@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/gate/verification-tail.ts

@@ -0,0 +1,52 @@
+import { status_icons } from '#scripts/lib/status-icons'
+import { gate_log } from './gate-log'
+
+// The end every josh verification check prints, in one place (joshuafolkken/kit#5162).
+//
+// **A run pipes a check into `tail` because the end is the answer.** Over 4,145 piped calls, 85% were a
+// `tail -N` and most of the rest a `grep` for `FAIL`, `error` or a `✓`/`✗` — the run wanted to know
+// whether the check passed and what to look at if it did not. `josh gate` already ended that way, while
+// `lint:related` printed no verdict at all and `test:related` printed one only on a failure, so the run
+// kept inventing the filter. Every check now ends with the same three parts, built here:
+//
+// 1. what failed and what to run next — nothing on a green run;
+// 2. where the whole output was kept (`gate-log.ts`), for a check that keeps one;
+// 3. the verdict, always the last line, for the reason `josh-verdict.ts` gives.
+
+const { FAIL_ICON, PASS_ICON } = status_icons
+
+// Where the whole output went: `path` is `undefined` when the write failed, which the notice says.
+interface KeptLog {
+	path: string | undefined
+}
+
+interface VerificationTail {
+	// The lines above the log notice, each ending in a newline; empty on a green run.
+	failures: string
+	// Absent where the console is the only copy of the output.
+	log?: KeptLog | undefined
+	verdict: string
+}
+
+// `✓ <command> passed` or `✗ <command> failed: <what failed>`.
+function format_verdict(command: string, failed: ReadonlyArray<string>): string {
+	if (failed.length === 0) return `${PASS_ICON} ${command} passed`
+
+	return `${FAIL_ICON} ${command} failed: ${failed.join(', ')}`
+}
+
+// One failure and the command that reproduces it, as `josh gate` names its failed checks.
+function format_rerun(label: string, command: string): string {
+	return `  ${FAIL_ICON} ${label} — re-run: ${command}`
+}
+
+function format_tail(tail: VerificationTail): string {
+	const notice = tail.log === undefined ? '' : gate_log.format_log_notice(tail.log.path)
+
+	return `${tail.failures}${notice}${tail.verdict}\n`
+}
+
+const verification_tail = { format_rerun, format_tail, format_verdict }
+
+export type { KeptLog, VerificationTail }
+export { verification_tail }

package/scripts/gh/gh-author-association.ts

@@ -1,14 +1,122 @@
-// Whose words kit acts on: the `author_association` REST reports with an issue or a comment, and the
-// ones that can write to the repository. On a public repository anyone can file an issue or comment,
-// so a body kit runs (`josh measure:rerun`) or copies into the ledger (`review:record`) is taken only
-// from an author with write access — and an unknown author is not a trusted one.
-const TRUSTED_ASSOCIATIONS: ReadonlySet<string> = new Set(['OWNER', 'MEMBER', 'COLLABORATOR'])
-const TRUSTED_LIST = [...TRUSTED_ASSOCIATIONS].join(' / ')
+import { git_gh_api_path } from '#scripts/gh/git-gh-api-path'
+import { git_gh_exec } from '#scripts/gh/git-gh-exec'
+import { author_fields_schema } from '#scripts/git/git-schemas'
+import { parse_json } from '#scripts/git/parse-json-array'
+import { z } from 'zod'
 
-function is_trusted(association: string | null | undefined): boolean {
-	return typeof association === 'string' && TRUSTED_ASSOCIATIONS.has(association)
+// Whose words kit acts on: the author of an issue or a comment who can write to the repository. On a
+// public repository anyone can file an issue or comment, so a body kit runs (`josh measure:rerun`) or
+// copies into the ledger (`review:record`) is taken only from an author with write access — and an
+// unknown author is not a trusted one.
+//
+// **`author_association` alone does not say "can write"** (joshuafolkken/kit#4037). `OWNER` does, so it
+// is trusted without a request. `MEMBER` is any member of the owning org, whatever their access to this
+// repository, and `COLLABORATOR` includes outside collaborators with read or triage access only — so
+// those two are asked of the collaborator-permission endpoint, once per login per process, and trusted
+// only on a write role. A lookup that fails is not trust.
+const OWNER = 'OWNER'
+const ASKED_ASSOCIATIONS: ReadonlySet<string> = new Set(['MEMBER', 'COLLABORATOR'])
+const WRITE_ROLES: ReadonlySet<string> = new Set(['admin', 'maintain', 'write'])
+// A GitHub user login, an Enterprise Managed User's `name_shortcode` included — it is placed in a REST
+// path, so anything else (a `[bot]` login, a slash) is refused before a request is made.
+const LOGIN_PATTERN = /^[\da-z](?:[\w-]*[\da-z])?$/iu
+const TRUSTED_LIST = 'OWNER, or MEMBER / COLLABORATOR with write access'
+// The REST fields that name who wrote an issue, asked beside its body by every reader that decides
+// whether to act on that body; `author_fields_schema` is the shape they parse to.
+const AUTHOR_FIELDS = 'author_association,user'
+
+const permission_schema = z.looseObject({
+	permission: z.string().nullish(),
+	role_name: z.string().nullish(),
+})
+
+// `timeout_ms` bounds the lookup for a caller inside a hook's own timeout (`issue-watch`).
+interface Author {
+	login: string | undefined
+	association: string | null | undefined
+	timeout_ms?: number | undefined
+}
+
+interface AuthorFields {
+	author_association?: string | null | undefined
+	user?: { login: string } | null | undefined
+}
+
+const answers = new Map<string, Promise<boolean | undefined>>()
+
+function permission_path(login: string): string {
+	return `${git_gh_api_path.repo_api_path()}/collaborators/${login}/permission`
+}
+
+// `role_name` names `maintain` exactly; `permission` folds it into `write`, so either answers.
+function has_write_role(raw: string): boolean {
+	const parsed = parse_json.parse_json_object_or_undefined(raw, permission_schema)
+	const roles = [parsed?.role_name, parsed?.permission]
+
+	return roles.some((role) => typeof role === 'string' && WRITE_ROLES.has(role))
+}
+
+// `undefined` for a lookup that failed, which is not an answer.
+async function ask_permission(login: string, timeout_ms?: number): Promise<boolean | undefined> {
+	try {
+		const raw = await git_gh_exec.exec_gh_api({ path: permission_path(login), timeout_ms })
+
+		return has_write_role(raw)
+	} catch {
+		return undefined
+	}
 }
 
-const gh_author_association = { TRUSTED_LIST, is_trusted }
+// A failed lookup is not remembered: the backlog driver keeps one process for hours, so one dropped
+// request would otherwise leave that author unanswered until it restarts. Only the caller's own
+// request is evicted, never a newer one another caller has stored since.
+async function can_write(login: string, timeout_ms?: number): Promise<boolean | undefined> {
+	const asked = answers.get(login) ?? ask_permission(login, timeout_ms)
+
+	answers.set(login, asked)
+
+	const has_write = await asked
+
+	if (has_write === undefined && answers.get(login) === asked) answers.delete(login)
+
+	return has_write
+}
+
+function is_user_login(login: string | undefined): login is string {
+	return login !== undefined && LOGIN_PATTERN.test(login)
+}
+
+function is_asked(author: Author): boolean {
+	return ASKED_ASSOCIATIONS.has(author.association ?? '') && is_user_login(author.login)
+}
+
+// `undefined` when the lookup failed: neither trusted nor refused, for a caller that must not settle a
+// permanent answer on it (`review-comment-round`).
+async function trust_of(author: Author): Promise<boolean | undefined> {
+	if (author.association === OWNER) return true
+	if (author.login === undefined || !is_asked(author)) return false
+
+	return await can_write(author.login, author.timeout_ms)
+}
+
+// A lookup that failed is not trust.
+async function is_trusted(author: Author): Promise<boolean> {
+	return (await trust_of(author)) === true
+}
+
+// The author of a row read with `AUTHOR_FIELDS`.
+function author_of(row: AuthorFields, timeout_ms?: number): Author {
+	return { login: row.user?.login, association: row.author_association, timeout_ms }
+}
+
+const gh_author_association = {
+	AUTHOR_FIELDS,
+	TRUSTED_LIST,
+	author_fields_schema,
+	author_of,
+	is_trusted,
+	trust_of,
+}
 
+export type { Author, AuthorFields }
 export { gh_author_association }

package/scripts/gh/git-ai-review-scan.ts

@@ -20,8 +20,10 @@ interface ClassifiedFindings {
 	infos: ReadonlyArray<ClassifiedFinding>
 }
 
-const CLAUDE_AUTHORS: ReadonlySet<string> = new Set(['claude', 'claude[bot]'])
-const CODERABBIT_AUTHORS: ReadonlySet<string> = new Set(['coderabbitai', 'coderabbitai[bot]'])
+// Only the app accounts (`type: Bot`): a bare `claude` / `coderabbitai` is an ordinary user login
+// anyone could register, and its comment is not an AI review.
+const CLAUDE_AUTHORS: ReadonlySet<string> = new Set(['claude[bot]'])
+const CODERABBIT_AUTHORS: ReadonlySet<string> = new Set(['coderabbitai[bot]'])
 
 const CLAUDE_BLOCKER_HEADINGS: ReadonlyArray<RegExp> = [
 	/^#{2,4}\s+Issues\b/mu,
@@ -147,5 +149,5 @@ function classify_ai_review_comments(comments: ReadonlyArray<ReviewComment>): Cl
 	}
 }
 
-export { classify_ai_review_comments }
+export { classify_ai_review_comments, is_coderabbit_author, is_coderabbit_rate_limit }
 export type { ReviewComment, ClassifiedFinding, ClassifiedFindings, FindingKind }

package/scripts/gh/git-gh-api-path.ts

@@ -28,6 +28,13 @@ function issue_api_path(issue_number: string, repo?: string): string {
 	return `${issues_api_path(repo)}/${issue_number}`
 }
 
+// One issue's labels — a pull request is an issue to this endpoint. Named here because the label
+// writes and reads in `git-gh-issue-write.ts` and the CI classification read in `pr-classification.ts`
+// all address it.
+function issue_labels_api_path(issue_number: string, repo?: string): string {
+	return `${issue_api_path(issue_number, repo)}/labels`
+}
+
 // The dependency relations, which REST serves from their own endpoint rather than inside the issue.
 // Named here because three call sites address it — the read in `git-gh-issue-read.ts` and both
 // writes in `git-gh-issue-write.ts`.
@@ -90,16 +97,30 @@ function commit_status_api_path(commit_sha: string, repo?: string): string {
 	return `${commit_api_path(commit_sha, repo)}/status`
 }
 
+// The rules that apply to one branch, from every ruleset that targets it — readable without the
+// admin access the classic branch protection endpoint needs.
+// Ref names are encoded as one segment: a `?` or `#` would otherwise end the path, and GitHub reads
+// an encoded `/` back as part of the branch name.
+function branch_rules_api_path(branch_name: string, repo?: string): string {
+	return `${repo_api_path(repo)}/rules/branches/${encodeURIComponent(branch_name)}`
+}
+
+// The status checks classic branch protection requires — the half of the required checks rulesets
+// do not carry.
+function branch_protection_checks_api_path(branch_name: string, repo?: string): string {
+	return `${repo_api_path(repo)}/branches/${encodeURIComponent(branch_name)}/protection/required_status_checks`
+}
+
 // A single tag reference. REST answers 404 when the tag does not exist, which is the whole of the
 // question the release command's tag watch asks.
 function tag_reference_api_path(tag: string, repo?: string): string {
-	return `${repo_api_path(repo)}/git/ref/tags/${tag}`
+	return `${repo_api_path(repo)}/git/ref/tags/${encodeURIComponent(tag)}`
 }
 
 // The GitHub Release published for one tag. REST answers 404 until `publish.yml`'s `create-release`
 // job has run, which is what the release command's progress watch asks.
 function release_by_tag_api_path(tag: string, repo?: string): string {
-	return `${repo_api_path(repo)}/releases/tags/${tag}`
+	return `${repo_api_path(repo)}/releases/tags/${encodeURIComponent(tag)}`
 }
 
 const git_gh_api_path = {
@@ -109,6 +130,7 @@ const git_gh_api_path = {
 	release_by_tag_api_path,
 	issues_api_path,
 	issue_api_path,
+	issue_labels_api_path,
 	blocked_by_api_path,
 	issue_comments_api_path,
 	pulls_api_path,
@@ -119,6 +141,8 @@ const git_gh_api_path = {
 	commit_api_path,
 	commit_check_runs_api_path,
 	commit_status_api_path,
+	branch_rules_api_path,
+	branch_protection_checks_api_path,
 }
 
 export { git_gh_api_path, FULL_PAGE_QUERY }

package/scripts/gh/git-gh-branch-rules.ts

@@ -0,0 +1,73 @@
+import { parse_json_array_or_undefined } from '#scripts/git/parse-json-array'
+import { z } from 'zod'
+import { FULL_PAGE_QUERY, git_gh_api_path } from './git-gh-api-path'
+import { git_gh_exec } from './git-gh-exec'
+
+// The status check contexts the base branch's rules require, which is what lets the merge gate tell
+// a pull request held only by a slow optional check — GitHub's default-setup `CodeQL` — from one
+// still waiting on a check that guards the merge (joshuafolkken/kit#4351).
+//
+// **An empty answer keeps the gate strict, so every gap folds into it.** With no required context
+// known, `git-pr-checks-eval.ts` waits for `CLEAN` exactly as it did before, so a repository with no
+// ruleset, a token the endpoint answers 403 to, or a rate limit costs the wait time it always did and
+// never a merge past a check nobody declared optional.
+
+const REQUIRED_STATUS_CHECKS_RULE = 'required_status_checks'
+
+const required_check_schema = z.looseObject({ context: z.string() })
+
+const rule_parameters_schema = z.looseObject({
+	required_status_checks: z.array(required_check_schema).optional(),
+})
+
+const branch_rule_schema = z.looseObject({
+	type: z.string(),
+	parameters: rule_parameters_schema.nullish(),
+})
+
+type BranchRule = z.infer<typeof branch_rule_schema>
+
+// A branch's rules do not change while one command waits on a pull request, so a read is remembered
+// for the life of the command; one that failed is not, and the next poll asks again.
+const required_contexts_by_branch = new Map<string, Array<string>>()
+
+function forget_branch_rules(): void {
+	required_contexts_by_branch.clear()
+}
+
+function to_required_contexts(rules: ReadonlyArray<BranchRule>): Array<string> {
+	return rules
+		.filter((rule) => rule.type === REQUIRED_STATUS_CHECKS_RULE)
+		.flatMap((rule) => rule.parameters?.required_status_checks ?? [])
+		.map((check) => check.context)
+}
+
+async function fetch_required_contexts(branch_name: string): Promise<Array<string> | undefined> {
+	const raw_json = await git_gh_exec.exec_gh_api({
+		path: `${git_gh_api_path.branch_rules_api_path(branch_name)}${FULL_PAGE_QUERY}`,
+		should_paginate: true,
+	})
+	const rules = parse_json_array_or_undefined(raw_json, branch_rule_schema)
+
+	return rules === undefined ? undefined : to_required_contexts(rules)
+}
+
+async function read_required_contexts(branch_name: string | undefined): Promise<Array<string>> {
+	if (branch_name === undefined) return []
+	const cached = required_contexts_by_branch.get(branch_name)
+	if (cached !== undefined) return cached
+
+	try {
+		const contexts = await fetch_required_contexts(branch_name)
+		if (contexts === undefined) return []
+		required_contexts_by_branch.set(branch_name, contexts)
+
+		return contexts
+	} catch {
+		return []
+	}
+}
+
+const git_gh_branch_rules = { read_required_contexts }
+
+export { git_gh_branch_rules, read_required_contexts, forget_branch_rules }

package/scripts/gh/git-gh-comments-unreadable.ts

@@ -0,0 +1,36 @@
+// A pull request comment listing that could not be read (joshuafolkken/kit#5012).
+//
+// The reader warns with gh's reason, never swallowing it. Only the AI review gate stops on the
+// unreadable listing — a CodeRabbit listing that could not be read is a note the followup carries
+// past — so the gate alone prints `UNREADABLE_COMMENTS_STOP` on the standard output, which `josh ship`
+// reads as the infrastructure and re-runs the followup on in place rather than relaunching the lane.
+// Its own module, so the ship's stop classification reads the note without loading the gate.
+
+const UNREADABLE_COMMENTS_STOP = 'the merge gate stopped on reviewer comments it could not read'
+
+// Set by `josh ship` around an attempt it will run again on an infrastructure stop
+// (`run-ship-infra-retry.ts`): the gate's `confirmation` then waits for the final attempt, so a read
+// that recovers sends none and one that never does sends one.
+const RETRY_PENDING_KEY = 'JOSH_SHIP_RETRY_PENDING'
+const RETRY_PENDING_VALUE = '1'
+
+function note_unreadable_comments(branch_name: string, reason: string): void {
+	console.warn(`⚠ pull request comments could not be read for ${branch_name}: ${reason}`)
+}
+
+function note_unreadable_stop(): void {
+	console.info(`⚠️ ${UNREADABLE_COMMENTS_STOP}`)
+}
+
+function is_retry_pending(): boolean {
+	return process.env[RETRY_PENDING_KEY] === RETRY_PENDING_VALUE
+}
+
+export {
+	is_retry_pending,
+	note_unreadable_comments,
+	note_unreadable_stop,
+	RETRY_PENDING_KEY,
+	RETRY_PENDING_VALUE,
+	UNREADABLE_COMMENTS_STOP,
+}

package/scripts/gh/git-gh-conditional.ts

@@ -19,7 +19,8 @@ const ETAG_HEADER = /^etag: *(?<etag>[^\r\n]+)/imu
 type ConditionalRead =
 	| { kind: 'unchanged' }
 	| { kind: 'changed'; etag: string | undefined; body: string }
-	| { kind: 'unreadable' }
+	// `cause` is gh's own failure where there was one, for a caller that reports it.
+	| { kind: 'unreadable'; cause?: unknown }
 
 const UNCHANGED: ConditionalRead = { kind: 'unchanged' }
 const UNREADABLE: ConditionalRead = { kind: 'unreadable' }
@@ -56,7 +57,9 @@ async function read_conditional(
 	try {
 		return to_read(await git_gh_exec.exec_gh_command(to_args(path, etag), timeout_ms))
 	} catch (error) {
-		return failure_status(error) === NOT_MODIFIED_STATUS ? UNCHANGED : UNREADABLE
+		return failure_status(error) === NOT_MODIFIED_STATUS
+			? UNCHANGED
+			: { kind: 'unreadable', cause: error }
 	}
 }
 

package/scripts/gh/git-gh-exec.ts

@@ -1,9 +1,11 @@
 import { has_timed_out } from '#scripts/git/git-execa-error'
 import { agent_session_environment } from '#scripts/josh/agent-session-environment'
 import { error_text } from '#scripts/lib/error-message'
+import { token_shape } from '#scripts/lib/token-shape'
 import { execa, execaSync } from 'execa'
 import { check_gh_installed } from './git-gh-check'
 import { gh_failure } from './git-gh-failure'
+import { gh_retry } from './git-gh-retry'
 
 const BODY_FROM_STDIN = '-'
 
@@ -258,6 +260,7 @@ const INPUT_FLAG = '--input'
 const PAGINATE_FLAG = '--paginate'
 const SLURP_FLAG = '--slurp'
 const JQ_FLAG = '--jq'
+const ALLOW_ESCAPES_FLAG = '--allow-escape-sequences'
 
 // One REST request through `gh api`. `path` is the only required field: a read names nothing else,
 // because `gh api` sends GET when neither `--method` nor a request body is given. **A `body` alone
@@ -292,16 +295,32 @@ interface GhApiRequest {
 	// The checkout gh runs in, which is what `{owner}/{repo}` in `path` resolves against. Absent means
 	// the process's own directory.
 	cwd?: string
+	// `false` for a write that must not be sent twice: a transient failure may follow a write that
+	// already landed, and nothing reads it back (`git-gh-retry.ts`). Absent means retried.
+	should_retry?: boolean
+	// `true` for a plain-text body that carries terminal colors, such as an Actions job log: gh refuses
+	// to print one off a terminal without `--allow-escape-sequences`.
+	should_allow_escapes?: boolean
 }
 
 function optional_flag(flag: string, value?: string): Array<string> {
 	return value === undefined ? [] : [flag, value]
 }
 
+// Every Issue and pull-request body kit writes travels through the two entries below, so a credential
+// pasted into one is refused here, once, before it reaches a public tracker. The writers pass the body
+// JSON-encoded, so it is scanned decoded.
+function refuse_credential_body(request: GhApiRequest): void {
+	if (request.body !== undefined) {
+		token_shape.refuse(token_shape.decoded(request.body), `The gh api ${request.path} body`)
+	}
+}
+
 function to_gh_api_args(request: GhApiRequest): Array<string> {
 	const body_args = request.body === undefined ? [] : [INPUT_FLAG, BODY_FROM_STDIN]
 	const paginate_args = request.should_paginate === true ? [PAGINATE_FLAG] : []
 	const slurp_args = request.should_slurp === true ? [SLURP_FLAG] : []
+	const escape_args = request.should_allow_escapes === true ? [ALLOW_ESCAPES_FLAG] : []
 
 	return [
 		'api',
@@ -310,6 +329,7 @@ function to_gh_api_args(request: GhApiRequest): Array<string> {
 		...body_args,
 		...paginate_args,
 		...slurp_args,
+		...escape_args,
 		...optional_flag(JQ_FLAG, request.jq_filter),
 	]
 }
@@ -320,8 +340,9 @@ function to_gh_api_args(request: GhApiRequest): Array<string> {
 // `read_gh_api_sync` below.
 //
 // Failure handling funnels through `to_gh_error` on both paths below, so a failed request throws
-// with gh's stderr summary *and* the JSON error body it wrote to stdout.
-async function exec_gh_api(request: GhApiRequest): Promise<string> {
+// with gh's stderr summary *and* the JSON error body it wrote to stdout. A transient failure — a 5xx
+// or no answer at all — is asked again a bounded number of times first (`git-gh-retry.ts`).
+async function send_gh_api(request: GhApiRequest): Promise<string> {
 	const args = to_gh_api_args(request)
 
 	if (request.body === undefined) {
@@ -336,6 +357,14 @@ async function exec_gh_api(request: GhApiRequest): Promise<string> {
 	})
 }
 
+async function exec_gh_api(request: GhApiRequest): Promise<string> {
+	refuse_credential_body(request)
+
+	if (request.should_retry === false) return await send_gh_api(request)
+
+	return await gh_retry.with_retry(async () => await send_gh_api(request))
+}
+
 // The synchronous twin of `exec_gh_api`, for a caller that cannot await. `josh propagate` runs each
 // consumer's steps as a sequential chain of `execaSync` spawns with inherited stdio, and that shape
 // reaches from `open_issue` up through `RunStep`, `run_target` and `run_targets` — so the issue it
@@ -357,6 +386,7 @@ async function exec_gh_api(request: GhApiRequest): Promise<string> {
 // the spawn's own failure and is reported like any other, which is what the direct spawn this
 // replaced already did.
 function exec_gh_api_sync(request: GhApiRequest): string {
+	refuse_credential_body(request)
 	const body_option = request.body === undefined ? {} : { input: request.body }
 	const options = { ...body_option, ...to_spawn_options(request.timeout_ms, request.cwd) }
 

package/scripts/gh/git-gh-issue-read.ts

@@ -1,4 +1,5 @@
 import type { IssueReference } from '#scripts/issue/issue-reference'
+import { gh_author_association } from './gh-author-association'
 import { git_gh_api_path } from './git-gh-api-path'
 import { git_gh_exec } from './git-gh-exec'
 import { gh_failure, type GhFailure } from './git-gh-failure'
@@ -281,7 +282,12 @@ async function issue_view_json(
 // `repo` reads a child in another repository. Cross-repository children are read this way rather
 // than from a local checkout: their state is a GitHub fact, and requiring a clone to learn it is
 // what kept the auto-close from ever running on such an epic.
-const STATE_AND_RELATIONS_FIELDS = 'number,state,labels,blockedBy'
+//
+// `body` rides along because `epic:next` holds a child until its declared start time
+// (joshuafolkken/kit#4007); the REST issue endpoint answers it in the same response, so it costs no
+// request. The author rides along for the same reason: `backlog:next` runs a child's body only when
+// its author has write access (joshuafolkken/kit#4633), and the same response already names them.
+const STATE_AND_RELATIONS_FIELDS = `number,state,labels,blockedBy,body,${gh_author_association.AUTHOR_FIELDS}`
 
 async function issue_get_state_and_relations(
 	issue_number: string,

package/scripts/gh/git-gh-issue-rest.ts

@@ -26,6 +26,7 @@ import { MERGED_STATE, to_gh_state } from './git-gh-rest-state'
 // readily as an issue, so it stays optional and tolerates an explicit null.
 const rest_issue_schema = z.looseObject({
 	number: z.number(),
+	body: z.string().nullish(),
 	issue_dependencies_summary: z.looseObject({ total_blocked_by: z.number().optional() }).nullish(),
 	// Present only on a pull request, which this endpoint serves as readily as an issue.
 	pull_request: z.looseObject({ merged_at: z.string().nullish() }).nullish(),