@growthub/cli 0.5.1 → 0.6.1

package/dist/starter/source-import/github-source.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Source Import Agent — GitHub repo source adapter.
+ *
+ * Combines two primitives for the `github-repo` source kind:
+ *
+ *   1. Access probe — mirrors the Fork Sync Agent's fixed-preference auth
+ *      ordering (direct CLI → hosted bridge → public), returning a
+ *      `GithubRepoAccessProbe` that downstream planners consume without
+ *      knowing which source produced the token.
+ *   2. Bounded clone — uses the existing `cli/src/kits/fork-remote.ts`
+ *      `git` wrapper semantics (child_process-based, token embedded in
+ *      HTTPS URL at invocation time, never written to git config).
+ *
+ * This module deliberately does not introduce a new transport or a new
+ * auth primitive. Every token it returns was produced by the existing
+ * `resolveGithubAccessToken()` resolver. Bridge-minted credentials remain
+ * in-memory only and are discarded at the end of the import run.
+ */
+import type { GithubRepoAccessProbe, GithubRepoSourceInput, SourceAccessMode } from "./types.js";
+/**
+ * Resolve repo access using the Fork Sync Agent's preference ordering.
+ * Returns a `GithubRepoAccessProbe` that downstream planners consume
+ * without knowing which source produced the token.
+ */
+export declare function probeGithubRepoSource(input: GithubRepoSourceInput): Promise<GithubRepoAccessProbe>;
+/**
+ * Resolve an access token usable for a git clone over HTTPS.
+ * Returns null for public probes — the caller should clone unauthenticated.
+ *
+ * IMPORTANT: this token is returned in memory only. The caller must not
+ * persist it. For bridge-sourced tokens, this honours the fork-sync
+ * invariant "bridge-minted credentials are never persisted to disk".
+ */
+export declare function resolveGithubCloneToken(probe: GithubRepoAccessProbe): Promise<{
+    token: string;
+    source: SourceAccessMode;
+} | null>;
+export interface CloneGithubRepoInput {
+    probe: GithubRepoAccessProbe;
+    branch?: string;
+    destination: string;
+    /** Optional token (required for private clones). */
+    token?: string;
+    /** Optional depth. Defaults to 1 for safe, bounded clones. */
+    depth?: number;
+}
+export interface CloneGithubRepoResult {
+    destination: string;
+    branch: string;
+    sha?: string;
+    cloneUrl: string;
+}
+/**
+ * Clone a GitHub repo into `destination`. Defaults to `--depth 1` to keep
+ * the agent's blast radius small; callers can override via `input.depth=0`
+ * for a full clone. The destination must not already exist — the agent is
+ * responsible for its lifecycle (caller places it in a staging zone).
+ */
+export declare function cloneGithubRepo(input: CloneGithubRepoInput): CloneGithubRepoResult;
+/**
+ * Narrow a cloned worktree to a single subdirectory. Moves
+ * `<root>/<subdirectory>` into place and removes everything else. Keeps
+ * the operator's subdirectory choice bounded and obvious on disk.
+ */
+export declare function narrowToSubdirectory(rootDir: string, subdirectory: string): void;
+//# sourceMappingURL=github-source.d.ts.map

package/dist/starter/source-import/github-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-source.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/github-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AA8CpB;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAiGhC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,IAAI,CAAC,CAK7D;AAMD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAmBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,qBAAqB,CA6ClF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAgBhF"}

package/dist/starter/source-import/github-source.js

@@ -0,0 +1,233 @@
+/**
+ * Source Import Agent — GitHub repo source adapter.
+ *
+ * Combines two primitives for the `github-repo` source kind:
+ *
+ *   1. Access probe — mirrors the Fork Sync Agent's fixed-preference auth
+ *      ordering (direct CLI → hosted bridge → public), returning a
+ *      `GithubRepoAccessProbe` that downstream planners consume without
+ *      knowing which source produced the token.
+ *   2. Bounded clone — uses the existing `cli/src/kits/fork-remote.ts`
+ *      `git` wrapper semantics (child_process-based, token embedded in
+ *      HTTPS URL at invocation time, never written to git config).
+ *
+ * This module deliberately does not introduce a new transport or a new
+ * auth primitive. Every token it returns was produced by the existing
+ * `resolveGithubAccessToken()` resolver. Bridge-minted credentials remain
+ * in-memory only and are discarded at the end of the import run.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { resolveGithubAccessToken } from "../../integrations/github-resolver.js";
+import { parseRepoRef } from "../../github/client.js";
+import { buildTokenCloneUrl, gitAvailable } from "../../kits/fork-remote.js";
+const GITHUB_API_BASE = "https://api.github.com";
+// ---------------------------------------------------------------------------
+// Access probe
+// ---------------------------------------------------------------------------
+function baseHeaders() {
+    return {
+        "User-Agent": "growthub-cli",
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+    };
+}
+function withToken(token) {
+    return { ...baseHeaders(), Authorization: `Bearer ${token}` };
+}
+function pickVisibility(raw) {
+    const v = raw.visibility;
+    if (v === "public" || v === "private" || v === "internal")
+        return v;
+    if (raw.private === true)
+        return "private";
+    if (raw.private === false)
+        return "public";
+    return "unknown";
+}
+async function fetchRepoMetadata(ref, authHeaders) {
+    const res = await fetch(`${GITHUB_API_BASE}/repos/${ref.owner}/${ref.repo}`, {
+        headers: authHeaders,
+    });
+    if (res.status === 404 || res.status === 401 || res.status === 403) {
+        return null;
+    }
+    if (!res.ok) {
+        throw new Error(`GitHub repo probe failed: ${res.status} ${res.statusText}`);
+    }
+    return (await res.json());
+}
+/**
+ * Resolve repo access using the Fork Sync Agent's preference ordering.
+ * Returns a `GithubRepoAccessProbe` that downstream planners consume
+ * without knowing which source produced the token.
+ */
+export async function probeGithubRepoSource(input) {
+    const ref = parseRepoRef(input.repo);
+    const warnings = [];
+    if (input.skipProbe) {
+        return {
+            kind: "github-repo",
+            mode: "public",
+            repo: ref,
+            defaultBranch: "main",
+            htmlUrl: `https://github.com/${ref.owner}/${ref.repo}`,
+            cloneUrl: `https://github.com/${ref.owner}/${ref.repo}.git`,
+            visibility: "unknown",
+            warnings: ["--skip-probe set; default branch assumed 'main'"],
+        };
+    }
+    const resolved = await resolveGithubAccessToken();
+    const orderedProbes = [];
+    if (resolved) {
+        orderedProbes.push({
+            mode: resolved.source,
+            headers: withToken(resolved.accessToken),
+            handle: resolved.handle,
+        });
+    }
+    orderedProbes.push({ mode: "public", headers: baseHeaders() });
+    let meta = null;
+    let successfulProbe = null;
+    let lastError = null;
+    for (const probe of orderedProbes) {
+        try {
+            const result = await fetchRepoMetadata(ref, probe.headers);
+            if (result) {
+                meta = result;
+                successfulProbe = probe;
+                break;
+            }
+            if (probe.mode !== "public") {
+                warnings.push(`repo metadata not readable via ${probe.mode} auth — falling through`);
+            }
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err.message : String(err);
+            warnings.push(`${probe.mode} probe errored: ${lastError}`);
+        }
+    }
+    if (!meta || !successfulProbe) {
+        if (input.privateRepo) {
+            throw new Error(`Private repo requested but no credential resolved access. ` +
+                `Run 'growthub github login' or connect GitHub inside Growthub. ` +
+                `Last error: ${lastError ?? "repo not found / not accessible"}`);
+        }
+        throw new Error(`Unable to resolve GitHub repo '${ref.owner}/${ref.repo}'. ` +
+            `Verify the slug and your auth. Last error: ${lastError ?? "not found"}`);
+    }
+    const visibility = pickVisibility(meta);
+    if (visibility === "private" && successfulProbe.mode === "public") {
+        throw new Error(`Repo '${ref.owner}/${ref.repo}' is private but only public access was probed. ` +
+            `This indicates a logic error — please report this probe trace.`);
+    }
+    const defaultBranch = typeof meta.default_branch === "string" ? meta.default_branch : "main";
+    const htmlUrl = typeof meta.html_url === "string"
+        ? meta.html_url
+        : `https://github.com/${ref.owner}/${ref.repo}`;
+    const cloneUrl = typeof meta.clone_url === "string"
+        ? meta.clone_url
+        : `https://github.com/${ref.owner}/${ref.repo}.git`;
+    return {
+        kind: "github-repo",
+        mode: successfulProbe.mode,
+        repo: ref,
+        defaultBranch,
+        htmlUrl,
+        cloneUrl,
+        visibility,
+        authHandle: successfulProbe.handle,
+        warnings,
+    };
+}
+/**
+ * Resolve an access token usable for a git clone over HTTPS.
+ * Returns null for public probes — the caller should clone unauthenticated.
+ *
+ * IMPORTANT: this token is returned in memory only. The caller must not
+ * persist it. For bridge-sourced tokens, this honours the fork-sync
+ * invariant "bridge-minted credentials are never persisted to disk".
+ */
+export async function resolveGithubCloneToken(probe) {
+    if (probe.mode === "public")
+        return null;
+    const resolved = await resolveGithubAccessToken();
+    if (!resolved)
+        return null;
+    return { token: resolved.accessToken, source: resolved.source };
+}
+function runGit(cwd, args) {
+    const res = spawnSync("git", args, {
+        cwd,
+        encoding: "utf8",
+        maxBuffer: 20 * 1024 * 1024,
+    });
+    return {
+        ok: res.status === 0,
+        stdout: res.stdout ?? "",
+        stderr: res.stderr ?? "",
+        code: res.status ?? -1,
+    };
+}
+/**
+ * Clone a GitHub repo into `destination`. Defaults to `--depth 1` to keep
+ * the agent's blast radius small; callers can override via `input.depth=0`
+ * for a full clone. The destination must not already exist — the agent is
+ * responsible for its lifecycle (caller places it in a staging zone).
+ */
+export function cloneGithubRepo(input) {
+    if (!gitAvailable()) {
+        throw new Error("`git` is not available on PATH — cannot clone.");
+    }
+    if (fs.existsSync(input.destination)) {
+        throw new Error(`Clone destination already exists: ${input.destination}`);
+    }
+    const cloneUrl = input.token
+        ? buildTokenCloneUrl(input.probe.repo, input.token)
+        : input.probe.cloneUrl;
+    const parent = path.dirname(input.destination);
+    fs.mkdirSync(parent, { recursive: true });
+    const depth = input.depth ?? 1;
+    const branch = input.branch ?? input.probe.defaultBranch;
+    const args = ["clone"];
+    if (depth > 0)
+        args.push("--depth", String(depth));
+    args.push("--single-branch", "--branch", branch, cloneUrl, input.destination);
+    const cloneRes = runGit(parent, args);
+    if (!cloneRes.ok) {
+        const sanitized = (cloneRes.stderr || "git clone failed").replace(/https:\/\/x-access-token:[^@]+@/g, "https://x-access-token:<redacted>@");
+        throw new Error(`git clone failed: ${sanitized}`);
+    }
+    const shaRes = runGit(input.destination, ["rev-parse", "HEAD"]);
+    const sha = shaRes.ok ? shaRes.stdout.trim() : undefined;
+    // Detach remote so a leaked token in history never lingers. The imported
+    // payload is a point-in-time snapshot; users can re-init git if they want
+    // their own origin.
+    runGit(input.destination, ["remote", "remove", "origin"]);
+    return {
+        destination: input.destination,
+        branch,
+        sha,
+        cloneUrl: input.probe.cloneUrl,
+    };
+}
+/**
+ * Narrow a cloned worktree to a single subdirectory. Moves
+ * `<root>/<subdirectory>` into place and removes everything else. Keeps
+ * the operator's subdirectory choice bounded and obvious on disk.
+ */
+export function narrowToSubdirectory(rootDir, subdirectory) {
+    const normalizedSub = subdirectory.replace(/^\/+|\/+$/g, "");
+    if (!normalizedSub)
+        return;
+    const abs = path.resolve(rootDir, normalizedSub);
+    if (!fs.existsSync(abs) || !fs.statSync(abs).isDirectory()) {
+        throw new Error(`Subdirectory not found in cloned repo: ${subdirectory}`);
+    }
+    const tmp = path.resolve(path.dirname(rootDir), `.${path.basename(rootDir)}-narrow-${Date.now().toString(36)}`);
+    fs.renameSync(abs, tmp);
+    fs.rmSync(rootDir, { recursive: true, force: true });
+    fs.renameSync(tmp, rootDir);
+}
+//# sourceMappingURL=github-source.js.map

package/dist/starter/source-import/github-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-source.js","sourceRoot":"","sources":["../../../src/starter/source-import/github-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAQ7E,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,SAAS,WAAW;IAClB,OAAO;QACL,YAAY,EAAE,cAAc;QAC5B,MAAM,EAAE,6BAA6B;QACrC,sBAAsB,EAAE,YAAY;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,EAAE,GAAG,WAAW,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CACrB,GAA4B;IAE5B,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;IACzB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC3C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,WAAmC;IAEnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,UAAU,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE;QAC3E,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA4B;IAE5B,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,GAAG;YACT,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE;YACtD,QAAQ,EAAE,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,MAAM;YAC3D,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,CAAC,iDAAiD,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAClD,MAAM,aAAa,GAId,EAAE,CAAC;IAER,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,QAAQ,CAAC,MAAM;YACrB,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAE/D,IAAI,IAAI,GAAmC,IAAI,CAAC;IAChD,IAAI,eAAe,GAA0C,IAAI,CAAC;IAClE,IAAI,SAAS,GAAkB,IAAI,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,GAAG,MAAM,CAAC;gBACd,eAAe,GAAG,KAAK,CAAC;gBACxB,MAAM;YACR,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACX,kCAAkC,KAAK,CAAC,IAAI,yBAAyB,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,mBAAmB,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,4DAA4D;gBAC1D,iEAAiE;gBACjE,eAAe,SAAS,IAAI,iCAAiC,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK;YAC1D,8CAA8C,SAAS,IAAI,WAAW,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,kDAAkD;YAC9E,gEAAgE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAC/C,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QACjD,CAAC,CAAC,IAAI,CAAC,SAAS;QAChB,CAAC,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC;IAEtD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,eAAe,CAAC,IAAI;QAC1B,IAAI,EAAE,GAAG;QACT,aAAa;QACb,OAAO;QACP,QAAQ;QACR,UAAU;QACV,UAAU,EAAE,eAAe,CAAC,MAAM;QAClC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAA4B;IAE5B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAClE,CAAC;AAuBD,SAAS,MAAM,CACb,GAAW,EACX,IAAc;IAEd,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QACjC,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;KACvB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK;QAC1B,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QACnD,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;IAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC;IAEzD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,IAAI,KAAK,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAC/D,kCAAkC,EAClC,oCAAoC,CACrC,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzD,yEAAyE;IACzE,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM;QACN,GAAG;QACH,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,YAAoB;IACxE,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,0CAA0C,YAAY,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EACrB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC/D,CAAC;IACF,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/starter/source-import/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Source Import Agent — public module surface.
+ *
+ * The canonical entrypoint for the Portable Source → Agent Environment
+ * Pipeline. Re-exports the types, source adapters, shared security
+ * inspector, planner, materializer, and background runner so every
+ * caller (CLI commands, discovery UX, test suites) imports from a
+ * single location.
+ */
+export * from "./types.js";
+export { probeGithubRepoSource, resolveGithubCloneToken, cloneGithubRepo, narrowToSubdirectory, } from "./github-source.js";
+export { browseSkills, probeSkillsSource, fetchSkillPayload, parseSkillRef, } from "./skills-source.js";
+export { detectSourceShape } from "./detect.js";
+export { inspectSourcePayload } from "./security.js";
+export { buildSourceImportPlan, pendingConfirmations } from "./plan.js";
+export { materializeImportPlan, PendingConfirmationError } from "./materialize.js";
+export { writeImportSummary } from "./summarize.js";
+export { runSourceImportJob, confirmAndResumeSourceImportJob, dispatchSourceImportJobBackground, getSourceImportJob, listSourceImportJobs, cancelSourceImportJob, pruneSourceImportJobs, } from "./agent.js";
+import type { SourceImportInput, SourceImportJob, SourceImportResult } from "./types.js";
+/**
+ * One-shot foreground entrypoint used by the CLI and discovery UX.
+ * Delegates to the background-capable runner but waits for terminal
+ * status before returning. When the job parks on confirmation, the
+ * returned job has `status === "awaiting_confirmation"` and the caller
+ * is responsible for prompting + calling `confirmAndResumeSourceImportJob`.
+ */
+export declare function importSourceAsWorkspace(input: SourceImportInput): Promise<{
+    job: SourceImportJob;
+    result?: SourceImportResult;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/starter/source-import/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,iCAAiC,EACjC,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGzF;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAGhE"}

package/dist/starter/source-import/index.js

@@ -0,0 +1,31 @@
+/**
+ * Source Import Agent — public module surface.
+ *
+ * The canonical entrypoint for the Portable Source → Agent Environment
+ * Pipeline. Re-exports the types, source adapters, shared security
+ * inspector, planner, materializer, and background runner so every
+ * caller (CLI commands, discovery UX, test suites) imports from a
+ * single location.
+ */
+export * from "./types.js";
+export { probeGithubRepoSource, resolveGithubCloneToken, cloneGithubRepo, narrowToSubdirectory, } from "./github-source.js";
+export { browseSkills, probeSkillsSource, fetchSkillPayload, parseSkillRef, } from "./skills-source.js";
+export { detectSourceShape } from "./detect.js";
+export { inspectSourcePayload } from "./security.js";
+export { buildSourceImportPlan, pendingConfirmations } from "./plan.js";
+export { materializeImportPlan, PendingConfirmationError } from "./materialize.js";
+export { writeImportSummary } from "./summarize.js";
+export { runSourceImportJob, confirmAndResumeSourceImportJob, dispatchSourceImportJobBackground, getSourceImportJob, listSourceImportJobs, cancelSourceImportJob, pruneSourceImportJobs, } from "./agent.js";
+import { runSourceImportJob } from "./agent.js";
+/**
+ * One-shot foreground entrypoint used by the CLI and discovery UX.
+ * Delegates to the background-capable runner but waits for terminal
+ * status before returning. When the job parks on confirmation, the
+ * returned job has `status === "awaiting_confirmation"` and the caller
+ * is responsible for prompting + calling `confirmAndResumeSourceImportJob`.
+ */
+export async function importSourceAsWorkspace(input) {
+    const job = await runSourceImportJob(input);
+    return { job, result: job.result };
+}
+//# sourceMappingURL=index.js.map

package/dist/starter/source-import/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/starter/source-import/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,YAAY,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,iCAAiC,EACjC,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACrC,CAAC"}

package/dist/starter/source-import/materialize.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Source Import Agent — materializer.
+ *
+ * Executes a `SourceImportPlan`. Composes already-shipping primitives:
+ *
+ *   - `copyBundledKitSource`      (kits/service)
+ *   - `registerKitFork`           (kits/fork-registry)
+ *   - `writeKitForkPolicy`        (kits/fork-policy)
+ *   - `appendKitForkTraceEvent`   (kits/fork-trace)
+ *
+ * Plus two source-specific fetch surfaces:
+ *
+ *   - `cloneGithubRepo` + `narrowToSubdirectory` (github-source)
+ *   - `fetchSkillPayload`                        (skills-source)
+ *
+ * The materializer never runs a skill script, never executes an imported
+ * shell command, and never opens a network port. Its job is to place the
+ * fetched payload into the starter shell and write the canonical manifest,
+ * policy, and trace entries.
+ *
+ * Confirmation gating:
+ *   - If the plan has pending confirmations that the caller has not
+ *     acknowledged, the materializer throws and the agent parks the job.
+ *   - If the security report is `blocked`, the materializer refuses even
+ *     when the caller passes confirmations.
+ */
+import type { SourceImportPlan, SourceImportResult } from "./types.js";
+export interface MaterializeInput {
+    plan: SourceImportPlan;
+    /**
+     * Operator-supplied confirmations (by `targetPath`) for actions the plan
+     * flagged as needing confirmation.
+     */
+    confirmations?: string[];
+    /**
+     * Remote-sync mode seeded into policy. Defaults to "off".
+     */
+    remoteSyncMode?: "off" | "branch" | "pr";
+    /** Human label for the registered fork. */
+    label?: string;
+    /** Progress callback. */
+    onProgress?: (step: string) => void;
+    /**
+     * Optional subdirectory filter for github-repo sources. Mirrored into the
+     * manifest detail.
+     */
+    subdirectory?: string;
+    /** Optional explicit branch override for github-repo sources. */
+    branch?: string;
+}
+export declare class PendingConfirmationError extends Error {
+    readonly pending: string[];
+    constructor(pending: string[]);
+}
+/**
+ * Execute a `SourceImportPlan` end-to-end. Returns the final
+ * `SourceImportResult`. Throws `PendingConfirmationError` when the plan
+ * has unsatisfied confirmations.
+ */
+export declare function materializeImportPlan(input: MaterializeInput): Promise<SourceImportResult>;
+//# sourceMappingURL=materialize.d.ts.map

package/dist/starter/source-import/materialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/materialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAqBH,OAAO,KAAK,EAKV,gBAAgB,EAChB,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;OAEG;IACH,cAAc,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgGD,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACf,OAAO,EAAE,MAAM,EAAE;CAO9B;AAMD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAmK7B"}