@nanonets/graft 0.12.1 → 0.15.0

package/dist/ai/synthesize.js

@@ -1,3 +1,4 @@
+import { recoverToolArgsFromContent, warnToolChoiceIgnored } from "./llm/recover-tool.js";
 const SYSTEM_PROMPT = `You build an ARCHITECTURE graph of a codebase from per-file summaries. The reader is an AI agent that will read this graph before working on the code, so it must describe the system at the level a senior engineer would explain it — not file by file.
 
 Produce a CURATED set of nodes of mixed granularity:
@@ -107,11 +108,24 @@ export class ChatSynthesizer {
                 { role: "user", content: userContent(files) },
             ],
         });
-        const call = res.toolCalls[0];
-        if (!call)
-            return [];
-        // `args` is already a parsed object — no JSON.parse.
-        return clean(call.args?.nodes);
+        return clean(nodesFromResponse(res)?.nodes);
+    }
+}
+/**
+ * Prefer a real tool call; if the gateway ignored `tool_choice` (#129), recover
+ * the same payload from `content`. Recovered args still go through {@link clean}.
+ */
+function nodesFromResponse(res) {
+    const call = res.toolCalls.find((c) => c.name === RECORD_TOOL) ?? res.toolCalls[0];
+    if (call?.args && typeof call.args === "object" && !Array.isArray(call.args)) {
+        return call.args;
     }
+    const recovered = recoverToolArgsFromContent(res.text, {
+        toolNames: [RECORD_TOOL, "emit_json"],
+        payloadKey: "nodes",
+    });
+    if (!recovered)
+        warnToolChoiceIgnored("synthesize", res.text?.trim() ? "unparsed" : "empty");
+    return recovered;
 }
 //# sourceMappingURL=synthesize.js.map

package/dist/ai/synthesize.js.map

@@ -1 +1 @@
-{"version":3,"file":"synthesize.js","sourceRoot":"","sources":["../../src/ai/synthesize.ts"],"names":[],"mappings":"AAsCA,MAAM,aAAa,GAAG;;;;;;;;;;;;;;sDAcgC,CAAC;AAEvD,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACrD,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACtB,QAAQ,EAAE;oCACR,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC;iCAC7F;gCACD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;6BAChC;4BACD,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;yBAC7B;qBACF;iBACF;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC;aACjD;SACF;KACF;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;CACX,CAAC;AAEX,iFAAiF;AACjF,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,SAAS,WAAW,CAAC,KAAoB;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,MAAM,GAAG,eAAe;QAClC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,iBAAiB;QACpD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAuC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QAC7E,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YACvD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACnH,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC3B,CAAC,CAAE,CAAC,CAAC,KAAwC;qBACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;qBAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACX,EAAE,EAAE,CAAC,CAAC,EAAY;oBAClB,QAAQ,EAAE,CAAC,CAAC,QAAkB;oBAC9B,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;iBAC3E,CAAC,CAAC;gBACP,CAAC,CAAC,EAAE;SACP,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG,cAAc,CAAC;AAEnC,2EAA2E;AAC3E,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,KAAgB;QAAhB,UAAK,GAAL,KAAK,CAAW;IAAG,CAAC;IAExC,KAAK,CAAC,UAAU,CAAC,KAAoB;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,IAAI;YACf,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,8DAA8D;oBAC3E,UAAU,EAAE,YAAkD;iBAC/D;aACF;YACD,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;YACnD,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;gBAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;aAC9C;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,qDAAqD;QACrD,OAAO,KAAK,CAAE,IAAI,CAAC,IAA4B,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;CACF"}
+{"version":3,"file":"synthesize.js","sourceRoot":"","sources":["../../src/ai/synthesize.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AA8B1F,MAAM,aAAa,GAAG;;;;;;;;;;;;;;sDAcgC,CAAC;AAEvD,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACrD,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACtB,QAAQ,EAAE;oCACR,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC;iCAC7F;gCACD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;6BAChC;4BACD,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;yBAC7B;qBACF;iBACF;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC;aACjD;SACF;KACF;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;CACX,CAAC;AAEX,iFAAiF;AACjF,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,SAAS,WAAW,CAAC,KAAoB;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,MAAM,GAAG,eAAe;QAClC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,iBAAiB;QACpD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAuC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QAC7E,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YACvD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACnH,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC3B,CAAC,CAAE,CAAC,CAAC,KAAwC;qBACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;qBAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACX,EAAE,EAAE,CAAC,CAAC,EAAY;oBAClB,QAAQ,EAAE,CAAC,CAAC,QAAkB;oBAC9B,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;iBAC3E,CAAC,CAAC;gBACP,CAAC,CAAC,EAAE;SACP,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG,cAAc,CAAC;AAEnC,2EAA2E;AAC3E,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,KAAgB;QAAhB,UAAK,GAAL,KAAK,CAAW;IAAG,CAAC;IAExC,KAAK,CAAC,UAAU,CAAC,KAAoB;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,IAAI;YACf,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,8DAA8D;oBAC3E,UAAU,EAAE,YAAkD;iBAC/D;aACF;YACD,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;YACnD,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE;gBAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;aAC9C;SACF,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,GAAmE;IAG5F,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,IAAI,EAAE,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,IAA2B,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,IAAI,EAAE;QACrD,SAAS,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;QACrC,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS;QAAE,qBAAqB,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7F,OAAO,SAA4C,CAAC;AACtD,CAAC"}

package/dist/app/checkout.d.ts

@@ -0,0 +1,28 @@
+export interface CheckoutRequest {
+    owner: string;
+    repo: string;
+    number: number;
+    baseRef: string;
+    token: string;
+    api?: string;
+}
+export interface Checkout {
+    /** Working tree at the pull request's merge commit. */
+    dir: string;
+    /** What `blast --base` should diff against. */
+    base: string;
+    /** Removes the tree. Always call it — the token's clone is not something to
+     * leave in /tmp. */
+    cleanup: () => void;
+}
+/**
+ * Fetch the PR's merge ref and its base, shallow.
+ *
+ * `refs/pull/N/merge` is GitHub's own merge of the PR into its base — the same
+ * thing the checks see, and the right thing to review: it is what will land, not
+ * what the contributor's branch says in isolation.
+ */
+export declare function checkoutPullRequest(req: CheckoutRequest): Checkout;
+/** Never let a token reach a log line, even inside git's own error text. */
+export declare function redact(text: string, token: string): string;
+//# sourceMappingURL=checkout.d.ts.map

package/dist/app/checkout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout.d.ts","sourceRoot":"","sources":["../../src/app/checkout.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb;wBACoB;IACpB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAkCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,QAAQ,CAoClE;AAED,4EAA4E;AAC5E,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI1D"}

package/dist/app/checkout.js

@@ -0,0 +1,100 @@
+/**
+ * Getting a pull request's code onto disk without running any of it.
+ *
+ * On a fork PR every byte here was written by a stranger, and this service holds
+ * an installation token for the base repository. So the rules are absolute:
+ *
+ *  - **Nothing is executed.** No `npm install`, no build, no hooks. The graph is
+ *    produced by tree-sitter reading source text, which runs none of it.
+ *  - **Git is told not to run things either.** A repository can carry hooks, and
+ *    `core.hooksPath` is a per-repo config a clone would otherwise honour; both
+ *    are disabled explicitly rather than assumed absent.
+ *  - **The token never lands in the repo.** It is passed per-invocation through
+ *    an http header config, not baked into a remote URL that `git remote -v`,
+ *    the reflog and any submodule would carry.
+ *  - **Bounded.** A hostile or merely enormous repository must not hold a worker
+ *    forever: every git call has a timeout, and the fetch is shallow.
+ */
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** Enough history for a merge base against the pull request's base branch. */
+const FETCH_DEPTH = 50;
+const GIT_TIMEOUT_MS = 120_000;
+/** A git invocation with the dangerous parts of the environment removed. */
+function git(dir, args, token) {
+    const auth = token
+        ? [
+            "-c",
+            // Basic auth with the token as the password, per GitHub's own guidance for
+            // installation tokens. Passed as an argument to THIS call so it is never
+            // written into .git/config.
+            `http.extraheader=Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`,
+        ]
+        : [];
+    const res = spawnSync("git", ["-c", "core.hooksPath=/dev/null", "-c", "protocol.version=2", ...auth, ...args], {
+        cwd: dir,
+        encoding: "utf8",
+        timeout: GIT_TIMEOUT_MS,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: {
+            ...process.env,
+            // No credential prompts, no system config, no repo-supplied helpers.
+            GIT_TERMINAL_PROMPT: "0",
+            GIT_CONFIG_NOSYSTEM: "1",
+            GIT_ASKPASS: "",
+            HOME: dir,
+        },
+    });
+    return { ok: res.status === 0, err: `${res.stderr ?? ""}${res.error ? ` ${res.error.message}` : ""}`.trim() };
+}
+/**
+ * Fetch the PR's merge ref and its base, shallow.
+ *
+ * `refs/pull/N/merge` is GitHub's own merge of the PR into its base — the same
+ * thing the checks see, and the right thing to review: it is what will land, not
+ * what the contributor's branch says in isolation.
+ */
+export function checkoutPullRequest(req) {
+    const host = (req.api ?? "https://github.com").replace(/\/$/, "");
+    const dir = mkdtempSync(join(tmpdir(), `graft-app-${req.owner}-${req.repo}-`));
+    const cleanup = () => rmSync(dir, { recursive: true, force: true });
+    const steps = [
+        ["init", ["init", "--quiet", "-b", "__graft_base"]],
+        ["remote", ["remote", "add", "origin", `${host}/${req.owner}/${req.repo}.git`]],
+        // Both refs in one fetch: the merge ref to review, the base to diff against.
+        [
+            "fetch",
+            [
+                "fetch",
+                "--quiet",
+                `--depth=${FETCH_DEPTH}`,
+                "--no-recurse-submodules",
+                "origin",
+                `+refs/pull/${req.number}/merge:refs/graft/merge`,
+                `+refs/heads/${req.baseRef}:refs/graft/base`,
+            ],
+        ],
+        ["checkout", ["checkout", "--quiet", "--detach", "refs/graft/merge"]],
+    ];
+    for (const [name, args] of steps) {
+        const { ok, err } = git(dir, args, name === "fetch" ? req.token : undefined);
+        if (!ok) {
+            cleanup();
+            // A merge ref is absent while GitHub is still computing mergeability, and
+            // present-but-stale right after a push — worth saying which step failed so
+            // that case is distinguishable from a permissions problem.
+            throw new Error(`checkout ${req.owner}/${req.repo}#${req.number} failed at ${name}: ${redact(err, req.token)}`);
+        }
+    }
+    return { dir, base: "refs/graft/base", cleanup };
+}
+/** Never let a token reach a log line, even inside git's own error text. */
+export function redact(text, token) {
+    if (!token)
+        return text;
+    const encoded = Buffer.from(`x-access-token:${token}`).toString("base64");
+    return text.split(token).join("[token]").split(encoded).join("[token]");
+}
+//# sourceMappingURL=checkout.js.map

package/dist/app/checkout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout.js","sourceRoot":"","sources":["../../src/app/checkout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,8EAA8E;AAC9E,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,cAAc,GAAG,OAAO,CAAC;AAqB/B,4EAA4E;AAC5E,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,KAAc;IACtD,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC;YACE,IAAI;YACJ,2EAA2E;YAC3E,yEAAyE;YACzE,4BAA4B;YAC5B,yCAAyC,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SACrG;QACH,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,SAAS,CACnB,KAAK,EACL,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAChF;QACE,GAAG,EAAE,GAAG;QACR,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,cAAc;QACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,qEAAqE;YACrE,mBAAmB,EAAE,GAAG;YACxB,mBAAmB,EAAE,GAAG;YACxB,WAAW,EAAE,EAAE;YACf,IAAI,EAAE,GAAG;SACV;KACF,CACF,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1E,MAAM,KAAK,GAA8B;QACvC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACnD,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC;QAC/E,6EAA6E;QAC7E;YACE,OAAO;YACP;gBACE,OAAO;gBACP,SAAS;gBACT,WAAW,WAAW,EAAE;gBACxB,yBAAyB;gBACzB,QAAQ;gBACR,cAAc,GAAG,CAAC,MAAM,yBAAyB;gBACjD,eAAe,GAAG,CAAC,OAAO,kBAAkB;aAC7C;SACF;QACD,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;KACtE,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,0EAA0E;YAC1E,2EAA2E;YAC3E,2DAA2D;YAC3D,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,cAAc,IAAI,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAa;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC1E,CAAC"}

package/dist/app/events.d.ts

@@ -0,0 +1,37 @@
+/**
+ * What arrived, and whether it is worth work.
+ *
+ * A busy installation delivers a lot of noise — labels, assignments, reviews —
+ * and every accepted delivery costs a clone and a parse. Narrowing happens here,
+ * once, so the queue only ever holds jobs that will produce a comment.
+ */
+/** The subset of a `pull_request` delivery this App reads. */
+export interface ReviewJob {
+    installationId: number;
+    owner: string;
+    repo: string;
+    /** Base repository's full name, which is where the comment goes — a fork PR
+     * carries a different head repo, and posting there would be posting on the
+     * contributor's copy. */
+    number: number;
+    baseRef: string;
+    headSha: string;
+    /** True when the head branch lives in a fork: the PR's code is not ours. */
+    fromFork: boolean;
+}
+/**
+ * A delivery to act on, or null with the reason it was skipped.
+ *
+ * Draft pull requests are skipped deliberately: a draft is a work in progress and
+ * a bot commenting on every push to one is the fastest way to be uninstalled.
+ * `ready_for_review` is in the accepted set so the comment appears the moment the
+ * author asks for eyes.
+ */
+export declare function reviewJobFor(event: string, payload: unknown): {
+    job: ReviewJob;
+} | {
+    skip: string;
+};
+/** Collapse queued work per pull request: only the newest push is worth reviewing. */
+export declare const jobKey: (j: ReviewJob) => string;
+//# sourceMappingURL=events.d.ts.map

package/dist/app/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/app/events.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8DAA8D;AAC9D,MAAM,WAAW,SAAS;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;6BAEyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG;IAAE,GAAG,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAqCnG;AAED,sFAAsF;AACtF,eAAO,MAAM,MAAM,GAAI,GAAG,SAAS,KAAG,MAA4C,CAAC"}

package/dist/app/events.js

@@ -0,0 +1,59 @@
+/**
+ * What arrived, and whether it is worth work.
+ *
+ * A busy installation delivers a lot of noise — labels, assignments, reviews —
+ * and every accepted delivery costs a clone and a parse. Narrowing happens here,
+ * once, so the queue only ever holds jobs that will produce a comment.
+ */
+/** Actions that change the diff. `edited` (a retitled PR) and `labeled` do not. */
+const ACTIONS = new Set(["opened", "synchronize", "reopened", "ready_for_review"]);
+/**
+ * A delivery to act on, or null with the reason it was skipped.
+ *
+ * Draft pull requests are skipped deliberately: a draft is a work in progress and
+ * a bot commenting on every push to one is the fastest way to be uninstalled.
+ * `ready_for_review` is in the accepted set so the comment appears the moment the
+ * author asks for eyes.
+ */
+export function reviewJobFor(event, payload) {
+    if (event === "ping")
+        return { skip: "ping" };
+    if (event !== "pull_request")
+        return { skip: `event ${event}` };
+    const p = payload;
+    const action = p.action ?? "";
+    if (!ACTIONS.has(action))
+        return { skip: `action ${action}` };
+    const pr = p.pull_request;
+    const installationId = p.installation?.id;
+    const owner = p.repository?.owner?.login;
+    const repo = p.repository?.name;
+    const number = pr?.number ?? p.number;
+    const baseRef = pr?.base?.ref;
+    const headSha = pr?.head?.sha;
+    if (!installationId || !owner || !repo || !number || !baseRef || !headSha) {
+        return { skip: "payload missing installation, repository or pull request fields" };
+    }
+    if (pr?.draft === true && action !== "ready_for_review")
+        return { skip: "draft" };
+    if (pr?.state === "closed")
+        return { skip: "closed" };
+    const base = pr?.base?.repo?.full_name;
+    const head = pr?.head?.repo?.full_name;
+    return {
+        job: {
+            installationId,
+            owner,
+            repo,
+            number,
+            baseRef,
+            headSha,
+            // A missing head repo means a deleted fork — treat it as one, since it is
+            // certainly not ours.
+            fromFork: head !== base,
+        },
+    };
+}
+/** Collapse queued work per pull request: only the newest push is worth reviewing. */
+export const jobKey = (j) => `${j.owner}/${j.repo}#${j.number}`;
+//# sourceMappingURL=events.js.map

package/dist/app/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/app/events.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA+BH,mFAAmF;AACnF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,OAAgB;IAC1D,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9C,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,EAAE,EAAE,CAAC;IAEhE,MAAM,CAAC,GAAG,OAAyB,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;IAE9D,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1B,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,EAAE,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC;IAC9B,MAAM,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC;IAE9B,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1E,OAAO,EAAE,IAAI,EAAE,iEAAiE,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,EAAE,EAAE,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClF,IAAI,EAAE,EAAE,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;IACvC,OAAO;QACL,GAAG,EAAE;YACH,cAAc;YACd,KAAK;YACL,IAAI;YACJ,MAAM;YACN,OAAO;YACP,OAAO;YACP,0EAA0E;YAC1E,sBAAsB;YACtB,QAAQ,EAAE,IAAI,KAAK,IAAI;SACxB;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/app/identity.d.ts

@@ -0,0 +1,54 @@
+export interface AppCredentials {
+    appId: string;
+    /** PEM, as GitHub hands it over. */
+    privateKey: string;
+}
+/**
+ * A signed App JWT.
+ *
+ * `iat` is backdated a minute: GitHub compares against ITS clock, and a server
+ * running even slightly fast has its tokens rejected as "issued in the future" —
+ * a failure that looks like a bad key and is not.
+ */
+export declare function appJwt(creds: AppCredentials, nowMs: number): string;
+export interface TokenResponse {
+    token: string;
+    expires_at: string;
+}
+/** Minimal shape of `fetch`, so tests need no network and no mocking library. */
+export type Fetch = (url: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text: () => Promise<string>;
+}>;
+/**
+ * Installation tokens, fetched once and reused until they are nearly expired.
+ *
+ * Tokens last an hour and a busy repository can fire a dozen webhooks a minute;
+ * without the cache every one of them spends a round trip and a signature.
+ */
+export declare class InstallationTokens {
+    private readonly creds;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly api;
+    private readonly cache;
+    constructor(creds: AppCredentials, fetchImpl: Fetch, now?: () => number, api?: string);
+    get(installationId: number): Promise<string>;
+    /** Drop a token GitHub has rejected, so the next call fetches a fresh one. */
+    invalidate(installationId: number): void;
+}
+/**
+ * Is this delivery really from GitHub?
+ *
+ * The webhook endpoint is public, and everything downstream — cloning a repo,
+ * posting as the App — happens on its say-so. Compared in constant time because
+ * a byte-at-a-time comparison leaks the expected digest to anyone willing to
+ * measure, and forging a signature is a total compromise of the endpoint.
+ */
+export declare function verifySignature(secret: string, body: string, header: string | undefined): boolean;
+//# sourceMappingURL=identity.d.ts.map

package/dist/app/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/app/identity.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC;IACxH,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC,CAAC;AAOH;;;;;GAKG;AACH,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;gBAGpC,KAAK,EAAE,cAAc,EACrB,SAAS,EAAE,KAAK,EAChB,GAAG,GAAE,MAAM,MAAiB,EAC5B,GAAG,SAA2B;IAG3C,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBlD,8EAA8E;IAC9E,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;CAGzC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMjG"}

package/dist/app/identity.js

@@ -0,0 +1,96 @@
+/**
+ * Who the App is, to GitHub.
+ *
+ * A GitHub App authenticates twice over: it signs a short JWT with its private
+ * key to prove it is the App, then trades that for an *installation* token scoped
+ * to one repository owner. The installation token is what matters here — it is
+ * the reason this exists at all. A workflow on a fork's pull request gets a
+ * read-only token and cannot comment; an App's installation token belongs to the
+ * base repository, so a fork PR is no different from any other.
+ *
+ * `node:crypto` signs the JWT, so there is no dependency to audit for something
+ * that handles a private key.
+ */
+import { createHmac, createSign, timingSafeEqual } from "node:crypto";
+/** GitHub rejects a JWT older than 60s or more than 10 minutes in the future. */
+const JWT_TTL_S = 540; // 9 minutes, inside the limit with room for clock skew
+/** Renew this long before expiry rather than racing it. */
+const RENEW_MARGIN_MS = 60_000;
+const b64url = (b) => Buffer.from(b).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+/**
+ * A signed App JWT.
+ *
+ * `iat` is backdated a minute: GitHub compares against ITS clock, and a server
+ * running even slightly fast has its tokens rejected as "issued in the future" —
+ * a failure that looks like a bad key and is not.
+ */
+export function appJwt(creds, nowMs) {
+    const iat = Math.floor(nowMs / 1000) - 60;
+    const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+    const payload = b64url(JSON.stringify({ iat, exp: iat + JWT_TTL_S, iss: creds.appId }));
+    const signer = createSign("RSA-SHA256");
+    signer.update(`${header}.${payload}`);
+    return `${header}.${payload}.${b64url(signer.sign(creds.privateKey))}`;
+}
+/**
+ * Installation tokens, fetched once and reused until they are nearly expired.
+ *
+ * Tokens last an hour and a busy repository can fire a dozen webhooks a minute;
+ * without the cache every one of them spends a round trip and a signature.
+ */
+export class InstallationTokens {
+    creds;
+    fetchImpl;
+    now;
+    api;
+    cache = new Map();
+    constructor(creds, fetchImpl, now = Date.now, api = "https://api.github.com") {
+        this.creds = creds;
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+        this.api = api;
+    }
+    async get(installationId) {
+        const hit = this.cache.get(installationId);
+        if (hit && hit.expiresMs - RENEW_MARGIN_MS > this.now())
+            return hit.token;
+        const res = await this.fetchImpl(`${this.api}/app/installations/${installationId}/access_tokens`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${appJwt(this.creds, this.now())}`,
+                accept: "application/vnd.github+json",
+                "user-agent": "graft-app",
+            },
+        });
+        const body = await res.text();
+        if (!res.ok) {
+            // The body carries GitHub's reason ("integration not found", a key that does
+            // not match the app id); losing it turns every setup mistake into "401".
+            throw new Error(`installation token for ${installationId} failed: ${res.status} ${body.slice(0, 200)}`);
+        }
+        const parsed = JSON.parse(body);
+        this.cache.set(installationId, { token: parsed.token, expiresMs: Date.parse(parsed.expires_at) });
+        return parsed.token;
+    }
+    /** Drop a token GitHub has rejected, so the next call fetches a fresh one. */
+    invalidate(installationId) {
+        this.cache.delete(installationId);
+    }
+}
+/**
+ * Is this delivery really from GitHub?
+ *
+ * The webhook endpoint is public, and everything downstream — cloning a repo,
+ * posting as the App — happens on its say-so. Compared in constant time because
+ * a byte-at-a-time comparison leaks the expected digest to anyone willing to
+ * measure, and forging a signature is a total compromise of the endpoint.
+ */
+export function verifySignature(secret, body, header) {
+    if (!header)
+        return false;
+    const expected = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;
+    const a = Buffer.from(expected);
+    const b = Buffer.from(header);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=identity.js.map

package/dist/app/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/app/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,iFAAiF;AACjF,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,uDAAuD;AAC9E,2DAA2D;AAC3D,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAU,EAAE,CAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAQ9F;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,KAAqB,EAAE,KAAa;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAIV;IACA;IACA;IACA;IANF,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,YACmB,KAAqB,EACrB,SAAgB,EAChB,MAAoB,IAAI,CAAC,GAAG,EAC5B,MAAM,wBAAwB;QAH9B,UAAK,GAAL,KAAK,CAAgB;QACrB,cAAS,GAAT,SAAS,CAAO;QAChB,QAAG,GAAH,GAAG,CAAyB;QAC5B,QAAG,GAAH,GAAG,CAA2B;IAC9C,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,cAAsB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAE1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,sBAAsB,cAAc,gBAAgB,EAAE;YAChG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE;gBACzD,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,WAAW;aAC1B;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6EAA6E;YAC7E,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,0BAA0B,cAAc,YAAY,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,UAAU,CAAC,cAAsB;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,MAA0B;IACtF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,QAAQ,GAAG,UAAU,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/app/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/app/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/app/main.ts"],"names":[],"mappings":""}

package/dist/app/main.js

@@ -0,0 +1,56 @@
+/**
+ * Entry point: read the environment, refuse to start half-configured, listen.
+ *
+ * Every misconfiguration is fatal at boot rather than at the first webhook. A
+ * server that starts without a webhook secret looks healthy and silently rejects
+ * every delivery; one that starts without a private key looks healthy and fails
+ * every review. Both are worth a loud death on line one.
+ */
+import { createApp } from "./server.js";
+function required(name) {
+    const value = process.env[name];
+    if (!value) {
+        console.error(`✗ ${name} is required`);
+        process.exit(1);
+    }
+    return value;
+}
+/**
+ * GitHub hands the private key over as a PEM file. Env vars cannot hold newlines
+ * comfortably, so both spellings are accepted: the raw PEM, or one with `\n`
+ * escaped — the shape you get from pasting a key into a hosting provider's UI.
+ */
+function privateKey() {
+    const raw = required("GRAFT_APP_PRIVATE_KEY");
+    const pem = raw.includes("\\n") ? raw.replace(/\\n/g, "\n") : raw;
+    if (!pem.includes("BEGIN") || !pem.includes("PRIVATE KEY")) {
+        console.error("✗ GRAFT_APP_PRIVATE_KEY does not look like a PEM private key");
+        process.exit(1);
+    }
+    return pem;
+}
+const port = Number(process.env.PORT ?? 3000);
+const { server, queue } = createApp({
+    appId: required("GRAFT_APP_ID"),
+    privateKey: privateKey(),
+    webhookSecret: required("GRAFT_WEBHOOK_SECRET"),
+    publicUrl: required("GRAFT_PUBLIC_URL"),
+    port,
+    concurrency: Number(process.env.GRAFT_CONCURRENCY ?? 2),
+});
+/**
+ * Finish what is in flight before dying.
+ *
+ * A container gets a TERM and a grace period on every deploy. Dropping a review
+ * mid-clone leaves a stale comment on a pull request and no retry, because the
+ * delivery was acknowledged long ago.
+ */
+for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.on(signal, () => {
+        console.log(`${signal}: draining ${queue.size} job(s)`);
+        server.close();
+        void queue.drain().then(() => process.exit(0));
+        setTimeout(() => process.exit(1), 25_000).unref();
+    });
+}
+//# sourceMappingURL=main.js.map

package/dist/app/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/app/main.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC9C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAClC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC;IAC/B,UAAU,EAAE,UAAU,EAAE;IACxB,aAAa,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IAC/C,SAAS,EAAE,QAAQ,CAAC,kBAAkB,CAAC;IACvC,IAAI;IACJ,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC;CACxD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/app/pages.d.ts

@@ -0,0 +1,39 @@
+export interface StoredPage {
+    html: string;
+    storedMs: number;
+}
+export interface PageStoreOptions {
+    secret: string;
+    ttlMs?: number;
+    maxPages?: number;
+    now?: () => number;
+}
+export declare class PageStore {
+    private readonly pages;
+    private readonly secret;
+    private readonly ttlMs;
+    private readonly maxPages;
+    private readonly now;
+    constructor(opts: PageStoreOptions);
+    /** `owner/repo#number` → a path segment safe to put in a URL. */
+    static idFor(owner: string, repo: string, number: number): string;
+    /** Store (replacing any previous page for the same PR) and return `id` + `token`. */
+    put(owner: string, repo: string, number: number, html: string): {
+        id: string;
+        token: string;
+    };
+    /**
+     * The page, if the token is valid and it has not expired.
+     *
+     * Expiry is checked against the STORED time rather than encoded in the token,
+     * so a link cannot outlive the data it points at — and re-reviewing a PR
+     * refreshes both together.
+     */
+    get(id: string, token: string | undefined): string | null;
+    get size(): number;
+    private sign;
+    private valid;
+    /** Oldest out first, plus anything past its TTL. */
+    private evict;
+}
+//# sourceMappingURL=pages.d.ts.map

package/dist/app/pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/app/pages.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,gBAAgB;IAOlC,iEAAiE;IACjE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAIjE,qFAAqF;IACrF,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAO7F;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAUzD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,KAAK;IAQb,oDAAoD;IACpD,OAAO,CAAC,KAAK;CASd"}