: {
+          owner: input.repository.owner,
+          repo: input.repository.repo,
+          trackedBranch: input.repository.trackedBranch,
+          createdByAppWork: input.repository.createdByAppWork
+        },
+        content,
+        lastWrittenWorkflowSha256: input.lastWrittenWorkflowSha256,
+        // §3.1b's recorded pull request, echoed back when GitHub reports the head's
+        // pull request still open (ACC-05-02). Never what decides that it is open.
+        pullRequestNumber: input.workflowPullRequestNumber ?? null,
+        pullRequestUrl: input.workflowPullRequestUrl ?? null
+      },
+      writer
+    );
+    if (written.state === "blocked") {
+      return {
+        workflow: { state: "unchanged", contentSha256: written.storedWorkflowSha256 ?? "" },
+        secretsWritten: [],
+        secretsRemoved: [],
+        buildInputsHash: computeBuildInputsHash(input.values ?? []),
+        blocked: {
+          reason: written.blocked?.reason ?? "workflowWriteFailed",
+          detail: { cause: written.blocked?.detail.cause ?? "unknown" }
+        }
+      };
+    }
+    const sync = createBuildValueSecretSync({ port: this.secretPort(auth, input.repository) });
+    const synced = await sync.syncBuildValues({
+      values: input.values ?? [],
+      previouslyWrittenSecretNames: input.previouslyWrittenSecretNames ?? []
+    });
+    return {
+      workflow: {
+        state: written.state,
+        ...written.commitSha ? { commitSha: written.commitSha } : {},
+        ...written.pullRequestUrl ? { pullRequestUrl: written.pullRequestUrl } : {},
+        // Only a matching read-back sets this — see the docstring.
+        contentSha256: written.storedWorkflowSha256 ?? ""
+      },
+      secretsWritten: synced.secretsWritten ?? [],
+      secretsRemoved: synced.secretsRemoved ?? [],
+      buildInputsHash: synced.buildInputsHash ?? computeBuildInputsHash(input.values ?? []),
+      ...synced.blocked ? { blocked: synced.blocked } : {}
+    };
+  }
+  /**
+   * The repository-secret operations T10's sync needs, over Octokit.
+   *
+   * A seam for the same reason {@link actionsPort} is one: the loader constructs
+   * this class with no arguments, so a spec replaces it on the instance.
+   */
+  secretPort(auth, repository) {
+    const octokit = new Octokit({ auth: auth.token });
+    const base = { owner: repository.owner, repo: repository.repo };
+    return {
+      getRepoPublicKey: async () => {
+        const { data } = await octokit.request("GET /repos/{owner}/{repo}/actions/secrets/public-key", base);
+        return data;
+      },
+      putRepoSecret: async ({ name, encryptedValue, keyId }) => {
+        await octokit.request("PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}", {
+          ...base,
+          secret_name: name,
+          encrypted_value: encryptedValue,
+          key_id: keyId
+        });
+      },
+      deleteRepoSecret: async ({ name }) => {
+        await octokit.request("DELETE /repos/{owner}/{repo}/actions/secrets/{secret_name}", {
+          ...base,
+          secret_name: name
+        });
+      }
+    };
+  }
+  /**
+   * APW-05 T12 — dispatch the generated workflow on the App Work's tracked branch.
+   *
+   * ## `providerRunId` is `null` here, and that is not a failure
+   *
+   * `POST .../dispatches` answers **204 with no body**: GitHub says nothing about
+   * the run it just created. So this method dispatches, records the instant, and
+   * makes ONE correlation attempt; the run is usually not listed that fast, and a
+   * `null` id is the normal answer. `app-build-watch` polls `getBuild`, which
+   * correlates again on every poll. Blocking here until a run appeared would hold
+   * the caller's request open for an arbitrary provider delay.
+   *
+   * ## The branch is the tracked branch, never the caller's ref
+   *
+   * FR-14: a Build may only run for the App Work's tracked branch. `input.ref` is
+   * what to BUILD; `repository.trackedBranch` is where the workflow file lives and
+   * the only `ref` a dispatch is allowed to name. Passing `input.ref` would let a
+   * Build run a workflow file from a branch nobody reviewed.
+   */
+  async startBuild(input, auth) {
+    const port = this.actionsPort(auth);
+    const repository = {
+      owner: input.repository.owner,
+      repo: input.repository.repo
+    };
+    const inputs = {
+      ew_build_id: input.buildId,
+      ew_sha: input.sha,
+      ew_mode: input.mode
+    };
+    if (input.reuseImageDigest) inputs.ew_reuse_digest = input.reuseImageDigest;
+    if (input.verification?.json) inputs.ew_verify_plan = input.verification.json;
+    const dispatchedAtMs = this.now();
+    await port.dispatchWorkflow({
+      repository,
+      workflowFile: WORKFLOW_FILE_NAME,
+      ref: input.repository.trackedBranch,
+      inputs
+    });
+    const correlated = await correlateDispatchedRun(port, {
+      repository,
+      workflowFile: WORKFLOW_FILE_NAME,
+      buildId: input.buildId,
+      dispatchedAtMs
+    });
+    return {
+      providerRunId: correlated.providerRunId,
+      dispatchedAt: new Date(dispatchedAtMs).toISOString()
+    };
+  }
+  /**
+   * APW-05 T12 — observe one run.
+   *
+   * Correlates first when the ref carries no `providerRunId`: a Build dispatched
+   * moments ago has none, and the watch job's whole purpose is to find it. `null`
+   * means "no such run" — never "I could not tell", which the contract says is a
+   * throw, and which is why a failed API call is not caught here.
+   *
+   * `redact` is APW-07's redactor for this App Work, and it is USED: every line
+   * of every excerpt goes through it, and through the secret-shape mask after
+   * it, before it leaves this method (FR-38).
+   */
+  async getBuild(ref, auth, redact) {
+    const port = this.actionsPort(auth);
+    const repository = {
+      owner: ref.repository.owner,
+      repo: ref.repository.repo
+    };
+    const runId = await this.resolveRunId(port, ref, repository);
+    if (runId === null) return null;
+    const run = await port.getWorkflowRun({ repository, runId });
+    if (!run) return null;
+    const jobs = await port.listRunJobs({ repository, runId });
+    const snapshot = observeRun({ run, jobs, mode: "build" });
+    const finished = snapshot.status !== "queued" && snapshot.status !== "running";
+    const artifact = finished ? await readResultArtifact(port, { repository, runId }) : null;
+    const result = artifact?.ok ? artifact.result : null;
+    const failure = snapshot.status === "failed" ? await this.classifyRunFailure({ port, repository, run, jobs, snapshot, result, redact }) : null;
+    const pushLogDigest = result && snapshot.status === "succeeded" && isPushingTrigger(snapshot.trigger) ? await this.readPushLogDigest({ port, repository, jobs, sha: snapshot.commitSha }) : void 0;
+    return {
+      ...snapshot,
+      ...result ? {
+        // `confirmed: false` without exception. This plugin reads the digest
+        // the member's own CI claimed; confirming it against the registry is
+        // `checkImageAccess` (T14), compared by `AppBuildsService.finalize`,
+        // and a plugin that marked its own input confirmed would make plan
+        // §4.8's "never believed" untrue. `pushLogDigest` is evidence the
+        // agent weighs only when the registry cannot be read; it confirms
+        // nothing here either.
+        image: {
+          repository: result.imageRepository ?? "",
+          digest: result.digest,
+          tags: [...result.tags ?? []],
+          confirmed: false,
+          ...pushLogDigest ? { pushLogDigest } : {}
+        },
+        ...result.secretCheck ? { secretCheck: result.secretCheck } : {}
+      } : {},
+      ...failure ? { failure } : {}
+    };
+  }
+  /**
+   * APW-05 T13 — why a failed run failed, as `BuildSnapshot.failure`.
+   *
+   * ## Which job's log
+   *
+   * The `build` job decides the Build's status (`run-observer.ts`, R-9), so when
+   * it failed it is the one worth reading. Only when it did NOT fail — a Build
+   * the run marked failed for some other reason — does any other failing job
+   * stand in. A failed `Ever Works check:` job is deliberately last: it never
+   * flips a Build to `failed`, so if it is the only failure the run's own
+   * conclusion is what actually needs explaining.
+   *
+   * No failing job at all is not an error: `jobCount` then carries the run into
+   * the classifier's `workflowInvalid` row, which is exactly what a run that
+   * produced no jobs is.
+   *
+   * ## Why the artifact's smoke rows are passed in
+   *
+   * `verificationFailed` is a class the LOG cannot show: the smoke rows live in
+   * the result artifact, which `getBuild` has already read by this point. Passing
+   * them costs nothing and is the difference between "your build failed" and
+   * "your app built, and then did not answer".
+   */
+  async classifyRunFailure(input) {
+    const { port, repository, run, jobs, snapshot, result, redact } = input;
+    const failed = (job) => Boolean(job.conclusion) && job.conclusion !== "success";
+    const buildJob2 = jobs.find((job) => job.name === BUILD_JOB_NAME);
+    const failingJob = buildJob2 && failed(buildJob2) ? buildJob2 : jobs.find(failed);
+    const log = failingJob ? await readJobLogTail(port, { repository, jobId: failingJob.id }) : "";
+    const smoke = result?.smoke ?? null;
+    return classifyFailure(
+      {
+        log,
+        jobConclusion: failingJob?.conclusion ?? null,
+        runConclusion: run.conclusion ?? null,
+        jobCount: jobs.length,
+        failingStepName: failingStep(failingJob)?.name ?? null,
+        ...typeof snapshot.billableMinutes === "number" ? { minutes: snapshot.billableMinutes } : {},
+        ...smoke ? { verification: { failed: smoke.filter((row) => !row.passed).length, total: smoke.length } } : {}
+      },
+      redact
+    );
+  }
+  /**
+   * APW-05 T14 remainder — the digest the build job's `Push` step logged for
+   * this Build's `sha-<sha>` tag, or `undefined`.
+   *
+   * The BUILD job's log, because that is the job holding the Push step; read as
+   * the same bounded tail T13 reads (the Push step is near the end of the job,
+   * followed only by the result write and the upload). An unreadable or expired
+   * log is `''` from `readJobLogTail`, so this never fails an observation — it
+   * only costs the fallback. Which lines count is `runs/push-digest.ts`'s rule.
+   */
+  async readPushLogDigest(input) {
+    const buildJob2 = input.jobs.find((job) => job.name === BUILD_JOB_NAME);
+    if (!buildJob2) return void 0;
+    const log = await readJobLogTail(input.port, { repository: input.repository, jobId: buildJob2.id });
+    return extractPushLogDigest(log, input.sha);
+  }
+  /**
+   * The run this ref addresses: the one it names, or the one correlation finds.
+   *
+   * Shared by `getBuild`, `cancelBuild` and `getLogsUrl` so all three agree about
+   * which run a ref means — a cancel that addressed a different run from the
+   * observation would stop the wrong Build.
+   */
+  async resolveRunId(port, ref, repository) {
+    if (ref.providerRunId) {
+      const parsed = Number(ref.providerRunId);
+      return Number.isFinite(parsed) ? parsed : null;
+    }
+    const dispatchedAtMs = ref.dispatchedAt ? Date.parse(ref.dispatchedAt) : this.now();
+    const correlated = await correlateDispatchedRun(port, {
+      repository,
+      workflowFile: WORKFLOW_FILE_NAME,
+      buildId: ref.buildId,
+      dispatchedAtMs: Number.isNaN(dispatchedAtMs) ? this.now() : dispatchedAtMs
+    });
+    return correlated.providerRunId === null ? null : Number(correlated.providerRunId);
+  }
+  /**
+   * APW-05 T12 — stop the run.
+   *
+   * A ref that resolves to no run is a no-op rather than a throw: the caller asked
+   * for the Build to stop, and a Build with no run has stopped. The port swallows
+   * GitHub's 409 ("not cancellable") for the same reason — a finished run is not a
+   * failed cancel.
+   */
+  async cancelBuild(ref, auth) {
+    const port = this.actionsPort(auth);
+    const repository = {
+      owner: ref.repository.owner,
+      repo: ref.repository.repo
+    };
+    const runId = await this.resolveRunId(port, ref, repository);
+    if (runId === null) return;
+    await port.cancelWorkflowRun({ repository, runId });
+  }
+  /**
+   * APW-05 T14 — can this installation read the image, and is its pull token the
+   * right shape?
+   *
+   * Declared now that it does something. It stayed undeclared while it did not,
+   * because the contract makes it optional and a caller materialises the member
+   * before calling it — so a throwing placeholder would have told a reader the
+   * capability was wired when it was not.
+   *
+   * This is the **confirming** half of plan §4.8's "only ever confirmed, never
+   * believed". `getBuild` reports the digest the member's own CI claimed with
+   * `confirmed: false`, always; comparing it against the digest this method reads
+   * from the registry is what makes it true, and that comparison belongs to the
+   * caller — `AppBuildsService.finalize` — which is the only party holding both
+   * the Build row and the installation's `pullToken` setting (`getBuild(ref, auth)`
+   * is given neither).
+   *
+   * The registry is read through GHCR's own token exchange (`registry/ghcr-access.ts`):
+   * a bare manifest `HEAD` is 401 for every image on GHCR, public or not, so a
+   * public image is only ever seen as public through the anonymous registry token.
+   * The pull token reaches `ghcr.io/token` (as Basic) and `api.github.com/user`,
+   * and nothing else.
+   */
+  async checkImageAccess(input) {
+    return checkImageAccess(input, this.registryFetch());
+  }
+  /**
+   * The registry/API HTTP seam.
+   *
+   * `redirect: 'manual'` is set by `ghcr-access.ts` on every request and passed
+   * straight through here: a 3xx followed with the `Authorization` header still
+   * attached is how a pull token reaches a host that is neither `api.github.com`
+   * nor `ghcr.io`, and that module's spec watches every call for exactly that.
+   */
+  registryFetch() {
+    return (url, init) => fetch(url, init);
+  }
+  /** APW-05 T12 — the run's own page, which is where a member reads its logs. */
+  async getLogsUrl(ref, auth) {
+    const port = this.actionsPort(auth);
+    const repository = {
+      owner: ref.repository.owner,
+      repo: ref.repository.repo
+    };
+    const runId = await this.resolveRunId(port, ref, repository);
+    if (runId === null) return null;
+    const run = await port.getWorkflowRun({ repository, runId });
+    return run?.html_url ?? null;
+  }
+};
+function resourcesOf(build) {
+  const resources = build?.resources;
+  if (!resources) return void 0;
+  return {
+    ...typeof resources.memoryGiB === "number" ? { memoryGiB: resources.memoryGiB } : {},
+    ...typeof resources.cpu === "number" ? { vcpu: resources.cpu } : {}
+  };
+}
+function isPushingTrigger(trigger) {
+  return APP_BUILD_DEPLOYABLE_TRIGGERS.includes(trigger);
+}
+var WORKFLOW_FILE_NAME = APP_BUILD_WORKFLOW_PATH.split("/").pop();
+function notImplemented(member, owner) {
+  return new Error(`github-actions-build: ${member} is not implemented yet \u2014 ${owner} owns it.`);
+}
+
+export { ACTION_PINS, ACTION_PIN_SHA_PATTERN, BRANCH_PROTECTION_RULE_TYPES, BRANCH_RULES_MAX_PAGES, BRANCH_RULES_PAGE_SIZE, CANONICAL_INPUT_FIELDS, EMBEDDED_VERIFY_RUNNER_SCRIPT, GENERATOR_RESERVED_LITERALS, GITHUB_ACTIONS_BUILD_PLATFORM_MANAGED_KEYS, GITHUB_ACTIONS_BUILD_SETTING_DEFAULTS, GITHUB_ACTIONS_BUILD_SETTING_KEYS, GITHUB_SECRET_NAME_PATTERN, GitHubActionsBuildPlugin, LARGER_RUNNER_LABEL_PATTERN, LARGER_RUNNER_MEMORY_MAX_GIB, LARGER_RUNNER_MEMORY_MIN_GIB, LARGER_RUNNER_VCPU_MAX, LARGER_RUNNER_VCPU_MIN, PREPARATION_STATE_KEYS, WORKFLOW_COMMIT_MESSAGE_ADD, WORKFLOW_COMMIT_MESSAGE_UPDATE, WORKFLOW_PULL_REQUEST_BODY, WORKFLOW_PULL_REQUEST_TITLE, WORKFLOW_READ_BACK_ATTEMPTS, WORKFLOW_WRITE_MAX_ATTEMPTS, actionPin, actionPinReference, branchSlug, buildImageRepository, buildSecretName, canonicalActionPins, canonicalCheck, canonicalInputsFor, canonicalWorkflowJson, canonicaliseWorkflowInputs, checkTimeoutMinutes, computeWorkflowInputsHash, createBuildValueSecretSync, GitHubActionsBuildPlugin as default, fromEnvNames, generateWorkflow, gitHubActionsBuildSettingsSchema, isBranchProtected, isSecretLimitError, isValidGitHubSecretName, loadSodium, normaliseBuildBlock, notImplemented, repositoryWriteErrorCode, sealSecretValue, secretNamesFor, workflowHeader, writeWorkflow, yamlString };