@nanonets/graft 0.13.0 → 0.16.0

package/dist/app/events.d.ts

@@ -0,0 +1,37 @@
+/**
+ * What arrived, and whether it is worth work.
+ *
+ * A busy installation delivers a lot of noise — labels, assignments, reviews —
+ * and every accepted delivery costs a clone and a parse. Narrowing happens here,
+ * once, so the queue only ever holds jobs that will produce a comment.
+ */
+/** The subset of a `pull_request` delivery this App reads. */
+export interface ReviewJob {
+    installationId: number;
+    owner: string;
+    repo: string;
+    /** Base repository's full name, which is where the comment goes — a fork PR
+     * carries a different head repo, and posting there would be posting on the
+     * contributor's copy. */
+    number: number;
+    baseRef: string;
+    headSha: string;
+    /** True when the head branch lives in a fork: the PR's code is not ours. */
+    fromFork: boolean;
+}
+/**
+ * A delivery to act on, or null with the reason it was skipped.
+ *
+ * Draft pull requests are skipped deliberately: a draft is a work in progress and
+ * a bot commenting on every push to one is the fastest way to be uninstalled.
+ * `ready_for_review` is in the accepted set so the comment appears the moment the
+ * author asks for eyes.
+ */
+export declare function reviewJobFor(event: string, payload: unknown): {
+    job: ReviewJob;
+} | {
+    skip: string;
+};
+/** Collapse queued work per pull request: only the newest push is worth reviewing. */
+export declare const jobKey: (j: ReviewJob) => string;
+//# sourceMappingURL=events.d.ts.map

package/dist/app/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/app/events.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8DAA8D;AAC9D,MAAM,WAAW,SAAS;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;6BAEyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG;IAAE,GAAG,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAqCnG;AAED,sFAAsF;AACtF,eAAO,MAAM,MAAM,GAAI,GAAG,SAAS,KAAG,MAA4C,CAAC"}

package/dist/app/events.js

@@ -0,0 +1,59 @@
+/**
+ * What arrived, and whether it is worth work.
+ *
+ * A busy installation delivers a lot of noise — labels, assignments, reviews —
+ * and every accepted delivery costs a clone and a parse. Narrowing happens here,
+ * once, so the queue only ever holds jobs that will produce a comment.
+ */
+/** Actions that change the diff. `edited` (a retitled PR) and `labeled` do not. */
+const ACTIONS = new Set(["opened", "synchronize", "reopened", "ready_for_review"]);
+/**
+ * A delivery to act on, or null with the reason it was skipped.
+ *
+ * Draft pull requests are skipped deliberately: a draft is a work in progress and
+ * a bot commenting on every push to one is the fastest way to be uninstalled.
+ * `ready_for_review` is in the accepted set so the comment appears the moment the
+ * author asks for eyes.
+ */
+export function reviewJobFor(event, payload) {
+    if (event === "ping")
+        return { skip: "ping" };
+    if (event !== "pull_request")
+        return { skip: `event ${event}` };
+    const p = payload;
+    const action = p.action ?? "";
+    if (!ACTIONS.has(action))
+        return { skip: `action ${action}` };
+    const pr = p.pull_request;
+    const installationId = p.installation?.id;
+    const owner = p.repository?.owner?.login;
+    const repo = p.repository?.name;
+    const number = pr?.number ?? p.number;
+    const baseRef = pr?.base?.ref;
+    const headSha = pr?.head?.sha;
+    if (!installationId || !owner || !repo || !number || !baseRef || !headSha) {
+        return { skip: "payload missing installation, repository or pull request fields" };
+    }
+    if (pr?.draft === true && action !== "ready_for_review")
+        return { skip: "draft" };
+    if (pr?.state === "closed")
+        return { skip: "closed" };
+    const base = pr?.base?.repo?.full_name;
+    const head = pr?.head?.repo?.full_name;
+    return {
+        job: {
+            installationId,
+            owner,
+            repo,
+            number,
+            baseRef,
+            headSha,
+            // A missing head repo means a deleted fork — treat it as one, since it is
+            // certainly not ours.
+            fromFork: head !== base,
+        },
+    };
+}
+/** Collapse queued work per pull request: only the newest push is worth reviewing. */
+export const jobKey = (j) => `${j.owner}/${j.repo}#${j.number}`;
+//# sourceMappingURL=events.js.map

package/dist/app/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/app/events.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA+BH,mFAAmF;AACnF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,OAAgB;IAC1D,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9C,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,EAAE,EAAE,CAAC;IAEhE,MAAM,CAAC,GAAG,OAAyB,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;IAE9D,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1B,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,EAAE,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC;IAC9B,MAAM,OAAO,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC;IAE9B,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1E,OAAO,EAAE,IAAI,EAAE,iEAAiE,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,EAAE,EAAE,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClF,IAAI,EAAE,EAAE,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;IACvC,OAAO;QACL,GAAG,EAAE;YACH,cAAc;YACd,KAAK;YACL,IAAI;YACJ,MAAM;YACN,OAAO;YACP,OAAO;YACP,0EAA0E;YAC1E,sBAAsB;YACtB,QAAQ,EAAE,IAAI,KAAK,IAAI;SACxB;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/app/identity.d.ts

@@ -0,0 +1,54 @@
+export interface AppCredentials {
+    appId: string;
+    /** PEM, as GitHub hands it over. */
+    privateKey: string;
+}
+/**
+ * A signed App JWT.
+ *
+ * `iat` is backdated a minute: GitHub compares against ITS clock, and a server
+ * running even slightly fast has its tokens rejected as "issued in the future" —
+ * a failure that looks like a bad key and is not.
+ */
+export declare function appJwt(creds: AppCredentials, nowMs: number): string;
+export interface TokenResponse {
+    token: string;
+    expires_at: string;
+}
+/** Minimal shape of `fetch`, so tests need no network and no mocking library. */
+export type Fetch = (url: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text: () => Promise<string>;
+}>;
+/**
+ * Installation tokens, fetched once and reused until they are nearly expired.
+ *
+ * Tokens last an hour and a busy repository can fire a dozen webhooks a minute;
+ * without the cache every one of them spends a round trip and a signature.
+ */
+export declare class InstallationTokens {
+    private readonly creds;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly api;
+    private readonly cache;
+    constructor(creds: AppCredentials, fetchImpl: Fetch, now?: () => number, api?: string);
+    get(installationId: number): Promise<string>;
+    /** Drop a token GitHub has rejected, so the next call fetches a fresh one. */
+    invalidate(installationId: number): void;
+}
+/**
+ * Is this delivery really from GitHub?
+ *
+ * The webhook endpoint is public, and everything downstream — cloning a repo,
+ * posting as the App — happens on its say-so. Compared in constant time because
+ * a byte-at-a-time comparison leaks the expected digest to anyone willing to
+ * measure, and forging a signature is a total compromise of the endpoint.
+ */
+export declare function verifySignature(secret: string, body: string, header: string | undefined): boolean;
+//# sourceMappingURL=identity.d.ts.map

package/dist/app/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/app/identity.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC;IACxH,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC,CAAC;AAOH;;;;;GAKG;AACH,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;gBAGpC,KAAK,EAAE,cAAc,EACrB,SAAS,EAAE,KAAK,EAChB,GAAG,GAAE,MAAM,MAAiB,EAC5B,GAAG,SAA2B;IAG3C,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBlD,8EAA8E;IAC9E,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;CAGzC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMjG"}

package/dist/app/identity.js

@@ -0,0 +1,96 @@
+/**
+ * Who the App is, to GitHub.
+ *
+ * A GitHub App authenticates twice over: it signs a short JWT with its private
+ * key to prove it is the App, then trades that for an *installation* token scoped
+ * to one repository owner. The installation token is what matters here — it is
+ * the reason this exists at all. A workflow on a fork's pull request gets a
+ * read-only token and cannot comment; an App's installation token belongs to the
+ * base repository, so a fork PR is no different from any other.
+ *
+ * `node:crypto` signs the JWT, so there is no dependency to audit for something
+ * that handles a private key.
+ */
+import { createHmac, createSign, timingSafeEqual } from "node:crypto";
+/** GitHub rejects a JWT older than 60s or more than 10 minutes in the future. */
+const JWT_TTL_S = 540; // 9 minutes, inside the limit with room for clock skew
+/** Renew this long before expiry rather than racing it. */
+const RENEW_MARGIN_MS = 60_000;
+const b64url = (b) => Buffer.from(b).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+/**
+ * A signed App JWT.
+ *
+ * `iat` is backdated a minute: GitHub compares against ITS clock, and a server
+ * running even slightly fast has its tokens rejected as "issued in the future" —
+ * a failure that looks like a bad key and is not.
+ */
+export function appJwt(creds, nowMs) {
+    const iat = Math.floor(nowMs / 1000) - 60;
+    const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+    const payload = b64url(JSON.stringify({ iat, exp: iat + JWT_TTL_S, iss: creds.appId }));
+    const signer = createSign("RSA-SHA256");
+    signer.update(`${header}.${payload}`);
+    return `${header}.${payload}.${b64url(signer.sign(creds.privateKey))}`;
+}
+/**
+ * Installation tokens, fetched once and reused until they are nearly expired.
+ *
+ * Tokens last an hour and a busy repository can fire a dozen webhooks a minute;
+ * without the cache every one of them spends a round trip and a signature.
+ */
+export class InstallationTokens {
+    creds;
+    fetchImpl;
+    now;
+    api;
+    cache = new Map();
+    constructor(creds, fetchImpl, now = Date.now, api = "https://api.github.com") {
+        this.creds = creds;
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+        this.api = api;
+    }
+    async get(installationId) {
+        const hit = this.cache.get(installationId);
+        if (hit && hit.expiresMs - RENEW_MARGIN_MS > this.now())
+            return hit.token;
+        const res = await this.fetchImpl(`${this.api}/app/installations/${installationId}/access_tokens`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${appJwt(this.creds, this.now())}`,
+                accept: "application/vnd.github+json",
+                "user-agent": "graft-app",
+            },
+        });
+        const body = await res.text();
+        if (!res.ok) {
+            // The body carries GitHub's reason ("integration not found", a key that does
+            // not match the app id); losing it turns every setup mistake into "401".
+            throw new Error(`installation token for ${installationId} failed: ${res.status} ${body.slice(0, 200)}`);
+        }
+        const parsed = JSON.parse(body);
+        this.cache.set(installationId, { token: parsed.token, expiresMs: Date.parse(parsed.expires_at) });
+        return parsed.token;
+    }
+    /** Drop a token GitHub has rejected, so the next call fetches a fresh one. */
+    invalidate(installationId) {
+        this.cache.delete(installationId);
+    }
+}
+/**
+ * Is this delivery really from GitHub?
+ *
+ * The webhook endpoint is public, and everything downstream — cloning a repo,
+ * posting as the App — happens on its say-so. Compared in constant time because
+ * a byte-at-a-time comparison leaks the expected digest to anyone willing to
+ * measure, and forging a signature is a total compromise of the endpoint.
+ */
+export function verifySignature(secret, body, header) {
+    if (!header)
+        return false;
+    const expected = `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`;
+    const a = Buffer.from(expected);
+    const b = Buffer.from(header);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=identity.js.map

package/dist/app/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/app/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,iFAAiF;AACjF,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,uDAAuD;AAC9E,2DAA2D;AAC3D,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAU,EAAE,CAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAQ9F;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,KAAqB,EAAE,KAAa;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAIV;IACA;IACA;IACA;IANF,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,YACmB,KAAqB,EACrB,SAAgB,EAChB,MAAoB,IAAI,CAAC,GAAG,EAC5B,MAAM,wBAAwB;QAH9B,UAAK,GAAL,KAAK,CAAgB;QACrB,cAAS,GAAT,SAAS,CAAO;QAChB,QAAG,GAAH,GAAG,CAAyB;QAC5B,QAAG,GAAH,GAAG,CAA2B;IAC9C,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,cAAsB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAE1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,sBAAsB,cAAc,gBAAgB,EAAE;YAChG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE;gBACzD,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,WAAW;aAC1B;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6EAA6E;YAC7E,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,0BAA0B,cAAc,YAAY,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClG,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,UAAU,CAAC,cAAsB;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,MAA0B;IACtF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,QAAQ,GAAG,UAAU,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/app/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/app/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/app/main.ts"],"names":[],"mappings":""}

package/dist/app/main.js

@@ -0,0 +1,56 @@
+/**
+ * Entry point: read the environment, refuse to start half-configured, listen.
+ *
+ * Every misconfiguration is fatal at boot rather than at the first webhook. A
+ * server that starts without a webhook secret looks healthy and silently rejects
+ * every delivery; one that starts without a private key looks healthy and fails
+ * every review. Both are worth a loud death on line one.
+ */
+import { createApp } from "./server.js";
+function required(name) {
+    const value = process.env[name];
+    if (!value) {
+        console.error(`✗ ${name} is required`);
+        process.exit(1);
+    }
+    return value;
+}
+/**
+ * GitHub hands the private key over as a PEM file. Env vars cannot hold newlines
+ * comfortably, so both spellings are accepted: the raw PEM, or one with `\n`
+ * escaped — the shape you get from pasting a key into a hosting provider's UI.
+ */
+function privateKey() {
+    const raw = required("GRAFT_APP_PRIVATE_KEY");
+    const pem = raw.includes("\\n") ? raw.replace(/\\n/g, "\n") : raw;
+    if (!pem.includes("BEGIN") || !pem.includes("PRIVATE KEY")) {
+        console.error("✗ GRAFT_APP_PRIVATE_KEY does not look like a PEM private key");
+        process.exit(1);
+    }
+    return pem;
+}
+const port = Number(process.env.PORT ?? 3000);
+const { server, queue } = createApp({
+    appId: required("GRAFT_APP_ID"),
+    privateKey: privateKey(),
+    webhookSecret: required("GRAFT_WEBHOOK_SECRET"),
+    publicUrl: required("GRAFT_PUBLIC_URL"),
+    port,
+    concurrency: Number(process.env.GRAFT_CONCURRENCY ?? 2),
+});
+/**
+ * Finish what is in flight before dying.
+ *
+ * A container gets a TERM and a grace period on every deploy. Dropping a review
+ * mid-clone leaves a stale comment on a pull request and no retry, because the
+ * delivery was acknowledged long ago.
+ */
+for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.on(signal, () => {
+        console.log(`${signal}: draining ${queue.size} job(s)`);
+        server.close();
+        void queue.drain().then(() => process.exit(0));
+        setTimeout(() => process.exit(1), 25_000).unref();
+    });
+}
+//# sourceMappingURL=main.js.map

package/dist/app/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/app/main.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC9C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAClC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC;IAC/B,UAAU,EAAE,UAAU,EAAE;IACxB,aAAa,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IAC/C,SAAS,EAAE,QAAQ,CAAC,kBAAkB,CAAC;IACvC,IAAI;IACJ,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC;CACxD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/app/pages.d.ts

@@ -0,0 +1,39 @@
+export interface StoredPage {
+    html: string;
+    storedMs: number;
+}
+export interface PageStoreOptions {
+    secret: string;
+    ttlMs?: number;
+    maxPages?: number;
+    now?: () => number;
+}
+export declare class PageStore {
+    private readonly pages;
+    private readonly secret;
+    private readonly ttlMs;
+    private readonly maxPages;
+    private readonly now;
+    constructor(opts: PageStoreOptions);
+    /** `owner/repo#number` → a path segment safe to put in a URL. */
+    static idFor(owner: string, repo: string, number: number): string;
+    /** Store (replacing any previous page for the same PR) and return `id` + `token`. */
+    put(owner: string, repo: string, number: number, html: string): {
+        id: string;
+        token: string;
+    };
+    /**
+     * The page, if the token is valid and it has not expired.
+     *
+     * Expiry is checked against the STORED time rather than encoded in the token,
+     * so a link cannot outlive the data it points at — and re-reviewing a PR
+     * refreshes both together.
+     */
+    get(id: string, token: string | undefined): string | null;
+    get size(): number;
+    private sign;
+    private valid;
+    /** Oldest out first, plus anything past its TTL. */
+    private evict;
+}
+//# sourceMappingURL=pages.d.ts.map

package/dist/app/pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../src/app/pages.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,gBAAgB;IAOlC,iEAAiE;IACjE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAIjE,qFAAqF;IACrF,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAO7F;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAUzD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,KAAK;IAQb,oDAAoD;IACpD,OAAO,CAAC,KAAK;CASd"}

package/dist/app/pages.js

@@ -0,0 +1,86 @@
+/**
+ * Where a reviewed pull request's page lives.
+ *
+ * This is the part GitHub Pages could not do. A private repository's graph must
+ * not be readable by anyone who guesses a URL, and the Actions route had only two
+ * options: publish to a public branch, or hand the reader a zip. So the page is
+ * held here and linked with a signed, expiring URL.
+ *
+ * The signature is the whole access-control story, deliberately: it is a
+ * capability, not a login. Anyone with the link can read that one page until it
+ * expires, which is the same property a GitHub artifact link has, and the link
+ * only ever appears in a comment on the pull request it describes.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** Long enough to review a PR at leisure, short enough that a leaked link dies. */
+const DEFAULT_TTL_MS = 14 * 24 * 60 * 60 * 1000;
+/** A page is ~50 kB; a few hundred of them is nothing, and eviction is by age. */
+const DEFAULT_MAX_PAGES = 500;
+export class PageStore {
+    pages = new Map();
+    secret;
+    ttlMs;
+    maxPages;
+    now;
+    constructor(opts) {
+        this.secret = opts.secret;
+        this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+        this.maxPages = opts.maxPages ?? DEFAULT_MAX_PAGES;
+        this.now = opts.now ?? Date.now;
+    }
+    /** `owner/repo#number` → a path segment safe to put in a URL. */
+    static idFor(owner, repo, number) {
+        return `${owner}__${repo}__${number}`.replace(/[^A-Za-z0-9_.-]/g, "-");
+    }
+    /** Store (replacing any previous page for the same PR) and return `id` + `token`. */
+    put(owner, repo, number, html) {
+        const id = PageStore.idFor(owner, repo, number);
+        this.pages.set(id, { html, storedMs: this.now() });
+        this.evict();
+        return { id, token: this.sign(id) };
+    }
+    /**
+     * The page, if the token is valid and it has not expired.
+     *
+     * Expiry is checked against the STORED time rather than encoded in the token,
+     * so a link cannot outlive the data it points at — and re-reviewing a PR
+     * refreshes both together.
+     */
+    get(id, token) {
+        const page = this.pages.get(id);
+        if (!page || !token || !this.valid(id, token))
+            return null;
+        if (this.now() - page.storedMs > this.ttlMs) {
+            this.pages.delete(id);
+            return null;
+        }
+        return page.html;
+    }
+    get size() {
+        return this.pages.size;
+    }
+    sign(id) {
+        return createHmac("sha256", this.secret).update(id).digest("hex").slice(0, 32);
+    }
+    valid(id, token) {
+        const a = Buffer.from(this.sign(id));
+        const b = Buffer.from(token);
+        // Length first: timingSafeEqual throws on a mismatch, which would turn a
+        // truncated token into a 500 instead of a 404.
+        return a.length === b.length && timingSafeEqual(a, b);
+    }
+    /** Oldest out first, plus anything past its TTL. */
+    evict() {
+        const cutoff = this.now() - this.ttlMs;
+        for (const [id, page] of this.pages)
+            if (page.storedMs < cutoff)
+                this.pages.delete(id);
+        while (this.pages.size > this.maxPages) {
+            const oldest = this.pages.keys().next();
+            if (oldest.done)
+                break;
+            this.pages.delete(oldest.value);
+        }
+    }
+}
+//# sourceMappingURL=pages.js.map

package/dist/app/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/app/pages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,mFAAmF;AACnF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAc9B,MAAM,OAAO,SAAS;IACH,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,MAAM,CAAS;IACf,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,GAAG,CAAe;IAEnC,YAAY,IAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,KAAK,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc;QACtD,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,qFAAqF;IACrF,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc,EAAE,IAAY;QAC3D,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,EAAU,EAAE,KAAyB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAEO,IAAI,CAAC,EAAU;QACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,EAAU,EAAE,KAAa;QACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,oDAAoD;IAC5C,KAAK;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,IAAI,CAAC,QAAQ,GAAG,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}

package/dist/app/queue.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The work queue.
+ *
+ * A webhook must be answered in seconds, and a review takes tens of them, so the
+ * HTTP handler's only job is to enqueue. Two properties matter and neither comes
+ * free from a bare array:
+ *
+ *  - **Superseding.** Five pushes to one pull request in a minute is normal, and
+ *    reviewing the first four is wasted work whose comments are immediately
+ *    overwritten. A queued job for the same PR is replaced, not appended.
+ *  - **A ceiling.** One repository must not be able to starve every other
+ *    installation, so a fixed number of workers drain the queue.
+ */
+export interface QueueOptions {
+    concurrency?: number;
+    /** Called for every failure: a job that throws must not take the process down,
+     * and a silent catch would hide a broken installation forever. */
+    onError?: (err: unknown, key: string) => void;
+}
+export declare class WorkQueue<T> {
+    private readonly run;
+    private readonly pending;
+    private readonly running;
+    private readonly concurrency;
+    private readonly onError;
+    private idle;
+    constructor(run: (item: T) => Promise<void>, opts?: QueueOptions);
+    /**
+     * Queue work under `key`, replacing anything queued under it and not yet started.
+     *
+     * A job already RUNNING is left alone: cancelling mid-clone buys nothing, and
+     * the newer job simply runs after it and overwrites the comment.
+     */
+    push(key: string, item: T): void;
+    get size(): number;
+    /** Resolves when nothing is queued or running — for tests and for shutdown. */
+    drain(): Promise<void>;
+    private pump;
+}
+//# sourceMappingURL=queue.d.ts.map

package/dist/app/queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../src/app/queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;sEACkE;IAClE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED,qBAAa,SAAS,CAAC,CAAC;IAQpB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,IAAI,CAAyB;gBAGlB,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EAChD,IAAI,GAAE,YAAiB;IAMzB;;;;;OAKG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI;IAKhC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+EAA+E;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,OAAO,CAAC,IAAI;CAoBb"}

package/dist/app/queue.js

@@ -0,0 +1,68 @@
+/**
+ * The work queue.
+ *
+ * A webhook must be answered in seconds, and a review takes tens of them, so the
+ * HTTP handler's only job is to enqueue. Two properties matter and neither comes
+ * free from a bare array:
+ *
+ *  - **Superseding.** Five pushes to one pull request in a minute is normal, and
+ *    reviewing the first four is wasted work whose comments are immediately
+ *    overwritten. A queued job for the same PR is replaced, not appended.
+ *  - **A ceiling.** One repository must not be able to starve every other
+ *    installation, so a fixed number of workers drain the queue.
+ */
+export class WorkQueue {
+    run;
+    pending = new Map();
+    running = new Set();
+    concurrency;
+    onError;
+    idle = [];
+    constructor(run, opts = {}) {
+        this.run = run;
+        this.concurrency = Math.max(1, opts.concurrency ?? 2);
+        this.onError = opts.onError ?? (() => { });
+    }
+    /**
+     * Queue work under `key`, replacing anything queued under it and not yet started.
+     *
+     * A job already RUNNING is left alone: cancelling mid-clone buys nothing, and
+     * the newer job simply runs after it and overwrites the comment.
+     */
+    push(key, item) {
+        this.pending.set(key, item);
+        this.pump();
+    }
+    get size() {
+        return this.pending.size + this.running.size;
+    }
+    /** Resolves when nothing is queued or running — for tests and for shutdown. */
+    async drain() {
+        if (this.size === 0)
+            return;
+        await new Promise((resolve) => this.idle.push(resolve));
+    }
+    pump() {
+        while (this.running.size < this.concurrency) {
+            const next = this.pending.entries().next();
+            if (next.done)
+                break;
+            const [key, item] = next.value;
+            this.pending.delete(key);
+            this.running.add(key);
+            void this.run(item)
+                .catch((err) => this.onError(err, key))
+                .finally(() => {
+                this.running.delete(key);
+                this.pump();
+                if (this.size === 0) {
+                    const waiting = this.idle;
+                    this.idle = [];
+                    for (const resolve of waiting)
+                        resolve();
+                }
+            });
+        }
+    }
+}
+//# sourceMappingURL=queue.js.map

package/dist/app/queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.js","sourceRoot":"","sources":["../../src/app/queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,OAAO,SAAS;IAQD;IAPF,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IAC/B,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,WAAW,CAAS;IACpB,OAAO,CAAsC;IACtD,IAAI,GAAsB,EAAE,CAAC;IAErC,YACmB,GAA+B,EAChD,OAAqB,EAAE;QADN,QAAG,GAAH,GAAG,CAA4B;QAGhD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,GAAW,EAAE,IAAO;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAEO,IAAI;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;iBAChB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;iBACtC,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;oBAC1B,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;oBACf,KAAK,MAAM,OAAO,IAAI,OAAO;wBAAE,OAAO,EAAE,CAAC;gBAC3C,CAAC;YACH,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;CACF"}

package/dist/app/review.d.ts

@@ -0,0 +1,23 @@
+import type { ReviewJob } from "./events.js";
+import type { Fetch } from "./identity.js";
+/** Hidden marker: how the App finds the comment it owns, on every later push. */
+export declare const MARKER = "<!-- graft-blast-radius -->";
+export interface ReviewDeps {
+    token: (installationId: number) => Promise<string>;
+    fetch: Fetch;
+    api?: string;
+    /** Somewhere to put the viewer page; returns the URL to link. Optional: the
+     * comment is useful on its own, and a page that fails to publish must not cost
+     * the review. */
+    publish?: (job: ReviewJob, html: string) => Promise<string | null>;
+    log?: (msg: string) => void;
+}
+export interface ReviewResult {
+    /** `null` when the diff had nothing indexed to say. */
+    commentUrl: string | null;
+    areas: number;
+    affected: number;
+    viewerUrl: string | null;
+}
+export declare function reviewPullRequest(job: ReviewJob, deps: ReviewDeps): Promise<ReviewResult>;
+//# sourceMappingURL=review.d.ts.map

package/dist/app/review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/app/review.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,iFAAiF;AACjF,eAAO,MAAM,MAAM,gCAAgC,CAAC;AAIpD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;qBAEiB;IACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAmD/F"}