@grimoire-rs/indexer 0.3.3 → 0.4.1

package/dist/ratings/provider.js

@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 The Grimoire Authors
+/**
+ * The `RatingProvider` seam — one interface, two forges, one in-memory fake.
+ *
+ * Mirrors `validate/adapters/forge.ts`: an interface, per-forge closures, and a
+ * `create*` factory that picks between them. The GraphQL plumbing every
+ * provider needs lives here rather than in each of them, because the one rule
+ * that must not drift is [`graphql`]'s error branching — a 200 carrying a
+ * populated `errors` array is a hard error, and two copies of that check is how
+ * one of them turns into an empty tally.
+ */
+import { CliError, EXIT } from "../cli/exit.js";
+import { LARGE_RESPONSE_BYTES, request } from "../validate/adapters/http.js";
+import { buildMarker } from "./marker.js";
+// The factory owns the dispatch, so it imports both implementations while they
+// import the shared plumbing back. ESM handles the cycle: everything crossing it
+// is a hoisted function declaration, referenced only from inside a closure.
+//
+// A `const` read at module scope is the case that rule excludes, and `PAGE_SIZE`
+// was one -- see `paging.ts`, which is why it lives there and not here. Re-exported
+// so callers still have one place to look.
+export { PAGE_SIZE } from "./paging.js";
+import { githubProvider as github } from "./provider_github.js";
+import { gitlabProvider as gitlab } from "./provider_gitlab.js";
+/**
+ * The forge answered, and the answer was unusable: a transport failure, a
+ * non-2xx, a body that did not parse, or a 200 carrying GraphQL `errors`.
+ *
+ * A `CliError` subclass rather than a name in `classify()`'s list, following
+ * `seed.ts`: that list exists for errors thrown by modules `main.ts` must not
+ * import, and `cli/exit.js` is already one of its static imports — so the
+ * mapping here is by type, which cannot drift out of sync with a string.
+ */
+export class ForgeError extends CliError {
+    constructor(message, code = EXIT.unavailable) {
+        super(message, code);
+        this.name = "RatingsForgeError";
+    }
+}
+/**
+ * A secondary rate limit. Distinguished from [`ForgeError`] because the two are
+ * handled oppositely: a forge error fails the run, a rate limit stops it early
+ * and publishes what it already got.
+ */
+export class RateLimited extends ForgeError {
+    /** What the forge asked us to wait, by GitHub's documented precedence. */
+    retryAfterMs;
+    /** Threads read before the limit. Empty on the create path. */
+    observed;
+    constructor(message, retryAfterMs, observed = []) {
+        super(message);
+        this.name = "RatingsRateLimited";
+        this.retryAfterMs = retryAfterMs;
+        this.observed = observed;
+    }
+}
+/** GitHub's documented floor when neither header says how long to wait. */
+export const BACKOFF_FLOOR_MS = 60_000;
+/**
+ * The body every provider writes. The marker sits on its own line, which is the
+ * only position R-1's anchored parser accepts; the prose above it is for the
+ * human who lands on the thread from the catalog.
+ */
+export function threadBody(ref) {
+    return [
+        `Rating thread for \`${ref}\`.`,
+        "",
+        "Upvote this thread to rate the package. Replies are not read by the tally.",
+        "",
+        buildMarker(ref),
+    ].join("\n");
+}
+export function field(data, key) {
+    if (typeof data !== "object" || data === null)
+        return undefined;
+    return data[key];
+}
+/** `field`, chained. Every GraphQL read here is a path into an `unknown`. */
+export function at(data, ...keys) {
+    return keys.reduce((value, key) => field(value, key), data);
+}
+export function stringAt(data, ...keys) {
+    const value = at(data, ...keys);
+    return typeof value === "string" ? value : "";
+}
+export function nodes(data) {
+    const value = at(data, "nodes");
+    return Array.isArray(value) ? value : [];
+}
+/**
+ * How long the forge asked us to wait: `retry-after` first, then
+ * `x-ratelimit-reset`, else the documented floor. GitHub's guidance is explicit
+ * that continuing to make requests while rate limited can get an integration
+ * banned, so this value is honoured by *stopping*, which is the strongest form
+ * of honouring it — a scheduled run resumes on the next tick, and sleeping here
+ * would burn CI minutes waiting to make requests the design has already decided
+ * not to make.
+ */
+function retryAfterMs(response) {
+    const after = Number(response.header("retry-after"));
+    if (Number.isFinite(after) && after > 0)
+        return after * 1000;
+    const reset = Number(response.header("x-ratelimit-reset"));
+    if (Number.isFinite(reset) && reset > 0) {
+        const wait = reset * 1000 - Date.now();
+        if (wait > 0)
+            return wait;
+    }
+    return BACKOFF_FLOOR_MS;
+}
+/**
+ * Is this reply a rate limit rather than an ordinary refusal?
+ *
+ * 429 always. 403 only when it says so — GitHub returns 403 for both a
+ * secondary limit and a plain permission failure, and the two are handled
+ * oppositely, so the discrimination has to be explicit.
+ */
+function rateLimitOf(response) {
+    if (response.status === 429)
+        return retryAfterMs(response);
+    if (response.status !== 403)
+        return null;
+    const secondary = /secondary rate limit|rate limit/i.test(response.body) ||
+        response.header("retry-after") !== "" ||
+        response.header("x-ratelimit-remaining") === "0";
+    return secondary ? retryAfterMs(response) : null;
+}
+function graphqlErrors(parsed) {
+    const errors = field(parsed, "errors");
+    if (!Array.isArray(errors) || errors.length === 0)
+        return null;
+    const message = errors
+        .map((err) => stringAt(err, "message") || JSON.stringify(err))
+        .join("; ");
+    const limited = errors.some((err) => stringAt(err, "type") === "RATE_LIMITED" ||
+        stringAt(err, "extensions", "code") === "RATE_LIMITED");
+    return { message, limited };
+}
+/**
+ * One GraphQL round trip, with the branching every provider shares.
+ *
+ * Order matters and is the reason this is one function: a rate limit is
+ * classified first (it is the one failure that must not fail the run), then
+ * `errors` is checked **independently of the HTTP status and before `data` is
+ * touched** — a 200 with `errors` and a null `data` otherwise reads as
+ * "genuinely fewer votes observed", which is silent emptying arriving through
+ * the one door R-2 does not watch.
+ *
+ * @param observed Threads already read, attached to a [`RateLimited`] so a
+ *   truncated pagination pass stays partial rather than becoming empty.
+ */
+export async function graphql(api, headers, query, variables, observed = []) {
+    const response = await request(api, { ...headers, "Content-Type": "application/json" }, {
+        method: "POST",
+        body: JSON.stringify({ query, variables }),
+        // A page is `PAGE_SIZE` threads and every one of their bodies. The default
+        // 1 MiB is sized for a small JSON document, and overrunning it lands as
+        // `status: 0` below — reported as a transport failure, which is what an
+        // oversized first page was being misdiagnosed as.
+        maxBytes: LARGE_RESPONSE_BYTES,
+    });
+    const wait = rateLimitOf(response);
+    if (wait !== null) {
+        throw new RateLimited(`${api}: secondary rate limit (HTTP ${response.status}), retry after ${Math.round(wait / 1000)}s`, wait, observed);
+    }
+    let parsed;
+    let parseError = null;
+    try {
+        parsed = JSON.parse(response.body);
+    }
+    catch (err) {
+        parseError = err.message;
+    }
+    const errors = graphqlErrors(parsed);
+    if (errors) {
+        if (errors.limited)
+            throw new RateLimited(`${api}: ${errors.message}`, BACKOFF_FLOOR_MS, observed);
+        throw new ForgeError(`${api}: ${errors.message}`);
+    }
+    // `status: 0` is `request()`'s transport catch *and* its response-size cap.
+    // Neither says anything about what the forge holds, so both are hard errors.
+    if (response.status === 0) {
+        throw new ForgeError(`${api}: the request did not complete (transport failure or oversized reply)`);
+    }
+    if (response.status < 200 || response.status >= 300) {
+        throw new ForgeError(`${api}: HTTP ${response.status}`);
+    }
+    if (parseError !== null) {
+        throw new ForgeError(`${api}: the reply did not parse (${parseError})`);
+    }
+    const data = field(parsed, "data");
+    if (typeof data !== "object" || data === null) {
+        throw new ForgeError(`${api}: the reply carried no data`);
+    }
+    return data;
+}
+export function createRatingProvider(kind, config) {
+    // Deliberately a `?:` and not a registry: two forges, one dispatch site, the
+    // same shape `createForge` already uses.
+    return kind === "github" ? github(config) : gitlab(config);
+}
+//# sourceMappingURL=provider.js.map

package/dist/ratings/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/ratings/provider.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAiB,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAqB,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,WAAW,EAAyB,MAAM,aAAa,CAAC;AAEjE,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,2CAA2C;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAsChE;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAW,SAAQ,QAAQ;IACtC,YAAY,OAAe,EAAE,OAAiB,IAAI,CAAC,WAAW;QAC5D,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,UAAU;IACzC,0EAA0E;IACjE,YAAY,CAAS;IAC9B,+DAA+D;IACtD,QAAQ,CAA0B;IAE3C,YAAY,OAAe,EAAE,YAAoB,EAAE,WAAoC,EAAE;QACvF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAGvC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO;QACL,uBAAuB,GAAG,KAAK;QAC/B,EAAE;QACF,4EAA4E;QAC5E,EAAE;QACF,WAAW,CAAC,GAAG,CAAC;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAa,EAAE,GAAW;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,OAAQ,IAAgC,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,EAAE,CAAC,IAAa,EAAE,GAAG,IAAc;IACjD,OAAO,IAAI,CAAC,MAAM,CAAU,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,GAAG,IAAc;IACvD,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAa;IACjC,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,QAAsB;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5B,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAsB;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,SAAS,GACb,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtD,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;QACrC,QAAQ,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;IACnD,OAAO,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,MAAe;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM;SACnB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;SAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,CAAC,GAAG,EAAE,EAAE,CACN,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,cAAc;QACxC,QAAQ,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,cAAc,CACzD,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,OAA+B,EAC/B,KAAa,EACb,SAAkC,EAClC,WAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE;QACtF,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC1C,2EAA2E;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,kDAAkD;QAClD,QAAQ,EAAE,oBAAoB;KAC/B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,WAAW,CACnB,GAAG,GAAG,gCAAgC,QAAQ,CAAC,MAAM,kBAAkB,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EACjG,IAAI,EACJ,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAY,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAI,GAAa,CAAC,OAAO,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACnG,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,uEAAuE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,UAAU,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,8BAA8B,UAAU,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAyB,EACzB,MAA4B;IAE5B,6EAA6E;IAC7E,yCAAyC;IACzC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC"}

package/dist/ratings/provider_github.d.ts

@@ -0,0 +1,3 @@
+import { type RatingProvider, type RatingProviderConfig } from "./provider.js";
+export declare function githubProvider(config: RatingProviderConfig): RatingProvider;
+//# sourceMappingURL=provider_github.d.ts.map

package/dist/ratings/provider_github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider_github.d.ts","sourceRoot":"","sources":["../../src/ratings/provider_github.ts"],"names":[],"mappings":"AAYA,OAAO,EAOL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAE1B,MAAM,eAAe,CAAC;AA0CvB,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiG3E"}

package/dist/ratings/provider_github.js

@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 The Grimoire Authors
+/**
+ * GitHub Discussions — GraphQL only, no REST equivalent.
+ *
+ * Upvotes are first-class here: `upvoteCount` is a scalar on the discussion, so
+ * the tally costs ~1 GraphQL point per page. Counting `reactionGroups` nodes
+ * instead would multiply nested-node cost for the same number.
+ */
+import { authorizeThread } from "./marker.js";
+import { ForgeError, at, graphql, nodes, threadBody, stringAt, } from "./provider.js";
+import { PAGE_SIZE } from "./paging.js";
+import { EXIT } from "../cli/exit.js";
+const CATEGORIES = `
+query($owner:String!,$name:String!){
+  repository(owner:$owner,name:$name){
+    id
+    discussionCategories(first:100){nodes{id name}}
+  }
+}`;
+// `databaseId` rather than the node `id`: R-1 clause 2 compares against
+// `index-policy.json`'s `trustedBots[].id`, which is the numeric account id the
+// validate gate already writes there — the opaque node id would never match.
+const DISCUSSIONS = `
+query($owner:String!,$name:String!,$categoryId:ID!,$cursor:String){
+  repository(owner:$owner,name:$name){
+    discussions(first:${PAGE_SIZE},after:$cursor,categoryId:$categoryId){
+      pageInfo{hasNextPage endCursor}
+      nodes{
+        id url upvoteCount body
+        category{id}
+        repository{id}
+        author{...on User{databaseId} ...on Bot{databaseId}}
+      }
+    }
+  }
+}`;
+const CREATE = `
+mutation($repositoryId:ID!,$categoryId:ID!,$title:String!,$body:String!){
+  createDiscussion(input:{repositoryId:$repositoryId,categoryId:$categoryId,title:$title,body:$body}){
+    discussion{id url upvoteCount}
+  }
+}`;
+const LOCK = `
+mutation($lockableId:ID!){
+  lockLockable(input:{lockableId:$lockableId}){clientMutationId}
+}`;
+export function githubProvider(config) {
+    const headers = { Authorization: `Bearer ${config.token}` };
+    const [owner = "", name = ""] = config.project.split("/", 2);
+    let resolved = null;
+    /** `container` is a name the operator typed; R-1 compares ids, so resolve it once. */
+    async function resolve() {
+        if (resolved)
+            return resolved;
+        const data = await graphql(config.api, headers, CATEGORIES, { owner, name });
+        const repositoryId = stringAt(data, "repository", "id");
+        if (repositoryId === "") {
+            throw new ForgeError(`${config.project}: no such repository, or it is not visible to this token`);
+        }
+        const wanted = config.container.trim().toLowerCase();
+        const categories = nodes(at(data, "repository", "discussionCategories"));
+        const match = categories.find((node) => stringAt(node, "name").trim().toLowerCase() === wanted);
+        if (!match) {
+            throw new ForgeError(`${config.project}: no discussion category named ${JSON.stringify(config.container)} ` +
+                `(found: ${categories.map((node) => stringAt(node, "name")).join(", ") || "none"})`, 
+            // The operator's `container` is wrong, not the forge — a data error, so
+            // a retry on the next schedule cannot fix it and should not pretend to.
+            EXIT.data);
+        }
+        resolved = { repositoryId, categoryId: stringAt(match, "id") };
+        return resolved;
+    }
+    return {
+        async listAuthored() {
+            const { repositoryId, categoryId } = await resolve();
+            const threads = [];
+            let cursor = null;
+            for (;;) {
+                const data = await graphql(config.api, headers, DISCUSSIONS, { owner, name, categoryId, cursor }, threads);
+                const page = at(data, "repository", "discussions");
+                for (const node of nodes(page)) {
+                    const author = at(node, "author");
+                    const databaseId = at(author, "databaseId");
+                    const observed = {
+                        target: stringAt(node, "id"),
+                        url: stringAt(node, "url"),
+                        up: typeof at(node, "upvoteCount") === "number" ? at(node, "upvoteCount") : 0,
+                        body: stringAt(node, "body"),
+                        authorId: typeof databaseId === "number" ? String(databaseId) : undefined,
+                        containerId: stringAt(node, "repository", "id"),
+                        categoryId: stringAt(node, "category", "id"),
+                    };
+                    const authorized = authorizeThread(observed, {
+                        trustedBots: config.trustedBots,
+                        containerId: repositoryId,
+                        categoryId,
+                    });
+                    if (authorized)
+                        threads.push(authorized);
+                }
+                if (at(page, "pageInfo", "hasNextPage") !== true)
+                    return threads;
+                cursor = stringAt(page, "pageInfo", "endCursor");
+            }
+        },
+        async create(ref) {
+            const { repositoryId, categoryId } = await resolve();
+            const data = await graphql(config.api, headers, CREATE, {
+                repositoryId,
+                categoryId,
+                title: ref,
+                body: threadBody(ref),
+            });
+            const discussion = at(data, "createDiscussion", "discussion");
+            const target = stringAt(discussion, "id");
+            if (target === "")
+                throw new ForgeError(`${config.project}: createDiscussion returned no discussion`);
+            // Locking is the promise `lockThreads: true` makes — votes count, replies
+            // are refused — so a failure here fails the run rather than silently
+            // leaving an open forum the operator did not ask to moderate. Turn it off
+            // in `index.config.json` if the forge cannot honour it.
+            if (config.lockThreads) {
+                await graphql(config.api, headers, LOCK, { lockableId: target });
+            }
+            return {
+                ref,
+                target,
+                url: stringAt(discussion, "url"),
+                up: typeof at(discussion, "upvoteCount") === "number" ? at(discussion, "upvoteCount") : 0,
+            };
+        },
+    };
+}
+//# sourceMappingURL=provider_github.js.map

package/dist/ratings/provider_github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider_github.js","sourceRoot":"","sources":["../../src/ratings/provider_github.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAuB,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,UAAU,EACV,EAAE,EACF,OAAO,EACP,KAAK,EACL,UAAU,EACV,QAAQ,GAIT,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,MAAM,UAAU,GAAG;;;;;;EAMjB,CAAC;AAEH,wEAAwE;AACxE,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,WAAW,GAAG;;;wBAGI,SAAS;;;;;;;;;;EAU/B,CAAC;AAEH,MAAM,MAAM,GAAG;;;;;EAKb,CAAC;AAEH,MAAM,IAAI,GAAG;;;EAGX,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,MAA4B;IACzD,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5D,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE7D,IAAI,QAAQ,GAAwD,IAAI,CAAC;IAEzE,sFAAsF;IACtF,KAAK,UAAU,OAAO;QACpB,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAAC,GAAG,MAAM,CAAC,OAAO,0DAA0D,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAClB,GAAG,MAAM,CAAC,OAAO,kCAAkC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG;gBACpF,WAAW,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;YACrF,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,CAAC,IAAI,CACV,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;YACrD,MAAM,OAAO,GAAmB,EAAE,CAAC;YACnC,IAAI,MAAM,GAAkB,IAAI,CAAC;YAEjC,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,CAAC,GAAG,EACV,OAAO,EACP,WAAW,EACX,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EACnC,OAAO,CACR,CAAC;gBACF,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;gBACnD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBAClC,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBAC5C,MAAM,QAAQ,GAAmB;wBAC/B,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;wBAC5B,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;wBAC1B,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,IAAI,EAAE,aAAa,CAAY,CAAC,CAAC,CAAC,CAAC;wBACzF,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;wBAC5B,QAAQ,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;wBACzE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC;wBAC/C,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC;qBAC7C,CAAC;oBACF,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,EAAE;wBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,WAAW,EAAE,YAAY;wBACzB,UAAU;qBACX,CAAC,CAAC;oBACH,IAAI,UAAU;wBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3C,CAAC;gBACD,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAC;gBACjE,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;gBACtD,YAAY;gBACZ,UAAU;gBACV,KAAK,EAAE,GAAG;gBACV,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;aACtB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,MAAM,CAAC,OAAO,2CAA2C,CAAC,CAAC;YAEtG,0EAA0E;YAC1E,qEAAqE;YACrE,0EAA0E;YAC1E,wDAAwD;YACxD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,OAAO;gBACL,GAAG;gBACH,MAAM;gBACN,GAAG,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;gBAChC,EAAE,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,UAAU,EAAE,aAAa,CAAY,CAAC,CAAC,CAAC,CAAC;aACtG,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ratings/provider_gitlab.d.ts

@@ -0,0 +1,3 @@
+import { type RatingProvider, type RatingProviderConfig } from "./provider.js";
+export declare function gitlabProvider(config: RatingProviderConfig): RatingProvider;
+//# sourceMappingURL=provider_gitlab.d.ts.map

package/dist/ratings/provider_gitlab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider_gitlab.d.ts","sourceRoot":"","sources":["../../src/ratings/provider_gitlab.ts"],"names":[],"mappings":"AAcA,OAAO,EAOL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAE1B,MAAM,eAAe,CAAC;AAgEvB,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CA8F3E"}

package/dist/ratings/provider_gitlab.js

@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 The Grimoire Authors
+/**
+ * GitLab work items — the GraphQL surface, not the long-term-deprecated REST
+ * issues API.
+ *
+ * The counter lives on the **Emoji Reactions** widget (`upvotes`). GitLab
+ * renamed the feature from Award Emoji in 16.0 while leaving the GraphQL names
+ * (`AwardEmoji`, `awardEmojiToggle`) unchanged, so the schema below reads
+ * legacy and the prose reads current — that is the rename, not a mismatch.
+ */
+import { authorizeThread } from "./marker.js";
+import { ForgeError, at, graphql, nodes, threadBody, stringAt, } from "./provider.js";
+import { PAGE_SIZE } from "./paging.js";
+import { EXIT } from "../cli/exit.js";
+const TYPES = `
+query($path:ID!){
+  project(fullPath:$path){
+    id
+    workItemTypes{nodes{id name}}
+  }
+}`;
+const WORK_ITEMS = `
+query($path:ID!,$types:[IssueType!],$cursor:String){
+  project(fullPath:$path){
+    id
+    workItems(first:${PAGE_SIZE},after:$cursor,types:$types){
+      pageInfo{hasNextPage endCursor}
+      nodes{
+        id webUrl
+        author{id}
+        workItemType{id}
+        widgets{
+          ...on WorkItemWidgetDescription{description}
+          ...on WorkItemWidgetAwardEmoji{upvotes}
+        }
+      }
+    }
+  }
+}`;
+const CREATE = `
+mutation($path:ID!,$typeId:WorkItemsTypeID!,$title:String!,$body:String!){
+  workItemCreate(input:{namespacePath:$path,workItemTypeId:$typeId,title:$title,descriptionWidget:{description:$body}}){
+    workItem{id webUrl}
+  }
+}`;
+const LOCK = `
+mutation($id:WorkItemID!){
+  workItemUpdate(input:{id:$id,notesWidget:{discussionLocked:true}}){
+    workItem{id}
+  }
+}`;
+/**
+ * The numeric tail of a global id — `gid://gitlab/User/42` → `42`.
+ *
+ * Only the **author** id is normalized, and only because R-1 clause 2 compares
+ * it against `index-policy.json`'s `trustedBots[].id`, which the validate gate
+ * writes as GitLab's numeric user id. Container and type ids stay whole gids:
+ * both sides of those comparisons come from this same provider, so there is
+ * nothing to agree with.
+ */
+function numericId(gid) {
+    const tail = gid.split("/").pop();
+    return tail !== undefined && /^\d+$/.test(tail) ? tail : undefined;
+}
+/** `Issue` → `ISSUE`, `Test case` → `TEST_CASE`. The `types:` filter's enum. */
+function typeEnum(container) {
+    return container.trim().toUpperCase().replace(/\s+/g, "_");
+}
+export function gitlabProvider(config) {
+    const headers = { Authorization: `Bearer ${config.token}` };
+    const path = config.project;
+    let resolved = null;
+    async function resolve() {
+        if (resolved)
+            return resolved;
+        const data = await graphql(config.api, headers, TYPES, { path });
+        const projectId = stringAt(data, "project", "id");
+        if (projectId === "") {
+            throw new ForgeError(`${path}: no such project, or it is not visible to this token`);
+        }
+        const wanted = config.container.trim().toLowerCase();
+        const types = nodes(at(data, "project", "workItemTypes"));
+        const match = types.find((node) => stringAt(node, "name").trim().toLowerCase() === wanted);
+        if (!match) {
+            throw new ForgeError(`${path}: no work item type named ${JSON.stringify(config.container)} ` +
+                `(found: ${types.map((node) => stringAt(node, "name")).join(", ") || "none"})`, EXIT.data);
+        }
+        resolved = { projectId, typeId: stringAt(match, "id") };
+        return resolved;
+    }
+    return {
+        async listAuthored() {
+            const { projectId, typeId } = await resolve();
+            const threads = [];
+            let cursor = null;
+            for (;;) {
+                const data = await graphql(config.api, headers, WORK_ITEMS, { path, types: [typeEnum(config.container)], cursor }, threads);
+                const page = at(data, "project", "workItems");
+                for (const node of nodes(page)) {
+                    const widgets = at(node, "widgets");
+                    const list = Array.isArray(widgets) ? widgets : [];
+                    const upvotes = list.map((w) => at(w, "upvotes")).find((v) => typeof v === "number");
+                    const description = list.map((w) => at(w, "description")).find((v) => typeof v === "string");
+                    const observed = {
+                        target: stringAt(node, "id"),
+                        url: stringAt(node, "webUrl"),
+                        up: typeof upvotes === "number" ? upvotes : 0,
+                        body: typeof description === "string" ? description : "",
+                        authorId: numericId(stringAt(node, "author", "id")),
+                        // The query is scoped to this project, so every node it returns is
+                        // in it. R-1 clause 4 still compares — the rule lives in one place.
+                        containerId: projectId,
+                        categoryId: stringAt(node, "workItemType", "id"),
+                    };
+                    const authorized = authorizeThread(observed, {
+                        trustedBots: config.trustedBots,
+                        containerId: projectId,
+                        categoryId: typeId,
+                    });
+                    if (authorized)
+                        threads.push(authorized);
+                }
+                if (at(page, "pageInfo", "hasNextPage") !== true)
+                    return threads;
+                cursor = stringAt(page, "pageInfo", "endCursor");
+            }
+        },
+        async create(ref) {
+            const { typeId } = await resolve();
+            const data = await graphql(config.api, headers, CREATE, {
+                path,
+                typeId,
+                title: ref,
+                body: threadBody(ref),
+            });
+            const item = at(data, "workItemCreate", "workItem");
+            const target = stringAt(item, "id");
+            if (target === "")
+                throw new ForgeError(`${path}: workItemCreate returned no work item`);
+            // Same contract as the GitHub side: `lockThreads: true` promises replies
+            // are refused, so failing to lock fails the run rather than quietly
+            // opening a forum the operator did not ask to moderate.
+            if (config.lockThreads) {
+                await graphql(config.api, headers, LOCK, { id: target });
+            }
+            // A fresh work item has no reactions, and asking for them would cost a
+            // second round trip to learn zero.
+            return { ref, target, url: stringAt(item, "webUrl"), up: 0 };
+        },
+    };
+}
+//# sourceMappingURL=provider_gitlab.js.map

package/dist/ratings/provider_gitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider_gitlab.js","sourceRoot":"","sources":["../../src/ratings/provider_gitlab.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAuB,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,UAAU,EACV,EAAE,EACF,OAAO,EACP,KAAK,EACL,UAAU,EACV,QAAQ,GAIT,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,MAAM,KAAK,GAAG;;;;;;EAMZ,CAAC;AAEH,MAAM,UAAU,GAAG;;;;sBAIG,SAAS;;;;;;;;;;;;;EAa7B,CAAC;AAEH,MAAM,MAAM,GAAG;;;;;EAKb,CAAC;AAEH,MAAM,IAAI,GAAG;;;;;EAKX,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAClC,OAAO,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,SAAiB;IACjC,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA4B;IACzD,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;IAE5B,IAAI,QAAQ,GAAiD,IAAI,CAAC;IAElE,KAAK,UAAU,OAAO;QACpB,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,uDAAuD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QAC3F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,6BAA6B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG;gBACrE,WAAW,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,EAChF,IAAI,CAAC,IAAI,CACV,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAmB,EAAE,CAAC;YACnC,IAAI,MAAM,GAAkB,IAAI,CAAC;YAEjC,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,CAAC,GAAG,EACV,OAAO,EACP,UAAU,EACV,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EACrD,OAAO,CACR,CAAC;gBACF,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;oBACrF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;oBAC7F,MAAM,QAAQ,GAAmB;wBAC/B,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;wBAC5B,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;wBAC7B,EAAE,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;wBAC7C,IAAI,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;wBACxD,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;wBACnD,mEAAmE;wBACnE,oEAAoE;wBACpE,WAAW,EAAE,SAAS;wBACtB,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC;qBACjD,CAAC;oBACF,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,EAAE;wBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,WAAW,EAAE,SAAS;wBACtB,UAAU,EAAE,MAAM;qBACnB,CAAC,CAAC;oBACH,IAAI,UAAU;wBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3C,CAAC;gBACD,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAC;gBACjE,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;gBACtD,IAAI;gBACJ,MAAM;gBACN,KAAK,EAAE,GAAG;gBACV,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;aACtB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;YAEzF,yEAAyE;YACzE,oEAAoE;YACpE,wDAAwD;YACxD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3D,CAAC;YAED,uEAAuE;YACvE,mCAAmC;YACnC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ratings/provider_memory.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The in-memory `RatingProvider` — the primary local test seam.
+ *
+ * It proves the reconcile logic with no network and no fixtures: threads live
+ * in an array, `create` appends to it, and the next `listAuthored` sees them.
+ * That is what makes "a rerun is idempotent" a thing a test can assert rather
+ * than a thing a comment claims.
+ *
+ * R-1 is not re-applied here. Every thread the fake holds is one it authored,
+ * which is exactly the post-R-1 state a live provider hands back.
+ */
+import { type RatingProvider, type RatingThread } from "./provider.js";
+export interface MemoryProviderOptions {
+    /** Threads already on the fake forge. Repeat a `ref` to stage a conflict. */
+    threads?: RatingThread[];
+    /** Stop the listing pass after this many threads and raise a rate limit. */
+    listLimit?: number;
+    /** Raise a rate limit on the create after this many succeeded. */
+    createLimit?: number;
+}
+export interface MemoryProvider extends RatingProvider {
+    /** Live view of the fake forge — assert on it after a run. */
+    readonly threads: RatingThread[];
+    /** Targets of threads created with locking asked for. */
+    readonly locked: string[];
+}
+export declare function memoryProvider(options?: MemoryProviderOptions): MemoryProvider;
+//# sourceMappingURL=provider_memory.d.ts.map

package/dist/ratings/provider_memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider_memory.d.ts","sourceRoot":"","sources":["../../src/ratings/provider_memory.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,EAAe,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAEpF,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAsClF"}

package/dist/ratings/provider_memory.js

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 The Grimoire Authors
+/**
+ * The in-memory `RatingProvider` — the primary local test seam.
+ *
+ * It proves the reconcile logic with no network and no fixtures: threads live
+ * in an array, `create` appends to it, and the next `listAuthored` sees them.
+ * That is what makes "a rerun is idempotent" a thing a test can assert rather
+ * than a thing a comment claims.
+ *
+ * R-1 is not re-applied here. Every thread the fake holds is one it authored,
+ * which is exactly the post-R-1 state a live provider hands back.
+ */
+import { RateLimited } from "./provider.js";
+export function memoryProvider(options = {}) {
+    const threads = options.threads ?? [];
+    const locked = [];
+    // The fake's limits are per-run, and a run always starts by listing — so the
+    // create counter resets there rather than needing a separate reset call.
+    let created = 0;
+    return {
+        threads,
+        locked,
+        listAuthored() {
+            created = 0;
+            const { listLimit } = options;
+            if (listLimit !== undefined && listLimit < threads.length) {
+                return Promise.reject(new RateLimited("memory: secondary rate limit while listing", 60_000, threads.slice(0, listLimit)));
+            }
+            return Promise.resolve([...threads]);
+        },
+        create(ref) {
+            if (options.createLimit !== undefined && created >= options.createLimit) {
+                return Promise.reject(new RateLimited("memory: secondary rate limit while creating", 60_000));
+            }
+            created += 1;
+            const thread = {
+                ref,
+                target: `t-${ref}`,
+                url: `https://forge.example/${ref}`,
+                up: 0,
+            };
+            threads.push(thread);
+            locked.push(thread.target);
+            return Promise.resolve(thread);
+        },
+    };
+}
+//# sourceMappingURL=provider_memory.js.map

package/dist/ratings/provider_memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider_memory.js","sourceRoot":"","sources":["../../src/ratings/provider_memory.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,sCAAsC;AAEtC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAA0C,MAAM,eAAe,CAAC;AAkBpF,MAAM,UAAU,cAAc,CAAC,UAAiC,EAAE;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,OAAO;QACL,OAAO;QACP,MAAM;QAEN,YAAY;YACV,OAAO,GAAG,CAAC,CAAC;YACZ,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;YAC9B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC1D,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,WAAW,CAAC,4CAA4C,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CACnG,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,GAAG;YACR,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,6CAA6C,EAAE,MAAM,CAAC,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,MAAM,GAAiB;gBAC3B,GAAG;gBACH,MAAM,EAAE,KAAK,GAAG,EAAE;gBAClB,GAAG,EAAE,yBAAyB,GAAG,EAAE;gBACnC,EAAE,EAAE,CAAC;aACN,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}