@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/dist/lib/internal/task-short-id.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { detectRepoRoot } from '../task/resolve-ref.js';
 import { configuredShortIdLength, executeShortIdCommand } from '../task/short-id.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-short-id <alloc|release|resolve|list> [argument] [--active-dir <path>] [--short-id-length <N>] [--verify]\n`;
 function failure(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, output: '', error: { code: 'SHORT_ID_PAYLOAD_INVALID', message } })}\n`);
@@ -8,12 +9,21 @@ function failure(message) {
     process.exitCode = 1;
 }
 function taskShortId(args = []) {
+    if (!ensureInternalHandlerRoute('task-short-id', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const operation = args[0];
-    if (!operation || !['alloc', 'release', 'resolve', 'list'].includes(operation)) {
+    const route = operation === 'list' && args.includes('--verify') ? 'list-verify' : operation ?? '';
+    if (!operation || ![
+        internalHandlerRoute('task-short-id', 'alloc', route),
+        internalHandlerRoute('task-short-id', 'release', route),
+        internalHandlerRoute('task-short-id', 'resolve', route),
+        internalHandlerRoute('task-short-id', 'list', route),
+        internalHandlerRoute('task-short-id', 'list-verify', route)
+    ].some(Boolean)) {
         failure('a valid short-id operation is required');
         return;
     }

package/dist/lib/internal/task-snapshot.js

@@ -1,4 +1,5 @@
 import { collectTaskSnapshot } from '../task/snapshot.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-snapshot <N | TASK-id> [--format json|text]\n';
 function fail(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'SNAPSHOT_PAYLOAD_INVALID', message } })}\n`);
@@ -6,11 +7,13 @@ function fail(message) {
     process.exitCode = 1;
 }
 function taskSnapshot(args = []) {
+    if (!ensureInternalHandlerRoute('task-snapshot', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
-    if (!args[0] || args[0].startsWith('--')) {
+    if (!args[0] || args[0].startsWith('--') || !internalHandlerRoute('task-snapshot', 'snapshot', 'snapshot')) {
         fail('task ref is required');
         return;
     }

package/dist/lib/internal/task-validate.js

@@ -16,6 +16,7 @@ import { readSandboxControlManifest } from '../sandbox/control/lifecycle.js';
 import { SANDBOX_CONTROL_FUTURE_SKEW_MS, SANDBOX_CONTROL_STATUS_STALE_MS } from '../sandbox/control/protocol.js';
 import { getProcessStartTime } from '../server/process-state.js';
 import { assertGitWorktreeBinding } from '../git/worktree-identity.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
 const MAX_TIMEOUT_MS = 60 * 60 * 1000;
 const RECOVERY_GRACE_MS = 30_000;
@@ -273,6 +274,8 @@ function sniffFormat(args) {
     return index >= 0 && args[index + 1] === 'json' ? 'json' : 'text';
 }
 function taskValidate(args) {
+    if (!ensureInternalHandlerRoute('task-validate', args))
+        return;
     let options;
     try {
         options = parseValidateArgs(args);
@@ -290,9 +293,11 @@ function taskValidate(args) {
         const target = resolveSandboxTarget(options.target, config.repoRoot);
         const commit = git(config.repoRoot, ['rev-parse', target.branch]);
         const startedAt = new Date().toISOString();
-        const result = options.scope === 'snapshot'
+        const result = internalHandlerRoute('task-validate', 'snapshot', options.scope)
             ? snapshotValidation(config.repoRoot, commit, options)
-            : inplaceValidation(config, target, options);
+            : internalHandlerRoute('task-validate', 'inplace', options.scope)
+                ? inplaceValidation(config, target, options)
+                : (() => { throw new Error('TASK_VALIDATE_SCOPE_UNREGISTERED'); })();
         const evidence = {
             version: 1,
             taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,

package/dist/lib/internal/task-verify.js

@@ -2,6 +2,7 @@ import { renderTaskVerification, verifyTaskEvent } from '../task/verification.js
 import { consumeHumanOverride, failureId } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
 function fail(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'VERIFY_PAYLOAD_INVALID', message } })}\n`);
@@ -9,11 +10,14 @@ function fail(message) {
     process.exitCode = 1;
 }
 async function taskVerify(args = []) {
+    if (!ensureInternalHandlerRoute('task-verify', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
-    if (!args[0] || !args[1] || args[0].startsWith('--') || args[1].startsWith('--')) {
+    if (!args[0] || !args[1] || args[0].startsWith('--') || args[1].startsWith('--')
+        || !internalHandlerRoute('task-verify', 'event', args[1] ? 'event' : '')) {
         fail('task ref and verification event are required');
         return;
     }

package/dist/lib/internal/task-warning.js

@@ -2,6 +2,7 @@ import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.js'
 import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-warning <task-ref> <add|set-status|list> [intent flags] [--dry-run]\n`;
 const FLAGS = {
     '--step': 'step', '--severity': 'severity', '--code': 'code', '--target': 'target',
@@ -14,12 +15,18 @@ function usageFailure(message) {
     process.exitCode = 1;
 }
 async function taskWarning(args = []) {
+    if (!ensureInternalHandlerRoute('task-warning', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const [taskRef, kind] = args;
-    if (!taskRef || !kind || !['add', 'set-status', 'list'].includes(kind)) {
+    if (!taskRef || !kind || ![
+        internalHandlerRoute('task-warning', 'add', kind ?? ''),
+        internalHandlerRoute('task-warning', 'set-status', kind ?? ''),
+        internalHandlerRoute('task-warning', 'list', kind ?? '')
+    ].some(Boolean)) {
         usageFailure('task ref and a valid intent are required');
         return;
     }

package/dist/lib/platform/comment-safety.js

@@ -0,0 +1,226 @@
+const CONTROL_MARKER_PATTERN = /<!--\s*(?:sync-issue|sync-pr|last-commit)\b[\s\S]*?-->|<!--\s*canonical-pr-change-report\s*-->/gi;
+function ok(value) {
+    return { ok: true, value };
+}
+function invalid(message, offset) {
+    return { ok: false, error: { code: 'COMMENT_DOCUMENT_INVALID', message, offset } };
+}
+function normalized(value) {
+    return value.replace(/\r\n?/g, '\n');
+}
+function linesOf(value) {
+    const lines = [];
+    let start = 0;
+    while (start < value.length) {
+        const newline = value.indexOf('\n', start);
+        const end = newline === -1 ? value.length : newline;
+        lines.push({ start, end: newline === -1 ? end : newline + 1, text: value.slice(start, end) });
+        start = newline === -1 ? value.length : newline + 1;
+    }
+    if (value.length === 0)
+        lines.push({ start: 0, end: 0, text: '' });
+    return lines;
+}
+function openingFence(line) {
+    const match = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+    if (!match)
+        return null;
+    const character = match[1][0];
+    const info = match[2];
+    if (character === '`' && info.includes('`'))
+        return 'invalid';
+    return { character, length: match[1].length };
+}
+function closesFence(line, fence) {
+    const escaped = fence.character === '`' ? '`' : '~';
+    return new RegExp(`^ {0,3}${escaped}{${fence.length},}[ \\t]*$`).test(line);
+}
+function fenceRanges(value) {
+    const ranges = [];
+    let fence = null;
+    for (const line of linesOf(value)) {
+        if (!fence) {
+            const opening = openingFence(line.text);
+            if (opening === 'invalid')
+                return invalid('fenced code info string is invalid', line.start);
+            if (opening)
+                fence = { ...opening, start: line.start, openingEnd: line.end };
+            continue;
+        }
+        if (closesFence(line.text, fence)) {
+            ranges.push({
+                start: fence.start,
+                end: line.end,
+                openingEnd: fence.openingEnd,
+                closingStart: line.start,
+                character: fence.character,
+                opening: value.slice(fence.start, fence.openingEnd),
+                closing: value.slice(line.start, line.end)
+            });
+            fence = null;
+        }
+    }
+    if (fence)
+        return invalid('fenced code block is not closed', fence.start);
+    return ok(ranges);
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+function escapeHtmlText(value) {
+    return escapeHtml(value);
+}
+function escapeHtmlAttribute(value) {
+    return escapeHtml(value);
+}
+function escapeMarkdownLiteral(value) {
+    return value.replace(/[\\`*_{}\[\]()#+.!|<>-]/g, '\\$&');
+}
+function markerSafe(value, markers) {
+    let result = value;
+    for (const marker of markers) {
+        const flags = marker.flags.includes('g') ? marker.flags : `${marker.flags}g`;
+        const pattern = new RegExp(marker.source, flags);
+        result = result.replace(pattern, (match) => escapeHtmlText(match));
+    }
+    return result;
+}
+function tagEnd(value, start) {
+    let quote = null;
+    for (let index = start + 1; index < value.length; index += 1) {
+        const character = value[index];
+        if (quote) {
+            if (character === quote)
+                quote = null;
+        }
+        else if (character === '"' || character === "'") {
+            quote = character;
+        }
+        else if (character === '>') {
+            return index;
+        }
+    }
+    return -1;
+}
+function isMarkdownAutolink(value, start) {
+    const end = value.indexOf('>', start + 1);
+    if (end === -1)
+        return false;
+    const target = value.slice(start + 1, end);
+    return /^(?:https?:\/\/|mailto:)[^<>\s]+$/i.test(target)
+        || /^[^<>\s@]+@[^<>\s@]+\.[^<>\s@]+$/.test(target);
+}
+function sanitizeOutside(value, baseOffset) {
+    let result = '';
+    let index = 0;
+    while (index < value.length) {
+        if (value.startsWith('<!--', index)) {
+            const end = value.indexOf('-->', index + 4);
+            if (end === -1)
+                return invalid('HTML comment is not closed', baseOffset + index);
+            const token = value.slice(index, end + 3);
+            result += escapeHtmlText(token);
+            index = end + 3;
+            continue;
+        }
+        if (value[index] === '<' && isMarkdownAutolink(value, index)) {
+            const end = value.indexOf('>', index + 1);
+            result += value.slice(index, end + 1);
+            index = end + 1;
+            continue;
+        }
+        if (value[index] === '<' && /[\\/!?A-Za-z]/.test(value[index + 1] || '')) {
+            const end = tagEnd(value, index);
+            if (end === -1)
+                return invalid('HTML-like tag is not closed', baseOffset + index);
+            result += escapeHtmlText(value.slice(index, end + 1));
+            index = end + 1;
+            continue;
+        }
+        result += value[index];
+        index += 1;
+    }
+    return ok(result);
+}
+function sanitizeMarkdownDocument(value, options = {}) {
+    const source = normalized(value);
+    const ranges = fenceRanges(source);
+    if (!ranges.ok)
+        return ranges;
+    const markers = options.reservedMarkers || [];
+    let result = '';
+    let cursor = 0;
+    for (const range of ranges.value) {
+        const outside = sanitizeOutside(source.slice(cursor, range.start), cursor);
+        if (!outside.ok)
+            return outside;
+        result += outside.value;
+        result += markerSafe(source.slice(range.start, range.end), markers);
+        cursor = range.end;
+    }
+    const tail = sanitizeOutside(source.slice(cursor), cursor);
+    if (!tail.ok)
+        return tail;
+    return ok(result + tail.value);
+}
+function renderSafeCodeFence(value, language = '', reservedMarkers = [CONTROL_MARKER_PATTERN]) {
+    const content = markerSafe(normalized(value), reservedMarkers);
+    const longestRun = Math.max(0, ...(content.match(/`+/g) || []).map((run) => run.length));
+    const delimiter = '`'.repeat(Math.max(3, longestRun + 1));
+    const suffix = content.endsWith('\n') ? '' : '\n';
+    return `${delimiter}${language}\n${content}${suffix}${delimiter}`;
+}
+function commentRangesOutsideFences(source, ranges) {
+    const comments = [];
+    let cursor = 0;
+    for (const fence of [...ranges, { start: source.length, end: source.length }]) {
+        const segment = source.slice(cursor, fence.start);
+        let index = 0;
+        while (index < segment.length) {
+            const opening = segment.indexOf('<!--', index);
+            if (opening === -1)
+                break;
+            const absoluteStart = cursor + opening;
+            const closing = segment.indexOf('-->', opening + 4);
+            if (closing === -1)
+                return invalid('HTML comment is not closed', absoluteStart);
+            comments.push({ start: absoluteStart, end: cursor + closing + 3 });
+            index = closing + 3;
+        }
+        cursor = fence.end;
+    }
+    return ok(comments);
+}
+function splitDocumentPlaceholder(value, placeholder) {
+    const source = normalized(value);
+    const ranges = fenceRanges(source);
+    if (!ranges.ok)
+        return ranges;
+    const positions = [];
+    let cursor = source.indexOf(placeholder);
+    while (cursor !== -1) {
+        positions.push(cursor);
+        cursor = source.indexOf(placeholder, cursor + placeholder.length);
+    }
+    if (positions.length !== 1)
+        return invalid('document must contain exactly one placeholder', positions[1] ?? positions[0] ?? source.length);
+    const position = positions[0];
+    if (ranges.value.some((range) => position >= range.start && position < range.end)) {
+        return invalid('placeholder must be outside fenced code', position);
+    }
+    const comments = commentRangesOutsideFences(source, ranges.value);
+    if (!comments.ok)
+        return comments;
+    const containing = comments.value.find((comment) => position >= comment.start && position < comment.end);
+    if (containing && (containing.start !== position || containing.end !== position + placeholder.length)) {
+        return invalid('placeholder must not be nested in another HTML comment', position);
+    }
+    return ok({ prefix: source.slice(0, position), suffix: source.slice(position + placeholder.length) });
+}
+export { CONTROL_MARKER_PATTERN, escapeHtmlAttribute, escapeHtmlText, escapeMarkdownLiteral, fenceRanges, renderSafeCodeFence, sanitizeMarkdownDocument, splitDocumentPlaceholder };
+//# sourceMappingURL=comment-safety.js.map

package/dist/lib/platform/github-provider.js

@@ -5,10 +5,11 @@ import path from 'node:path';
 import semver from 'semver';
 import { createGitHubClient, MINIMUM_GITHUB_CLI_VERSION } from './github-client.js';
 import { resourceIdentityNumber, resourceIdentityString } from './resource-identity.js';
-import { syncLabelDelta } from './in-label-sync.js';
+import { extractPullRequestFileNames, syncLabelDelta } from './in-label-sync.js';
 const CURRENT_USER_QUERY = 'query { viewer { login } }';
 const ISSUE_TYPES_QUERY = `query($owner:String!){organization(login:$owner){issueTypes(first:20){nodes{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}}}}}`;
 const ISSUE_FIELDS_QUERY = `query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){issue(number:$number){id issueType{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}} issueFieldValues(first:50){nodes{__typename ... on IssueFieldSingleSelectValue{name optionId field{... on IssueFieldSingleSelect{id name}}} ... on IssueFieldDateValue{value field{... on IssueFieldDate{id name}}} ... on IssueFieldTextValue{value field{... on IssueFieldText{id name}}} ... on IssueFieldNumberValue{value field{... on IssueFieldNumber{id name}}}}}}}}`;
+const CLOSING_ISSUES_QUERY = 'query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100,after:$cursor){nodes{number} pageInfo{hasNextPage endCursor}}}}}';
 function parseGitHubRemote(remote) {
     const trimmed = remote.trim().replace(/\.git$/, '');
     const match = trimmed.match(/^(?:https?:\/\/github\.com\/|ssh:\/\/(?:git@)?github\.com\/|git@github\.com:)([^/\s]+\/[^/\s]+)$/i);
@@ -289,6 +290,21 @@ function commentSnapshot(value) {
 function createReceipt(remoteId) {
     return { ok: true, value: { changed: true, remoteId } };
 }
+function partialFailure(response, value) {
+    return { ok: false, error: response.error, value };
+}
+function labelReconciliation(created, updated, removed, skipped) {
+    return {
+        changed: created.length > 0 || updated.length > 0 || removed.length > 0,
+        created,
+        updated,
+        removed,
+        skipped
+    };
+}
+function milestoneInitialization(created, skipped) {
+    return { changed: created.length > 0, created, skipped };
+}
 function githubResourceToken(identity) {
     return resourceIdentityString(identity) || (identity?.kind === 'number' ? String(identity.value) : null);
 }
@@ -391,6 +407,20 @@ function createGitHubOperations(client) {
             return { ok: true, value: issueSnapshot(fetched.value, graph || undefined) };
         },
         async create({ context, desired }) {
+            let milestone = null;
+            if (desired.milestone) {
+                const milestones = client.json(['api', '--paginate', '--slurp', `repos/${repository(context)}/milestones?state=open&per_page=100`], { cwd: context.workingDirectory });
+                if (!milestones.ok)
+                    return milestones;
+                const values = Array.isArray(milestones.value)
+                    ? milestones.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry])
+                    : [];
+                const selected = values.find((item) => item?.title === desired.milestone);
+                if (!Number.isSafeInteger(selected?.number) || selected.number <= 0) {
+                    return invalid('MILESTONE_IDENTITY_INVALID', 'Milestone title does not resolve to a positive number');
+                }
+                milestone = selected.number;
+            }
             const response = client.json(['api', `repos/${repository(context)}/issues`, '-X', 'POST', '--input', '-'], {
                 cwd: context.workingDirectory,
                 method: 'POST',
@@ -399,7 +429,7 @@ function createGitHubOperations(client) {
                     body: desired.body,
                     labels: desired.labels,
                     assignees: desired.assignees,
-                    ...(desired.milestone ? { milestone: desired.milestone } : {})
+                    ...(milestone ? { milestone } : {})
                 })
             });
             if (!response.ok)
@@ -582,6 +612,61 @@ function createGitHubOperations(client) {
                 return fetched;
             return { ok: true, value: changeRequestSnapshot(fetched.value) };
         },
+        async listFiles({ context, target }) {
+            const number = resourceIdentityNumber(target);
+            if (!number)
+                return invalid('PR_NUMBER_INVALID', 'Pull request number must be positive');
+            const response = client.json(['api', '--paginate', '--slurp', `repos/${repository(context)}/pulls/${number}/files?per_page=100`], { cwd: context.workingDirectory });
+            if (!response.ok)
+                return response;
+            const files = extractPullRequestFileNames(response.value);
+            return files
+                ? { ok: true, value: files }
+                : invalid('IN_LABEL_SYNC_FILES_INVALID', 'Pull request files response is incomplete');
+        },
+        async listClosingIssues({ context, target }) {
+            const number = resourceIdentityNumber(target);
+            if (!number)
+                return invalid('PR_NUMBER_INVALID', 'Pull request number must be positive');
+            const [owner, name] = repository(context).split('/');
+            if (!owner || !name)
+                return invalid('IN_LABEL_SYNC_REPOSITORY_INVALID', 'Repository identity is invalid');
+            const identities = [];
+            let cursor = null;
+            for (;;) {
+                const args = ['api', 'graphql', '-f', `query=${CLOSING_ISSUES_QUERY}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `number=${number}`];
+                if (cursor)
+                    args.push('-F', `cursor=${cursor}`);
+                const response = client.json(args, { cwd: context.workingDirectory });
+                if (!response.ok)
+                    return response;
+                const connection = response.value?.data?.repository?.pullRequest?.closingIssuesReferences;
+                if (!connection || !Array.isArray(connection.nodes) || !connection.pageInfo) {
+                    return invalid('IN_LABEL_SYNC_ASSOCIATION_INVALID', 'Closing Issue response is incomplete');
+                }
+                for (const node of connection.nodes) {
+                    const issue = Number(node?.number);
+                    if (!Number.isSafeInteger(issue) || issue <= 0) {
+                        return invalid('IN_LABEL_SYNC_ASSOCIATION_INVALID', 'Closing Issue identity is invalid');
+                    }
+                    identities.push({ kind: 'number', value: issue });
+                }
+                if (!connection.pageInfo.hasNextPage) {
+                    const seen = new Set();
+                    return { ok: true, value: identities.filter((identity) => {
+                            const key = `${identity.kind}:${identity.value}`;
+                            if (seen.has(key))
+                                return false;
+                            seen.add(key);
+                            return true;
+                        }) };
+                }
+                if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor) {
+                    return invalid('IN_LABEL_SYNC_ASSOCIATION_INVALID', 'Closing Issue pagination cursor is invalid');
+                }
+                cursor = connection.pageInfo.endCursor;
+            }
+        },
         async listClosing({ context, issue }) {
             const number = resourceIdentityNumber(issue);
             if (!number)
@@ -855,23 +940,165 @@ function createGitHubOperations(client) {
             };
         }
     };
+    const securityAlerts = {
+        async inspect({ context, kind, number }) {
+            if (!Number.isSafeInteger(number) || number <= 0)
+                return invalid('SECURITY_NUMBER_INVALID', 'Alert number must be a positive integer');
+            const suffix = kind === 'dependabot' ? 'dependabot' : kind === 'code-scanning' ? 'code-scanning' : null;
+            if (!suffix)
+                return invalid('SECURITY_KIND_INVALID', 'Alert kind is invalid');
+            const response = client.json(['api', `repos/${repository(context)}/${suffix}/alerts/${number}`], { cwd: context.workingDirectory });
+            if (!response.ok)
+                return response;
+            const data = response.value;
+            if (!data || typeof data !== 'object' || Array.isArray(data))
+                return invalid('SECURITY_RESPONSE_INVALID', 'The platform returned an invalid security alert');
+            const value = {
+                kind,
+                number,
+                state: typeof data.state === 'string' ? data.state : 'invalid',
+                data
+            };
+            return { ok: true, value };
+        },
+        async dismiss({ context, kind, number, reason, comment }) {
+            const suffix = kind === 'dependabot' ? 'dependabot' : kind === 'code-scanning' ? 'code-scanning' : null;
+            if (!suffix)
+                return invalid('SECURITY_KIND_INVALID', 'Alert kind is invalid');
+            if (!Number.isSafeInteger(number) || number <= 0)
+                return invalid('SECURITY_NUMBER_INVALID', 'Alert number must be a positive integer');
+            const response = client.json(['api', `repos/${repository(context)}/${suffix}/alerts/${number}`, '-X', 'PATCH', '--input', '-'], {
+                cwd: context.workingDirectory,
+                method: 'PATCH',
+                input: JSON.stringify({ state: 'dismissed', dismissed_reason: reason, dismissed_comment: comment })
+            });
+            if (!response.ok)
+                return response;
+            return createReceipt(String(response.value?.id || `${kind}:${number}`));
+        }
+    };
+    const repositoryMetadata = {
+        async reconcileLabels({ context, desired, cleanupStaleIn }) {
+            const endpoint = `repos/${repository(context)}/labels?per_page=100`;
+            const listed = client.json(['api', '--paginate', '--slurp', endpoint], { cwd: context.workingDirectory });
+            if (!listed.ok)
+                return listed;
+            if (!Array.isArray(listed.value))
+                return invalid('LABEL_RESPONSE_INVALID', 'The platform returned an invalid label list');
+            const values = Array.isArray(listed.value)
+                ? listed.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry])
+                : [];
+            if (values.some((entry) => !entry || typeof entry.name !== 'string' || !entry.name)) {
+                return invalid('LABEL_RESPONSE_INVALID', 'The platform returned a label without a valid name');
+            }
+            const current = new Map(values.map((entry) => [String(entry.name), entry]));
+            const created = [];
+            const updated = [];
+            const skipped = [];
+            const removed = [];
+            for (const label of desired) {
+                const existing = current.get(label.name);
+                if (!existing) {
+                    const response = client.json(['api', `repos/${repository(context)}/labels`, '-X', 'POST', '--input', '-'], {
+                        cwd: context.workingDirectory,
+                        method: 'POST',
+                        input: JSON.stringify({ name: label.name, color: label.color, description: label.description })
+                    });
+                    if (!response.ok)
+                        return partialFailure(response, labelReconciliation(created, updated, removed, skipped));
+                    created.push(label.name);
+                    continue;
+                }
+                const sameColor = typeof existing.color === 'string' && existing.color.toUpperCase() === label.color.toUpperCase();
+                const sameDescription = String(existing.description || '') === label.description;
+                if (sameColor && sameDescription) {
+                    skipped.push(label.name);
+                    continue;
+                }
+                const response = client.json(['api', `repos/${repository(context)}/labels/${encodeURIComponent(label.name)}`, '-X', 'PATCH', '--input', '-'], {
+                    cwd: context.workingDirectory,
+                    method: 'PATCH',
+                    input: JSON.stringify({ new_name: label.name, color: label.color, description: label.description })
+                });
+                if (!response.ok)
+                    return partialFailure(response, labelReconciliation(created, updated, removed, skipped));
+                updated.push(label.name);
+            }
+            const desiredNames = new Set(desired.map((label) => label.name));
+            if (cleanupStaleIn) {
+                for (const name of current.keys()) {
+                    if (!name.startsWith('in:') || desiredNames.has(name))
+                        continue;
+                    const response = client.text(['api', `repos/${repository(context)}/labels/${encodeURIComponent(name)}`, '-X', 'DELETE'], {
+                        cwd: context.workingDirectory,
+                        method: 'DELETE'
+                    });
+                    if (!response.ok)
+                        return partialFailure(response, labelReconciliation(created, updated, removed, skipped));
+                    removed.push(name);
+                }
+            }
+            return {
+                ok: true,
+                value: {
+                    changed: created.length > 0 || updated.length > 0 || removed.length > 0,
+                    created,
+                    updated,
+                    removed,
+                    skipped
+                }
+            };
+        },
+        async reconcileMilestones({ context, desired }) {
+            const listed = client.json(['api', '--paginate', '--slurp', `repos/${repository(context)}/milestones?state=all&per_page=100`], { cwd: context.workingDirectory });
+            if (!listed.ok)
+                return listed;
+            if (!Array.isArray(listed.value))
+                return invalid('MILESTONE_RESPONSE_INVALID', 'The platform returned an invalid milestone list');
+            const values = Array.isArray(listed.value)
+                ? listed.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry])
+                : [];
+            if (values.some((entry) => !entry || typeof entry.title !== 'string' || !entry.title)) {
+                return invalid('MILESTONE_RESPONSE_INVALID', 'The platform returned a milestone without a valid title');
+            }
+            const existing = new Set(values.map((entry) => String(entry.title)));
+            const created = [];
+            const skipped = [];
+            for (const milestone of desired) {
+                if (existing.has(milestone.title)) {
+                    skipped.push(milestone.title);
+                    continue;
+                }
+                const response = client.json(['api', `repos/${repository(context)}/milestones`, '-X', 'POST', '--input', '-'], {
+                    cwd: context.workingDirectory,
+                    method: 'POST',
+                    input: JSON.stringify({ title: milestone.title, description: milestone.description, state: milestone.state })
+                });
+                if (!response.ok)
+                    return partialFailure(response, milestoneInitialization(created, skipped));
+                existing.add(milestone.title);
+                created.push(milestone.title);
+            }
+            return { ok: true, value: { changed: created.length > 0, created, skipped } };
+        }
+    };
     const verification = {
         async fetchRemoteFacts(input) {
             const issue = input.issue && issues.inspect
                 ? await issues.inspect({ context: input.context, target: input.issue })
                 : { ok: true, value: null };
             if (!issue.ok)
-                return issue;
+                return { ok: false, error: issue.error };
             const commentFacts = input.includeComments && input.issue && comments.list
                 ? await comments.list({ context: input.context, parent: input.issue })
                 : { ok: true, value: [] };
             if (!commentFacts.ok)
-                return commentFacts;
+                return { ok: false, error: commentFacts.error };
             const changeRequest = input.changeRequest && changeRequests.inspect
                 ? await changeRequests.inspect({ context: input.context, target: input.changeRequest })
                 : { ok: true, value: null };
             if (!changeRequest.ok)
-                return changeRequest;
+                return { ok: false, error: changeRequest.error };
             return {
                 ok: true,
                 value: {
@@ -884,7 +1111,7 @@ function createGitHubOperations(client) {
             };
         }
     };
-    return { issues, comments, changeRequests, checks, reviews, releases, verification };
+    return { issues, comments, changeRequests, checks, reviews, releases, securityAlerts, repositoryMetadata, verification };
 }
 function createGitHubProvider(input, client = createGitHubClient()) {
     return {