@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/dist/lib/platform/repository-metadata.js

@@ -0,0 +1,377 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolvePlatformProviderContext } from './context.js';
+import { providerError, providerOperationContext, providerStatus } from './provider-bridge.js';
+import { platformResult } from './types.js';
+const COMMON_LABELS = [
+    { name: 'type: bug', color: 'DED6F9', description: 'A general bug' },
+    { name: 'type: enhancement', color: 'DED6F9', description: 'A general enhancement' },
+    { name: 'type: feature', color: 'DED6F9', description: 'A general feature' },
+    { name: 'type: documentation', color: 'DED6F9', description: 'A documentation task' },
+    { name: 'type: dependency-upgrade', color: 'DED6F9', description: 'A dependency upgrade' },
+    { name: 'type: task', color: 'DED6F9', description: 'A general task' },
+    { name: 'status: waiting-for-triage', color: 'FCF1C4', description: "An issue we've not yet triaged or decided on" },
+    { name: 'status: waiting-for-feedback', color: 'FCF1C4', description: 'We need additional information before we can continue' },
+    { name: 'status: feedback-provided', color: 'FCF1C4', description: 'Feedback has been provided' },
+    { name: 'status: feedback-reminder', color: 'FCF1C4', description: "We've sent a reminder that we need additional information before we can continue" },
+    { name: 'status: pending-design-work', color: 'FCF1C4', description: 'Needs design work before any code can be developed' },
+    { name: 'status: in-progress', color: 'FCF1C4', description: 'Work is actively being developed' },
+    { name: 'status: on-hold', color: 'FCF1C4', description: "We can't start working on this issue yet" },
+    { name: 'status: blocked', color: 'FCF1C4', description: "An issue that's blocked on an external project change" },
+    { name: 'status: declined', color: 'FCF1C4', description: "A suggestion or change that we don't feel we should currently apply" },
+    { name: 'status: duplicate', color: 'FCF1C4', description: 'A duplicate of another issue' },
+    { name: 'status: invalid', color: 'FCF1C4', description: "An issue that we don't feel is valid" },
+    { name: 'status: superseded', color: 'FCF1C4', description: 'An issue that has been superseded by another' },
+    { name: 'status: bulk-closed', color: 'FCF1C4', description: "An outdated, unresolved issue that's closed in bulk as part of a cleaning process" },
+    { name: 'status: ideal-for-contribution', color: 'FCF1C4', description: 'An issue that a contributor can help us with' },
+    { name: 'status: backported', color: 'FCF1C4', description: 'An issue that has been backported to maintenance branches' },
+    { name: 'status: waiting-for-internal-feedback', color: 'FCF1C4', description: 'An issue that needs input from a member or another team' },
+    { name: 'good first issue', color: 'F9D9E6', description: 'Good for newcomers' },
+    { name: 'help wanted', color: '008672', description: 'Extra attention is needed' },
+    { name: 'dependencies', color: '0366D6', description: 'Pull requests that update a dependency file' }
+];
+function validIdentifiers(value, prerelease) {
+    if (!value)
+        return false;
+    return value.split('.').every((identifier) => /^[0-9A-Za-z-]+$/.test(identifier)
+        && (!prerelease || !/^\d+$/.test(identifier) || /^(0|[1-9]\d*)$/.test(identifier)));
+}
+function parseVersionTag(tag) {
+    if (!tag.startsWith('v'))
+        return null;
+    let version = tag.slice(1);
+    const plusAt = version.indexOf('+');
+    if (plusAt >= 0) {
+        const build = version.slice(plusAt + 1);
+        if (!validIdentifiers(build, false))
+            return null;
+        version = version.slice(0, plusAt);
+    }
+    let prerelease = '';
+    const dashAt = version.indexOf('-');
+    if (dashAt >= 0) {
+        prerelease = version.slice(dashAt + 1);
+        if (!validIdentifiers(prerelease, true))
+            return null;
+        version = version.slice(0, dashAt);
+    }
+    const core = version.split('.');
+    if (core.length !== 3 || !core.every((part) => /^(0|[1-9]\d*)$/.test(part)))
+        return null;
+    return { tag, major: core[0], minor: core[1], patch: core[2], prerelease };
+}
+function compareDecimal(left, right) {
+    if (left.length !== right.length)
+        return left.length > right.length ? 1 : -1;
+    if (left === right)
+        return 0;
+    return left > right ? 1 : -1;
+}
+function compareAscii(left, right) {
+    const alphabet = '+-.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+    const limit = Math.min(left.length, right.length);
+    for (let index = 0; index < limit; index += 1) {
+        const leftRank = alphabet.indexOf(left[index]);
+        const rightRank = alphabet.indexOf(right[index]);
+        if (leftRank !== rightRank)
+            return leftRank > rightRank ? 1 : -1;
+    }
+    if (left.length === right.length)
+        return 0;
+    return left.length > right.length ? 1 : -1;
+}
+function comparePrerelease(left, right) {
+    if (!left || !right) {
+        if (left === right)
+            return 0;
+        return left ? -1 : 1;
+    }
+    const leftIds = left.split('.');
+    const rightIds = right.split('.');
+    const limit = Math.min(leftIds.length, rightIds.length);
+    for (let index = 0; index < limit; index += 1) {
+        const leftId = leftIds[index];
+        const rightId = rightIds[index];
+        const leftNumeric = /^\d+$/.test(leftId);
+        const rightNumeric = /^\d+$/.test(rightId);
+        const comparison = leftNumeric && rightNumeric
+            ? compareDecimal(leftId, rightId)
+            : leftNumeric !== rightNumeric
+                ? leftNumeric ? -1 : 1
+                : compareAscii(leftId, rightId);
+        if (comparison !== 0)
+            return comparison;
+    }
+    if (leftIds.length === rightIds.length)
+        return 0;
+    return leftIds.length > rightIds.length ? 1 : -1;
+}
+function compareVersions(left, right) {
+    for (const [leftPart, rightPart] of [
+        [left.major, right.major],
+        [left.minor, right.minor],
+        [left.patch, right.patch]
+    ]) {
+        const comparison = compareDecimal(leftPart, rightPart);
+        if (comparison !== 0)
+            return comparison;
+    }
+    const prerelease = comparePrerelease(left.prerelease, right.prerelease);
+    return prerelease !== 0 ? prerelease : compareAscii(left.tag, right.tag);
+}
+function incrementDecimal(value) {
+    const digits = value.split('');
+    let carry = 1;
+    for (let index = digits.length - 1; index >= 0 && carry; index -= 1) {
+        const next = Number(digits[index]) + carry;
+        digits[index] = String(next % 10);
+        carry = next === 10 ? 1 : 0;
+    }
+    return carry ? `1${digits.join('')}` : digits.join('');
+}
+function buildMilestonePlan(tags, history) {
+    const parsed = tags.flatMap((tag) => {
+        const version = parseVersionTag(tag);
+        return version ? [version] : [];
+    });
+    const selected = parsed.reduce((best, candidate) => !best || compareVersions(candidate, best) > 0 ? candidate : best, null);
+    const baseline = selected
+        ? { version: `${selected.major}.${selected.minor}.${selected.patch}`, source: `git tag ${selected.tag}` }
+        : { version: '0.1.0', source: 'compatibility default' };
+    const [major, minor, patch] = baseline.version.split('.');
+    const desired = [];
+    const titles = new Set();
+    const add = (title, description, state) => {
+        if (titles.has(title))
+            return;
+        titles.add(title);
+        desired.push({ title, description, state });
+    };
+    const line = `${major}.${minor}.x`;
+    const version = selected
+        ? `${major}.${minor}.${incrementDecimal(patch)}`
+        : baseline.version;
+    add('General Backlog', 'All unsorted backlogged tasks may be completed in a future version.', 'open');
+    add(line, `Issues that we want to resolve in ${major}.${minor} line.`, 'open');
+    add(version, `Issues that we want to release in v${version}.`, 'open');
+    if (patch === '0') {
+        const nextMinor = `${major}.${incrementDecimal(minor)}.0`;
+        const nextLine = `${major}.${incrementDecimal(minor)}.x`;
+        add(nextMinor, `Issues that we want to release in v${nextMinor}.`, 'open');
+        add(nextLine, `Issues that we want to resolve in ${major}.${incrementDecimal(minor)} line.`, 'open');
+    }
+    if (history) {
+        for (const historical of parsed) {
+            const historicalVersion = `${historical.major}.${historical.minor}.${historical.patch}`;
+            add(`${historical.major}.${historical.minor}.x`, `Issues that we want to resolve in ${historical.major}.${historical.minor} line.`, 'open');
+            add(historicalVersion, `Issues that we want to release in v${historicalVersion}.`, 'closed');
+        }
+    }
+    return { baseline, history, desired };
+}
+function buildLabelDefinitions(config) {
+    const labels = config && typeof config === 'object' && !Array.isArray(config)
+        ? config.labels
+        : undefined;
+    const mapping = labels && typeof labels === 'object' && !Array.isArray(labels)
+        ? labels.in
+        : undefined;
+    if (mapping === undefined)
+        return [...COMMON_LABELS];
+    if (!mapping || typeof mapping !== 'object' || Array.isArray(mapping))
+        throw new Error('labels.in must be an object');
+    const dynamic = Object.keys(mapping).sort().map((key) => {
+        if (!key || /[\r\n\t]/.test(key))
+            throw new Error('labels.in keys must be non-empty single-line values');
+        return { name: `in: ${key}`, color: 'BFD4F2', description: `Module label for ${key}` };
+    });
+    return [...COMMON_LABELS, ...dynamic];
+}
+function configAt(root) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(root, '.agents', '.airc.json'), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function baseResult(status, context, extra = {}) {
+    return {
+        ...platformResult(status, {
+            platform: context.platform,
+            capabilities: context.capabilities,
+            operations: context.operations,
+            error: context.error
+        }),
+        ...extra
+    };
+}
+function unsupported(providerType, operation) {
+    return {
+        code: 'PLATFORM_CAPABILITY_UNSUPPORTED',
+        message: `Platform '${providerType}' does not provide ${operation}`,
+        retryable: false
+    };
+}
+function operationStatus(changed) {
+    return changed ? 'applied' : 'no-op';
+}
+function errorStatus(error) {
+    return error.code === 'PLATFORM_CAPABILITY_UNSUPPORTED' ? 'degraded' : providerStatus(error);
+}
+function initialLabelsResult(context, labels) {
+    return baseResult('degraded', context, {
+        operation: 'init-labels',
+        labels: {
+            commonCount: COMMON_LABELS.length,
+            inCount: labels.filter((item) => item.name.startsWith('in:')).length,
+            created: [], updated: [], removed: [], skipped: []
+        },
+        error: context.error || { code: 'PLATFORM_CAPABILITY_UNSUPPORTED', message: 'Label initialization is unavailable', retryable: false }
+    });
+}
+function initialMilestonesResult(context, history) {
+    return baseResult('degraded', context, {
+        operation: 'init-milestones',
+        milestones: { baseline: null, history, desired: [], created: [], skipped: [] },
+        error: context.error || { code: 'PLATFORM_CAPABILITY_UNSUPPORTED', message: 'Milestone initialization is unavailable', retryable: false }
+    });
+}
+function labelsFromReconciliation(initial, value) {
+    if (!value)
+        return initial.labels;
+    return {
+        ...initial.labels,
+        created: value.created,
+        updated: value.updated,
+        removed: value.removed,
+        skipped: value.skipped
+    };
+}
+function milestonesFromInitialization(initial, value) {
+    if (!value)
+        return initial.milestones;
+    return {
+        ...initial.milestones,
+        created: value.created,
+        skipped: value.skipped
+    };
+}
+function usableContext(loaded) {
+    return loaded.ok && Boolean(loaded.value.context.platform.repository);
+}
+async function initializeLabels(input = {}, options = {}) {
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    let definitions;
+    try {
+        definitions = buildLabelDefinitions(loaded.ok ? configAt(loaded.value.repositoryRoot) : {});
+    }
+    catch (error) {
+        return {
+            ...initialLabelsResult(context, []),
+            status: 'failed',
+            error: { code: 'LABEL_CONFIG_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+        };
+    }
+    const initial = initialLabelsResult(context, definitions);
+    if (!usableContext(loaded))
+        return { ...initial, error: initial.error || context.error };
+    const operation = loaded.value.provider.repositoryMetadata?.reconcileLabels;
+    if (!operation)
+        return { ...initial, error: unsupported(loaded.value.provider.type, 'repositoryMetadata.reconcileLabels') };
+    const reconciled = await operation({
+        context: providerOperationContext(loaded.value),
+        desired: definitions,
+        cleanupStaleIn: input.cleanupStaleIn === true,
+        mutation: { idempotencyKey: 'labels:init' }
+    });
+    if (!reconciled.ok)
+        return {
+            ...initial,
+            status: errorStatus(reconciled.error),
+            changed: reconciled.value?.changed || false,
+            operations: [{ name: 'reconcile-labels', status: 'failed', reasonCode: reconciled.error.code }],
+            labels: labelsFromReconciliation(initial, reconciled.value),
+            error: providerError(reconciled.error, 'LABEL_INITIALIZATION_FAILED')
+        };
+    return {
+        ...initial,
+        status: operationStatus(reconciled.value.changed),
+        changed: reconciled.value.changed,
+        operations: [{ name: 'reconcile-labels', status: operationStatus(reconciled.value.changed), reasonCode: null }],
+        labels: {
+            commonCount: COMMON_LABELS.length,
+            inCount: definitions.length - COMMON_LABELS.length,
+            created: reconciled.value.created,
+            updated: reconciled.value.updated,
+            removed: reconciled.value.removed,
+            skipped: reconciled.value.skipped
+        },
+        error: null
+    };
+}
+function gitTags(cwd) {
+    const output = execFileSync('git', ['tag', '--list', 'v*'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+    return output ? output.split(/\r?\n/).filter(Boolean) : [];
+}
+async function initializeMilestones(input = {}, options = {}) {
+    const history = input.history === true;
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    const initial = initialMilestonesResult(context, history);
+    if (!usableContext(loaded))
+        return initial;
+    let plan;
+    try {
+        plan = buildMilestonePlan(gitTags(loaded.value.workingDirectory), history);
+    }
+    catch (error) {
+        return {
+            ...initial,
+            status: 'failed',
+            error: { code: 'MILESTONE_TAG_DISCOVERY_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false }
+        };
+    }
+    const operation = loaded.value.provider.repositoryMetadata?.reconcileMilestones;
+    if (!operation)
+        return {
+            ...initial,
+            milestones: { ...initial.milestones, baseline: plan.baseline, history, desired: plan.desired.map((item) => item.title) },
+            error: unsupported(loaded.value.provider.type, 'repositoryMetadata.reconcileMilestones')
+        };
+    const reconciled = await operation({
+        context: providerOperationContext(loaded.value),
+        desired: plan.desired,
+        mutation: { idempotencyKey: `milestones:init:${plan.baseline.version}:${history}` }
+    });
+    if (!reconciled.ok)
+        return {
+            ...initial,
+            status: errorStatus(reconciled.error),
+            changed: reconciled.value?.changed || false,
+            operations: [{ name: 'reconcile-milestones', status: 'failed', reasonCode: reconciled.error.code }],
+            milestones: milestonesFromInitialization({
+                ...initial,
+                milestones: { ...initial.milestones, baseline: plan.baseline, history, desired: plan.desired.map((item) => item.title) }
+            }, reconciled.value),
+            error: providerError(reconciled.error, 'MILESTONE_INITIALIZATION_FAILED')
+        };
+    return {
+        ...initial,
+        status: operationStatus(reconciled.value.changed),
+        changed: reconciled.value.changed,
+        operations: [{ name: 'reconcile-milestones', status: operationStatus(reconciled.value.changed), reasonCode: null }],
+        milestones: {
+            baseline: plan.baseline,
+            history,
+            desired: plan.desired.map((item) => item.title),
+            created: reconciled.value.created,
+            skipped: reconciled.value.skipped
+        },
+        error: null
+    };
+}
+export { buildLabelDefinitions, buildMilestonePlan, initializeLabels, initializeMilestones };
+//# sourceMappingURL=repository-metadata.js.map

package/dist/lib/platform/resource-identity.d.ts

@@ -0,0 +1,26 @@
+type ResourceIdentityKind = 'id' | 'number' | 'key';
+type ResourceIdentity = {
+    kind: 'id';
+    value: string;
+} | {
+    kind: 'number';
+    value: number;
+} | {
+    kind: 'key';
+    value: string;
+};
+type CanonicalResourceIdentity = ResourceIdentity;
+type PlatformResourceKind = 'issue' | 'pull-request' | 'comment' | 'release';
+type ProviderIdentityDeclaration = Partial<Record<PlatformResourceKind, ResourceIdentityKind>>;
+declare function isResourceIdentity(value: unknown): value is CanonicalResourceIdentity;
+declare function parseResourceIdentity(value: unknown, label?: string): CanonicalResourceIdentity;
+declare function serializeResourceIdentity(identity: ResourceIdentity): string;
+declare function resourceIdentityEquals(left: unknown, right: unknown): boolean;
+declare function primaryIdentityKind(declaration: ProviderIdentityDeclaration | undefined, resourceKind: PlatformResourceKind): ResourceIdentityKind;
+declare function parseResourceToken(token: string, resourceKind: PlatformResourceKind, declaration: ProviderIdentityDeclaration | undefined): ResourceIdentity;
+declare function identityFromRemoteValue(value: unknown, resourceKind: PlatformResourceKind, declaration: ProviderIdentityDeclaration | undefined): ResourceIdentity;
+declare function resourceIdentityNumber(identity: ResourceIdentity | null | undefined): number | null;
+declare function resourceIdentityString(identity: ResourceIdentity | null | undefined): string | null;
+declare function reviewMarker(identity: ResourceIdentity): string;
+export { identityFromRemoteValue, isResourceIdentity, parseResourceIdentity, parseResourceToken, primaryIdentityKind, resourceIdentityEquals, resourceIdentityNumber, resourceIdentityString, reviewMarker, serializeResourceIdentity };
+export type { CanonicalResourceIdentity, PlatformResourceKind, ProviderIdentityDeclaration, ResourceIdentity, ResourceIdentityKind };

package/dist/lib/platform/resource-identity.js

@@ -0,0 +1,92 @@
+function identityError(message) {
+    return Object.assign(new Error(`PLATFORM_IDENTITY_INVALID: ${message}`), {
+        code: 'PLATFORM_IDENTITY_INVALID'
+    });
+}
+function isResourceIdentity(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    if (Object.keys(candidate).length !== 2 || typeof candidate.kind !== 'string')
+        return false;
+    if (candidate.kind === 'number') {
+        return Number.isSafeInteger(candidate.value) && candidate.value > 0;
+    }
+    return (candidate.kind === 'id' || candidate.kind === 'key')
+        && typeof candidate.value === 'string'
+        && candidate.value.length > 0
+        && candidate.value.trim() === candidate.value;
+}
+function parseResourceIdentity(value, label = 'identity') {
+    if (!isResourceIdentity(value))
+        throw identityError(`${label} must contain exactly one valid kind/value pair`);
+    if (value.kind === 'number')
+        return { kind: 'number', value: value.value };
+    if (value.kind === 'id')
+        return { kind: 'id', value: value.value };
+    return { kind: 'key', value: value.value };
+}
+function serializeResourceIdentity(identity) {
+    return JSON.stringify(parseResourceIdentity(identity));
+}
+function resourceIdentityEquals(left, right) {
+    return isResourceIdentity(left) && isResourceIdentity(right)
+        && left.kind === right.kind && left.value === right.value;
+}
+function primaryIdentityKind(declaration, resourceKind) {
+    const kind = declaration?.[resourceKind];
+    if (kind !== 'id' && kind !== 'number' && kind !== 'key') {
+        throw identityError(`provider does not declare a primary identity for ${resourceKind}`);
+    }
+    return kind;
+}
+function parseResourceToken(token, resourceKind, declaration) {
+    if (typeof token !== 'string' || token.length === 0)
+        throw identityError('resource token must be a non-empty string');
+    const kind = primaryIdentityKind(declaration, resourceKind);
+    if (kind === 'number') {
+        if (!/^[1-9]\d*$/u.test(token))
+            throw identityError(`${resourceKind} token must be a positive safe integer`);
+        const value = Number(token);
+        if (!Number.isSafeInteger(value) || value <= 0)
+            throw identityError(`${resourceKind} token must be a positive safe integer`);
+        return { kind, value };
+    }
+    const value = token.trim();
+    if (!value)
+        throw identityError(`${resourceKind} token must not be empty`);
+    return { kind, value };
+}
+function identityFromRemoteValue(value, resourceKind, declaration) {
+    const kind = primaryIdentityKind(declaration, resourceKind);
+    if (isResourceIdentity(value)) {
+        if (value.kind !== kind)
+            throw identityError(`${resourceKind} response identity kind does not match provider declaration`);
+        return value;
+    }
+    if (kind === 'number') {
+        if (typeof value === 'number' && Number.isSafeInteger(value) && value > 0)
+            return { kind, value };
+        if (typeof value === 'string' && /^[1-9]\d*$/u.test(value))
+            return parseResourceToken(value, resourceKind, declaration);
+        throw identityError(`${resourceKind} response does not contain a valid number identity`);
+    }
+    if (typeof value !== 'string' || !value.trim())
+        throw identityError(`${resourceKind} response does not contain a valid string identity`);
+    return { kind, value: value.trim() };
+}
+function resourceIdentityNumber(identity) {
+    return identity?.kind === 'number' ? identity.value : null;
+}
+function resourceIdentityString(identity) {
+    return identity && (identity.kind === 'id' || identity.kind === 'key') ? identity.value : null;
+}
+function reviewMarker(identity) {
+    const parsed = parseResourceIdentity(identity);
+    if (parsed.kind === 'number')
+        return `pr${parsed.value}`;
+    const encoded = Buffer.from(serializeResourceIdentity(parsed), 'utf8').toString('base64url');
+    return `pr:${encoded}`;
+}
+export { identityFromRemoteValue, isResourceIdentity, parseResourceIdentity, parseResourceToken, primaryIdentityKind, resourceIdentityEquals, resourceIdentityNumber, resourceIdentityString, reviewMarker, serializeResourceIdentity };
+//# sourceMappingURL=resource-identity.js.map

package/dist/lib/platform/security-alerts.js

@@ -0,0 +1,155 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolvePlatformProviderContext } from './context.js';
+import { providerError, providerOperationContext, providerStatus } from './provider-bridge.js';
+import { platformResult } from './types.js';
+function baseResult(operation, status, context, overrides = {}) {
+    return {
+        ...platformResult(status, {
+            platform: context.platform,
+            capabilities: context.capabilities,
+            operations: context.operations,
+            error: context.error,
+            changed: false
+        }),
+        operation,
+        alert: null,
+        data: null,
+        ...overrides
+    };
+}
+function unsupported(providerType) {
+    return {
+        code: 'PLATFORM_CAPABILITY_UNSUPPORTED',
+        message: `Platform '${providerType}' does not provide securityAlerts`,
+        retryable: false
+    };
+}
+function resultStatus(error) {
+    return error.code === 'PLATFORM_CAPABILITY_UNSUPPORTED' ? 'degraded' : providerStatus(error);
+}
+function validKind(value) {
+    return value === 'dependabot' || value === 'code-scanning';
+}
+function validNumber(value) {
+    return Number.isSafeInteger(value) && value > 0;
+}
+function unavailable(operation, context, error) {
+    const status = context.status === 'blocked' || context.status === 'failed' ? context.status : 'degraded';
+    return baseResult(operation, status, context, {
+        error: error || context.error || { code: 'PLATFORM_CAPABILITY_UNSUPPORTED', message: 'Security alert operations are unavailable', retryable: false }
+    });
+}
+async function readSecurityAlert(input, options = {}) {
+    if (!validKind(input.kind))
+        return baseResult('read', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_KIND_INVALID', message: 'Alert kind must be dependabot or code-scanning', retryable: false }
+        });
+    if (!validNumber(input.number))
+        return baseResult('read', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_NUMBER_INVALID', message: 'Alert number must be a positive integer', retryable: false }
+        });
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    if (!loaded.ok || !context.platform.repository)
+        return unavailable('read', context);
+    const inspect = loaded.value.provider.securityAlerts?.inspect;
+    if (!inspect)
+        return unavailable('read', context, unsupported(loaded.value.provider.type));
+    const result = await inspect({ context: providerOperationContext(loaded.value), kind: input.kind, number: input.number });
+    if (!result.ok)
+        return {
+            ...baseResult('read', resultStatus(result.error), context),
+            error: providerError(result.error, 'SECURITY_ALERT_READ_FAILED')
+        };
+    return {
+        ...baseResult('read', 'applied', context, {
+            alert: result.value,
+            data: result.value.data,
+            operations: [{ name: 'inspect-alert', status: 'applied', reasonCode: null }]
+        }),
+        changed: false,
+        error: null
+    };
+}
+async function dismissSecurityAlert(input, options = {}) {
+    if (!validKind(input.kind))
+        return baseResult('dismiss', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_KIND_INVALID', message: 'Alert kind must be dependabot or code-scanning', retryable: false }
+        });
+    if (!validNumber(input.number))
+        return baseResult('dismiss', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_NUMBER_INVALID', message: 'Alert number must be a positive integer', retryable: false }
+        });
+    if (!input.reason || typeof input.comment !== 'string')
+        return baseResult('dismiss', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_DISMISS_INPUT_INVALID', message: 'Dismissal reason and comment are required', retryable: false }
+        });
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    if (!loaded.ok || !context.platform.repository)
+        return unavailable('dismiss', context);
+    const inspect = loaded.value.provider.securityAlerts?.inspect;
+    const dismiss = loaded.value.provider.securityAlerts?.dismiss;
+    if (!inspect || !dismiss)
+        return unavailable('dismiss', context, unsupported(loaded.value.provider.type));
+    const current = await inspect({ context: providerOperationContext(loaded.value), kind: input.kind, number: input.number });
+    if (!current.ok)
+        return {
+            ...baseResult('dismiss', resultStatus(current.error), context),
+            error: providerError(current.error, 'SECURITY_ALERT_READ_FAILED')
+        };
+    if (current.value.state === 'dismissed' || current.value.state === 'fixed')
+        return {
+            ...baseResult('dismiss', 'no-op', context, {
+                alert: current.value,
+                data: current.value.data,
+                operations: [{ name: 'inspect-alert', status: 'no-op', reasonCode: 'ALREADY_CLOSED' }]
+            }),
+            error: null
+        };
+    if (current.value.state !== 'open')
+        return {
+            ...baseResult('dismiss', 'failed', context, {
+                alert: current.value,
+                data: current.value.data,
+                operations: [{ name: 'inspect-alert', status: 'failed', reasonCode: 'INVALID_STATE' }]
+            }),
+            error: { code: 'SECURITY_RESPONSE_INVALID', message: 'The platform returned an alert without a valid state', retryable: false }
+        };
+    const changed = await dismiss({
+        context: providerOperationContext(loaded.value),
+        kind: input.kind,
+        number: input.number,
+        reason: input.reason,
+        comment: input.comment,
+        mutation: { idempotencyKey: `security-alert:dismiss:${input.kind}:${input.number}` }
+    });
+    if (!changed.ok)
+        return {
+            ...baseResult('dismiss', resultStatus(changed.error), context, {
+                alert: current.value,
+                data: current.value.data,
+                operations: [{ name: 'dismiss-alert', status: 'failed', reasonCode: null }]
+            }),
+            error: providerError(changed.error, 'SECURITY_ALERT_DISMISS_FAILED')
+        };
+    return {
+        ...baseResult('dismiss', changed.value.changed ? 'applied' : 'no-op', context, {
+            operations: [{ name: 'dismiss-alert', status: changed.value.changed ? 'applied' : 'no-op', reasonCode: null }]
+        }),
+        changed: changed.value.changed,
+        error: null
+    };
+}
+function readCommentFile(commentFile, cwd = process.cwd()) {
+    try {
+        const requested = path.resolve(cwd, commentFile);
+        return { ok: true, value: fs.readFileSync(requested, 'utf8') };
+    }
+    catch {
+        return { ok: false, error: { code: 'SECURITY_DISMISS_INPUT_INVALID', message: 'Dismissal comment file could not be read', retryable: false } };
+    }
+}
+export { dismissSecurityAlert, readCommentFile, readSecurityAlert };
+//# sourceMappingURL=security-alerts.js.map