@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/platform/completion-backfill.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { COMPLETION_BACKFILL_FAMILIES, inspectCompletionArtifacts } from '../task/finalization-artifacts.js';
-import { parseArtifactName } from '../task/artifact-lifecycle.js';
+import { parseArtifactName } from '../task/artifact-name.js';
 import { parseTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { getOpenWorkflowWarnings } from '../task/workflow-warnings.js';

package/dist/lib/platform/github-data.js

@@ -0,0 +1,241 @@
+import { checkStatusBucket } from './check-status.js';
+const ISSUE_FIELDS_QUERY = `query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){issue(number:$number){id issueType{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}} issueFieldValues(first:50){nodes{__typename ... on IssueFieldSingleSelectValue{name optionId field{... on IssueFieldSingleSelect{id name}}} ... on IssueFieldDateValue{value field{... on IssueFieldDate{id name}}} ... on IssueFieldTextValue{value field{... on IssueFieldText{id name}}} ... on IssueFieldNumberValue{value field{... on IssueFieldNumber{id name}}}}}}}}`;
+function normalizeIssue(remote, repository, fallbackNumber) {
+    const number = Number.isInteger(remote.number) && Number(remote.number) > 0
+        ? Number(remote.number)
+        : fallbackNumber;
+    if (!number || !Number.isSafeInteger(number) || remote.pull_request)
+        return null;
+    return {
+        repository,
+        number,
+        databaseId: Number.isInteger(remote.id) ? Number(remote.id) : null,
+        nodeId: remote.node_id || `issue-${number}`,
+        url: remote.html_url || `https://github.com/${repository}/issues/${number}`,
+        state: String(remote.state || '').toLowerCase() === 'closed' ? 'closed' : 'open',
+        title: remote.title || '',
+        body: remote.body || '',
+        labels: (remote.labels || []).map((label) => typeof label === 'string' ? label : label.name || '').filter(Boolean).sort(),
+        assignees: (remote.assignees || []).map((assignee) => assignee.login || '').filter(Boolean).sort(),
+        milestone: remote.milestone?.title || null,
+        issueType: remote.type?.name || null,
+        fields: {}
+    };
+}
+function fieldKind(value) {
+    if (value.__typename === 'IssueFieldSingleSelect' || value.__typename === 'IssueFieldSingleSelectValue')
+        return 'single-select';
+    if (value.__typename === 'IssueFieldDate' || value.__typename === 'IssueFieldDateValue')
+        return 'date';
+    if (value.__typename === 'IssueFieldText' || value.__typename === 'IssueFieldTextValue')
+        return 'text';
+    if (value.__typename === 'IssueFieldNumber' || value.__typename === 'IssueFieldNumberValue')
+        return 'number';
+    return null;
+}
+function normalizeFieldSchemas(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.flatMap((raw) => {
+        const item = raw;
+        const kind = fieldKind(item);
+        return item.id && item.name && kind ? [{
+                id: item.id,
+                name: item.name,
+                kind,
+                options: (item.options || []).flatMap((option) => option.id && option.name ? [{ id: option.id, name: option.name }] : [])
+            }] : [];
+    });
+}
+function normalizeCurrentFields(value) {
+    const issue = value?.data?.repository?.issue;
+    const type = issue?.issueType?.name ? {
+        id: issue.issueType.id || issue.issueType.name,
+        name: issue.issueType.name,
+        fields: normalizeFieldSchemas(issue.issueType.pinnedFields)
+    } : null;
+    const values = (issue?.issueFieldValues?.nodes || []).flatMap((raw) => {
+        const item = raw;
+        const kind = fieldKind(item);
+        const value = kind === 'single-select' ? item.name : item.value;
+        return item.field?.name && kind && value !== undefined
+            ? [{ id: item.field.id || item.field.name, name: item.field.name, kind, value: value ?? null }]
+            : [];
+    });
+    return { issueId: issue?.id || null, type, values };
+}
+function graphState(client, repository, issue, cwd) {
+    const [owner, name] = repository.split('/');
+    if (!owner || !name)
+        return null;
+    const current = client.json([
+        'api', 'graphql', '-f', `query=${ISSUE_FIELDS_QUERY}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `number=${issue}`
+    ], { cwd });
+    if (!current.ok)
+        return null;
+    return normalizeCurrentFields(current.value);
+}
+function fetchIssue(client, repository, issue, cwd) {
+    return client.json(['api', `repos/${repository}/issues/${issue}`], { cwd });
+}
+function inspectGitHubIssue(client, repository, issue, cwd) {
+    const fetched = fetchIssue(client, repository, issue, cwd);
+    if (!fetched.ok)
+        return fetched;
+    const snapshot = normalizeIssue(fetched.value, repository, issue);
+    return snapshot
+        ? { ok: true, value: snapshot }
+        : { ok: false, error: { code: 'ISSUE_IDENTITY_INVALID', message: 'Remote resource is not a valid Issue', retryable: false } };
+}
+const CLOSING_PULL_REQUESTS_QUERY = `query($owner:String!,$name:String!,$issue:Int!,$cursor:String){repository(owner:$owner,name:$name){issue(number:$issue){closedByPullRequestsReferences(first:100,after:$cursor){nodes{number id url state title body isDraft headRefName headRefOid headRepository{nameWithOwner} baseRefName baseRefOid baseRepository{nameWithOwner} mergedAt mergeCommit{oid} labels(first:100){nodes{name}} assignees(first:100){nodes{login}} milestone{title}} pageInfo{hasNextPage endCursor}}}}}`;
+function normalizePullRequest(remote, repository) {
+    const number = Number(remote.number);
+    const headRepository = remote.head?.repo?.full_name;
+    const baseRepository = remote.base?.repo?.full_name;
+    if (!Number.isInteger(number) || number <= 0 || !remote.node_id || !remote.html_url ||
+        !remote.head?.ref || !remote.head.sha || !headRepository || !remote.base?.ref || !baseRepository)
+        return null;
+    const mergeabilityDetail = remote.mergeable_state?.trim().toLowerCase() || null;
+    const mergeability = remote.mergeable === false
+        ? { state: 'conflicting', detail: mergeabilityDetail }
+        : remote.mergeable === true && mergeabilityDetail !== 'dirty'
+            ? { state: 'mergeable', detail: mergeabilityDetail }
+            : { state: 'unknown', detail: mergeabilityDetail };
+    return {
+        repository,
+        number,
+        nodeId: remote.node_id,
+        url: remote.html_url,
+        state: remote.state === 'closed' ? 'closed' : 'open',
+        title: remote.title || '',
+        body: remote.body || '',
+        draft: Boolean(remote.draft),
+        head: { repository: headRepository, ref: remote.head.ref, sha: remote.head.sha },
+        base: { repository: baseRepository, ref: remote.base.ref, sha: remote.base.sha || '' },
+        mergedAt: remote.merged_at || null,
+        mergeCommitSha: remote.merge_commit_sha || null,
+        labels: (remote.labels || []).map((label) => typeof label === 'string' ? label : label.name || '').filter(Boolean).sort(),
+        assignees: (remote.assignees || []).map((assignee) => assignee.login || '').filter(Boolean).sort(),
+        milestone: remote.milestone?.title || null,
+        mergeability
+    };
+}
+function normalizeClosingPullRequest(node, repository) {
+    return normalizePullRequest({
+        number: node.number,
+        node_id: node.id,
+        html_url: node.url,
+        state: node.state === 'OPEN' ? 'open' : 'closed',
+        title: node.title,
+        body: node.body,
+        draft: node.isDraft,
+        head: { ref: node.headRefName, sha: node.headRefOid, repo: node.headRepository ? { full_name: node.headRepository.nameWithOwner } : null },
+        base: { ref: node.baseRefName, sha: node.baseRefOid, repo: node.baseRepository ? { full_name: node.baseRepository.nameWithOwner } : null },
+        merged_at: node.mergedAt,
+        merge_commit_sha: node.mergeCommit?.oid,
+        labels: node.labels?.nodes,
+        assignees: node.assignees?.nodes,
+        milestone: node.milestone
+    }, repository);
+}
+function inspectGitHubIssueClosingChangeRequests(client, repository, issueNumber, cwd) {
+    const [owner, name] = repository.split('/');
+    if (!owner || !name || !Number.isInteger(issueNumber) || issueNumber <= 0)
+        return {
+            ok: false,
+            error: { code: 'PR_IDENTITY_INVALID', message: 'Repository or Issue identity is invalid', retryable: false }
+        };
+    const candidates = [];
+    let cursor = null;
+    for (;;) {
+        const args = [
+            'api', 'graphql', '-f', `query=${CLOSING_PULL_REQUESTS_QUERY}`,
+            '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `issue=${issueNumber}`
+        ];
+        if (cursor)
+            args.push('-F', `cursor=${cursor}`);
+        const response = client.json(args, { cwd });
+        if (!response.ok)
+            return response;
+        const connection = response.value?.data?.repository?.issue?.closedByPullRequestsReferences;
+        if (!connection || !Array.isArray(connection.nodes) || !connection.pageInfo)
+            return {
+                ok: false,
+                error: { code: 'PR_IDENTITY_INVALID', message: 'Closing pull request response is incomplete', retryable: false }
+            };
+        for (const node of connection.nodes) {
+            const normalized = normalizeClosingPullRequest(node, repository);
+            if (!normalized)
+                return {
+                    ok: false,
+                    error: { code: 'PR_IDENTITY_INVALID', message: 'Closing pull request identity is incomplete', retryable: false }
+                };
+            candidates.push(normalized);
+        }
+        if (!connection.pageInfo.hasNextPage)
+            return { ok: true, value: candidates };
+        if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor)
+            return {
+                ok: false,
+                error: { code: 'PR_IDENTITY_INVALID', message: 'Closing pull request pagination cursor is invalid', retryable: false }
+            };
+        cursor = connection.pageInfo.endCursor;
+    }
+}
+function inspectGitHubPullRequest(client, repository, number, cwd) {
+    const fetched = client.json(['api', `repos/${repository}/pulls/${number}`], { cwd });
+    if (!fetched.ok)
+        return fetched;
+    const pullRequest = normalizePullRequest(fetched.value, repository);
+    return pullRequest
+        ? { ok: true, value: pullRequest }
+        : { ok: false, error: { code: 'PR_IDENTITY_INVALID', message: 'Remote resource is not a valid pull request', retryable: false } };
+}
+function normalizeGitHubChecks(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.flatMap((raw) => {
+        const item = raw;
+        const name = String(item.name || item.context || '');
+        return name ? [{
+                name,
+                status: checkStatusBucket(String(item.bucket || item.status || item.conclusion || item.state || '')),
+                conclusion: item.conclusion ? String(item.conclusion) : item.state ? String(item.state) : null,
+                detailsUrl: item.link ? String(item.link) : item.detailsUrl ? String(item.detailsUrl) : null
+            }] : [];
+    });
+}
+function inspectGitHubRequiredChecks(client, repository, number, cwd) {
+    const inspected = client.json([
+        'pr', 'checks', String(number), '--repo', repository,
+        '--json', 'name,state,bucket,link,workflow,startedAt,completedAt'
+    ], { cwd });
+    return inspected.ok
+        ? { ok: true, value: normalizeGitHubChecks(inspected.value) }
+        : { ok: false, error: inspected.error };
+}
+function parseRunJobIdentity(detailsUrl) {
+    try {
+        const url = new URL(detailsUrl);
+        if (url.hostname !== 'github.com')
+            return null;
+        const match = url.pathname.match(/\/actions\/runs\/(\d+)(?:\/job\/(\d+))?/);
+        if (!match)
+            return null;
+        return { runId: Number(match[1]), jobId: match[2] ? Number(match[2]) : null };
+    }
+    catch {
+        return null;
+    }
+}
+function fetchCheckLogText(client, args, cwd) {
+    if (!client.text)
+        return { ok: false, error: { code: 'PLATFORM_CLIENT_TEXT_UNAVAILABLE', message: 'Platform client does not support text responses', retryable: false } };
+    const fetched = client.text(args, { cwd });
+    if (fetched.ok || args[0] !== 'api' || !/response contains terminal escape sequences/i.test(fetched.error.message)) {
+        return fetched;
+    }
+    return client.text([...args, '--allow-escape-sequences'], { cwd });
+}
+export { ISSUE_FIELDS_QUERY, graphState, inspectGitHubIssue, normalizePullRequest, inspectGitHubIssueClosingChangeRequests, inspectGitHubPullRequest, inspectGitHubRequiredChecks, parseRunJobIdentity, fetchCheckLogText };
+//# sourceMappingURL=github-data.js.map

package/dist/lib/platform/github-provider.js

@@ -1,3 +1,4 @@
+import { ISSUE_FIELDS_QUERY, graphState, inspectGitHubIssue, inspectGitHubPullRequest, inspectGitHubIssueClosingChangeRequests, inspectGitHubRequiredChecks, parseRunJobIdentity, fetchCheckLogText } from './github-data.js';
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -5,10 +6,10 @@ import path from 'node:path';
 import semver from 'semver';
 import { createGitHubClient, MINIMUM_GITHUB_CLI_VERSION } from './github-client.js';
 import { resourceIdentityNumber, resourceIdentityString } from './resource-identity.js';
-import { syncLabelDelta } from './in-label-sync.js';
+import { extractPullRequestFileNames, syncLabelDelta } from './in-label-sync.js';
 const CURRENT_USER_QUERY = 'query { viewer { login } }';
 const ISSUE_TYPES_QUERY = `query($owner:String!){organization(login:$owner){issueTypes(first:20){nodes{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}}}}}`;
-const ISSUE_FIELDS_QUERY = `query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){issue(number:$number){id issueType{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}} issueFieldValues(first:50){nodes{__typename ... on IssueFieldSingleSelectValue{name optionId field{... on IssueFieldSingleSelect{id name}}} ... on IssueFieldDateValue{value field{... on IssueFieldDate{id name}}} ... on IssueFieldTextValue{value field{... on IssueFieldText{id name}}} ... on IssueFieldNumberValue{value field{... on IssueFieldNumber{id name}}}}}}}}`;
+const CLOSING_ISSUES_QUERY = 'query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100,after:$cursor){nodes{number} pageInfo{hasNextPage endCursor}}}}}';
 function parseGitHubRemote(remote) {
     const trimmed = remote.trim().replace(/\.git$/, '');
     const match = trimmed.match(/^(?:https?:\/\/github\.com\/|ssh:\/\/(?:git@)?github\.com\/|git@github\.com:)([^/\s]+\/[^/\s]+)$/i);
@@ -289,6 +290,21 @@ function commentSnapshot(value) {
 function createReceipt(remoteId) {
     return { ok: true, value: { changed: true, remoteId } };
 }
+function partialFailure(response, value) {
+    return { ok: false, error: response.error, value };
+}
+function labelReconciliation(created, updated, removed, skipped) {
+    return {
+        changed: created.length > 0 || updated.length > 0 || removed.length > 0,
+        created,
+        updated,
+        removed,
+        skipped
+    };
+}
+function milestoneInitialization(created, skipped) {
+    return { changed: created.length > 0, created, skipped };
+}
 function githubResourceToken(identity) {
     return resourceIdentityString(identity) || (identity?.kind === 'number' ? String(identity.value) : null);
 }
@@ -383,14 +399,27 @@ function createGitHubOperations(client) {
             const number = resourceIdentityNumber(target);
             if (!number)
                 return invalid('ISSUE_NUMBER_INVALID', 'Issue number must be positive');
-            const module = await import('./issues.js');
-            const fetched = module.inspectGitHubIssue(client, repository(context), number, context.workingDirectory);
+            const fetched = inspectGitHubIssue(client, repository(context), number, context.workingDirectory);
             if (!fetched.ok)
                 return fetched;
-            const graph = module.graphState(client, repository(context), number, context.workingDirectory);
+            const graph = graphState(client, repository(context), number, context.workingDirectory);
             return { ok: true, value: issueSnapshot(fetched.value, graph || undefined) };
         },
         async create({ context, desired }) {
+            let milestone = null;
+            if (desired.milestone) {
+                const milestones = client.json(['api', '--paginate', '--slurp', `repos/${repository(context)}/milestones?state=open&per_page=100`], { cwd: context.workingDirectory });
+                if (!milestones.ok)
+                    return milestones;
+                const values = Array.isArray(milestones.value)
+                    ? milestones.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry])
+                    : [];
+                const selected = values.find((item) => item?.title === desired.milestone);
+                if (!Number.isSafeInteger(selected?.number) || selected.number <= 0) {
+                    return invalid('MILESTONE_IDENTITY_INVALID', 'Milestone title does not resolve to a positive number');
+                }
+                milestone = selected.number;
+            }
             const response = client.json(['api', `repos/${repository(context)}/issues`, '-X', 'POST', '--input', '-'], {
                 cwd: context.workingDirectory,
                 method: 'POST',
@@ -399,7 +428,7 @@ function createGitHubOperations(client) {
                     body: desired.body,
                     labels: desired.labels,
                     assignees: desired.assignees,
-                    ...(desired.milestone ? { milestone: desired.milestone } : {})
+                    ...(milestone ? { milestone } : {})
                 })
             });
             if (!response.ok)
@@ -576,18 +605,71 @@ function createGitHubOperations(client) {
             const number = resourceIdentityNumber(target);
             if (!number)
                 return invalid('PR_NUMBER_INVALID', 'Pull request number must be positive');
-            const module = await import('./pull-requests.js');
-            const fetched = module.inspectGitHubPullRequest(client, repository(context), number, context.workingDirectory);
+            const fetched = inspectGitHubPullRequest(client, repository(context), number, context.workingDirectory);
             if (!fetched.ok)
                 return fetched;
             return { ok: true, value: changeRequestSnapshot(fetched.value) };
         },
+        async listFiles({ context, target }) {
+            const number = resourceIdentityNumber(target);
+            if (!number)
+                return invalid('PR_NUMBER_INVALID', 'Pull request number must be positive');
+            const response = client.json(['api', '--paginate', '--slurp', `repos/${repository(context)}/pulls/${number}/files?per_page=100`], { cwd: context.workingDirectory });
+            if (!response.ok)
+                return response;
+            const files = extractPullRequestFileNames(response.value);
+            return files
+                ? { ok: true, value: files }
+                : invalid('IN_LABEL_SYNC_FILES_INVALID', 'Pull request files response is incomplete');
+        },
+        async listClosingIssues({ context, target }) {
+            const number = resourceIdentityNumber(target);
+            if (!number)
+                return invalid('PR_NUMBER_INVALID', 'Pull request number must be positive');
+            const [owner, name] = repository(context).split('/');
+            if (!owner || !name)
+                return invalid('IN_LABEL_SYNC_REPOSITORY_INVALID', 'Repository identity is invalid');
+            const identities = [];
+            let cursor = null;
+            for (;;) {
+                const args = ['api', 'graphql', '-f', `query=${CLOSING_ISSUES_QUERY}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `number=${number}`];
+                if (cursor)
+                    args.push('-F', `cursor=${cursor}`);
+                const response = client.json(args, { cwd: context.workingDirectory });
+                if (!response.ok)
+                    return response;
+                const connection = response.value?.data?.repository?.pullRequest?.closingIssuesReferences;
+                if (!connection || !Array.isArray(connection.nodes) || !connection.pageInfo) {
+                    return invalid('IN_LABEL_SYNC_ASSOCIATION_INVALID', 'Closing Issue response is incomplete');
+                }
+                for (const node of connection.nodes) {
+                    const issue = Number(node?.number);
+                    if (!Number.isSafeInteger(issue) || issue <= 0) {
+                        return invalid('IN_LABEL_SYNC_ASSOCIATION_INVALID', 'Closing Issue identity is invalid');
+                    }
+                    identities.push({ kind: 'number', value: issue });
+                }
+                if (!connection.pageInfo.hasNextPage) {
+                    const seen = new Set();
+                    return { ok: true, value: identities.filter((identity) => {
+                            const key = `${identity.kind}:${identity.value}`;
+                            if (seen.has(key))
+                                return false;
+                            seen.add(key);
+                            return true;
+                        }) };
+                }
+                if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor) {
+                    return invalid('IN_LABEL_SYNC_ASSOCIATION_INVALID', 'Closing Issue pagination cursor is invalid');
+                }
+                cursor = connection.pageInfo.endCursor;
+            }
+        },
         async listClosing({ context, issue }) {
             const number = resourceIdentityNumber(issue);
             if (!number)
                 return invalid('ISSUE_NUMBER_INVALID', 'Issue number must be positive');
-            const module = await import('./pull-requests.js');
-            const fetched = module.inspectGitHubIssueClosingChangeRequests(client, repository(context), number, context.workingDirectory);
+            const fetched = inspectGitHubIssueClosingChangeRequests(client, repository(context), number, context.workingDirectory);
             if (!fetched.ok)
                 return fetched;
             return { ok: true, value: fetched.value.map(changeRequestSnapshot) };
@@ -671,8 +753,7 @@ function createGitHubOperations(client) {
             const number = resourceIdentityNumber(target);
             if (!number)
                 return invalid('PR_NUMBER_INVALID', 'Pull request number must be positive');
-            const module = await import('./github-provider.js');
-            return module.resolveGitHubChangeRequestGitEvidence({
+            return resolveGitHubChangeRequestGitEvidence({
                 cwd: context.workingDirectory,
                 repository: repository(context),
                 number,
@@ -686,18 +767,13 @@ function createGitHubOperations(client) {
             const number = resourceIdentityNumber(changeRequest);
             if (!number)
                 return invalid('PR_NUMBER_INVALID', 'Pull request number must be positive');
-            const module = await import('./pr-checks.js');
-            const fetched = module.inspectGitHubRequiredChecks(client, repository(context), number, context.workingDirectory);
-            if (!fetched.ok)
-                return fetched;
-            return { ok: true, value: fetched.value.map((check) => ({ name: check.name, status: check.bucket, conclusion: check.conclusion, detailsUrl: check.detailsUrl })) };
+            return inspectGitHubRequiredChecks(client, repository(context), number, context.workingDirectory);
         },
         async resolveRun({ context, changeRequest, checkName, detailsUrl }) {
             const number = resourceIdentityNumber(changeRequest);
             if (!number)
                 return invalid('PR_NUMBER_INVALID', 'Pull request number must be positive');
-            const module = await import('./pr-checks.js');
-            const direct = detailsUrl ? module.parseRunJobIdentity(detailsUrl) : null;
+            const direct = detailsUrl ? parseRunJobIdentity(detailsUrl) : null;
             if (direct) {
                 const run = client.json(['api', `repos/${repository(context)}/actions/runs/${direct.runId}`], { cwd: context.workingDirectory });
                 if (!run.ok)
@@ -713,11 +789,10 @@ function createGitHubOperations(client) {
                 : invalid('CHECK_RUN_NOT_FOUND', 'Check run was not found');
         },
         async fetchLogs({ context, runId, jobId }) {
-            const module = await import('./pr-checks.js');
             const args = jobId
                 ? ['api', `repos/${repository(context)}/actions/jobs/${jobId}/logs`]
                 : ['run', 'view', runId, '--repo', repository(context), '--log-failed'];
-            const fetched = module.fetchCheckLogText(client, args, context.workingDirectory);
+            const fetched = fetchCheckLogText(client, args, context.workingDirectory);
             if (!fetched.ok)
                 return fetched;
             return { ok: true, value: { runId, jobId, text: fetched.value || '' } };
@@ -798,7 +873,12 @@ function createGitHubOperations(client) {
                     }
                     continue;
                 }
-                const response = client.json(['api', '--method', 'POST', `repos/${repository(context)}/milestones`, '-f', `title=${item.title}`, '-f', `description=${item.description}`], { cwd: context.workingDirectory });
+                const response = client.json([
+                    'api', '--method', 'POST', `repos/${repository(context)}/milestones`,
+                    '-f', `title=${item.title}`,
+                    '-f', `description=${item.description}`,
+                    '-f', `state=${item.state}`
+                ], { cwd: context.workingDirectory });
                 if (!response.ok)
                     return response;
                 created.push(item.title);
@@ -855,23 +935,165 @@ function createGitHubOperations(client) {
             };
         }
     };
+    const securityAlerts = {
+        async inspect({ context, kind, number }) {
+            if (!Number.isSafeInteger(number) || number <= 0)
+                return invalid('SECURITY_NUMBER_INVALID', 'Alert number must be a positive integer');
+            const suffix = kind === 'dependabot' ? 'dependabot' : kind === 'code-scanning' ? 'code-scanning' : null;
+            if (!suffix)
+                return invalid('SECURITY_KIND_INVALID', 'Alert kind is invalid');
+            const response = client.json(['api', `repos/${repository(context)}/${suffix}/alerts/${number}`], { cwd: context.workingDirectory });
+            if (!response.ok)
+                return response;
+            const data = response.value;
+            if (!data || typeof data !== 'object' || Array.isArray(data))
+                return invalid('SECURITY_RESPONSE_INVALID', 'The platform returned an invalid security alert');
+            const value = {
+                kind,
+                number,
+                state: typeof data.state === 'string' ? data.state : 'invalid',
+                data
+            };
+            return { ok: true, value };
+        },
+        async dismiss({ context, kind, number, reason, comment }) {
+            const suffix = kind === 'dependabot' ? 'dependabot' : kind === 'code-scanning' ? 'code-scanning' : null;
+            if (!suffix)
+                return invalid('SECURITY_KIND_INVALID', 'Alert kind is invalid');
+            if (!Number.isSafeInteger(number) || number <= 0)
+                return invalid('SECURITY_NUMBER_INVALID', 'Alert number must be a positive integer');
+            const response = client.json(['api', `repos/${repository(context)}/${suffix}/alerts/${number}`, '-X', 'PATCH', '--input', '-'], {
+                cwd: context.workingDirectory,
+                method: 'PATCH',
+                input: JSON.stringify({ state: 'dismissed', dismissed_reason: reason, dismissed_comment: comment })
+            });
+            if (!response.ok)
+                return response;
+            return createReceipt(String(response.value?.id || `${kind}:${number}`));
+        }
+    };
+    const repositoryMetadata = {
+        async reconcileLabels({ context, desired, cleanupStaleIn }) {
+            const endpoint = `repos/${repository(context)}/labels?per_page=100`;
+            const listed = client.json(['api', '--paginate', '--slurp', endpoint], { cwd: context.workingDirectory });
+            if (!listed.ok)
+                return listed;
+            if (!Array.isArray(listed.value))
+                return invalid('LABEL_RESPONSE_INVALID', 'The platform returned an invalid label list');
+            const values = Array.isArray(listed.value)
+                ? listed.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry])
+                : [];
+            if (values.some((entry) => !entry || typeof entry.name !== 'string' || !entry.name)) {
+                return invalid('LABEL_RESPONSE_INVALID', 'The platform returned a label without a valid name');
+            }
+            const current = new Map(values.map((entry) => [String(entry.name), entry]));
+            const created = [];
+            const updated = [];
+            const skipped = [];
+            const removed = [];
+            for (const label of desired) {
+                const existing = current.get(label.name);
+                if (!existing) {
+                    const response = client.json(['api', `repos/${repository(context)}/labels`, '-X', 'POST', '--input', '-'], {
+                        cwd: context.workingDirectory,
+                        method: 'POST',
+                        input: JSON.stringify({ name: label.name, color: label.color, description: label.description })
+                    });
+                    if (!response.ok)
+                        return partialFailure(response, labelReconciliation(created, updated, removed, skipped));
+                    created.push(label.name);
+                    continue;
+                }
+                const sameColor = typeof existing.color === 'string' && existing.color.toUpperCase() === label.color.toUpperCase();
+                const sameDescription = String(existing.description || '') === label.description;
+                if (sameColor && sameDescription) {
+                    skipped.push(label.name);
+                    continue;
+                }
+                const response = client.json(['api', `repos/${repository(context)}/labels/${encodeURIComponent(label.name)}`, '-X', 'PATCH', '--input', '-'], {
+                    cwd: context.workingDirectory,
+                    method: 'PATCH',
+                    input: JSON.stringify({ new_name: label.name, color: label.color, description: label.description })
+                });
+                if (!response.ok)
+                    return partialFailure(response, labelReconciliation(created, updated, removed, skipped));
+                updated.push(label.name);
+            }
+            const desiredNames = new Set(desired.map((label) => label.name));
+            if (cleanupStaleIn) {
+                for (const name of current.keys()) {
+                    if (!name.startsWith('in:') || desiredNames.has(name))
+                        continue;
+                    const response = client.text(['api', `repos/${repository(context)}/labels/${encodeURIComponent(name)}`, '-X', 'DELETE'], {
+                        cwd: context.workingDirectory,
+                        method: 'DELETE'
+                    });
+                    if (!response.ok)
+                        return partialFailure(response, labelReconciliation(created, updated, removed, skipped));
+                    removed.push(name);
+                }
+            }
+            return {
+                ok: true,
+                value: {
+                    changed: created.length > 0 || updated.length > 0 || removed.length > 0,
+                    created,
+                    updated,
+                    removed,
+                    skipped
+                }
+            };
+        },
+        async reconcileMilestones({ context, desired }) {
+            const listed = client.json(['api', '--paginate', '--slurp', `repos/${repository(context)}/milestones?state=all&per_page=100`], { cwd: context.workingDirectory });
+            if (!listed.ok)
+                return listed;
+            if (!Array.isArray(listed.value))
+                return invalid('MILESTONE_RESPONSE_INVALID', 'The platform returned an invalid milestone list');
+            const values = Array.isArray(listed.value)
+                ? listed.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry])
+                : [];
+            if (values.some((entry) => !entry || typeof entry.title !== 'string' || !entry.title)) {
+                return invalid('MILESTONE_RESPONSE_INVALID', 'The platform returned a milestone without a valid title');
+            }
+            const existing = new Set(values.map((entry) => String(entry.title)));
+            const created = [];
+            const skipped = [];
+            for (const milestone of desired) {
+                if (existing.has(milestone.title)) {
+                    skipped.push(milestone.title);
+                    continue;
+                }
+                const response = client.json(['api', `repos/${repository(context)}/milestones`, '-X', 'POST', '--input', '-'], {
+                    cwd: context.workingDirectory,
+                    method: 'POST',
+                    input: JSON.stringify({ title: milestone.title, description: milestone.description, state: milestone.state })
+                });
+                if (!response.ok)
+                    return partialFailure(response, milestoneInitialization(created, skipped));
+                existing.add(milestone.title);
+                created.push(milestone.title);
+            }
+            return { ok: true, value: { changed: created.length > 0, created, skipped } };
+        }
+    };
     const verification = {
         async fetchRemoteFacts(input) {
             const issue = input.issue && issues.inspect
                 ? await issues.inspect({ context: input.context, target: input.issue })
                 : { ok: true, value: null };
             if (!issue.ok)
-                return issue;
+                return { ok: false, error: issue.error };
             const commentFacts = input.includeComments && input.issue && comments.list
                 ? await comments.list({ context: input.context, parent: input.issue })
                 : { ok: true, value: [] };
             if (!commentFacts.ok)
-                return commentFacts;
+                return { ok: false, error: commentFacts.error };
             const changeRequest = input.changeRequest && changeRequests.inspect
                 ? await changeRequests.inspect({ context: input.context, target: input.changeRequest })
                 : { ok: true, value: null };
             if (!changeRequest.ok)
-                return changeRequest;
+                return { ok: false, error: changeRequest.error };
             return {
                 ok: true,
                 value: {
@@ -884,7 +1106,7 @@ function createGitHubOperations(client) {
             };
         }
     };
-    return { issues, comments, changeRequests, checks, reviews, releases, verification };
+    return { issues, comments, changeRequests, checks, reviews, releases, securityAlerts, repositoryMetadata, verification };
 }
 function createGitHubProvider(input, client = createGitHubClient()) {
     return {