@geminixiang/mikan 1.0.0-beta.39 → 1.0.0-beta.40

package/dist/adapters/github/gcp-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-auth.js","sourceRoot":"","sources":["../../../src/adapters/github/gcp-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAIpC;;;;;;;;;;;GAWG;AAEH,MAAM,oBAAoB,GAAG,gDAAgD,CAAC;AAC9E,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D;yEACyE;AACzE,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAmC9C,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IAO3B,YAAY,OAAgC;QAJpC,gBAAW,GAA0B,IAAI,CAAC;QAC1C,WAAM,GAAgD,IAAI,CAAC;QAC3D,aAAQ,GAA2B,IAAI,CAAC;QAG9C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC9C,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,uBAAuB,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAmB,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,kCAAkC,IAAI,CAAC,eAAe,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC7G,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,YAAY,CACpB,oCAAqC,MAA4B,CAAC,IAAI,eAAe;gBACnF,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,MAAmD,CAAC;QACxD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,kBAAkB;gBACrB,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACrD,MAAM;YACR,KAAK,iBAAiB;gBACpB,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,iBAAiB;gBACpB,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBACpD,MAAM;QACV,CAAC;QACD,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI;SACvD,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,IAA4B,EAC5B,OAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,IAAI,YAAY,CAAC,GAAG,OAAO,gBAAgB,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,mBAAmB,CAC/B,WAAuC;QAEvC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,WAAW,CAAC,SAAS,EACrB;YACE,UAAU,EAAE,iDAAiD;YAC7D,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,KAAK,EAAE,oBAAoB;YAC3B,oBAAoB,EAAE,+CAA+C;YACrE,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;SACnD,EACD,wBAAwB,CACzB,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAsB,CAAC;QAC5C,MAAM,UAAU,GAAI,GAAG,CAAC,UAAiC,IAAI,IAAI,CAAC;QAClE,IAAI,CAAC,WAAW,CAAC,iCAAiC,EAAE,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,iCAAiC,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,EAAE;aACpC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,IAAI,YAAY,CACpB,iDAAiD,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC5F,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAC/B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CACtE,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,WAAuC;QACpE,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC;QAC7C,IAAI,GAAW,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,YAAY,CACpB,sCAAsC,QAAQ,CAAC,MAAM,8BAA8B,CACpF,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,YAAY,CACpB,6EAA6E;gBAC3E,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAwB,IAAI,OAAO,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,YAAY,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,kBAAkB,CAC9B,WAAsC;QAEtC,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,IAAI,eAAe,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,SAAS,CACvB,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,WAAW,CAAC,YAAY;YAC7B,KAAK,EAAE,oBAAoB;YAC3B,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI;SAChB,CAAC,CACH,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC;aACvC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;aAC9B,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;aAC7B,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9B,QAAQ,EACR;YACE,UAAU,EAAE,6CAA6C;YACzD,SAAS,EAAE,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE;SAC/C,EACD,iCAAiC,CAClC,CAAC;QACF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAsB;YAClC,gBAAgB,EAAG,IAAI,CAAC,UAAiC,IAAI,IAAI;SAClE,CAAC;IACJ,CAAC;IAED,4CAA4C;IACpC,KAAK,CAAC,kBAAkB,CAC9B,WAAsC;QAEtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9B,eAAe,EACf;YACE,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,aAAa,EAAE,WAAW,CAAC,aAAa;SACzC,EACD,6BAA6B,CAC9B,CAAC;QACF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAsB;YAClC,gBAAgB,EAAG,IAAI,CAAC,UAAiC,IAAI,IAAI;SAClE,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { readFileSync } from \"fs\";\nimport { createSign } from \"crypto\";\nexport type { GcpTokenProviderOptions } from \"./types.js\";\nimport type { GcpTokenProviderOptions } from \"./types.js\";\n\n/**\n * Minimal Google Application Default Credentials provider — enough to mint\n * cloud-platform access tokens on the host without pulling in\n * google-auth-library (this repo hand-rolls its GitHub App JWTs the same way).\n *\n * Supported `GOOGLE_APPLICATION_CREDENTIALS` JSON shapes:\n *  - `external_account` (Workload Identity Federation) with a file or url\n *    credential source: STS token exchange, plus optional service-account\n *    impersonation. AWS/executable sources are rejected with a clear error.\n *  - `service_account` key: self-signed JWT assertion grant.\n *  - `authorized_user` (gcloud user ADC): refresh-token grant. Local dev.\n */\n\nconst CLOUD_PLATFORM_SCOPE = \"https://www.googleapis.com/auth/cloud-platform\";\nconst OAUTH_TOKEN_URL = \"https://oauth2.googleapis.com/token\";\n\n/** Refresh cached tokens this long before expiry — STS/impersonation tokens\n *  live ~1h; minting per request would hammer STS in a CI-debug loop. */\nconst TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;\n\ninterface ExternalAccountCredentials {\n  type: \"external_account\";\n  audience: string;\n  subject_token_type: string;\n  token_url: string;\n  service_account_impersonation_url?: string;\n  credential_source: {\n    file?: string;\n    url?: string;\n    headers?: Record<string, string>;\n    format?: { type?: string; subject_token_field_name?: string };\n  };\n}\n\ninterface ServiceAccountCredentials {\n  type: \"service_account\";\n  client_email: string;\n  private_key: string;\n  token_uri?: string;\n}\n\ninterface AuthorizedUserCredentials {\n  type: \"authorized_user\";\n  client_id: string;\n  client_secret: string;\n  refresh_token: string;\n}\n\ntype AdcCredentials =\n  | ExternalAccountCredentials\n  | ServiceAccountCredentials\n  | AuthorizedUserCredentials;\n\nfunction base64Url(data: string): string {\n  return Buffer.from(data).toString(\"base64url\");\n}\n\nexport class GcpAuthError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = \"GcpAuthError\";\n  }\n}\n\nexport class GcpTokenProvider {\n  private readonly credentialsPath: string;\n  private readonly fetchImpl: typeof fetch;\n  private credentials: AdcCredentials | null = null;\n  private cached: { token: string; expiresAt: number } | null = null;\n  private inFlight: Promise<string> | null = null;\n\n  constructor(options: GcpTokenProviderOptions) {\n    this.credentialsPath = options.credentialsPath;\n    this.fetchImpl = options.fetchImpl ?? fetch;\n  }\n\n  /** A valid cloud-platform access token, cached until near expiry. */\n  async getAccessToken(): Promise<string> {\n    if (this.cached && Date.now() < this.cached.expiresAt - TOKEN_REFRESH_MARGIN_MS) {\n      return this.cached.token;\n    }\n    // Single-flight: concurrent tool calls must not each hit STS.\n    this.inFlight ??= this.mintToken().finally(() => {\n      this.inFlight = null;\n    });\n    return this.inFlight;\n  }\n\n  private loadCredentials(): AdcCredentials {\n    if (this.credentials) return this.credentials;\n    let parsed: AdcCredentials;\n    try {\n      parsed = JSON.parse(readFileSync(this.credentialsPath, \"utf-8\")) as AdcCredentials;\n    } catch (err) {\n      throw new GcpAuthError(\n        `Cannot read GCP credentials at ${this.credentialsPath}: ${err instanceof Error ? err.message : String(err)}`,\n        { cause: err },\n      );\n    }\n    if (![\"external_account\", \"service_account\", \"authorized_user\"].includes(parsed.type)) {\n      throw new GcpAuthError(\n        `Unsupported GCP credential type '${(parsed as { type?: string }).type}' — expected ` +\n          `external_account (WIF), service_account, or authorized_user.`,\n      );\n    }\n    this.credentials = parsed;\n    return parsed;\n  }\n\n  private async mintToken(): Promise<string> {\n    const credentials = this.loadCredentials();\n    let minted: { token: string; expiresInSeconds: number };\n    switch (credentials.type) {\n      case \"external_account\":\n        minted = await this.mintExternalAccount(credentials);\n        break;\n      case \"service_account\":\n        minted = await this.mintServiceAccount(credentials);\n        break;\n      case \"authorized_user\":\n        minted = await this.mintAuthorizedUser(credentials);\n        break;\n    }\n    this.cached = {\n      token: minted.token,\n      expiresAt: Date.now() + minted.expiresInSeconds * 1000,\n    };\n    return minted.token;\n  }\n\n  private async postForm(\n    url: string,\n    form: Record<string, string>,\n    context: string,\n  ): Promise<Record<string, unknown>> {\n    const response = await this.fetchImpl(url, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams(form).toString(),\n    });\n    if (!response.ok) {\n      const detail = (await response.text().catch(() => \"\")).slice(0, 300);\n      throw new GcpAuthError(`${context} failed with ${response.status}: ${detail}`);\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /** WIF: read the subject token, exchange at STS, optionally impersonate. */\n  private async mintExternalAccount(\n    credentials: ExternalAccountCredentials,\n  ): Promise<{ token: string; expiresInSeconds: number }> {\n    const subjectToken = await this.readSubjectToken(credentials);\n    const sts = await this.postForm(\n      credentials.token_url,\n      {\n        grant_type: \"urn:ietf:params:oauth:grant-type:token-exchange\",\n        audience: credentials.audience,\n        scope: CLOUD_PLATFORM_SCOPE,\n        requested_token_type: \"urn:ietf:params:oauth:token-type:access_token\",\n        subject_token: subjectToken,\n        subject_token_type: credentials.subject_token_type,\n      },\n      \"GCP STS token exchange\",\n    );\n    const stsToken = sts.access_token as string;\n    const stsExpires = (sts.expires_in as number | undefined) ?? 3600;\n    if (!credentials.service_account_impersonation_url) {\n      return { token: stsToken, expiresInSeconds: stsExpires };\n    }\n\n    const response = await this.fetchImpl(credentials.service_account_impersonation_url, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${stsToken}`,\n      },\n      body: JSON.stringify({ scope: [CLOUD_PLATFORM_SCOPE] }),\n    });\n    if (!response.ok) {\n      const detail = (await response.text().catch(() => \"\")).slice(0, 300);\n      throw new GcpAuthError(\n        `GCP service-account impersonation failed with ${response.status}: ${detail}`,\n      );\n    }\n    const impersonated = (await response.json()) as { accessToken: string; expireTime: string };\n    const expiresInSeconds = Math.max(\n      0,\n      Math.floor((Date.parse(impersonated.expireTime) - Date.now()) / 1000),\n    );\n    return { token: impersonated.accessToken, expiresInSeconds };\n  }\n\n  private async readSubjectToken(credentials: ExternalAccountCredentials): Promise<string> {\n    const source = credentials.credential_source;\n    let raw: string;\n    if (source.file) {\n      raw = readFileSync(source.file, \"utf-8\").trim();\n    } else if (source.url) {\n      const response = await this.fetchImpl(source.url, { headers: source.headers });\n      if (!response.ok) {\n        throw new GcpAuthError(\n          `WIF credential_source url returned ${response.status} — cannot read subject token`,\n        );\n      }\n      raw = (await response.text()).trim();\n    } else {\n      throw new GcpAuthError(\n        \"Unsupported WIF credential_source: only file and url sources are supported \" +\n          \"(aws/executable sources are not).\",\n      );\n    }\n    if (source.format?.type === \"json\") {\n      const field = source.format.subject_token_field_name ?? \"token\";\n      const parsed = JSON.parse(raw) as Record<string, string>;\n      const token = parsed[field];\n      if (!token) {\n        throw new GcpAuthError(`WIF subject token field '${field}' missing from JSON source`);\n      }\n      return token;\n    }\n    return raw;\n  }\n\n  /** Service-account key: self-signed RS256 JWT → assertion grant. */\n  private async mintServiceAccount(\n    credentials: ServiceAccountCredentials,\n  ): Promise<{ token: string; expiresInSeconds: number }> {\n    const tokenUrl = credentials.token_uri ?? OAUTH_TOKEN_URL;\n    const now = Math.floor(Date.now() / 1000);\n    const header = base64Url(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" }));\n    const payload = base64Url(\n      JSON.stringify({\n        iss: credentials.client_email,\n        scope: CLOUD_PLATFORM_SCOPE,\n        aud: tokenUrl,\n        iat: now,\n        exp: now + 3600,\n      }),\n    );\n    const signature = createSign(\"RSA-SHA256\")\n      .update(`${header}.${payload}`)\n      .sign(credentials.private_key)\n      .toString(\"base64url\");\n    const data = await this.postForm(\n      tokenUrl,\n      {\n        grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n        assertion: `${header}.${payload}.${signature}`,\n      },\n      \"GCP service-account token grant\",\n    );\n    return {\n      token: data.access_token as string,\n      expiresInSeconds: (data.expires_in as number | undefined) ?? 3600,\n    };\n  }\n\n  /** gcloud user ADC: refresh-token grant. */\n  private async mintAuthorizedUser(\n    credentials: AuthorizedUserCredentials,\n  ): Promise<{ token: string; expiresInSeconds: number }> {\n    const data = await this.postForm(\n      OAUTH_TOKEN_URL,\n      {\n        grant_type: \"refresh_token\",\n        client_id: credentials.client_id,\n        client_secret: credentials.client_secret,\n        refresh_token: credentials.refresh_token,\n      },\n      \"GCP user-credential refresh\",\n    );\n    return {\n      token: data.access_token as string,\n      expiresInSeconds: (data.expires_in as number | undefined) ?? 3600,\n    };\n  }\n}\n"]}
+{"version":3,"file":"gcp-auth.js","sourceRoot":"","sources":["../../../src/adapters/github/gcp-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC;;;;;;;;;;;GAWG;AAEH,MAAM,oBAAoB,GAAG,gDAAgD,CAAC;AAC9E,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAE9D;yEACyE;AACzE,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAmC9C,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IAO3B,YAAY,OAAgC;QAJpC,gBAAW,GAA0B,IAAI,CAAC;QAC1C,WAAM,GAAgD,IAAI,CAAC;QAC3D,aAAQ,GAA2B,IAAI,CAAC;QAG9C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC9C,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,uBAAuB,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAmB,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,kCAAkC,IAAI,CAAC,eAAe,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC7G,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,YAAY,CACpB,oCAAqC,MAA4B,CAAC,IAAI,eAAe;gBACnF,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,MAAmD,CAAC;QACxD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,kBAAkB;gBACrB,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACrD,MAAM;YACR,KAAK,iBAAiB;gBACpB,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,iBAAiB;gBACpB,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBACpD,MAAM;QACV,CAAC;QACD,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI;SACvD,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,IAA4B,EAC5B,OAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,IAAI,YAAY,CAAC,GAAG,OAAO,gBAAgB,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,mBAAmB,CAC/B,WAAuC;QAEvC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC7B,WAAW,CAAC,SAAS,EACrB;YACE,UAAU,EAAE,iDAAiD;YAC7D,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,KAAK,EAAE,oBAAoB;YAC3B,oBAAoB,EAAE,+CAA+C;YACrE,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;SACnD,EACD,wBAAwB,CACzB,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAsB,CAAC;QAC5C,MAAM,UAAU,GAAI,GAAG,CAAC,UAAiC,IAAI,IAAI,CAAC;QAClE,IAAI,CAAC,WAAW,CAAC,iCAAiC,EAAE,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,iCAAiC,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,QAAQ,EAAE;aACpC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,IAAI,YAAY,CACpB,iDAAiD,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC5F,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAC/B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CACtE,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,WAAuC;QACpE,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC;QAC7C,IAAI,GAAW,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,YAAY,CACpB,sCAAsC,QAAQ,CAAC,MAAM,8BAA8B,CACpF,CAAC;YACJ,CAAC;YACD,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,YAAY,CACpB,6EAA6E;gBAC3E,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAwB,IAAI,OAAO,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,YAAY,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,kBAAkB,CAC9B,WAAsC;QAEtC,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,IAAI,eAAe,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,SAAS,CACvB,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,WAAW,CAAC,YAAY;YAC7B,KAAK,EAAE,oBAAoB;YAC3B,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI;SAChB,CAAC,CACH,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC;aACvC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;aAC9B,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;aAC7B,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9B,QAAQ,EACR;YACE,UAAU,EAAE,6CAA6C;YACzD,SAAS,EAAE,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE;SAC/C,EACD,iCAAiC,CAClC,CAAC;QACF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAsB;YAClC,gBAAgB,EAAG,IAAI,CAAC,UAAiC,IAAI,IAAI;SAClE,CAAC;IACJ,CAAC;IAED,4CAA4C;IACpC,KAAK,CAAC,kBAAkB,CAC9B,WAAsC;QAEtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9B,eAAe,EACf;YACE,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,aAAa,EAAE,WAAW,CAAC,aAAa;SACzC,EACD,6BAA6B,CAC9B,CAAC;QACF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAsB;YAClC,gBAAgB,EAAG,IAAI,CAAC,UAAiC,IAAI,IAAI;SAClE,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { readFileSync } from \"node:fs\";\nimport { createSign } from \"node:crypto\";\nexport type { GcpTokenProviderOptions } from \"./types.js\";\nimport type { GcpTokenProviderOptions } from \"./types.js\";\n\n/**\n * Minimal Google Application Default Credentials provider — enough to mint\n * cloud-platform access tokens on the host without pulling in\n * google-auth-library (this repo hand-rolls its GitHub App JWTs the same way).\n *\n * Supported `GOOGLE_APPLICATION_CREDENTIALS` JSON shapes:\n *  - `external_account` (Workload Identity Federation) with a file or url\n *    credential source: STS token exchange, plus optional service-account\n *    impersonation. AWS/executable sources are rejected with a clear error.\n *  - `service_account` key: self-signed JWT assertion grant.\n *  - `authorized_user` (gcloud user ADC): refresh-token grant. Local dev.\n */\n\nconst CLOUD_PLATFORM_SCOPE = \"https://www.googleapis.com/auth/cloud-platform\";\nconst OAUTH_TOKEN_URL = \"https://oauth2.googleapis.com/token\";\n\n/** Refresh cached tokens this long before expiry — STS/impersonation tokens\n *  live ~1h; minting per request would hammer STS in a CI-debug loop. */\nconst TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;\n\ninterface ExternalAccountCredentials {\n  type: \"external_account\";\n  audience: string;\n  subject_token_type: string;\n  token_url: string;\n  service_account_impersonation_url?: string;\n  credential_source: {\n    file?: string;\n    url?: string;\n    headers?: Record<string, string>;\n    format?: { type?: string; subject_token_field_name?: string };\n  };\n}\n\ninterface ServiceAccountCredentials {\n  type: \"service_account\";\n  client_email: string;\n  private_key: string;\n  token_uri?: string;\n}\n\ninterface AuthorizedUserCredentials {\n  type: \"authorized_user\";\n  client_id: string;\n  client_secret: string;\n  refresh_token: string;\n}\n\ntype AdcCredentials =\n  | ExternalAccountCredentials\n  | ServiceAccountCredentials\n  | AuthorizedUserCredentials;\n\nfunction base64Url(data: string): string {\n  return Buffer.from(data).toString(\"base64url\");\n}\n\nexport class GcpAuthError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = \"GcpAuthError\";\n  }\n}\n\nexport class GcpTokenProvider {\n  private readonly credentialsPath: string;\n  private readonly fetchImpl: typeof fetch;\n  private credentials: AdcCredentials | null = null;\n  private cached: { token: string; expiresAt: number } | null = null;\n  private inFlight: Promise<string> | null = null;\n\n  constructor(options: GcpTokenProviderOptions) {\n    this.credentialsPath = options.credentialsPath;\n    this.fetchImpl = options.fetchImpl ?? fetch;\n  }\n\n  /** A valid cloud-platform access token, cached until near expiry. */\n  async getAccessToken(): Promise<string> {\n    if (this.cached && Date.now() < this.cached.expiresAt - TOKEN_REFRESH_MARGIN_MS) {\n      return this.cached.token;\n    }\n    // Single-flight: concurrent tool calls must not each hit STS.\n    this.inFlight ??= this.mintToken().finally(() => {\n      this.inFlight = null;\n    });\n    return this.inFlight;\n  }\n\n  private loadCredentials(): AdcCredentials {\n    if (this.credentials) return this.credentials;\n    let parsed: AdcCredentials;\n    try {\n      parsed = JSON.parse(readFileSync(this.credentialsPath, \"utf-8\")) as AdcCredentials;\n    } catch (err) {\n      throw new GcpAuthError(\n        `Cannot read GCP credentials at ${this.credentialsPath}: ${err instanceof Error ? err.message : String(err)}`,\n        { cause: err },\n      );\n    }\n    if (![\"external_account\", \"service_account\", \"authorized_user\"].includes(parsed.type)) {\n      throw new GcpAuthError(\n        `Unsupported GCP credential type '${(parsed as { type?: string }).type}' — expected ` +\n          `external_account (WIF), service_account, or authorized_user.`,\n      );\n    }\n    this.credentials = parsed;\n    return parsed;\n  }\n\n  private async mintToken(): Promise<string> {\n    const credentials = this.loadCredentials();\n    let minted: { token: string; expiresInSeconds: number };\n    switch (credentials.type) {\n      case \"external_account\":\n        minted = await this.mintExternalAccount(credentials);\n        break;\n      case \"service_account\":\n        minted = await this.mintServiceAccount(credentials);\n        break;\n      case \"authorized_user\":\n        minted = await this.mintAuthorizedUser(credentials);\n        break;\n    }\n    this.cached = {\n      token: minted.token,\n      expiresAt: Date.now() + minted.expiresInSeconds * 1000,\n    };\n    return minted.token;\n  }\n\n  private async postForm(\n    url: string,\n    form: Record<string, string>,\n    context: string,\n  ): Promise<Record<string, unknown>> {\n    const response = await this.fetchImpl(url, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams(form).toString(),\n    });\n    if (!response.ok) {\n      const detail = (await response.text().catch(() => \"\")).slice(0, 300);\n      throw new GcpAuthError(`${context} failed with ${response.status}: ${detail}`);\n    }\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  /** WIF: read the subject token, exchange at STS, optionally impersonate. */\n  private async mintExternalAccount(\n    credentials: ExternalAccountCredentials,\n  ): Promise<{ token: string; expiresInSeconds: number }> {\n    const subjectToken = await this.readSubjectToken(credentials);\n    const sts = await this.postForm(\n      credentials.token_url,\n      {\n        grant_type: \"urn:ietf:params:oauth:grant-type:token-exchange\",\n        audience: credentials.audience,\n        scope: CLOUD_PLATFORM_SCOPE,\n        requested_token_type: \"urn:ietf:params:oauth:token-type:access_token\",\n        subject_token: subjectToken,\n        subject_token_type: credentials.subject_token_type,\n      },\n      \"GCP STS token exchange\",\n    );\n    const stsToken = sts.access_token as string;\n    const stsExpires = (sts.expires_in as number | undefined) ?? 3600;\n    if (!credentials.service_account_impersonation_url) {\n      return { token: stsToken, expiresInSeconds: stsExpires };\n    }\n\n    const response = await this.fetchImpl(credentials.service_account_impersonation_url, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${stsToken}`,\n      },\n      body: JSON.stringify({ scope: [CLOUD_PLATFORM_SCOPE] }),\n    });\n    if (!response.ok) {\n      const detail = (await response.text().catch(() => \"\")).slice(0, 300);\n      throw new GcpAuthError(\n        `GCP service-account impersonation failed with ${response.status}: ${detail}`,\n      );\n    }\n    const impersonated = (await response.json()) as { accessToken: string; expireTime: string };\n    const expiresInSeconds = Math.max(\n      0,\n      Math.floor((Date.parse(impersonated.expireTime) - Date.now()) / 1000),\n    );\n    return { token: impersonated.accessToken, expiresInSeconds };\n  }\n\n  private async readSubjectToken(credentials: ExternalAccountCredentials): Promise<string> {\n    const source = credentials.credential_source;\n    let raw: string;\n    if (source.file) {\n      raw = readFileSync(source.file, \"utf-8\").trim();\n    } else if (source.url) {\n      const response = await this.fetchImpl(source.url, { headers: source.headers });\n      if (!response.ok) {\n        throw new GcpAuthError(\n          `WIF credential_source url returned ${response.status} — cannot read subject token`,\n        );\n      }\n      raw = (await response.text()).trim();\n    } else {\n      throw new GcpAuthError(\n        \"Unsupported WIF credential_source: only file and url sources are supported \" +\n          \"(aws/executable sources are not).\",\n      );\n    }\n    if (source.format?.type === \"json\") {\n      const field = source.format.subject_token_field_name ?? \"token\";\n      const parsed = JSON.parse(raw) as Record<string, string>;\n      const token = parsed[field];\n      if (!token) {\n        throw new GcpAuthError(`WIF subject token field '${field}' missing from JSON source`);\n      }\n      return token;\n    }\n    return raw;\n  }\n\n  /** Service-account key: self-signed RS256 JWT → assertion grant. */\n  private async mintServiceAccount(\n    credentials: ServiceAccountCredentials,\n  ): Promise<{ token: string; expiresInSeconds: number }> {\n    const tokenUrl = credentials.token_uri ?? OAUTH_TOKEN_URL;\n    const now = Math.floor(Date.now() / 1000);\n    const header = base64Url(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" }));\n    const payload = base64Url(\n      JSON.stringify({\n        iss: credentials.client_email,\n        scope: CLOUD_PLATFORM_SCOPE,\n        aud: tokenUrl,\n        iat: now,\n        exp: now + 3600,\n      }),\n    );\n    const signature = createSign(\"RSA-SHA256\")\n      .update(`${header}.${payload}`)\n      .sign(credentials.private_key)\n      .toString(\"base64url\");\n    const data = await this.postForm(\n      tokenUrl,\n      {\n        grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n        assertion: `${header}.${payload}.${signature}`,\n      },\n      \"GCP service-account token grant\",\n    );\n    return {\n      token: data.access_token as string,\n      expiresInSeconds: (data.expires_in as number | undefined) ?? 3600,\n    };\n  }\n\n  /** gcloud user ADC: refresh-token grant. */\n  private async mintAuthorizedUser(\n    credentials: AuthorizedUserCredentials,\n  ): Promise<{ token: string; expiresInSeconds: number }> {\n    const data = await this.postForm(\n      OAUTH_TOKEN_URL,\n      {\n        grant_type: \"refresh_token\",\n        client_id: credentials.client_id,\n        client_secret: credentials.client_secret,\n        refresh_token: credentials.refresh_token,\n      },\n      \"GCP user-credential refresh\",\n    );\n    return {\n      token: data.access_token as string,\n      expiresInSeconds: (data.expires_in as number | undefined) ?? 3600,\n    };\n  }\n}\n"]}

package/dist/adapters/github/github-ops.d.ts

@@ -1,4 +1,5 @@
-import { GithubClient } from "./client.js";
+import type { GithubClient } from "./client.js";
+import type { Workspace } from "../../office/index.js";
 import type { GithubBotConfig, GithubCheckSummary, GithubConversationRef, GithubIssueRequest, GithubPrRequest, GithubPrResult, GithubReadRequest, GithubReadResult, PlatformGithubOps } from "./types.js";
 /** Whether the conversation's issue is a PR, for callers where the triggering
  *  item didn't carry that knowledge. Errs toward plain issue. */
@@ -24,7 +25,7 @@ export declare class GithubOps implements PlatformGithubOps {
     /** Cloud Build ids seen in getChecks summaries → their GCP project. */
     private buildRef;
     constructor(client: GithubClient, config: {
-        workspace: import("../../office/types.js").Workspace;
+        workspace: Workspace;
         cloudBuild?: GithubBotConfig["cloudBuild"];
     });
     private repoDir;

package/dist/adapters/github/github-ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-ops.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/github-ops.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,YAAY,EAA0C,MAAM,aAAa,CAAC;AAWnG,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAWpB;iEACiE;AACjE,wBAAsB,SAAS,CAC7B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B;AAED;;;;;;GAMG;AACH,qBAAa,SAAU,YAAW,iBAAiB;IAK/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAA0C;IAE1D,YACmB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE;QACvB,SAAS,EAAE,OAAO,uBAAuB,EAAE,SAAS,CAAC;QACrD,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;KAC5C,EACC;IAEJ,OAAO,CAAC,OAAO;IAMf;;;;;OAKG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAqD/F;IAED;;;OAGG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiDtF;IAED,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B1E;IAED;;;;;OAKG;IACG,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyCvE;IAED;;;;OAIG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4C9F;IAED;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoEtF;IAED;;;;;OAKG;IACG,mBAAmB,CACvB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CA4B1B;IAED;;;;;;OAMG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;CACF"}
+{"version":3,"file":"github-ops.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/github-ops.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAYhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAWpB;iEACiE;AACjE,wBAAsB,SAAS,CAC7B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B;AAED;;;;;;GAMG;AACH,qBAAa,SAAU,YAAW,iBAAiB;IAK/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAA0C;IAE1D,YACmB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE;QACvB,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;KAC5C,EACC;IAEJ,OAAO,CAAC,OAAO;IAMf;;;;;OAKG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAqD/F;IAED;;;OAGG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiDtF;IAED,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B1E;IAED;;;;;OAKG;IACG,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyCvE;IAED;;;;OAIG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4C9F;IAED;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoEtF;IAED;;;;;OAKG;IACG,mBAAmB,CACvB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CA4B1B;IAED;;;;;;OAMG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;CACF"}

package/dist/adapters/github/github-ops.js

@@ -1,4 +1,4 @@
-import { existsSync } from "fs";
+import { existsSync } from "node:fs";
 import * as log from "../../log.js";
 import { GithubApiError, GITHUB_MAX_COMMENT_LENGTH, githubRetry } from "./client.js";
 import { CLOUD_BUILD_APP_SLUG, CloudBuildLogUnavailableError, fetchCloudBuildLog, isCloudBuildId, projectFromDetailsUrl, } from "./cloudbuild.js";

package/dist/adapters/github/github-ops.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-ops.js","sourceRoot":"","sources":["../../../src/adapters/github/github-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,cAAc,EAAgB,yBAAyB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,cAAc,EACd,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAa5D,+DAA+D;AAC/D,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,OAAO,CAAC,MAAM,GAAG,aAAa;QACnC,CAAC,CAAC,2BAA2B,aAAa,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;QACrF,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAoB,EACpB,GAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAoB,EACpB,GAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GACZ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IAIpB,YACmB,MAAoB,EACpB,MAGhB;QAJgB,WAAM,GAAN,MAAM,CAAc;QACpB,WAAM,GAAN,MAAM,CAGtB;QARH,uEAAuE;QAC/D,aAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAQvD,CAAC;IAEI,OAAO,CAAC,cAAsB;QACpC,OAAO,mBAAmB,CACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAC5E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,cAAsB,EAAE,OAAwB;QACpE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,WAAW,OAAO,CAAC,MAAM,0DAA0D,GAAG,CAAC,MAAM,IAAI,CAClG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,cAAc,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE;YACtE,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAChC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;gBACjD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,MAAM;gBACpB,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CACH,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,IAAI,cAAc,gBAAgB,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,6DAA6D;YAC7D,IACE,GAAG,YAAY,cAAc;gBAC7B,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EACnC,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAC5D,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,MAAM,CACf,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,OAAO,CACT,IAAI,cAAc,4BAA4B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,EAAE,CACtF,CAAC;oBACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBACpF,CAAC;YACH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,MAAe;QACrD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,MAAM,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,IAAI,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;YACnD,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,qEAAqE;YACrE,wEAAwE;YACxE,8DAA8D;YAC9D,IACE,IAAI,CAAC,MAAM,CAAC,UAAU;gBACtB,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK,oBAAoB;gBACtC,UAAU;gBACV,cAAc,CAAC,UAAU,CAAC,EAC1B,CAAC;gBACD,MAAM,OAAO,GACX,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;gBACnF,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACxC,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,GAAG,EAAE,GAAG,CAAC,QAAQ;gBACjB,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;gBACpF,UAAU;gBACV,iBAAiB;aAClB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,OAAe,EAAE,OAAe;QACpD,0EAA0E;QAC1E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,OAAe;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,yDAAyD;gBAClF,cAAc,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,kBAAkB,CAAC;gBACjC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa;gBACnD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB;oBACrF,6EAA6E,EAC/E,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,cAAsB,EAAE,MAAe;QACpD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE;YACtE,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,IAAI,QAA4B,CAAC;QACjC,IAAI,YAAgC,CAAC;QACrC,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;gBACtB,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3F,aAAa,GAAG,UAAU,CAAC,cAAc,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;QAE7F,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,OAAO,0BAA0B,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAChG,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,aAAa,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,YAAY,gCAAgC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CACL,WAAW,MAAM,CAAC,MAAM,mBAAmB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB;YAC1F,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YAC7E,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,cAAsB,EAAE,OAA0B;QACjE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;QAC5C,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,IAAI,EAAE,CAAC;gBACV,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC5F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC5B,CAAC;YACD,KAAK,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAC9D,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YACrC,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC3C,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAClF,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBACnF,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAClD,CAAC;YACD,KAAK,OAAO,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,UAAU,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAC3D,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;oBAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAClC,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,OAA2B;QACnE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;QAC5C,IAAI,CAAC;YACH,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,KAAK,YAAY,EAAE,CAAC;oBAClB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;oBACnE,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAO,CAAC,CACzE,CAAC;oBACF,OAAO,kBAAkB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,GAAG,CAAC;gBACtE,CAAC;gBACD,KAAK,cAAc,EAAE,CAAC;oBACpB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBACzD,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAM,CAAC,CAC1E,CAAC;oBACF,OAAO,iBAAiB,OAAO,CAAC,KAAK,UAAU,MAAM,GAAG,CAAC;gBAC3D,CAAC;gBACD,KAAK,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;oBACzE,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,SAAU,CAAC,CAC/E,CAAC;oBACF,OAAO,YAAY,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,GAAG,CAAC;gBAC/F,CAAC;gBACD,KAAK,kBAAkB,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBAC5E,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,SAAU,CAAC,CAClF,CAAC;oBACF,OAAO,cAAc,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC;gBACnG,CAAC;gBACD,KAAK,OAAO,EAAE,CAAC;oBACb,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC1B,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,IAAI,EACR,MAAM,EACN,QAAQ,EACR,OAAO,CAAC,YAAY,CACrB,CACF,CAAC;oBACF,OAAO,WAAW,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC1F,CAAC;gBACD,KAAK,QAAQ,EAAE,CAAC;oBACd,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAClE,CAAC;oBACF,OAAO,aAAa,MAAM,GAAG,CAAC;gBAChC,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,iBAAiB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CACvB,cAAsB,EACtB,SAAiB,EACjB,IAAY;QAEZ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,GAAG,yBAAyB;YACrC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,gBAAgB;YAC7D,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CACnF,CAAC;YACF,OAAO;gBACL,GAAG,EAAE,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,MAAM,gBAAgB,KAAK,CAAC,EAAE,EAAE;aAC9F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,2DAA2D;oBAC7E,+EAA+E,EACjF,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,KAAa;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,gDAAgD;oBACpF,oFAAoF;oBACpF,oFAAoF;oBACpF,iDAAiD,EACnD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;CACF","sourcesContent":["import { existsSync } from \"fs\";\nimport * as log from \"../../log.js\";\nimport { GithubApiError, GithubClient, GITHUB_MAX_COMMENT_LENGTH, githubRetry } from \"./client.js\";\nimport {\n  CLOUD_BUILD_APP_SLUG,\n  CloudBuildLogUnavailableError,\n  fetchCloudBuildLog,\n  isCloudBuildId,\n  projectFromDetailsUrl,\n} from \"./cloudbuild.js\";\nimport { parseGithubConversationId } from \"./ids.js\";\nimport { conversationRepoDir, GITHUB_PUSH_BRANCH_PATTERN, pushBranch, syncRepo } from \"./repo.js\";\nimport { createOfficeAddress } from \"../../office/index.js\";\nimport type {\n  GithubBotConfig,\n  GithubCheckSummary,\n  GithubConversationRef,\n  GithubIssueRequest,\n  GithubPrRequest,\n  GithubPrResult,\n  GithubReadRequest,\n  GithubReadResult,\n  PlatformGithubOps,\n} from \"./types.js\";\n\n/** Both CI log modes tail-truncate to this many characters. */\nconst MAX_LOG_CHARS = 20000;\n\nfunction truncateLogTail(logText: string): string {\n  return logText.length > MAX_LOG_CHARS\n    ? `…(truncated to the last ${MAX_LOG_CHARS} chars)\\n${logText.slice(-MAX_LOG_CHARS)}`\n    : logText;\n}\n\n/** Whether the conversation's issue is a PR, for callers where the triggering\n *  item didn't carry that knowledge. Errs toward plain issue. */\nexport async function fetchIsPr(\n  client: GithubClient,\n  ref: GithubConversationRef,\n): Promise<boolean> {\n  try {\n    const issue = await githubRetry(() => client.getIssue(ref.owner, ref.repo, ref.number));\n    return Boolean(issue.pull_request);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The PR's head branch name when it lives in this repo — that is the name\n * the local checkout should carry, so committing on it and calling\n * github_pr pushes back to the PR itself instead of opening a new one.\n * Fork heads (unpushable with the repo-scoped token) and failed lookups\n * return undefined; callers then fall back to the synthetic pr-<n>.\n */\nexport async function fetchPrHeadBranch(\n  client: GithubClient,\n  ref: GithubConversationRef,\n): Promise<string | undefined> {\n  try {\n    const pr = await githubRetry(() => client.getPullRequest(ref.owner, ref.repo, ref.number));\n    const sameRepo =\n      pr.head?.repo?.full_name?.toLowerCase() === `${ref.owner}/${ref.repo}`.toLowerCase();\n    return sameRepo ? pr.head?.ref : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Host-side backend of the github_* tool pack (`PlatformGithubOps`),\n * standalone from the messaging bot: it needs the API client, the\n * conversation working dir, and optional Cloud Build access — not the poll\n * loop, queues, or trigger gate. Tokens are minted per call, scoped to the\n * conversation's repo, and never enter the sandbox.\n */\nexport class GithubOps implements PlatformGithubOps {\n  /** Cloud Build ids seen in getChecks summaries → their GCP project. */\n  private buildRef = new Map<string, { project: string }>();\n\n  constructor(\n    private readonly client: GithubClient,\n    private readonly config: {\n      workspace: import(\"../../office/types.js\").Workspace;\n      cloudBuild?: GithubBotConfig[\"cloudBuild\"];\n    },\n  ) {}\n\n  private repoDir(conversationId: string): string {\n    return conversationRepoDir(\n      this.config.workspace.office(createOfficeAddress(\"github\", conversationId)),\n    );\n  }\n\n  /**\n   * Backs the `github_pr` tool: push a `pi/*` branch the agent prepared in\n   * the conversation's clone, then open a pull request as the App. The write\n   * token is minted per call, scoped to this one repo, and never enters the\n   * sandbox.\n   */\n  async pushAndCreatePr(conversationId: string, request: GithubPrRequest): Promise<GithubPrResult> {\n    const ref = parseGithubConversationId(conversationId);\n    const dir = this.repoDir(conversationId);\n    if (!existsSync(dir)) {\n      throw new Error(\"This conversation has no ./repo clone to push from.\");\n    }\n    if (!GITHUB_PUSH_BRANCH_PATTERN.test(request.branch)) {\n      throw new Error(\n        `Branch '${request.branch}' is not pushable: name it pi/<something> (e.g. pi/fix-${ref.number}).`,\n      );\n    }\n    const repository = await githubRetry(() => this.client.getRepository(ref.owner, ref.repo));\n    const base = request.base ?? repository.default_branch;\n    const token = await this.client.createScopedInstallationToken(ref.repo, {\n      contents: \"write\",\n      pull_requests: \"write\",\n    });\n    await pushBranch({ dir, branch: request.branch, token });\n    try {\n      const pr = await githubRetry(() =>\n        this.client.createPullRequest(ref.owner, ref.repo, {\n          title: request.title,\n          head: request.branch,\n          base,\n          body: request.body,\n          draft: request.draft,\n        }),\n      );\n      log.logInfo(`[${conversationId}] Opened PR #${pr.number}: ${pr.html_url}`);\n      return { number: pr.number, url: pr.html_url };\n    } catch (err) {\n      // Idempotency: pushing more commits to a branch that already has an\n      // open PR updates that PR; the create call then 422s. Surface the\n      // existing PR instead of failing the fix-CI-push-again loop.\n      if (\n        err instanceof GithubApiError &&\n        err.status === 422 &&\n        /already exists/i.test(err.message)\n      ) {\n        const existing = await this.client.findOpenPullRequestByBranch(\n          ref.owner,\n          ref.repo,\n          request.branch,\n        );\n        if (existing) {\n          log.logInfo(\n            `[${conversationId}] Pushed to existing PR #${existing.number}: ${existing.html_url}`,\n          );\n          return { number: existing.number, url: existing.html_url, updatedExisting: true };\n        }\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the `github_checks` tool: CI check runs for a branch the agent\n   * pushed, or for the conversation's PR head when no branch is given.\n   */\n  async getChecks(conversationId: string, branch?: string): Promise<GithubCheckSummary[]> {\n    const ref = parseGithubConversationId(conversationId);\n    let target = branch;\n    if (!target) {\n      let pr;\n      try {\n        pr = await githubRetry(() => this.client.getPullRequest(ref.owner, ref.repo, ref.number));\n      } catch {\n        pr = null;\n      }\n      if (!pr?.head) {\n        throw new Error(\n          \"This conversation is not a pull request — pass the branch whose checks you want.\",\n        );\n      }\n      target = pr.head.sha;\n    }\n    const runs = await githubRetry(() => this.client.listCheckRuns(ref.owner, ref.repo, target));\n    return runs.map((run) => {\n      const externalId = run.external_id?.trim() || null;\n      let buildLogAvailable = false;\n      // Cloud Build runs carry their build UUID in external_id and the GCP\n      // project in details_url. Remember project-by-build so getBuildLog only\n      // serves builds the agent actually saw on this repo's checks.\n      if (\n        this.config.cloudBuild &&\n        run.app?.slug === CLOUD_BUILD_APP_SLUG &&\n        externalId &&\n        isCloudBuildId(externalId)\n      ) {\n        const project =\n          projectFromDetailsUrl(run.details_url) ?? this.config.cloudBuild.projectFallback;\n        if (project) {\n          this.rememberBuild(externalId, project);\n          buildLogAvailable = true;\n        }\n      }\n      return {\n        id: run.id,\n        name: run.name,\n        status: run.status,\n        conclusion: run.conclusion,\n        url: run.html_url,\n        appSlug: run.app?.slug ?? null,\n        outputSummary: run.output?.summary?.trim() ? run.output.summary.slice(0, 500) : null,\n        externalId,\n        buildLogAvailable,\n      };\n    });\n  }\n\n  private rememberBuild(buildId: string, project: string): void {\n    // Insertion-ordered Map as a small LRU: re-insert on touch, prune oldest.\n    this.buildRef.delete(buildId);\n    this.buildRef.set(buildId, { project });\n    if (this.buildRef.size > 200) {\n      const oldest = this.buildRef.keys().next().value;\n      if (oldest !== undefined) this.buildRef.delete(oldest);\n    }\n  }\n\n  /**\n   * Backs the Cloud Build log mode of `github_checks`. GCP credentials stay\n   * host-side (ADC via GOOGLE_APPLICATION_CREDENTIALS — e.g. a Workload\n   * Identity Federation external_account file); the build must have appeared\n   * in a github_checks summary first, which is also where its project is\n   * learned. Unreadable logs degrade to the console url, never a dead end.\n   */\n  async getBuildLog(conversationId: string, buildId: string): Promise<string> {\n    if (!this.config.cloudBuild) {\n      throw new Error(\n        \"Cloud Build log access is not configured on this host (no GCP credentials).\",\n      );\n    }\n    const known = this.buildRef.get(buildId);\n    if (!known) {\n      throw new Error(\n        `Unknown build id ${buildId}: run github_checks first and take a [build …] id from ` +\n          `the summary.`,\n      );\n    }\n    let logText: string;\n    try {\n      logText = await fetchCloudBuildLog({\n        tokenProvider: this.config.cloudBuild.tokenProvider,\n        project: known.project,\n        buildId,\n      });\n    } catch (err) {\n      if (err instanceof CloudBuildLogUnavailableError) {\n        throw new Error(\n          `${err.message}${err.consoleUrl ? ` Console: ${err.consoleUrl}` : \"\"} Use the check's ` +\n            `summary/url from github_checks, or reproduce the failure locally in ./repo.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n    return truncateLogTail(logText);\n  }\n\n  /**\n   * Backs the `github_sync` tool: refresh the conversation's ./repo clone\n   * from origin with an ephemeral read token. Fetch-only when moving the\n   * checkout could lose agent work; the formatted report tells the agent\n   * what happened and what to do next.\n   */\n  async syncRepo(conversationId: string, branch?: string): Promise<string> {\n    const ref = parseGithubConversationId(conversationId);\n    const dir = this.repoDir(conversationId);\n    if (!existsSync(dir)) {\n      throw new Error(\"This conversation has no ./repo clone to sync.\");\n    }\n    const token = await this.client.createScopedInstallationToken(ref.repo, {\n      contents: \"read\",\n    });\n    let prNumber: number | undefined;\n    let prHeadBranch: string | undefined;\n    let defaultBranch: string | undefined;\n    if (!branch) {\n      if (await fetchIsPr(this.client, ref)) {\n        prNumber = ref.number;\n        prHeadBranch = await fetchPrHeadBranch(this.client, ref);\n      } else {\n        const repository = await githubRetry(() => this.client.getRepository(ref.owner, ref.repo));\n        defaultBranch = repository.default_branch;\n      }\n    }\n    const result = await syncRepo({ dir, token, branch, prNumber, prHeadBranch, defaultBranch });\n\n    if (result.updatedCheckout) {\n      return `Updated ./repo: branch ${result.target} is now at ${result.fetchedSha.slice(0, 12)}.`;\n    }\n    const reasons: string[] = [];\n    if (result.currentBranch !== result.target) {\n      reasons.push(`the checkout is on '${result.currentBranch}', not '${result.target}'`);\n    }\n    if (result.dirty) {\n      reasons.push(\"the working tree has uncommitted changes\");\n    }\n    if (result.localCommits > 0) {\n      reasons.push(`'${result.target}' has ${result.localCommits} local commit(s) not on origin`);\n    }\n    return (\n      `Fetched ${result.target} to FETCH_HEAD (${result.fetchedSha.slice(0, 12)}) but left the ` +\n      `checkout alone: ${reasons.join(\"; \")}. Merge or rebase FETCH_HEAD yourself ` +\n      `(e.g. git merge FETCH_HEAD), or commit your work to a pi/* branch first.`\n    );\n  }\n\n  /**\n   * Backs the `github_read` tool: PR/issue metadata the ./repo clone cannot\n   * provide (diff stats, review state, other issues in the repo). Owner/repo\n   * always come from the conversation id, so reads never leave this repo.\n   */\n  async readGithub(conversationId: string, request: GithubReadRequest): Promise<GithubReadResult> {\n    const ref = parseGithubConversationId(conversationId);\n    const number = request.number ?? ref.number;\n    switch (request.action) {\n      case \"pr\": {\n        const pr = await githubRetry(() => this.client.getPullRequest(ref.owner, ref.repo, number));\n        return { kind: \"pr\", pr };\n      }\n      case \"pr_files\": {\n        const files = await githubRetry(() =>\n          this.client.listPullRequestFiles(ref.owner, ref.repo, number),\n        );\n        return { kind: \"pr_files\", files };\n      }\n      case \"pr_reviews\": {\n        const [reviews, threads] = await Promise.all([\n          githubRetry(() => this.client.listPullRequestReviews(ref.owner, ref.repo, number)),\n          githubRetry(() => this.client.listPullReviewComments(ref.owner, ref.repo, number)),\n        ]);\n        return { kind: \"pr_reviews\", reviews, threads };\n      }\n      case \"issue\": {\n        const issue = await githubRetry(() => this.client.getIssue(ref.owner, ref.repo, number));\n        return { kind: \"issue\", issue };\n      }\n      case \"comments\": {\n        const comments = await githubRetry(() =>\n          this.client.listIssueComments(ref.owner, ref.repo, number),\n        );\n        return { kind: \"comments\", comments };\n      }\n      case \"list\": {\n        const issues = await githubRetry(() =>\n          this.client.listIssues(ref.owner, ref.repo, {\n            state: request.state,\n            labels: request.labels,\n            creator: request.creator,\n          }),\n        );\n        return { kind: \"list\", issues };\n      }\n      default:\n        throw new Error(`Unknown github_read action: ${String(request.action)}`);\n    }\n  }\n\n  /**\n   * Backs the `github_issue` tool: labels, assignees, and open/closed state\n   * on any issue of this conversation's repo (triage). Same-repo by\n   * construction — owner/repo come from the conversation id; the action enum\n   * is closed, so lock/delete/transfer cannot be expressed at all.\n   */\n  async manageIssue(conversationId: string, request: GithubIssueRequest): Promise<string> {\n    const ref = parseGithubConversationId(conversationId);\n    const number = request.number ?? ref.number;\n    try {\n      switch (request.action) {\n        case \"add_labels\": {\n          if (!request.labels?.length) {\n            throw new Error(\"add_labels requires a non-empty labels array.\");\n          }\n          await githubRetry(() =>\n            this.client.addIssueLabels(ref.owner, ref.repo, number, request.labels!),\n          );\n          return `Added label(s) ${request.labels.join(\", \")} to #${number}.`;\n        }\n        case \"remove_label\": {\n          if (!request.label) {\n            throw new Error(\"remove_label requires a label name.\");\n          }\n          await githubRetry(() =>\n            this.client.removeIssueLabel(ref.owner, ref.repo, number, request.label!),\n          );\n          return `Removed label ${request.label} from #${number}.`;\n        }\n        case \"add_assignees\": {\n          if (!request.assignees?.length) {\n            throw new Error(\"add_assignees requires a non-empty assignees array.\");\n          }\n          await githubRetry(() =>\n            this.client.addIssueAssignees(ref.owner, ref.repo, number, request.assignees!),\n          );\n          return `Assigned ${request.assignees.map((login) => `@${login}`).join(\", \")} to #${number}.`;\n        }\n        case \"remove_assignees\": {\n          if (!request.assignees?.length) {\n            throw new Error(\"remove_assignees requires a non-empty assignees array.\");\n          }\n          await githubRetry(() =>\n            this.client.removeIssueAssignees(ref.owner, ref.repo, number, request.assignees!),\n          );\n          return `Unassigned ${request.assignees.map((login) => `@${login}`).join(\", \")} from #${number}.`;\n        }\n        case \"close\": {\n          await githubRetry(() =>\n            this.client.updateIssueState(\n              ref.owner,\n              ref.repo,\n              number,\n              \"closed\",\n              request.state_reason,\n            ),\n          );\n          return `Closed #${number}${request.state_reason ? ` as ${request.state_reason}` : \"\"}.`;\n        }\n        case \"reopen\": {\n          await githubRetry(() =>\n            this.client.updateIssueState(ref.owner, ref.repo, number, \"open\"),\n          );\n          return `Reopened #${number}.`;\n        }\n        default:\n          throw new Error(`Unknown github_issue action: ${String(request.action)}`);\n      }\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(`Issue #${number} not found in ${ref.owner}/${ref.repo}.`, { cause: err });\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the `github_review_reply` tool: answer inside one inline review\n   * thread of this conversation's PR. The comment id comes from an\n   * `[PR review comment rc-<id> …]` message; GitHub validates it belongs to\n   * this PR (404 otherwise, translated into agent-actionable guidance).\n   */\n  async replyToReviewThread(\n    conversationId: string,\n    commentId: number,\n    body: string,\n  ): Promise<{ url: string }> {\n    if (!Number.isInteger(commentId) || commentId <= 0) {\n      throw new Error(\n        \"comment_id must be the numeric id from an [PR review comment rc-<id> …] message.\",\n      );\n    }\n    const ref = parseGithubConversationId(conversationId);\n    const text =\n      body.length > GITHUB_MAX_COMMENT_LENGTH\n        ? `${body.slice(0, GITHUB_MAX_COMMENT_LENGTH)}\\n…(truncated)`\n        : body;\n    try {\n      const reply = await githubRetry(() =>\n        this.client.replyToReviewComment(ref.owner, ref.repo, ref.number, commentId, text),\n      );\n      return {\n        url: `https://github.com/${ref.owner}/${ref.repo}/pull/${ref.number}#discussion_r${reply.id}`,\n      };\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(\n          `Comment ${commentId} is not a review comment on this PR. Take the id from an ` +\n            `[PR review comment rc-<id> …] message in this conversation; do not guess ids.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the log mode of `github_checks`: the tail of one CI job's log so\n   * the agent can diagnose a failing check without sandbox credentials. Only\n   * GitHub Actions checks have logs on GitHub — external CI apps (e.g. Cloud\n   * Build) keep theirs on their own service, so a 404 here is translated\n   * into guidance instead of a dead end.\n   */\n  async getJobLog(conversationId: string, jobId: number): Promise<string> {\n    if (!Number.isInteger(jobId) || jobId <= 0) {\n      throw new Error(\n        \"job_id must be a positive Actions job id taken from a [job …] entry in the github_checks summary.\",\n      );\n    }\n    const ref = parseGithubConversationId(conversationId);\n    let logText: string;\n    try {\n      logText = await githubRetry(() => this.client.getJobLog(ref.owner, ref.repo, jobId));\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(\n          `No GitHub Actions log for job ${jobId}. Logs are only available for checks reported ` +\n            `by github-actions; external CI (e.g. Cloud Build) keeps logs on its own service — ` +\n            `use that check's summary/url from github_checks, or reproduce the failure locally ` +\n            `in ./repo instead. Do not retry with other ids.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n    return truncateLogTail(logText);\n  }\n}\n"]}
+{"version":3,"file":"github-ops.js","sourceRoot":"","sources":["../../../src/adapters/github/github-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,cAAc,EACd,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAc5D,+DAA+D;AAC/D,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,OAAO,CAAC,MAAM,GAAG,aAAa;QACnC,CAAC,CAAC,2BAA2B,aAAa,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;QACrF,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAoB,EACpB,GAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAoB,EACpB,GAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GACZ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IAIpB,YACmB,MAAoB,EACpB,MAGhB;QAJgB,WAAM,GAAN,MAAM,CAAc;QACpB,WAAM,GAAN,MAAM,CAGtB;QARH,uEAAuE;QAC/D,aAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAQvD,CAAC;IAEI,OAAO,CAAC,cAAsB;QACpC,OAAO,mBAAmB,CACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAC5E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,cAAsB,EAAE,OAAwB;QACpE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,WAAW,OAAO,CAAC,MAAM,0DAA0D,GAAG,CAAC,MAAM,IAAI,CAClG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,cAAc,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE;YACtE,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAChC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;gBACjD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,MAAM;gBACpB,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CACH,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,IAAI,cAAc,gBAAgB,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,6DAA6D;YAC7D,IACE,GAAG,YAAY,cAAc;gBAC7B,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EACnC,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAC5D,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,MAAM,CACf,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,OAAO,CACT,IAAI,cAAc,4BAA4B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,EAAE,CACtF,CAAC;oBACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBACpF,CAAC;YACH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,MAAe;QACrD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,MAAM,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,IAAI,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;YACnD,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,qEAAqE;YACrE,wEAAwE;YACxE,8DAA8D;YAC9D,IACE,IAAI,CAAC,MAAM,CAAC,UAAU;gBACtB,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK,oBAAoB;gBACtC,UAAU;gBACV,cAAc,CAAC,UAAU,CAAC,EAC1B,CAAC;gBACD,MAAM,OAAO,GACX,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;gBACnF,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACxC,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,GAAG,EAAE,GAAG,CAAC,QAAQ;gBACjB,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;gBACpF,UAAU;gBACV,iBAAiB;aAClB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,OAAe,EAAE,OAAe;QACpD,0EAA0E;QAC1E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,OAAe;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,yDAAyD;gBAClF,cAAc,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,kBAAkB,CAAC;gBACjC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa;gBACnD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB;oBACrF,6EAA6E,EAC/E,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,cAAsB,EAAE,MAAe;QACpD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE;YACtE,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,IAAI,QAA4B,CAAC;QACjC,IAAI,YAAgC,CAAC;QACrC,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;gBACtB,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3F,aAAa,GAAG,UAAU,CAAC,cAAc,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;QAE7F,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,OAAO,0BAA0B,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAChG,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,aAAa,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,YAAY,gCAAgC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CACL,WAAW,MAAM,CAAC,MAAM,mBAAmB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB;YAC1F,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YAC7E,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,cAAsB,EAAE,OAA0B;QACjE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;QAC5C,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,IAAI,EAAE,CAAC;gBACV,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC5F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC5B,CAAC;YACD,KAAK,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAC9D,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YACrC,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC3C,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAClF,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBACnF,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAClD,CAAC;YACD,KAAK,OAAO,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,UAAU,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAC3D,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;oBAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAClC,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,OAA2B;QACnE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;QAC5C,IAAI,CAAC;YACH,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,KAAK,YAAY,EAAE,CAAC;oBAClB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;oBACnE,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAO,CAAC,CACzE,CAAC;oBACF,OAAO,kBAAkB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,GAAG,CAAC;gBACtE,CAAC;gBACD,KAAK,cAAc,EAAE,CAAC;oBACpB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBACzD,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAM,CAAC,CAC1E,CAAC;oBACF,OAAO,iBAAiB,OAAO,CAAC,KAAK,UAAU,MAAM,GAAG,CAAC;gBAC3D,CAAC;gBACD,KAAK,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;oBACzE,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,SAAU,CAAC,CAC/E,CAAC;oBACF,OAAO,YAAY,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,GAAG,CAAC;gBAC/F,CAAC;gBACD,KAAK,kBAAkB,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBAC5E,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,SAAU,CAAC,CAClF,CAAC;oBACF,OAAO,cAAc,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC;gBACnG,CAAC;gBACD,KAAK,OAAO,EAAE,CAAC;oBACb,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC1B,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,IAAI,EACR,MAAM,EACN,QAAQ,EACR,OAAO,CAAC,YAAY,CACrB,CACF,CAAC;oBACF,OAAO,WAAW,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC1F,CAAC;gBACD,KAAK,QAAQ,EAAE,CAAC;oBACd,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAClE,CAAC;oBACF,OAAO,aAAa,MAAM,GAAG,CAAC;gBAChC,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,iBAAiB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CACvB,cAAsB,EACtB,SAAiB,EACjB,IAAY;QAEZ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,GAAG,yBAAyB;YACrC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,gBAAgB;YAC7D,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CACnF,CAAC;YACF,OAAO;gBACL,GAAG,EAAE,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,MAAM,gBAAgB,KAAK,CAAC,EAAE,EAAE;aAC9F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,2DAA2D;oBAC7E,+EAA+E,EACjF,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,KAAa;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,gDAAgD;oBACpF,oFAAoF;oBACpF,oFAAoF;oBACpF,iDAAiD,EACnD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;CACF","sourcesContent":["import { existsSync } from \"node:fs\";\nimport * as log from \"../../log.js\";\nimport type { GithubClient } from \"./client.js\";\nimport { GithubApiError, GITHUB_MAX_COMMENT_LENGTH, githubRetry } from \"./client.js\";\nimport {\n  CLOUD_BUILD_APP_SLUG,\n  CloudBuildLogUnavailableError,\n  fetchCloudBuildLog,\n  isCloudBuildId,\n  projectFromDetailsUrl,\n} from \"./cloudbuild.js\";\nimport { parseGithubConversationId } from \"./ids.js\";\nimport { conversationRepoDir, GITHUB_PUSH_BRANCH_PATTERN, pushBranch, syncRepo } from \"./repo.js\";\nimport { createOfficeAddress } from \"../../office/index.js\";\nimport type { Workspace } from \"../../office/index.js\";\nimport type {\n  GithubBotConfig,\n  GithubCheckSummary,\n  GithubConversationRef,\n  GithubIssueRequest,\n  GithubPrRequest,\n  GithubPrResult,\n  GithubReadRequest,\n  GithubReadResult,\n  PlatformGithubOps,\n} from \"./types.js\";\n\n/** Both CI log modes tail-truncate to this many characters. */\nconst MAX_LOG_CHARS = 20000;\n\nfunction truncateLogTail(logText: string): string {\n  return logText.length > MAX_LOG_CHARS\n    ? `…(truncated to the last ${MAX_LOG_CHARS} chars)\\n${logText.slice(-MAX_LOG_CHARS)}`\n    : logText;\n}\n\n/** Whether the conversation's issue is a PR, for callers where the triggering\n *  item didn't carry that knowledge. Errs toward plain issue. */\nexport async function fetchIsPr(\n  client: GithubClient,\n  ref: GithubConversationRef,\n): Promise<boolean> {\n  try {\n    const issue = await githubRetry(() => client.getIssue(ref.owner, ref.repo, ref.number));\n    return Boolean(issue.pull_request);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The PR's head branch name when it lives in this repo — that is the name\n * the local checkout should carry, so committing on it and calling\n * github_pr pushes back to the PR itself instead of opening a new one.\n * Fork heads (unpushable with the repo-scoped token) and failed lookups\n * return undefined; callers then fall back to the synthetic pr-<n>.\n */\nexport async function fetchPrHeadBranch(\n  client: GithubClient,\n  ref: GithubConversationRef,\n): Promise<string | undefined> {\n  try {\n    const pr = await githubRetry(() => client.getPullRequest(ref.owner, ref.repo, ref.number));\n    const sameRepo =\n      pr.head?.repo?.full_name?.toLowerCase() === `${ref.owner}/${ref.repo}`.toLowerCase();\n    return sameRepo ? pr.head?.ref : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Host-side backend of the github_* tool pack (`PlatformGithubOps`),\n * standalone from the messaging bot: it needs the API client, the\n * conversation working dir, and optional Cloud Build access — not the poll\n * loop, queues, or trigger gate. Tokens are minted per call, scoped to the\n * conversation's repo, and never enter the sandbox.\n */\nexport class GithubOps implements PlatformGithubOps {\n  /** Cloud Build ids seen in getChecks summaries → their GCP project. */\n  private buildRef = new Map<string, { project: string }>();\n\n  constructor(\n    private readonly client: GithubClient,\n    private readonly config: {\n      workspace: Workspace;\n      cloudBuild?: GithubBotConfig[\"cloudBuild\"];\n    },\n  ) {}\n\n  private repoDir(conversationId: string): string {\n    return conversationRepoDir(\n      this.config.workspace.office(createOfficeAddress(\"github\", conversationId)),\n    );\n  }\n\n  /**\n   * Backs the `github_pr` tool: push a `pi/*` branch the agent prepared in\n   * the conversation's clone, then open a pull request as the App. The write\n   * token is minted per call, scoped to this one repo, and never enters the\n   * sandbox.\n   */\n  async pushAndCreatePr(conversationId: string, request: GithubPrRequest): Promise<GithubPrResult> {\n    const ref = parseGithubConversationId(conversationId);\n    const dir = this.repoDir(conversationId);\n    if (!existsSync(dir)) {\n      throw new Error(\"This conversation has no ./repo clone to push from.\");\n    }\n    if (!GITHUB_PUSH_BRANCH_PATTERN.test(request.branch)) {\n      throw new Error(\n        `Branch '${request.branch}' is not pushable: name it pi/<something> (e.g. pi/fix-${ref.number}).`,\n      );\n    }\n    const repository = await githubRetry(() => this.client.getRepository(ref.owner, ref.repo));\n    const base = request.base ?? repository.default_branch;\n    const token = await this.client.createScopedInstallationToken(ref.repo, {\n      contents: \"write\",\n      pull_requests: \"write\",\n    });\n    await pushBranch({ dir, branch: request.branch, token });\n    try {\n      const pr = await githubRetry(() =>\n        this.client.createPullRequest(ref.owner, ref.repo, {\n          title: request.title,\n          head: request.branch,\n          base,\n          body: request.body,\n          draft: request.draft,\n        }),\n      );\n      log.logInfo(`[${conversationId}] Opened PR #${pr.number}: ${pr.html_url}`);\n      return { number: pr.number, url: pr.html_url };\n    } catch (err) {\n      // Idempotency: pushing more commits to a branch that already has an\n      // open PR updates that PR; the create call then 422s. Surface the\n      // existing PR instead of failing the fix-CI-push-again loop.\n      if (\n        err instanceof GithubApiError &&\n        err.status === 422 &&\n        /already exists/i.test(err.message)\n      ) {\n        const existing = await this.client.findOpenPullRequestByBranch(\n          ref.owner,\n          ref.repo,\n          request.branch,\n        );\n        if (existing) {\n          log.logInfo(\n            `[${conversationId}] Pushed to existing PR #${existing.number}: ${existing.html_url}`,\n          );\n          return { number: existing.number, url: existing.html_url, updatedExisting: true };\n        }\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the `github_checks` tool: CI check runs for a branch the agent\n   * pushed, or for the conversation's PR head when no branch is given.\n   */\n  async getChecks(conversationId: string, branch?: string): Promise<GithubCheckSummary[]> {\n    const ref = parseGithubConversationId(conversationId);\n    let target = branch;\n    if (!target) {\n      let pr;\n      try {\n        pr = await githubRetry(() => this.client.getPullRequest(ref.owner, ref.repo, ref.number));\n      } catch {\n        pr = null;\n      }\n      if (!pr?.head) {\n        throw new Error(\n          \"This conversation is not a pull request — pass the branch whose checks you want.\",\n        );\n      }\n      target = pr.head.sha;\n    }\n    const runs = await githubRetry(() => this.client.listCheckRuns(ref.owner, ref.repo, target));\n    return runs.map((run) => {\n      const externalId = run.external_id?.trim() || null;\n      let buildLogAvailable = false;\n      // Cloud Build runs carry their build UUID in external_id and the GCP\n      // project in details_url. Remember project-by-build so getBuildLog only\n      // serves builds the agent actually saw on this repo's checks.\n      if (\n        this.config.cloudBuild &&\n        run.app?.slug === CLOUD_BUILD_APP_SLUG &&\n        externalId &&\n        isCloudBuildId(externalId)\n      ) {\n        const project =\n          projectFromDetailsUrl(run.details_url) ?? this.config.cloudBuild.projectFallback;\n        if (project) {\n          this.rememberBuild(externalId, project);\n          buildLogAvailable = true;\n        }\n      }\n      return {\n        id: run.id,\n        name: run.name,\n        status: run.status,\n        conclusion: run.conclusion,\n        url: run.html_url,\n        appSlug: run.app?.slug ?? null,\n        outputSummary: run.output?.summary?.trim() ? run.output.summary.slice(0, 500) : null,\n        externalId,\n        buildLogAvailable,\n      };\n    });\n  }\n\n  private rememberBuild(buildId: string, project: string): void {\n    // Insertion-ordered Map as a small LRU: re-insert on touch, prune oldest.\n    this.buildRef.delete(buildId);\n    this.buildRef.set(buildId, { project });\n    if (this.buildRef.size > 200) {\n      const oldest = this.buildRef.keys().next().value;\n      if (oldest !== undefined) this.buildRef.delete(oldest);\n    }\n  }\n\n  /**\n   * Backs the Cloud Build log mode of `github_checks`. GCP credentials stay\n   * host-side (ADC via GOOGLE_APPLICATION_CREDENTIALS — e.g. a Workload\n   * Identity Federation external_account file); the build must have appeared\n   * in a github_checks summary first, which is also where its project is\n   * learned. Unreadable logs degrade to the console url, never a dead end.\n   */\n  async getBuildLog(conversationId: string, buildId: string): Promise<string> {\n    if (!this.config.cloudBuild) {\n      throw new Error(\n        \"Cloud Build log access is not configured on this host (no GCP credentials).\",\n      );\n    }\n    const known = this.buildRef.get(buildId);\n    if (!known) {\n      throw new Error(\n        `Unknown build id ${buildId}: run github_checks first and take a [build …] id from ` +\n          `the summary.`,\n      );\n    }\n    let logText: string;\n    try {\n      logText = await fetchCloudBuildLog({\n        tokenProvider: this.config.cloudBuild.tokenProvider,\n        project: known.project,\n        buildId,\n      });\n    } catch (err) {\n      if (err instanceof CloudBuildLogUnavailableError) {\n        throw new Error(\n          `${err.message}${err.consoleUrl ? ` Console: ${err.consoleUrl}` : \"\"} Use the check's ` +\n            `summary/url from github_checks, or reproduce the failure locally in ./repo.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n    return truncateLogTail(logText);\n  }\n\n  /**\n   * Backs the `github_sync` tool: refresh the conversation's ./repo clone\n   * from origin with an ephemeral read token. Fetch-only when moving the\n   * checkout could lose agent work; the formatted report tells the agent\n   * what happened and what to do next.\n   */\n  async syncRepo(conversationId: string, branch?: string): Promise<string> {\n    const ref = parseGithubConversationId(conversationId);\n    const dir = this.repoDir(conversationId);\n    if (!existsSync(dir)) {\n      throw new Error(\"This conversation has no ./repo clone to sync.\");\n    }\n    const token = await this.client.createScopedInstallationToken(ref.repo, {\n      contents: \"read\",\n    });\n    let prNumber: number | undefined;\n    let prHeadBranch: string | undefined;\n    let defaultBranch: string | undefined;\n    if (!branch) {\n      if (await fetchIsPr(this.client, ref)) {\n        prNumber = ref.number;\n        prHeadBranch = await fetchPrHeadBranch(this.client, ref);\n      } else {\n        const repository = await githubRetry(() => this.client.getRepository(ref.owner, ref.repo));\n        defaultBranch = repository.default_branch;\n      }\n    }\n    const result = await syncRepo({ dir, token, branch, prNumber, prHeadBranch, defaultBranch });\n\n    if (result.updatedCheckout) {\n      return `Updated ./repo: branch ${result.target} is now at ${result.fetchedSha.slice(0, 12)}.`;\n    }\n    const reasons: string[] = [];\n    if (result.currentBranch !== result.target) {\n      reasons.push(`the checkout is on '${result.currentBranch}', not '${result.target}'`);\n    }\n    if (result.dirty) {\n      reasons.push(\"the working tree has uncommitted changes\");\n    }\n    if (result.localCommits > 0) {\n      reasons.push(`'${result.target}' has ${result.localCommits} local commit(s) not on origin`);\n    }\n    return (\n      `Fetched ${result.target} to FETCH_HEAD (${result.fetchedSha.slice(0, 12)}) but left the ` +\n      `checkout alone: ${reasons.join(\"; \")}. Merge or rebase FETCH_HEAD yourself ` +\n      `(e.g. git merge FETCH_HEAD), or commit your work to a pi/* branch first.`\n    );\n  }\n\n  /**\n   * Backs the `github_read` tool: PR/issue metadata the ./repo clone cannot\n   * provide (diff stats, review state, other issues in the repo). Owner/repo\n   * always come from the conversation id, so reads never leave this repo.\n   */\n  async readGithub(conversationId: string, request: GithubReadRequest): Promise<GithubReadResult> {\n    const ref = parseGithubConversationId(conversationId);\n    const number = request.number ?? ref.number;\n    switch (request.action) {\n      case \"pr\": {\n        const pr = await githubRetry(() => this.client.getPullRequest(ref.owner, ref.repo, number));\n        return { kind: \"pr\", pr };\n      }\n      case \"pr_files\": {\n        const files = await githubRetry(() =>\n          this.client.listPullRequestFiles(ref.owner, ref.repo, number),\n        );\n        return { kind: \"pr_files\", files };\n      }\n      case \"pr_reviews\": {\n        const [reviews, threads] = await Promise.all([\n          githubRetry(() => this.client.listPullRequestReviews(ref.owner, ref.repo, number)),\n          githubRetry(() => this.client.listPullReviewComments(ref.owner, ref.repo, number)),\n        ]);\n        return { kind: \"pr_reviews\", reviews, threads };\n      }\n      case \"issue\": {\n        const issue = await githubRetry(() => this.client.getIssue(ref.owner, ref.repo, number));\n        return { kind: \"issue\", issue };\n      }\n      case \"comments\": {\n        const comments = await githubRetry(() =>\n          this.client.listIssueComments(ref.owner, ref.repo, number),\n        );\n        return { kind: \"comments\", comments };\n      }\n      case \"list\": {\n        const issues = await githubRetry(() =>\n          this.client.listIssues(ref.owner, ref.repo, {\n            state: request.state,\n            labels: request.labels,\n            creator: request.creator,\n          }),\n        );\n        return { kind: \"list\", issues };\n      }\n      default:\n        throw new Error(`Unknown github_read action: ${String(request.action)}`);\n    }\n  }\n\n  /**\n   * Backs the `github_issue` tool: labels, assignees, and open/closed state\n   * on any issue of this conversation's repo (triage). Same-repo by\n   * construction — owner/repo come from the conversation id; the action enum\n   * is closed, so lock/delete/transfer cannot be expressed at all.\n   */\n  async manageIssue(conversationId: string, request: GithubIssueRequest): Promise<string> {\n    const ref = parseGithubConversationId(conversationId);\n    const number = request.number ?? ref.number;\n    try {\n      switch (request.action) {\n        case \"add_labels\": {\n          if (!request.labels?.length) {\n            throw new Error(\"add_labels requires a non-empty labels array.\");\n          }\n          await githubRetry(() =>\n            this.client.addIssueLabels(ref.owner, ref.repo, number, request.labels!),\n          );\n          return `Added label(s) ${request.labels.join(\", \")} to #${number}.`;\n        }\n        case \"remove_label\": {\n          if (!request.label) {\n            throw new Error(\"remove_label requires a label name.\");\n          }\n          await githubRetry(() =>\n            this.client.removeIssueLabel(ref.owner, ref.repo, number, request.label!),\n          );\n          return `Removed label ${request.label} from #${number}.`;\n        }\n        case \"add_assignees\": {\n          if (!request.assignees?.length) {\n            throw new Error(\"add_assignees requires a non-empty assignees array.\");\n          }\n          await githubRetry(() =>\n            this.client.addIssueAssignees(ref.owner, ref.repo, number, request.assignees!),\n          );\n          return `Assigned ${request.assignees.map((login) => `@${login}`).join(\", \")} to #${number}.`;\n        }\n        case \"remove_assignees\": {\n          if (!request.assignees?.length) {\n            throw new Error(\"remove_assignees requires a non-empty assignees array.\");\n          }\n          await githubRetry(() =>\n            this.client.removeIssueAssignees(ref.owner, ref.repo, number, request.assignees!),\n          );\n          return `Unassigned ${request.assignees.map((login) => `@${login}`).join(\", \")} from #${number}.`;\n        }\n        case \"close\": {\n          await githubRetry(() =>\n            this.client.updateIssueState(\n              ref.owner,\n              ref.repo,\n              number,\n              \"closed\",\n              request.state_reason,\n            ),\n          );\n          return `Closed #${number}${request.state_reason ? ` as ${request.state_reason}` : \"\"}.`;\n        }\n        case \"reopen\": {\n          await githubRetry(() =>\n            this.client.updateIssueState(ref.owner, ref.repo, number, \"open\"),\n          );\n          return `Reopened #${number}.`;\n        }\n        default:\n          throw new Error(`Unknown github_issue action: ${String(request.action)}`);\n      }\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(`Issue #${number} not found in ${ref.owner}/${ref.repo}.`, { cause: err });\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the `github_review_reply` tool: answer inside one inline review\n   * thread of this conversation's PR. The comment id comes from an\n   * `[PR review comment rc-<id> …]` message; GitHub validates it belongs to\n   * this PR (404 otherwise, translated into agent-actionable guidance).\n   */\n  async replyToReviewThread(\n    conversationId: string,\n    commentId: number,\n    body: string,\n  ): Promise<{ url: string }> {\n    if (!Number.isInteger(commentId) || commentId <= 0) {\n      throw new Error(\n        \"comment_id must be the numeric id from an [PR review comment rc-<id> …] message.\",\n      );\n    }\n    const ref = parseGithubConversationId(conversationId);\n    const text =\n      body.length > GITHUB_MAX_COMMENT_LENGTH\n        ? `${body.slice(0, GITHUB_MAX_COMMENT_LENGTH)}\\n…(truncated)`\n        : body;\n    try {\n      const reply = await githubRetry(() =>\n        this.client.replyToReviewComment(ref.owner, ref.repo, ref.number, commentId, text),\n      );\n      return {\n        url: `https://github.com/${ref.owner}/${ref.repo}/pull/${ref.number}#discussion_r${reply.id}`,\n      };\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(\n          `Comment ${commentId} is not a review comment on this PR. Take the id from an ` +\n            `[PR review comment rc-<id> …] message in this conversation; do not guess ids.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the log mode of `github_checks`: the tail of one CI job's log so\n   * the agent can diagnose a failing check without sandbox credentials. Only\n   * GitHub Actions checks have logs on GitHub — external CI apps (e.g. Cloud\n   * Build) keep theirs on their own service, so a 404 here is translated\n   * into guidance instead of a dead end.\n   */\n  async getJobLog(conversationId: string, jobId: number): Promise<string> {\n    if (!Number.isInteger(jobId) || jobId <= 0) {\n      throw new Error(\n        \"job_id must be a positive Actions job id taken from a [job …] entry in the github_checks summary.\",\n      );\n    }\n    const ref = parseGithubConversationId(conversationId);\n    let logText: string;\n    try {\n      logText = await githubRetry(() => this.client.getJobLog(ref.owner, ref.repo, jobId));\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(\n          `No GitHub Actions log for job ${jobId}. Logs are only available for checks reported ` +\n            `by github-actions; external CI (e.g. Cloud Build) keeps logs on its own service — ` +\n            `use that check's summary/url from github_checks, or reproduce the failure locally ` +\n            `in ./repo instead. Do not retry with other ids.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n    return truncateLogTail(logText);\n  }\n}\n"]}

package/dist/adapters/github/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/ids.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,qBAAqB,GAAG,MAAM,CAE5E;AAID,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,qBAAqB,CAYvF;AAED,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/ids.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,qBAAqB,GAAG,MAAM,CAE5E;AAID,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,qBAAqB,CAgBvF;AAED,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D"}

package/dist/adapters/github/ids.js

@@ -28,10 +28,14 @@ export function parseGithubConversationId(conversationId) {
     if (!match) {
         throw new Error(`Not a GitHub conversation id: ${conversationId}`);
     }
+    const [, owner, repo, number] = match;
+    if (owner === undefined || repo === undefined || number === undefined) {
+        throw new Error(`Not a GitHub conversation id: ${conversationId}`);
+    }
     return {
-        owner: match[1].toLowerCase(),
-        repo: match[2].toLowerCase(),
-        number: Number(match[3]),
+        owner: owner.toLowerCase(),
+        repo: repo.toLowerCase(),
+        number: Number(number),
     };
 }
 /** Message ts used for the issue/PR body itself (comments use their comment id). */

package/dist/adapters/github/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../../src/adapters/github/ids.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAA0B;IAClE,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAElE,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACzB,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,MAAM,SAAS,EAAE,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC","sourcesContent":["import type { GithubConversationRef } from \"./types.js\";\n\n/**\n * Conversation id for one issue/PR: `GH_<owner>_<repo>_<number>`.\n *\n * DESIGN.md originally proposed `gh:<owner>/<repo>#<number>`, but conversation\n * ids are used verbatim as a single path segment (LAYOUT.md § Casing) and the\n * conversation dir is bind-mounted with docker's `-v source:target` syntax in\n * image mode — so the id can contain neither `/` nor `:`. `_` is the\n * separator because it is the only inert character that also parses back\n * unambiguously under GitHub's name grammar: owners allow `-` (so `-` would\n * make the owner/repo boundary ambiguous) but never `_`, repos may contain\n * `_` but the trailing number is pure digits — so the first `_` and the last\n * `_` before the digits are always the real boundaries.\n *\n * Owner and repo are lowercased: GitHub names are case-insensitive (and this\n * id has two spelling sources — the GITHUB_REPOS env var and API payloads),\n * so per LAYOUT.md § Casing this is a mikan-derived slug, not a verbatim\n * platform id, and derived slugs are lowercased to keep one issue from\n * mapping to two conversation dirs on case-sensitive filesystems.\n */\nexport function buildGithubConversationId(ref: GithubConversationRef): string {\n  return `GH_${ref.owner.toLowerCase()}_${ref.repo.toLowerCase()}_${ref.number}`;\n}\n\nconst CONVERSATION_ID_PATTERN = /^GH_([A-Za-z0-9-]+)_(.+)_(\\d+)$/;\n\nexport function parseGithubConversationId(conversationId: string): GithubConversationRef {\n  // The greedy repo group splits at the last `_` followed by digits-to-end,\n  // which is always the number boundary (repos may contain `_` themselves).\n  const match = CONVERSATION_ID_PATTERN.exec(conversationId);\n  if (!match) {\n    throw new Error(`Not a GitHub conversation id: ${conversationId}`);\n  }\n  return {\n    owner: match[1].toLowerCase(),\n    repo: match[2].toLowerCase(),\n    number: Number(match[3]),\n  };\n}\n\n/** Message ts used for the issue/PR body itself (comments use their comment id). */\nexport const GITHUB_ISSUE_BODY_TS = \"issue\";\n\n/**\n * Message ts for an inline PR review comment: `rc-<id>`. Review-comment ids\n * live in a different id space than issue-comment ids, and several endpoints\n * (reactions, edits) differ by family — the prefix makes routing a review id\n * to an issue-comment endpoint structurally impossible.\n */\nexport function githubReviewCommentTs(commentId: number): string {\n  return `rc-${commentId}`;\n}\n\n/** The review-comment id inside an `rc-<id>` ts, or null for other ts kinds. */\nexport function parseReviewCommentTs(ts: string): number | null {\n  const match = /^rc-(\\d+)$/.exec(ts);\n  return match ? Number(match[1]) : null;\n}\n"]}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../../src/adapters/github/ids.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAA0B;IAClE,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAElE,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;QACxB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;KACvB,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,MAAM,SAAS,EAAE,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC","sourcesContent":["import type { GithubConversationRef } from \"./types.js\";\n\n/**\n * Conversation id for one issue/PR: `GH_<owner>_<repo>_<number>`.\n *\n * DESIGN.md originally proposed `gh:<owner>/<repo>#<number>`, but conversation\n * ids are used verbatim as a single path segment (LAYOUT.md § Casing) and the\n * conversation dir is bind-mounted with docker's `-v source:target` syntax in\n * image mode — so the id can contain neither `/` nor `:`. `_` is the\n * separator because it is the only inert character that also parses back\n * unambiguously under GitHub's name grammar: owners allow `-` (so `-` would\n * make the owner/repo boundary ambiguous) but never `_`, repos may contain\n * `_` but the trailing number is pure digits — so the first `_` and the last\n * `_` before the digits are always the real boundaries.\n *\n * Owner and repo are lowercased: GitHub names are case-insensitive (and this\n * id has two spelling sources — the GITHUB_REPOS env var and API payloads),\n * so per LAYOUT.md § Casing this is a mikan-derived slug, not a verbatim\n * platform id, and derived slugs are lowercased to keep one issue from\n * mapping to two conversation dirs on case-sensitive filesystems.\n */\nexport function buildGithubConversationId(ref: GithubConversationRef): string {\n  return `GH_${ref.owner.toLowerCase()}_${ref.repo.toLowerCase()}_${ref.number}`;\n}\n\nconst CONVERSATION_ID_PATTERN = /^GH_([A-Za-z0-9-]+)_(.+)_(\\d+)$/;\n\nexport function parseGithubConversationId(conversationId: string): GithubConversationRef {\n  // The greedy repo group splits at the last `_` followed by digits-to-end,\n  // which is always the number boundary (repos may contain `_` themselves).\n  const match = CONVERSATION_ID_PATTERN.exec(conversationId);\n  if (!match) {\n    throw new Error(`Not a GitHub conversation id: ${conversationId}`);\n  }\n  const [, owner, repo, number] = match;\n  if (owner === undefined || repo === undefined || number === undefined) {\n    throw new Error(`Not a GitHub conversation id: ${conversationId}`);\n  }\n  return {\n    owner: owner.toLowerCase(),\n    repo: repo.toLowerCase(),\n    number: Number(number),\n  };\n}\n\n/** Message ts used for the issue/PR body itself (comments use their comment id). */\nexport const GITHUB_ISSUE_BODY_TS = \"issue\";\n\n/**\n * Message ts for an inline PR review comment: `rc-<id>`. Review-comment ids\n * live in a different id space than issue-comment ids, and several endpoints\n * (reactions, edits) differ by family — the prefix makes routing a review id\n * to an issue-comment endpoint structurally impossible.\n */\nexport function githubReviewCommentTs(commentId: number): string {\n  return `rc-${commentId}`;\n}\n\n/** The review-comment id inside an `rc-<id>` ts, or null for other ts kinds. */\nexport function parseReviewCommentTs(ts: string): number | null {\n  const match = /^rc-(\\d+)$/.exec(ts);\n  return match ? Number(match[1]) : null;\n}\n"]}

package/dist/adapters/github/repo.js

@@ -1,6 +1,6 @@
-import { execFile } from "child_process";
-import { join } from "path";
-import { promisify } from "util";
+import { execFile } from "node:child_process";
+import { join } from "node:path";
+import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
 const GIT_TIMEOUT_MS = 120_000;
 /**

package/dist/adapters/github/repo.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../../src/adapters/github/repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAQjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AAEhF,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,EAAE,yCAAyC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,KAAc;IAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE;QAC7F,OAAO,EAAE,cAAc;QACvB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE;KAClD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,CACL,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,YAAqB;IAC7D,OAAO,YAAY,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,CACP,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,OAAO,CAAC,QAAQ,OAAO,CAAC,EACxF,OAAO,CAAC,KAAK,CACd,CAAC;QACF,MAAM,GAAG,CAAC;YACR,IAAI;YACJ,OAAO,CAAC,GAAG;YACX,UAAU;YACV,IAAI;YACJ,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC;YACtD,YAAY;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACrD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QACzB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1B,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,GAAG,QAAQ,OAAO,CAAC,QAAQ,OAAO,CAAC;QAC1C,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QAChC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3F,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,QAAQ,GACZ,aAAa,KAAK,MAAM,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,cAAc,CAAC,CAAC;IACjG,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,YAAY,GAAG,MAAM,CACnB,CACE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAC7F,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,YAAY,KAAK,CAAC,CAAC;IACjE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,4BAA4B,MAAM,oDAAoD,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,sDAAsD,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,MAAM,eAAe,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/F,CAAC","sourcesContent":["import { execFile } from \"child_process\";\nimport { join } from \"path\";\nimport type { Office } from \"../../office/index.js\";\nimport { promisify } from \"util\";\nimport type {\n  CloneRepoOptions,\n  PushBranchOptions,\n  SyncRepoOptions,\n  SyncRepoResult,\n} from \"./types.js\";\n\nconst execFileAsync = promisify(execFile);\n\nconst GIT_TIMEOUT_MS = 120_000;\n\n/**\n * Branches the bot may push: `pi/<name>`. Everything else — including the\n * repo's default branch by construction — is refused, so a driven agent can\n * only ever produce reviewable branches, never touch mainline directly.\n */\nexport const GITHUB_PUSH_BRANCH_PATTERN = /^pi\\/[A-Za-z0-9._][A-Za-z0-9._/-]*$/;\n\n/** The conversation's clone location (bind-mounted into the sandbox as ./repo). */\nexport function conversationRepoDir(office: Office): string {\n  return join(office.dir, \"repo\");\n}\n\n/**\n * Pass the ephemeral token as a per-invocation header, never in the remote\n * URL: nothing credential-shaped may end up in `.git/config`, which lives in\n * the conversation dir and is bind-mounted into the sandbox.\n */\nfunction gitAuthArgs(token: string): string[] {\n  const basic = Buffer.from(`x-access-token:${token}`).toString(\"base64\");\n  return [\"-c\", `http.extraheader=Authorization: basic ${basic}`];\n}\n\nasync function git(args: string[], token?: string): Promise<string> {\n  const { stdout } = await execFileAsync(\"git\", [...(token ? gitAuthArgs(token) : []), ...args], {\n    timeout: GIT_TIMEOUT_MS,\n    env: { ...process.env, GIT_TERMINAL_PROMPT: \"0\" },\n  });\n  return stdout;\n}\n\n/**\n * Git itself rejects these ref shapes; the check just keeps an API-supplied\n * branch name that would parse as a git option (leading dash) or an invalid\n * ref out of argv entirely instead of surfacing as a git error mid-clone.\n */\nfunction isSafeBranchName(name: string): boolean {\n  return (\n    name.length > 0 && !name.startsWith(\"-\") && !name.includes(\"..\") && !/[\\s~^:?*[\\\\]/.test(name)\n  );\n}\n\n/**\n * Local checkout name for a PR conversation: the PR's real head branch when\n * known (same-repo heads only — the caller resolves that), falling back to\n * the synthetic `pr-<n>` for fork PRs, unresolvable heads, and unsafe names.\n * Using the real name is what lets the agent update the PR in place: commit\n * on a `pi/*` head and `github_pr` pushes back to the same branch.\n */\nfunction prCheckoutName(prNumber: number, prHeadBranch?: string): string {\n  return prHeadBranch && isSafeBranchName(prHeadBranch) ? prHeadBranch : `pr-${prNumber}`;\n}\n\n/**\n * Shallow-clone a repo into a conversation dir and preconfigure the bot's\n * commit identity. For PR conversations, additionally fetch the PR head and\n * check it out so the agent starts on the code under review — under its real\n * branch name when the caller resolved one, which is what lets the agent push\n * fixes back to the PR itself.\n */\nexport async function cloneRepo(options: CloneRepoOptions): Promise<void> {\n  await git([\"clone\", \"--depth\", \"50\", options.url, options.dir], options.token);\n  await git([\"-C\", options.dir, \"config\", \"user.name\", options.botLogin]);\n  await git([\"-C\", options.dir, \"config\", \"user.email\", options.botEmail]);\n  if (options.prNumber !== undefined) {\n    await git(\n      [\"-C\", options.dir, \"fetch\", \"--depth\", \"50\", \"origin\", `pull/${options.prNumber}/head`],\n      options.token,\n    );\n    await git([\n      \"-C\",\n      options.dir,\n      \"checkout\",\n      \"-B\",\n      prCheckoutName(options.prNumber, options.prHeadBranch),\n      \"FETCH_HEAD\",\n    ]);\n  }\n}\n\n/**\n * Refresh a conversation clone from origin. Always fetches; only moves the\n * checkout when that provably cannot lose agent work: the target branch is\n * the one checked out, the tree is clean, and it has no commits of its own\n * (`checkout -B` then handles fast-forward and force-pushed heads alike).\n * Anything else stays fetch-only — FETCH_HEAD is left for the agent, which\n * has full credential-less git inside the sandbox, to merge or rebase itself.\n */\nexport async function syncRepo(options: SyncRepoOptions): Promise<SyncRepoResult> {\n  const { dir, token } = options;\n  let refspec: string;\n  let target: string;\n  if (options.branch) {\n    refspec = options.branch;\n    target = options.branch;\n  } else if (options.prNumber !== undefined) {\n    refspec = `pull/${options.prNumber}/head`;\n    target = prCheckoutName(options.prNumber, options.prHeadBranch);\n  } else if (options.defaultBranch) {\n    refspec = options.defaultBranch;\n    target = options.defaultBranch;\n  } else {\n    throw new Error(\"syncRepo needs a branch, a PR number, or the default branch\");\n  }\n\n  await git([\"-C\", dir, \"fetch\", \"--depth\", \"50\", \"origin\", refspec], token);\n  const fetchedSha = (await git([\"-C\", dir, \"rev-parse\", \"FETCH_HEAD\"])).trim();\n  const dirty = (await git([\"-C\", dir, \"status\", \"--porcelain\"])).trim().length > 0;\n  const currentBranch = (await git([\"-C\", dir, \"rev-parse\", \"--abbrev-ref\", \"HEAD\"])).trim();\n  // Clones made before the head branch name was resolvable sit on the\n  // synthetic pr-<n>; treat that as the same checkout so a clean sync\n  // migrates them to the real name instead of going fetch-only forever.\n  const legacyPrBranch = options.prNumber !== undefined ? `pr-${options.prNumber}` : undefined;\n  const onTarget =\n    currentBranch === target || (legacyPrBranch !== undefined && currentBranch === legacyPrBranch);\n  let localCommits = 0;\n  if (onTarget) {\n    // Commits unique to HEAD split two ways: ones the agent committed here\n    // (the clone's preconfigured bot identity) are its work and must survive;\n    // ones committed by others were force-pushed away upstream and are safe\n    // to drop. Filter by the bot committer so a rebased PR head still syncs.\n    const botEmail = (await git([\"-C\", dir, \"config\", \"user.email\"])).trim();\n    localCommits = Number(\n      (\n        await git([\"-C\", dir, \"rev-list\", \"--count\", `--committer=${botEmail}`, \"FETCH_HEAD..HEAD\"])\n      ).trim(),\n    );\n  }\n\n  const updatedCheckout = onTarget && !dirty && localCommits === 0;\n  if (updatedCheckout) {\n    await git([\"-C\", dir, \"checkout\", \"-B\", target, \"FETCH_HEAD\"]);\n  }\n  return { target, fetchedSha, updatedCheckout, dirty, currentBranch, localCommits };\n}\n\n/**\n * Push one local branch to origin. Non-force by construction (plain refspec),\n * and only `pi/*` branches are accepted.\n */\nexport async function pushBranch(options: PushBranchOptions): Promise<void> {\n  const { dir, branch, token } = options;\n  if (!GITHUB_PUSH_BRANCH_PATTERN.test(branch)) {\n    throw new Error(\n      `Refusing to push branch '${branch}': only branches matching pi/<name> may be pushed.`,\n    );\n  }\n  try {\n    await git([\"-C\", dir, \"rev-parse\", \"--verify\", \"--quiet\", `refs/heads/${branch}`]);\n  } catch {\n    throw new Error(`Branch '${branch}' does not exist in the conversation's ./repo clone.`);\n  }\n  await git([\"-C\", dir, \"push\", \"origin\", `refs/heads/${branch}:refs/heads/${branch}`], token);\n}\n"]}
+{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../../src/adapters/github/repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAQtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AAEhF,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,EAAE,yCAAyC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,KAAc;IAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE;QAC7F,OAAO,EAAE,cAAc;QACvB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE;KAClD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,CACL,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,YAAqB;IAC7D,OAAO,YAAY,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,CACP,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,OAAO,CAAC,QAAQ,OAAO,CAAC,EACxF,OAAO,CAAC,KAAK,CACd,CAAC;QACF,MAAM,GAAG,CAAC;YACR,IAAI;YACJ,OAAO,CAAC,GAAG;YACX,UAAU;YACV,IAAI;YACJ,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC;YACtD,YAAY;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACrD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QACzB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1B,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,GAAG,QAAQ,OAAO,CAAC,QAAQ,OAAO,CAAC;QAC1C,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QAChC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3F,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,QAAQ,GACZ,aAAa,KAAK,MAAM,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,cAAc,CAAC,CAAC;IACjG,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,YAAY,GAAG,MAAM,CACnB,CACE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAC7F,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,YAAY,KAAK,CAAC,CAAC;IACjE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,4BAA4B,MAAM,oDAAoD,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,sDAAsD,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,MAAM,eAAe,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/F,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { join } from \"node:path\";\nimport type { Office } from \"../../office/index.js\";\nimport { promisify } from \"node:util\";\nimport type {\n  CloneRepoOptions,\n  PushBranchOptions,\n  SyncRepoOptions,\n  SyncRepoResult,\n} from \"./types.js\";\n\nconst execFileAsync = promisify(execFile);\n\nconst GIT_TIMEOUT_MS = 120_000;\n\n/**\n * Branches the bot may push: `pi/<name>`. Everything else — including the\n * repo's default branch by construction — is refused, so a driven agent can\n * only ever produce reviewable branches, never touch mainline directly.\n */\nexport const GITHUB_PUSH_BRANCH_PATTERN = /^pi\\/[A-Za-z0-9._][A-Za-z0-9._/-]*$/;\n\n/** The conversation's clone location (bind-mounted into the sandbox as ./repo). */\nexport function conversationRepoDir(office: Office): string {\n  return join(office.dir, \"repo\");\n}\n\n/**\n * Pass the ephemeral token as a per-invocation header, never in the remote\n * URL: nothing credential-shaped may end up in `.git/config`, which lives in\n * the conversation dir and is bind-mounted into the sandbox.\n */\nfunction gitAuthArgs(token: string): string[] {\n  const basic = Buffer.from(`x-access-token:${token}`).toString(\"base64\");\n  return [\"-c\", `http.extraheader=Authorization: basic ${basic}`];\n}\n\nasync function git(args: string[], token?: string): Promise<string> {\n  const { stdout } = await execFileAsync(\"git\", [...(token ? gitAuthArgs(token) : []), ...args], {\n    timeout: GIT_TIMEOUT_MS,\n    env: { ...process.env, GIT_TERMINAL_PROMPT: \"0\" },\n  });\n  return stdout;\n}\n\n/**\n * Git itself rejects these ref shapes; the check just keeps an API-supplied\n * branch name that would parse as a git option (leading dash) or an invalid\n * ref out of argv entirely instead of surfacing as a git error mid-clone.\n */\nfunction isSafeBranchName(name: string): boolean {\n  return (\n    name.length > 0 && !name.startsWith(\"-\") && !name.includes(\"..\") && !/[\\s~^:?*[\\\\]/.test(name)\n  );\n}\n\n/**\n * Local checkout name for a PR conversation: the PR's real head branch when\n * known (same-repo heads only — the caller resolves that), falling back to\n * the synthetic `pr-<n>` for fork PRs, unresolvable heads, and unsafe names.\n * Using the real name is what lets the agent update the PR in place: commit\n * on a `pi/*` head and `github_pr` pushes back to the same branch.\n */\nfunction prCheckoutName(prNumber: number, prHeadBranch?: string): string {\n  return prHeadBranch && isSafeBranchName(prHeadBranch) ? prHeadBranch : `pr-${prNumber}`;\n}\n\n/**\n * Shallow-clone a repo into a conversation dir and preconfigure the bot's\n * commit identity. For PR conversations, additionally fetch the PR head and\n * check it out so the agent starts on the code under review — under its real\n * branch name when the caller resolved one, which is what lets the agent push\n * fixes back to the PR itself.\n */\nexport async function cloneRepo(options: CloneRepoOptions): Promise<void> {\n  await git([\"clone\", \"--depth\", \"50\", options.url, options.dir], options.token);\n  await git([\"-C\", options.dir, \"config\", \"user.name\", options.botLogin]);\n  await git([\"-C\", options.dir, \"config\", \"user.email\", options.botEmail]);\n  if (options.prNumber !== undefined) {\n    await git(\n      [\"-C\", options.dir, \"fetch\", \"--depth\", \"50\", \"origin\", `pull/${options.prNumber}/head`],\n      options.token,\n    );\n    await git([\n      \"-C\",\n      options.dir,\n      \"checkout\",\n      \"-B\",\n      prCheckoutName(options.prNumber, options.prHeadBranch),\n      \"FETCH_HEAD\",\n    ]);\n  }\n}\n\n/**\n * Refresh a conversation clone from origin. Always fetches; only moves the\n * checkout when that provably cannot lose agent work: the target branch is\n * the one checked out, the tree is clean, and it has no commits of its own\n * (`checkout -B` then handles fast-forward and force-pushed heads alike).\n * Anything else stays fetch-only — FETCH_HEAD is left for the agent, which\n * has full credential-less git inside the sandbox, to merge or rebase itself.\n */\nexport async function syncRepo(options: SyncRepoOptions): Promise<SyncRepoResult> {\n  const { dir, token } = options;\n  let refspec: string;\n  let target: string;\n  if (options.branch) {\n    refspec = options.branch;\n    target = options.branch;\n  } else if (options.prNumber !== undefined) {\n    refspec = `pull/${options.prNumber}/head`;\n    target = prCheckoutName(options.prNumber, options.prHeadBranch);\n  } else if (options.defaultBranch) {\n    refspec = options.defaultBranch;\n    target = options.defaultBranch;\n  } else {\n    throw new Error(\"syncRepo needs a branch, a PR number, or the default branch\");\n  }\n\n  await git([\"-C\", dir, \"fetch\", \"--depth\", \"50\", \"origin\", refspec], token);\n  const fetchedSha = (await git([\"-C\", dir, \"rev-parse\", \"FETCH_HEAD\"])).trim();\n  const dirty = (await git([\"-C\", dir, \"status\", \"--porcelain\"])).trim().length > 0;\n  const currentBranch = (await git([\"-C\", dir, \"rev-parse\", \"--abbrev-ref\", \"HEAD\"])).trim();\n  // Clones made before the head branch name was resolvable sit on the\n  // synthetic pr-<n>; treat that as the same checkout so a clean sync\n  // migrates them to the real name instead of going fetch-only forever.\n  const legacyPrBranch = options.prNumber !== undefined ? `pr-${options.prNumber}` : undefined;\n  const onTarget =\n    currentBranch === target || (legacyPrBranch !== undefined && currentBranch === legacyPrBranch);\n  let localCommits = 0;\n  if (onTarget) {\n    // Commits unique to HEAD split two ways: ones the agent committed here\n    // (the clone's preconfigured bot identity) are its work and must survive;\n    // ones committed by others were force-pushed away upstream and are safe\n    // to drop. Filter by the bot committer so a rebased PR head still syncs.\n    const botEmail = (await git([\"-C\", dir, \"config\", \"user.email\"])).trim();\n    localCommits = Number(\n      (\n        await git([\"-C\", dir, \"rev-list\", \"--count\", `--committer=${botEmail}`, \"FETCH_HEAD..HEAD\"])\n      ).trim(),\n    );\n  }\n\n  const updatedCheckout = onTarget && !dirty && localCommits === 0;\n  if (updatedCheckout) {\n    await git([\"-C\", dir, \"checkout\", \"-B\", target, \"FETCH_HEAD\"]);\n  }\n  return { target, fetchedSha, updatedCheckout, dirty, currentBranch, localCommits };\n}\n\n/**\n * Push one local branch to origin. Non-force by construction (plain refspec),\n * and only `pi/*` branches are accepted.\n */\nexport async function pushBranch(options: PushBranchOptions): Promise<void> {\n  const { dir, branch, token } = options;\n  if (!GITHUB_PUSH_BRANCH_PATTERN.test(branch)) {\n    throw new Error(\n      `Refusing to push branch '${branch}': only branches matching pi/<name> may be pushed.`,\n    );\n  }\n  try {\n    await git([\"-C\", dir, \"rev-parse\", \"--verify\", \"--quiet\", `refs/heads/${branch}`]);\n  } catch {\n    throw new Error(`Branch '${branch}' does not exist in the conversation's ./repo clone.`);\n  }\n  await git([\"-C\", dir, \"push\", \"origin\", `refs/heads/${branch}:refs/heads/${branch}`], token);\n}\n"]}

package/dist/adapters/github/types.d.ts

@@ -1,5 +1,6 @@
 import type { ConversationEvent } from "../../adapter.js";
 import type { GcpTokenProvider } from "./gcp-auth.js";
+import type { Workspace } from "../../office/types.js";
 export interface GithubEvent extends ConversationEvent {
     type: "message" | "issue";
     userName?: string;
@@ -12,7 +13,7 @@ export interface GithubBotConfig {
     /** `owner/repo` entries to watch; empty = all installation repositories. */
     repos: string[];
     pollIntervalMs: number;
-    workspace: import("../../office/types.js").Workspace;
+    workspace: Workspace;
     /**
      * Where the poll watermark state (baseline + seen ids) is persisted. Lives
      * under the host-only state dir: the workspace dir can be mounted into

package/dist/adapters/github/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,OAAO,uBAAuB,EAAE,SAAS,CAAC;IACrD;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,aAAa,EAAE,gBAAgB,CAAC;QAChC,iEAAiE;QACjE,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,gBAAgB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,oEAAoE;AACpE,UAAU,mBAAmB;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC;IAC1E,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/B,uDAAuD;IACvD,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oEAAoE;AACpE,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAC1C,MAAM,CAAC,UAAU,GAAG,eAAe,GAAG,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAClE,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,UAAU,GACV,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,eAAe,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAID,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,sEAAsE;IACtE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gEAAgE;IAChE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9D,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACzE,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sEAAsE;AACtE,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,iBAAiB,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,qBAAqB,EAAE,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAAC,OAAO,EAAE,mBAAmB,EAAE,CAAA;CAAE,GAC1F;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE5C;+DAC+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,GAAG,cAAc,GAAG,eAAe,GAAG,kBAAkB,GAAG,OAAO,GAAG,QAAQ,CAAC;IAClG,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY;IACZ,YAAY,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC;CAC5C;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAErF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE7E,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3F,kFAAkF;IAClF,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClF,wEAAwE;IACxE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,0EAA0E;IAC1E,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,sEAAsE;IACtE,mBAAmB,CACjB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,uEAAuE;IACvE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1F,+EAA+E;IAC/E,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,aAAa,EAAE,gBAAgB,CAAC;QAChC,iEAAiE;QACjE,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,gBAAgB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,oEAAoE;AACpE,UAAU,mBAAmB;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC;IAC1E,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/B,uDAAuD;IACvD,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oEAAoE;AACpE,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAC1C,MAAM,CAAC,UAAU,GAAG,eAAe,GAAG,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAClE,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,UAAU,GACV,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,eAAe,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAID,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,sEAAsE;IACtE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gEAAgE;IAChE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC9D,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACzE,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sEAAsE;AACtE,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,iBAAiB,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,qBAAqB,EAAE,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAAC,OAAO,EAAE,mBAAmB,EAAE,CAAA;CAAE,GAC1F;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE5C;+DAC+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,GAAG,cAAc,GAAG,eAAe,GAAG,kBAAkB,GAAG,OAAO,GAAG,QAAQ,CAAC;IAClG,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY;IACZ,YAAY,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC;CAC5C;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAErF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE7E,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3F,kFAAkF;IAClF,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClF,wEAAwE;IACxE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,0EAA0E;IAC1E,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,sEAAsE;IACtE,mBAAmB,CACjB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,uEAAuE;IACvE,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1F,+EAA+E;IAC/E,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnF"}

package/dist/adapters/github/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/adapters/github/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ConversationEvent } from \"../../adapter.js\";\nimport type { GcpTokenProvider } from \"./gcp-auth.js\";\n\nexport interface GithubEvent extends ConversationEvent {\n  type: \"message\" | \"issue\";\n  userName?: string;\n}\n\nexport interface GithubBotConfig {\n  appId: string;\n  /** PEM-encoded GitHub App private key. */\n  privateKey: string;\n  installationId: string;\n  /** `owner/repo` entries to watch; empty = all installation repositories. */\n  repos: string[];\n  pollIntervalMs: number;\n  workspace: import(\"../../office/types.js\").Workspace;\n  /**\n   * Where the poll watermark state (baseline + seen ids) is persisted. Lives\n   * under the host-only state dir: the workspace dir can be mounted into\n   * sandboxes, and sandboxed code must not be able to clear dedup state and\n   * re-trigger runs.\n   */\n  syncStatePath: string;\n  /**\n   * Present when the host has GCP credentials (GOOGLE_APPLICATION_CREDENTIALS):\n   * lets github_checks fetch Cloud Build logs. Credentials never enter the\n   * sandbox; absent, external-CI checks degrade to guidance text.\n   */\n  cloudBuild?: {\n    tokenProvider: GcpTokenProvider;\n    /** Project used when a check's details_url does not name one. */\n    projectFallback?: string;\n  };\n}\n\nexport interface GcpTokenProviderOptions {\n  /** Path to the ADC JSON (usually $GOOGLE_APPLICATION_CREDENTIALS). */\n  credentialsPath: string;\n  fetchImpl?: typeof fetch;\n}\n\nexport interface CloudBuildLogOptions {\n  tokenProvider: GcpTokenProvider;\n  project: string;\n  buildId: string;\n  fetchImpl?: typeof fetch;\n}\n\n/** Persisted per-repo poll watermark (DESIGN.md § Event source). */\ninterface GithubRepoSyncState {\n  /** Comments/issues created before this ISO instant never trigger. */\n  baseline: string;\n  /** Newest updated_at seen; polls fetch from (cursor - overlap). */\n  cursor: string;\n  seenComments: number[];\n  seenIssues: number[];\n  /** Optional so state files written before review-comment polling still load. */\n  seenReviewComments?: number[];\n}\n\nexport interface GithubSyncState {\n  repos: Record<string, GithubRepoSyncState>;\n}\n\nexport interface GithubRepoRef {\n  owner: string;\n  repo: string;\n}\n\nexport interface GithubConversationRef extends GithubRepoRef {\n  number: number;\n}\n\n// ── GitHub REST payload shapes (only the fields mikan reads) ─────────────────\n\ninterface GithubUser {\n  login: string;\n  type: string;\n}\n\nexport interface GithubIssue {\n  id: number;\n  number: number;\n  title: string;\n  body: string | null;\n  user: GithubUser;\n  created_at: string;\n  updated_at: string;\n  pull_request?: object;\n  /** open | closed */\n  state?: string;\n  labels?: { name: string }[];\n  assignees?: { login: string }[];\n}\n\nexport interface GithubIssueComment {\n  id: number;\n  body: string;\n  user: GithubUser;\n  created_at: string;\n  updated_at: string;\n  /** API URL of the parent issue, e.g. …/repos/o/r/issues/42 */\n  issue_url: string;\n}\n\n/** An inline PR review comment (a comment on a diff line). */\nexport interface GithubReviewComment {\n  id: number;\n  body: string;\n  user: GithubUser;\n  created_at: string;\n  updated_at: string;\n  /** API URL of the parent PR, e.g. …/repos/o/r/pulls/42 */\n  pull_request_url: string;\n  /** File the comment is anchored to. */\n  path: string;\n  /** Line in the diff's right side; null when the anchor is outdated. */\n  line: number | null;\n  /** The diff excerpt the comment is anchored to. */\n  diff_hunk: string;\n  /** Set on replies: the id of the thread's root comment. */\n  in_reply_to_id?: number;\n}\n\nexport interface GithubRepository {\n  name: string;\n  owner: GithubUser;\n}\n\nexport interface GithubRepositoryDetails {\n  default_branch: string;\n}\n\nexport interface GithubCollaboratorPermission {\n  /** Legacy field: admin | write | read | none (maintain→write, triage→read). */\n  permission: string;\n  /** Granular assigned role (admin/maintain/write/triage/read or a custom role). */\n  role_name?: string;\n}\n\nexport interface GithubPullRequest {\n  number: number;\n  html_url: string;\n  /** head.repo is null when the fork a PR came from was deleted. */\n  head?: { ref: string; sha: string; repo?: { full_name?: string } | null };\n  base?: { ref: string };\n  title?: string;\n  body?: string | null;\n  /** open | closed */\n  state?: string;\n  draft?: boolean;\n  merged?: boolean;\n  mergeable_state?: string;\n  changed_files?: number;\n  additions?: number;\n  deletions?: number;\n  user?: GithubUser;\n}\n\n/** One row of GET /pulls/{n}/files. */\nexport interface GithubPullRequestFile {\n  filename: string;\n  /** added | removed | modified | renamed | … */\n  status: string;\n  additions: number;\n  deletions: number;\n}\n\n/** One submitted review of GET /pulls/{n}/reviews. */\nexport interface GithubPullRequestReview {\n  id: number;\n  user: GithubUser;\n  body: string | null;\n  /** APPROVED | CHANGES_REQUESTED | COMMENTED | DISMISSED | PENDING */\n  state: string;\n  submitted_at?: string;\n}\n\nexport interface GithubCheckRun {\n  /** Check-run id; for GitHub Actions this doubles as the job id (log fetch). */\n  id: number;\n  name: string;\n  /** queued | in_progress | completed */\n  status: string;\n  /** success | failure | neutral | cancelled | skipped | timed_out | action_required | null while running */\n  conclusion: string | null;\n  html_url: string | null;\n  /** The app that reported the check (github-actions vs external CI). */\n  app?: { slug?: string } | null;\n  /** Whatever the reporting app posted about the run. */\n  output?: { title?: string | null; summary?: string | null } | null;\n  /** The reporting app's own id for the run; Cloud Build puts the build UUID here. */\n  external_id?: string | null;\n  /** The reporting app's own results page; Cloud Build encodes the GCP project here. */\n  details_url?: string | null;\n}\n\n/** Permission subset requestable on a scoped installation token. */\nexport type GithubTokenPermissions = Partial<\n  Record<\"contents\" | \"pull_requests\" | \"issues\", \"read\" | \"write\">\n>;\n\nexport type GithubReactionContent =\n  | \"+1\"\n  | \"-1\"\n  | \"laugh\"\n  | \"confused\"\n  | \"heart\"\n  | \"hooray\"\n  | \"rocket\"\n  | \"eyes\";\n\nexport interface CloneRepoOptions {\n  /** HTTPS remote, e.g. https://github.com/owner/repo.git (no credentials). */\n  url: string;\n  /** Destination directory (the conversation dir's `repo/`). */\n  dir: string;\n  /** Ephemeral scoped installation token; used per-invocation, never stored. */\n  token: string;\n  botLogin: string;\n  botEmail: string;\n  /** When the conversation is a PR: fetch and check out its head. */\n  prNumber?: number;\n  /**\n   * The PR's head branch name when it lives in this repo (not a fork): the\n   * checkout is named after it so committing there + github_pr updates the\n   * PR in place. Absent (fork/unknown), the checkout falls back to pr-<n>.\n   */\n  prHeadBranch?: string;\n}\n\nexport interface PushBranchOptions {\n  dir: string;\n  branch: string;\n  token: string;\n}\n\nexport interface SyncRepoOptions {\n  dir: string;\n  /** Ephemeral contents:read token; used per-invocation, never stored. */\n  token: string;\n  /** Explicit branch to fetch; wins over prNumber/defaultBranch. */\n  branch?: string;\n  /** PR conversations: fetch pull/<n>/head into the local PR checkout. */\n  prNumber?: number;\n  /** Same-repo PR head name; the local checkout target. Fallback: pr-<n>. */\n  prHeadBranch?: string;\n  /** Fallback target when neither branch nor prNumber applies. */\n  defaultBranch?: string;\n}\n\nexport interface SyncRepoResult {\n  /** Local branch the fetch targets (the PR head name, pr-<n>, or the branch). */\n  target: string;\n  fetchedSha: string;\n  /** True when the checkout was moved to the fetched head. */\n  updatedCheckout: boolean;\n  /** Working tree had uncommitted changes (checkout left alone). */\n  dirty: boolean;\n  currentBranch: string;\n  /** Bot-committed (agent-made) commits on the target that origin lacks. */\n  localCommits: number;\n}\n\nexport interface GithubClientOptions {\n  appId: string;\n  privateKey: string;\n  installationId: string;\n  /** Override the API root for tests; defaults to https://api.github.com */\n  baseUrl?: string;\n  fetchImpl?: typeof fetch;\n}\n\n// ── Host-side tool contracts (capability pack, not messaging core) ───────────\n\n/** Arguments for the host-side `github_pr` tool. */\nexport interface GithubPrRequest {\n  /** Local branch in the conversation's ./repo clone; must match pi/<name>. */\n  branch: string;\n  title: string;\n  body?: string;\n  /** Target branch; defaults to the repository's default branch. */\n  base?: string;\n  draft?: boolean;\n}\n\nexport interface GithubPrResult {\n  number: number;\n  url: string;\n  /** True when the branch already had an open PR that this push updated. */\n  updatedExisting?: boolean;\n}\n\n/** Normalized check-run row for the host-side `github_checks` tool. */\nexport interface GithubCheckSummary {\n  /** Check-run id; for GitHub Actions checks it is also the job id for log fetch. */\n  id: number;\n  name: string;\n  /** queued | in_progress | completed */\n  status: string;\n  /** success | failure | … ; null while the run is still in progress */\n  conclusion: string | null;\n  url: string | null;\n  /** Slug of the reporting app; \"github-actions\" checks have fetchable logs. */\n  appSlug: string | null;\n  /** The reporting app's own summary of the run, when it posted one. */\n  outputSummary: string | null;\n  /** The reporting app's run id (Cloud Build: the build UUID). */\n  externalId: string | null;\n  /** True when this run's log is fetchable via build_id (Cloud Build + GCP creds). */\n  buildLogAvailable?: boolean;\n}\n\nexport interface GithubChecksFns {\n  getChecks: (branch?: string) => Promise<GithubCheckSummary[]>;\n  getJobLog: (jobId: number) => Promise<string>;\n  getBuildLog: (buildId: string) => Promise<string>;\n}\n\n/** Arguments for the host-side `github_read` tool. */\nexport interface GithubReadRequest {\n  action: \"pr\" | \"pr_files\" | \"pr_reviews\" | \"issue\" | \"comments\" | \"list\";\n  /** Issue/PR number; defaults to the conversation's own. */\n  number?: number;\n  /** list only: open | closed | all (default open). */\n  state?: string;\n  /** list only: comma-separated label names. */\n  labels?: string;\n  /** list only: filter by author login. */\n  creator?: string;\n}\n\n/** Typed payload of one `github_read` action; the tool renders it. */\nexport type GithubReadResult =\n  | { kind: \"pr\"; pr: GithubPullRequest }\n  | { kind: \"pr_files\"; files: GithubPullRequestFile[] }\n  | { kind: \"pr_reviews\"; reviews: GithubPullRequestReview[]; threads: GithubReviewComment[] }\n  | { kind: \"issue\"; issue: GithubIssue }\n  | { kind: \"comments\"; comments: GithubIssueComment[] }\n  | { kind: \"list\"; issues: GithubIssue[] };\n\n/** Arguments for the host-side `github_issue` tool. Deliberately a closed\n *  action set: lock/delete/transfer are not offered at all. */\nexport interface GithubIssueRequest {\n  action: \"add_labels\" | \"remove_label\" | \"add_assignees\" | \"remove_assignees\" | \"close\" | \"reopen\";\n  /** Issue/PR number; defaults to the conversation's own (triage may target others). */\n  number?: number;\n  /** add_labels */\n  labels?: string[];\n  /** remove_label */\n  label?: string;\n  /** add_assignees / remove_assignees */\n  assignees?: string[];\n  /** close */\n  state_reason?: \"completed\" | \"not_planned\";\n}\n\n/**\n * Host-side GitHub operations for github_* tools. Wired in main.ts over the\n * GitHub bot; tokens stay host-side. Consumed by `createGithubToolPack`.\n */\nexport type GithubSyncFn = (branch?: string) => Promise<string>;\n\nexport type GithubReviewReplyFn = (commentId: number, body: string) => Promise<{ url: string }>;\n\nexport type GithubReadFn = (request: GithubReadRequest) => Promise<GithubReadResult>;\n\nexport type GithubIssueFn = (request: GithubIssueRequest) => Promise<string>;\n\nexport interface PlatformGithubOps {\n  /** Push a prepared pi/* branch and open (or update) a pull request. */\n  pushAndCreatePr(conversationId: string, request: GithubPrRequest): Promise<GithubPrResult>;\n  /** CI check runs for a branch, or for the conversation's PR head when omitted. */\n  getChecks(conversationId: string, branch?: string): Promise<GithubCheckSummary[]>;\n  /** Log text of one CI job (an Actions check-run id), tail-truncated. */\n  getJobLog(conversationId: string, jobId: number): Promise<string>;\n  /** Log text of one Cloud Build run (a [build …] uuid), tail-truncated. */\n  getBuildLog(conversationId: string, buildId: string): Promise<string>;\n  /** Reply inside one inline review thread of the conversation's PR. */\n  replyToReviewThread(\n    conversationId: string,\n    commentId: number,\n    body: string,\n  ): Promise<{ url: string }>;\n  /** Refresh the conversation's ./repo clone; returns a human-readable report. */\n  syncRepo(conversationId: string, branch?: string): Promise<string>;\n  /** Read PR/issue metadata the clone cannot provide; same repo only. */\n  readGithub(conversationId: string, request: GithubReadRequest): Promise<GithubReadResult>;\n  /** Label/assignee/state management on this repo's issues; returns a report. */\n  manageIssue(conversationId: string, request: GithubIssueRequest): Promise<string>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/adapters/github/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ConversationEvent } from \"../../adapter.js\";\nimport type { GcpTokenProvider } from \"./gcp-auth.js\";\nimport type { Workspace } from \"../../office/types.js\";\n\nexport interface GithubEvent extends ConversationEvent {\n  type: \"message\" | \"issue\";\n  userName?: string;\n}\n\nexport interface GithubBotConfig {\n  appId: string;\n  /** PEM-encoded GitHub App private key. */\n  privateKey: string;\n  installationId: string;\n  /** `owner/repo` entries to watch; empty = all installation repositories. */\n  repos: string[];\n  pollIntervalMs: number;\n  workspace: Workspace;\n  /**\n   * Where the poll watermark state (baseline + seen ids) is persisted. Lives\n   * under the host-only state dir: the workspace dir can be mounted into\n   * sandboxes, and sandboxed code must not be able to clear dedup state and\n   * re-trigger runs.\n   */\n  syncStatePath: string;\n  /**\n   * Present when the host has GCP credentials (GOOGLE_APPLICATION_CREDENTIALS):\n   * lets github_checks fetch Cloud Build logs. Credentials never enter the\n   * sandbox; absent, external-CI checks degrade to guidance text.\n   */\n  cloudBuild?: {\n    tokenProvider: GcpTokenProvider;\n    /** Project used when a check's details_url does not name one. */\n    projectFallback?: string;\n  };\n}\n\nexport interface GcpTokenProviderOptions {\n  /** Path to the ADC JSON (usually $GOOGLE_APPLICATION_CREDENTIALS). */\n  credentialsPath: string;\n  fetchImpl?: typeof fetch;\n}\n\nexport interface CloudBuildLogOptions {\n  tokenProvider: GcpTokenProvider;\n  project: string;\n  buildId: string;\n  fetchImpl?: typeof fetch;\n}\n\n/** Persisted per-repo poll watermark (DESIGN.md § Event source). */\ninterface GithubRepoSyncState {\n  /** Comments/issues created before this ISO instant never trigger. */\n  baseline: string;\n  /** Newest updated_at seen; polls fetch from (cursor - overlap). */\n  cursor: string;\n  seenComments: number[];\n  seenIssues: number[];\n  /** Optional so state files written before review-comment polling still load. */\n  seenReviewComments?: number[];\n}\n\nexport interface GithubSyncState {\n  repos: Record<string, GithubRepoSyncState>;\n}\n\nexport interface GithubRepoRef {\n  owner: string;\n  repo: string;\n}\n\nexport interface GithubConversationRef extends GithubRepoRef {\n  number: number;\n}\n\n// ── GitHub REST payload shapes (only the fields mikan reads) ─────────────────\n\ninterface GithubUser {\n  login: string;\n  type: string;\n}\n\nexport interface GithubIssue {\n  id: number;\n  number: number;\n  title: string;\n  body: string | null;\n  user: GithubUser;\n  created_at: string;\n  updated_at: string;\n  pull_request?: object;\n  /** open | closed */\n  state?: string;\n  labels?: { name: string }[];\n  assignees?: { login: string }[];\n}\n\nexport interface GithubIssueComment {\n  id: number;\n  body: string;\n  user: GithubUser;\n  created_at: string;\n  updated_at: string;\n  /** API URL of the parent issue, e.g. …/repos/o/r/issues/42 */\n  issue_url: string;\n}\n\n/** An inline PR review comment (a comment on a diff line). */\nexport interface GithubReviewComment {\n  id: number;\n  body: string;\n  user: GithubUser;\n  created_at: string;\n  updated_at: string;\n  /** API URL of the parent PR, e.g. …/repos/o/r/pulls/42 */\n  pull_request_url: string;\n  /** File the comment is anchored to. */\n  path: string;\n  /** Line in the diff's right side; null when the anchor is outdated. */\n  line: number | null;\n  /** The diff excerpt the comment is anchored to. */\n  diff_hunk: string;\n  /** Set on replies: the id of the thread's root comment. */\n  in_reply_to_id?: number;\n}\n\nexport interface GithubRepository {\n  name: string;\n  owner: GithubUser;\n}\n\nexport interface GithubRepositoryDetails {\n  default_branch: string;\n}\n\nexport interface GithubCollaboratorPermission {\n  /** Legacy field: admin | write | read | none (maintain→write, triage→read). */\n  permission: string;\n  /** Granular assigned role (admin/maintain/write/triage/read or a custom role). */\n  role_name?: string;\n}\n\nexport interface GithubPullRequest {\n  number: number;\n  html_url: string;\n  /** head.repo is null when the fork a PR came from was deleted. */\n  head?: { ref: string; sha: string; repo?: { full_name?: string } | null };\n  base?: { ref: string };\n  title?: string;\n  body?: string | null;\n  /** open | closed */\n  state?: string;\n  draft?: boolean;\n  merged?: boolean;\n  mergeable_state?: string;\n  changed_files?: number;\n  additions?: number;\n  deletions?: number;\n  user?: GithubUser;\n}\n\n/** One row of GET /pulls/{n}/files. */\nexport interface GithubPullRequestFile {\n  filename: string;\n  /** added | removed | modified | renamed | … */\n  status: string;\n  additions: number;\n  deletions: number;\n}\n\n/** One submitted review of GET /pulls/{n}/reviews. */\nexport interface GithubPullRequestReview {\n  id: number;\n  user: GithubUser;\n  body: string | null;\n  /** APPROVED | CHANGES_REQUESTED | COMMENTED | DISMISSED | PENDING */\n  state: string;\n  submitted_at?: string;\n}\n\nexport interface GithubCheckRun {\n  /** Check-run id; for GitHub Actions this doubles as the job id (log fetch). */\n  id: number;\n  name: string;\n  /** queued | in_progress | completed */\n  status: string;\n  /** success | failure | neutral | cancelled | skipped | timed_out | action_required | null while running */\n  conclusion: string | null;\n  html_url: string | null;\n  /** The app that reported the check (github-actions vs external CI). */\n  app?: { slug?: string } | null;\n  /** Whatever the reporting app posted about the run. */\n  output?: { title?: string | null; summary?: string | null } | null;\n  /** The reporting app's own id for the run; Cloud Build puts the build UUID here. */\n  external_id?: string | null;\n  /** The reporting app's own results page; Cloud Build encodes the GCP project here. */\n  details_url?: string | null;\n}\n\n/** Permission subset requestable on a scoped installation token. */\nexport type GithubTokenPermissions = Partial<\n  Record<\"contents\" | \"pull_requests\" | \"issues\", \"read\" | \"write\">\n>;\n\nexport type GithubReactionContent =\n  | \"+1\"\n  | \"-1\"\n  | \"laugh\"\n  | \"confused\"\n  | \"heart\"\n  | \"hooray\"\n  | \"rocket\"\n  | \"eyes\";\n\nexport interface CloneRepoOptions {\n  /** HTTPS remote, e.g. https://github.com/owner/repo.git (no credentials). */\n  url: string;\n  /** Destination directory (the conversation dir's `repo/`). */\n  dir: string;\n  /** Ephemeral scoped installation token; used per-invocation, never stored. */\n  token: string;\n  botLogin: string;\n  botEmail: string;\n  /** When the conversation is a PR: fetch and check out its head. */\n  prNumber?: number;\n  /**\n   * The PR's head branch name when it lives in this repo (not a fork): the\n   * checkout is named after it so committing there + github_pr updates the\n   * PR in place. Absent (fork/unknown), the checkout falls back to pr-<n>.\n   */\n  prHeadBranch?: string;\n}\n\nexport interface PushBranchOptions {\n  dir: string;\n  branch: string;\n  token: string;\n}\n\nexport interface SyncRepoOptions {\n  dir: string;\n  /** Ephemeral contents:read token; used per-invocation, never stored. */\n  token: string;\n  /** Explicit branch to fetch; wins over prNumber/defaultBranch. */\n  branch?: string;\n  /** PR conversations: fetch pull/<n>/head into the local PR checkout. */\n  prNumber?: number;\n  /** Same-repo PR head name; the local checkout target. Fallback: pr-<n>. */\n  prHeadBranch?: string;\n  /** Fallback target when neither branch nor prNumber applies. */\n  defaultBranch?: string;\n}\n\nexport interface SyncRepoResult {\n  /** Local branch the fetch targets (the PR head name, pr-<n>, or the branch). */\n  target: string;\n  fetchedSha: string;\n  /** True when the checkout was moved to the fetched head. */\n  updatedCheckout: boolean;\n  /** Working tree had uncommitted changes (checkout left alone). */\n  dirty: boolean;\n  currentBranch: string;\n  /** Bot-committed (agent-made) commits on the target that origin lacks. */\n  localCommits: number;\n}\n\nexport interface GithubClientOptions {\n  appId: string;\n  privateKey: string;\n  installationId: string;\n  /** Override the API root for tests; defaults to https://api.github.com */\n  baseUrl?: string;\n  fetchImpl?: typeof fetch;\n}\n\n// ── Host-side tool contracts (capability pack, not messaging core) ───────────\n\n/** Arguments for the host-side `github_pr` tool. */\nexport interface GithubPrRequest {\n  /** Local branch in the conversation's ./repo clone; must match pi/<name>. */\n  branch: string;\n  title: string;\n  body?: string;\n  /** Target branch; defaults to the repository's default branch. */\n  base?: string;\n  draft?: boolean;\n}\n\nexport interface GithubPrResult {\n  number: number;\n  url: string;\n  /** True when the branch already had an open PR that this push updated. */\n  updatedExisting?: boolean;\n}\n\n/** Normalized check-run row for the host-side `github_checks` tool. */\nexport interface GithubCheckSummary {\n  /** Check-run id; for GitHub Actions checks it is also the job id for log fetch. */\n  id: number;\n  name: string;\n  /** queued | in_progress | completed */\n  status: string;\n  /** success | failure | … ; null while the run is still in progress */\n  conclusion: string | null;\n  url: string | null;\n  /** Slug of the reporting app; \"github-actions\" checks have fetchable logs. */\n  appSlug: string | null;\n  /** The reporting app's own summary of the run, when it posted one. */\n  outputSummary: string | null;\n  /** The reporting app's run id (Cloud Build: the build UUID). */\n  externalId: string | null;\n  /** True when this run's log is fetchable via build_id (Cloud Build + GCP creds). */\n  buildLogAvailable?: boolean;\n}\n\nexport interface GithubChecksFns {\n  getChecks: (branch?: string) => Promise<GithubCheckSummary[]>;\n  getJobLog: (jobId: number) => Promise<string>;\n  getBuildLog: (buildId: string) => Promise<string>;\n}\n\n/** Arguments for the host-side `github_read` tool. */\nexport interface GithubReadRequest {\n  action: \"pr\" | \"pr_files\" | \"pr_reviews\" | \"issue\" | \"comments\" | \"list\";\n  /** Issue/PR number; defaults to the conversation's own. */\n  number?: number;\n  /** list only: open | closed | all (default open). */\n  state?: string;\n  /** list only: comma-separated label names. */\n  labels?: string;\n  /** list only: filter by author login. */\n  creator?: string;\n}\n\n/** Typed payload of one `github_read` action; the tool renders it. */\nexport type GithubReadResult =\n  | { kind: \"pr\"; pr: GithubPullRequest }\n  | { kind: \"pr_files\"; files: GithubPullRequestFile[] }\n  | { kind: \"pr_reviews\"; reviews: GithubPullRequestReview[]; threads: GithubReviewComment[] }\n  | { kind: \"issue\"; issue: GithubIssue }\n  | { kind: \"comments\"; comments: GithubIssueComment[] }\n  | { kind: \"list\"; issues: GithubIssue[] };\n\n/** Arguments for the host-side `github_issue` tool. Deliberately a closed\n *  action set: lock/delete/transfer are not offered at all. */\nexport interface GithubIssueRequest {\n  action: \"add_labels\" | \"remove_label\" | \"add_assignees\" | \"remove_assignees\" | \"close\" | \"reopen\";\n  /** Issue/PR number; defaults to the conversation's own (triage may target others). */\n  number?: number;\n  /** add_labels */\n  labels?: string[];\n  /** remove_label */\n  label?: string;\n  /** add_assignees / remove_assignees */\n  assignees?: string[];\n  /** close */\n  state_reason?: \"completed\" | \"not_planned\";\n}\n\n/**\n * Host-side GitHub operations for github_* tools. Wired in main.ts over the\n * GitHub bot; tokens stay host-side. Consumed by `createGithubToolPack`.\n */\nexport type GithubSyncFn = (branch?: string) => Promise<string>;\n\nexport type GithubReviewReplyFn = (commentId: number, body: string) => Promise<{ url: string }>;\n\nexport type GithubReadFn = (request: GithubReadRequest) => Promise<GithubReadResult>;\n\nexport type GithubIssueFn = (request: GithubIssueRequest) => Promise<string>;\n\nexport interface PlatformGithubOps {\n  /** Push a prepared pi/* branch and open (or update) a pull request. */\n  pushAndCreatePr(conversationId: string, request: GithubPrRequest): Promise<GithubPrResult>;\n  /** CI check runs for a branch, or for the conversation's PR head when omitted. */\n  getChecks(conversationId: string, branch?: string): Promise<GithubCheckSummary[]>;\n  /** Log text of one CI job (an Actions check-run id), tail-truncated. */\n  getJobLog(conversationId: string, jobId: number): Promise<string>;\n  /** Log text of one Cloud Build run (a [build …] uuid), tail-truncated. */\n  getBuildLog(conversationId: string, buildId: string): Promise<string>;\n  /** Reply inside one inline review thread of the conversation's PR. */\n  replyToReviewThread(\n    conversationId: string,\n    commentId: number,\n    body: string,\n  ): Promise<{ url: string }>;\n  /** Refresh the conversation's ./repo clone; returns a human-readable report. */\n  syncRepo(conversationId: string, branch?: string): Promise<string>;\n  /** Read PR/issue metadata the clone cannot provide; same repo only. */\n  readGithub(conversationId: string, request: GithubReadRequest): Promise<GithubReadResult>;\n  /** Label/assignee/state management on this repo's issues; returns a report. */\n  manageIssue(conversationId: string, request: GithubIssueRequest): Promise<string>;\n}\n"]}

package/dist/adapters/progressive-renderer.js

@@ -58,7 +58,7 @@ export function createProgressiveRenderer(platform) {
         state.responseId = await platform.post(text);
     }
     async function postSplit(text) {
-        const [head, ...tail] = split(text);
+        const [head = text, ...tail] = split(text);
         await postOrUpdate(head);
         for (const part of tail) {
             if (platform.typing?.stopOnSend)