@open-everywhere/core 0.1.0

package/dist/agent/scm/github-search.js

@@ -0,0 +1,122 @@
+// GitHub's WORK-SEARCH adapter (OPE-961) — the GitHub Search API over the issue/PR conversation
+// plane, on a per-owner installation token union-scoped to this session's GRANTED repos
+// (`resolveAccessFor(ctx).repos` — the same repo grant `scm/github-work.ts`'s `githubWorkMount`
+// reads, `access/work-grant.ts`'s GITHUB header explains why it's a repo list and not a
+// `Domain.credentials` row).
+//
+// REGISTERED UNGATED (`registerCoreWorkSearchAdapter`, not `registerWorkSearchAdapter`), because
+// GitHub's SCM plane does not participate in provider SELECTION at all — `githubWorkMount` never
+// calls `admitProviderRegistration` either, and github/agent/register.ts's own header states the
+// doctrine: "SCM subsystem STAYS IN CORE ... register from core exactly as before."
+// 🔴 "UNGATED" THERE NAMES PROVIDER SELECTION AND NOTHING ELSE. The adapter's own `search` passes the
+// ACTING-IDENTITY gate (scm/github-acting-identity.ts) like every other GitHub read, so an
+// own-account ask is refused rather than answered as the org (OPE-1642).
+//
+// 🔴 `insideDomain` IS A DOCUMENTED NO-OP HERE, AND THAT IS HONEST, NOT A GAP. Every call —
+// scoped or not — is already qualified to `repo:` for exactly this domain's own granted repos: the
+// domain's work GRANT *is* that repo list (there is no wider GitHub reach a session could hold to
+// narrow away from). Compare Notion/Linear, where a single shared credential's reach can exceed one
+// domain's own declared space and the flag has something real to narrow.
+//
+// PER-OWNER FAN-OUT, because one GitHub App installation token cannot span two owners. Repos are
+// grouped by owner, one Search API call per owner, results merged and capped at `limit`.
+import { assertGithubActingIdentity } from "./github-acting-identity.js";
+import { getGitHubApp, repoAllowed } from "./provider.js";
+import { CONVERSATION_READ_PERMISSIONS } from "./mint.js";
+import { prApiHeaders } from "./pr.js";
+import { resolveAccessFor } from "../access/request.js";
+import { registerCoreWorkSearchAdapter } from "../channels/work-search.js";
+/**
+ * Search GitHub issues + PRs across `repos` (a session's full granted set) for `query`, one
+ * installation-token Search API call per owner. Throws on no configured App, no token for any
+ * granted owner, or a non-2xx from any owner's call — the caller (the adapter below, or the
+ * federating `search` tool) turns that into a named per-connector absence rather than faking a
+ * result.
+ */
+export async function searchGithubIssues(repos, query, limit, opts = {}) {
+    const app = opts.app === undefined ? getGitHubApp() : opts.app;
+    if (!app)
+        throw new Error("no GitHub App configured — GitHub search is unavailable.");
+    const { tokens, ungranted } = await app.tokensForRepos(repos, CONVERSATION_READ_PERMISSIONS);
+    if (tokens.size === 0) {
+        throw new Error(`no installation token for any of this domain's granted repos (${(ungranted.length ? ungranted : repos).join(", ")}).`);
+    }
+    const fetchFn = opts.fetchFn ?? globalThis.fetch;
+    const apiBase = opts.apiBase ?? "https://api.github.com";
+    const perPage = Math.min(Math.max(limit, 1), 100);
+    const byOwner = new Map();
+    for (const r of repos) {
+        const slash = r.indexOf("/");
+        if (slash <= 0)
+            continue;
+        const owner = r.slice(0, slash);
+        if (!tokens.has(owner))
+            continue; // ungranted owner — skip, not a failure of the whole call
+        const list = byOwner.get(owner);
+        if (list)
+            list.push(r);
+        else
+            byOwner.set(owner, [r]);
+    }
+    const hits = [];
+    for (const [owner, ownerRepos] of byOwner) {
+        const token = tokens.get(owner).token;
+        const qualifiers = ownerRepos.map((r) => `repo:${r}`).join(" ");
+        const q = `${query} ${qualifiers}`.trim();
+        const url = `${apiBase}/search/issues?q=${encodeURIComponent(q)}&per_page=${perPage}`;
+        const res = await fetchFn(url, { method: "GET", headers: prApiHeaders(token) });
+        if (!res.ok)
+            throw new Error(`GitHub search failed for "${owner}": ${res.status} ${await res.text()}`);
+        const data = (await res.json());
+        const items = Array.isArray(data.items) ? data.items : [];
+        for (const item of items) {
+            if (typeof item.number !== "number" || typeof item.repository_url !== "string")
+                continue;
+            const repoMatch = /\/repos\/(.+)$/.exec(item.repository_url);
+            const repo = repoMatch ? repoMatch[1] : `${owner}/?`;
+            // Defensive re-check: never surface a hit from a repo outside the granted set, whatever the
+            // API returned (the query's own `repo:` qualifiers already enforce this — belt and braces).
+            if (!repoAllowed(repo, repos))
+                continue;
+            hits.push({
+                connector: "github",
+                id: `${repo}#${item.number}`,
+                title: typeof item.title === "string" && item.title.length > 0 ? item.title : "(untitled)",
+                ...(typeof item.html_url === "string" ? { url: item.html_url } : {}),
+            });
+        }
+    }
+    return hits.slice(0, limit);
+}
+export const githubWorkSearchAdapter = {
+    connector: "github",
+    async search(ctx, _domain, query, opts) {
+        const repos = resolveAccessFor(ctx).repos;
+        if (repos.length === 0)
+            throw new Error("this domain holds no GitHub repo grant.");
+        // 🔴 THE ACTING-IDENTITY GATE, ON THE ADAPTER RATHER THAN ON `searchGithubIssues` (OPE-1642).
+        // This method is the only entry that holds a context, and `searchGithubIssues` is called directly
+        // by tests and by any future caller that already gated. It runs AFTER the grant check, so a
+        // session with no GitHub reach writes no `connector.acting_identity` row.
+        //
+        // 🔴 WHAT THE REFUSAL REACHES HERE, SAID EXACTLY. The federating `search` tool CATCHES an
+        // adapter throw and reports it as a named per-connector absence (tools/search.ts), so the
+        // sentence reaches the model inside that tool's untrusted-fenced absence list — as information,
+        // not as an instruction it will obey. The SUBSTITUTION is closed either way: this arm returns no
+        // hits at all rather than the org's view of the member's own question. Making the sentence
+        // instruction-grade would mean changing how the federator folds an absence, which is a different
+        // tool's contract.
+        await assertGithubActingIdentity(ctx, "search");
+        // `insideDomain` is intentionally unread — see this file's header.
+        return searchGithubIssues(repos, query, opts.limit);
+    },
+};
+let registered = false;
+/** Idempotent — safe to call from module load more than once (import ordering can revisit it). */
+export function registerGithubWorkSearch() {
+    if (registered)
+        return;
+    registered = true;
+    registerCoreWorkSearchAdapter(githubWorkSearchAdapter);
+}
+//# sourceMappingURL=github-search.js.map

package/dist/agent/scm/github-search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-search.js","sourceRoot":"","sources":["../../../agent/scm/github-search.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,wFAAwF;AACxF,gGAAgG;AAChG,wFAAwF;AACxF,6BAA6B;AAC7B,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,oFAAoF;AACpF,sGAAsG;AACtG,2FAA2F;AAC3F,yEAAyE;AACzE,EAAE;AACF,4FAA4F;AAC5F,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,yEAAyE;AACzE,EAAE;AACF,iGAAiG;AACjG,yFAAyF;AAEzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAkB,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,6BAA6B,EAA8C,MAAM,4BAA4B,CAAC;AAqBvH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB,EACxB,KAAa,EACb,KAAa,EACb,IAAI,GAAqB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1I,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAK,UAAU,CAAC,KAA8B,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,0DAA0D;QAC5F,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC;QACvC,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,GAAG,KAAK,IAAI,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,OAAO,oBAAoB,kBAAkB,CAAC,CAAC,CAAC,aAAa,OAAO,EAAE,CAAC;QACtF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,MAAM,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvG,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;gBAAE,SAAS;YACzF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;YACrD,4FAA4F;YAC5F,4FAA4F;YAC5F,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,QAAQ;gBACnB,EAAE,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE;gBAC5B,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;gBAC1F,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,SAAS,EAAE,QAAQ;IACnB,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,OAA2B,EAAE,KAAa,EAAE,IAA8C;QAC3H,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACnF,8FAA8F;QAC9F,kGAAkG;QAClG,4FAA4F;QAC5F,0EAA0E;QAC1E,EAAE;QACF,0FAA0F;QAC1F,0FAA0F;QAC1F,gGAAgG;QAChG,iGAAiG;QACjG,2FAA2F;QAC3F,iGAAiG;QACjG,mBAAmB;QACnB,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,mEAAmE;QACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;CACF,CAAC;AAEF,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB,kGAAkG;AAClG,MAAM,UAAU,wBAAwB;IACtC,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,6BAA6B,CAAC,uBAAuB,CAAC,CAAC;AACzD,CAAC"}

package/dist/agent/scm/github-work.d.ts

@@ -0,0 +1,17 @@
+import type { BindableContext } from "../identity/binding.js";
+/**
+ * The MOUNT predicate GitHub's work tools pass to `windowGated` — true when the calling scope grants
+ * at least one repo.
+ *
+ * FAILS OPEN, deliberately, and this is `windowGated`'s own stated rule for a `mountGate`: "a false
+ * predicate must fail-OPEN on anything it can't positively decide (never drop a tool from a seat
+ * that can use it)". `resolveAccessFor` throws when no app config is registered (an offline unit
+ * test, a boot-order fault) and an unreadable config is no evidence that the seat holds no repo. The
+ * fail-closed direction here would strand a working seat, and it would buy nothing: the repo fence
+ * at execute refuses an ungranted repo either way.
+ *
+ * Compare `notionWorkMount`, which fails CLOSED for the opposite reason — the Notion grant is that
+ * plane's only fence, so an unreadable config there must hide the tools.
+ */
+export declare function githubWorkMount(ctx: BindableContext): boolean;
+//# sourceMappingURL=github-work.d.ts.map

package/dist/agent/scm/github-work.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-work.d.ts","sourceRoot":"","sources":["../../../agent/scm/github-work.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAM7D"}

package/dist/agent/scm/github-work.js

@@ -0,0 +1,43 @@
+// GITHUB'S HALF OF THE WORK-SURFACE GRANT (OPE-940) — the mount predicate, and nothing else. The
+// GitHub counterpart of the notion/linear providers' own work modules, in core because GitHub's work
+// plane is core (scm/, tools/checkout_repo.ts, tools/open_pull_request.ts).
+//
+// WHAT THIS CLOSES. `checkout_repo` and `open_pull_request` mounted on the session's GRAIN alone
+// (access/window-gated.ts). Grain says "this seat has wide hands"; it says nothing about whether the
+// caller's scope grants a single repo. So a task worker on a domain with NO repo grant saw
+// `open_pull_request` mounted, picked a repo, and learned only from the refusal that it could reach
+// none — the OPE-927 "mounted tool that structurally cannot succeed" class, in its most permissive
+// form. The grant now decides the mount, the way it does for every other provider's work tools.
+//
+// THE GRANT IS THE REPO GRANT. `resolveAccessFor(ctx).repos` — the access bundle's `repos` for the
+// calling scope. access/work-grant.ts's GITHUB header carries the reasoning for that shape and the
+// condition that would move GitHub onto a `Domain.credentials` declaration.
+//
+// 🔴 THIS IS NOT THE WALL. Every GitHub write still calls `repoAllowed(repo, access.repos)` on the
+// repo it was handed (scm/provider.ts), and that check is authoritative. The mount predicate can only
+// remove a tool from a seat that could never have used it; it can never widen what a seat may reach.
+import { resolveAccessFor } from "../access/request.js";
+import { hasGithubWorkGrant } from "../access/work-grant.js";
+/**
+ * The MOUNT predicate GitHub's work tools pass to `windowGated` — true when the calling scope grants
+ * at least one repo.
+ *
+ * FAILS OPEN, deliberately, and this is `windowGated`'s own stated rule for a `mountGate`: "a false
+ * predicate must fail-OPEN on anything it can't positively decide (never drop a tool from a seat
+ * that can use it)". `resolveAccessFor` throws when no app config is registered (an offline unit
+ * test, a boot-order fault) and an unreadable config is no evidence that the seat holds no repo. The
+ * fail-closed direction here would strand a working seat, and it would buy nothing: the repo fence
+ * at execute refuses an ungranted repo either way.
+ *
+ * Compare `notionWorkMount`, which fails CLOSED for the opposite reason — the Notion grant is that
+ * plane's only fence, so an unreadable config there must hide the tools.
+ */
+export function githubWorkMount(ctx) {
+    try {
+        return hasGithubWorkGrant(resolveAccessFor(ctx).repos);
+    }
+    catch {
+        return true;
+    }
+}
+//# sourceMappingURL=github-work.js.map

package/dist/agent/scm/github-work.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-work.js","sourceRoot":"","sources":["../../../agent/scm/github-work.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,qGAAqG;AACrG,4EAA4E;AAC5E,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,2FAA2F;AAC3F,oGAAoG;AACpG,mGAAmG;AACnG,gGAAgG;AAChG,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,4EAA4E;AAC5E,EAAE;AACF,mGAAmG;AACnG,sGAAsG;AACtG,qGAAqG;AAErG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/agent/scm/installations.d.ts

@@ -0,0 +1,46 @@
+import type { GitHubInstallationRow } from "../operational/store.js";
+/**
+ * Compose the effective owner→installation map. PURE — this is the whole rule in one place:
+ * discovered rows first, the configured (env) map laid OVER them, so a configured owner always
+ * wins. Exported for the unit test; every live read goes through it.
+ */
+export declare function composeGitHubInstallations(configured: Readonly<Record<string, string>>, discoveredMap: Readonly<Record<string, string>>): Record<string, string>;
+/** The in-process discovered map (a snapshot — callers must not mutate it). Synchronous: no
+ *  store read, so a sync call site gets whatever this process has already learned, never a stall. */
+export declare function discoveredGitHubInstallations(): Readonly<Record<string, string>>;
+/** Monotonic counter over {@link discovered} changes — a cheap "has anything moved?" signal for
+ *  memoized consumers (provider.ts's getGitHubApp). */
+export declare function discoveredInstallationsGeneration(): number;
+/**
+ * Pull this org's persisted installations into the in-process cache. BEST-EFFORT by contract: a
+ * store error leaves the cache exactly as it was and resolves — the env map is the floor, so a
+ * broken/absent store degrades to today's behaviour rather than taking the SCM plane down.
+ * Idempotent + TTL'd + single-flight, so it is safe to call on every mint.
+ */
+export declare function hydrateGitHubInstallations(org?: string, now?: number): Promise<void>;
+/**
+ * Learn one installation (an `installation`/`created` or `unsuspend` delivery, or a metadata
+ * refresh from `installation_repositories`). Writes the durable row THEN updates the in-process
+ * cache, so a store failure propagates to the caller (the webhook leg audits + logs it) rather
+ * than leaving this process believing something it never persisted.
+ */
+export declare function recordGitHubInstallation(rec: GitHubInstallationRow, org?: string): Promise<void>;
+/**
+ * Forget one owner's installation (an `installation`/`deleted` or `suspend` delivery). Returns
+ * whether a persisted row was actually removed.
+ *
+ * NOTE the deliberate asymmetry: this clears only the DISCOVERED entry. An owner that is ALSO in
+ * `OE_GITHUB_INSTALLATIONS` stays resolvable, because env is authoritative (see the header) — a
+ * webhook must not be able to revoke what the operator pinned by hand. Such an owner's mints will
+ * fail at GitHub (the App genuinely isn't installed any more), which is the honest, visible
+ * failure; silently dropping an operator's own config would not be.
+ */
+export declare function forgetGitHubInstallation(owner: string, org?: string): Promise<boolean>;
+/**
+ * The effective installation id for one owner: the configured (env) map first, then whatever the
+ * webhook has taught us — hydrating from the store first so a cold instance sees installations it
+ * never handled the webhook for. Returns undefined when the owner has no installation either way
+ * (the caller surfaces that; it is never widened into a guess).
+ */
+export declare function resolveGitHubInstallationId(owner: string, configured?: Readonly<Record<string, string>>, org?: string): Promise<string | undefined>;
+//# sourceMappingURL=installations.d.ts.map

package/dist/agent/scm/installations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../../agent/scm/installations.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAgBrE;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC5C,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;qGACqG;AACrG,wBAAgB,6BAA6B,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEhF;AAED;uDACuD;AACvD,wBAAgB,iCAAiC,IAAI,MAAM,CAE1D;AASD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,GAAG,GAAE,MAAwB,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBvH;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,GAAE,MAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvH;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ7G;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA8C,EACzF,GAAG,GAAE,MAAwB,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B"}

package/dist/agent/scm/installations.js

@@ -0,0 +1,144 @@
+// Owner → installation id, WITHOUT the hand-edited env var (OPE-118 GitHub §3).
+//
+// THE PROBLEM: `OE_GITHUB_INSTALLATIONS` is a JSON map an operator edits (and redeploys) every
+// time a new org installs the GitHub App — so the "public app / Marketplace install" flow, which
+// GitHub makes fully self-service, dead-ends on a config change. GitHub already tells us: the App
+// registration's ONE webhook fans in an `installation` event (created/deleted/suspend/unsuspend/
+// new_permissions_accepted) plus `installation_repositories` (added/removed) for every install of
+// the App, across every account. This module is the durable half of consuming that.
+//
+// THE COMPOSITION RULE (the load-bearing decision): the ENV map stays AUTHORITATIVE and
+// webhook-discovered rows only AUGMENT it —
+//
+//     effective = { ...discovered, ...configured }        // configured wins every collision
+//
+// so (a) an operator who set the env var keeps EXACTLY today's behaviour, byte for byte; (b) a
+// hosted deploy whose store isn't writable (or isn't reachable at boot) still resolves every
+// env-configured owner; and (c) an operator override can never be silently displaced by whatever
+// a webhook delivered. The inverse composition would let an inbound delivery re-point an owner
+// the operator had pinned — exactly the wrong direction for a routing number.
+//
+// TRUST: rows are written ONLY from a delivery that already passed the App's shared-secret HMAC
+// gate (gateGithubDelivery / `GITHUB_WEBHOOK_SECRET`) in the webhook route — the same, single
+// verification path the chat surface uses; there is no second one. An installation id is not a
+// secret (it's a public routing number, useless without the App private key, which never leaves
+// env), so the row carries no credential material.
+//
+// PROCESS MODEL: serverless means the instance that HANDLED the install webhook is usually not
+// the instance that later mints a token, so an in-process map alone would be useless — hence the
+// durable table (operational/store.ts `github_installation`). The in-process map is a cache over
+// it: {@link hydrateGitHubInstallations} fills it once per process (TTL-refreshed), and a webhook
+// write updates it immediately so the handling instance converges without a round-trip.
+import { getOperationalStore } from "../operational/provider.js";
+import { deploymentOrg } from "../identity/binding.js";
+import { loadGitHubAppConfig } from "./config.js";
+/** How long a hydration is considered current before the next resolve re-reads the store. Short
+ *  enough that an install lands within a minute on an already-warm instance, long enough that the
+ *  mint path isn't a per-call DB read. */
+const HYDRATE_TTL_MS = 60_000;
+/** The in-process cache over the durable table: owner → installation id. */
+let discovered = {};
+let hydratedAt = 0;
+/** In-flight hydration, so N concurrent resolves share ONE store read (not N). */
+let inFlight = null;
+/** Bumped whenever {@link discovered} CHANGES — the memoized GitHubApp in provider.ts watches
+ *  this so a freshly-learned installation invalidates the cached app instead of going unseen. */
+let generation = 0;
+/**
+ * Compose the effective owner→installation map. PURE — this is the whole rule in one place:
+ * discovered rows first, the configured (env) map laid OVER them, so a configured owner always
+ * wins. Exported for the unit test; every live read goes through it.
+ */
+export function composeGitHubInstallations(configured, discoveredMap) {
+    return { ...discoveredMap, ...configured };
+}
+/** The in-process discovered map (a snapshot — callers must not mutate it). Synchronous: no
+ *  store read, so a sync call site gets whatever this process has already learned, never a stall. */
+export function discoveredGitHubInstallations() {
+    return discovered;
+}
+/** Monotonic counter over {@link discovered} changes — a cheap "has anything moved?" signal for
+ *  memoized consumers (provider.ts's getGitHubApp). */
+export function discoveredInstallationsGeneration() {
+    return generation;
+}
+function setDiscovered(next) {
+    const before = JSON.stringify(discovered);
+    const after = JSON.stringify(next);
+    discovered = next;
+    if (before !== after)
+        generation++;
+}
+/**
+ * Pull this org's persisted installations into the in-process cache. BEST-EFFORT by contract: a
+ * store error leaves the cache exactly as it was and resolves — the env map is the floor, so a
+ * broken/absent store degrades to today's behaviour rather than taking the SCM plane down.
+ * Idempotent + TTL'd + single-flight, so it is safe to call on every mint.
+ */
+export async function hydrateGitHubInstallations(org = deploymentOrg(), now = Date.now()) {
+    if (now - hydratedAt < HYDRATE_TTL_MS)
+        return;
+    if (inFlight)
+        return inFlight;
+    inFlight = (async () => {
+        try {
+            const rows = await getOperationalStore().listGitHubInstallations(org);
+            const next = {};
+            for (const r of rows)
+                next[r.owner] = r.installationId;
+            setDiscovered(next);
+            hydratedAt = now;
+        }
+        catch {
+            // Best-effort: keep whatever we already had. Deliberately silent — this runs on the mint
+            // path and a store blip must not narrate itself into every token mint's logs.
+        }
+        finally {
+            inFlight = null;
+        }
+    })();
+    return inFlight;
+}
+/**
+ * Learn one installation (an `installation`/`created` or `unsuspend` delivery, or a metadata
+ * refresh from `installation_repositories`). Writes the durable row THEN updates the in-process
+ * cache, so a store failure propagates to the caller (the webhook leg audits + logs it) rather
+ * than leaving this process believing something it never persisted.
+ */
+export async function recordGitHubInstallation(rec, org = deploymentOrg()) {
+    await getOperationalStore().putGitHubInstallation(org, rec);
+    setDiscovered({ ...discovered, [rec.owner]: rec.installationId });
+}
+/**
+ * Forget one owner's installation (an `installation`/`deleted` or `suspend` delivery). Returns
+ * whether a persisted row was actually removed.
+ *
+ * NOTE the deliberate asymmetry: this clears only the DISCOVERED entry. An owner that is ALSO in
+ * `OE_GITHUB_INSTALLATIONS` stays resolvable, because env is authoritative (see the header) — a
+ * webhook must not be able to revoke what the operator pinned by hand. Such an owner's mints will
+ * fail at GitHub (the App genuinely isn't installed any more), which is the honest, visible
+ * failure; silently dropping an operator's own config would not be.
+ */
+export async function forgetGitHubInstallation(owner, org = deploymentOrg()) {
+    const removed = await getOperationalStore().deleteGitHubInstallation(org, owner);
+    if (owner in discovered) {
+        const next = { ...discovered };
+        delete next[owner];
+        setDiscovered(next);
+    }
+    return removed;
+}
+/**
+ * The effective installation id for one owner: the configured (env) map first, then whatever the
+ * webhook has taught us — hydrating from the store first so a cold instance sees installations it
+ * never handled the webhook for. Returns undefined when the owner has no installation either way
+ * (the caller surfaces that; it is never widened into a guess).
+ */
+export async function resolveGitHubInstallationId(owner, configured = loadGitHubAppConfig()?.installations ?? {}, org = deploymentOrg()) {
+    const fromEnv = configured[owner];
+    if (fromEnv)
+        return fromEnv; // authoritative — never pay for a store read
+    await hydrateGitHubInstallations(org);
+    return composeGitHubInstallations(configured, discovered)[owner];
+}
+//# sourceMappingURL=installations.js.map

package/dist/agent/scm/installations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations.js","sourceRoot":"","sources":["../../../agent/scm/installations.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,iGAAiG;AACjG,kGAAkG;AAClG,oFAAoF;AACpF,EAAE;AACF,wFAAwF;AACxF,4CAA4C;AAC5C,EAAE;AACF,6FAA6F;AAC7F,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,iGAAiG;AACjG,+FAA+F;AAC/F,8EAA8E;AAC9E,EAAE;AACF,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,gGAAgG;AAChG,mDAAmD;AACnD,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,wFAAwF;AAExF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD;;0CAE0C;AAC1C,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,4EAA4E;AAC5E,IAAI,UAAU,GAA2B,EAAE,CAAC;AAC5C,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,kFAAkF;AAClF,IAAI,QAAQ,GAAyB,IAAI,CAAC;AAC1C;iGACiG;AACjG,IAAI,UAAU,GAAG,CAAC,CAAC;AAEnB;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAA4C,EAC5C,aAA+C;IAE/C,OAAO,EAAE,GAAG,aAAa,EAAE,GAAG,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED;qGACqG;AACrG,MAAM,UAAU,6BAA6B;IAC3C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,iCAAiC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,IAA4B;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,UAAU,GAAG,IAAI,CAAC;IAClB,IAAI,MAAM,KAAK,KAAK;QAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAG,GAAW,aAAa,EAAE,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IACtG,IAAI,GAAG,GAAG,UAAU,GAAG,cAAc;QAAE,OAAO;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;YACvD,aAAa,CAAC,IAAI,CAAC,CAAC;YACpB,UAAU,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,8EAA8E;QAChF,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAA0B,EAAE,GAAG,GAAW,aAAa,EAAE;IACtG,MAAM,mBAAmB,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5D,aAAa,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAa,EAAE,GAAG,GAAW,aAAa,EAAE;IACzF,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjF,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,aAAa,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAa,EACb,UAAU,GAAqC,mBAAmB,EAAE,EAAE,aAAa,IAAI,EAAE,EACzF,GAAG,GAAW,aAAa,EAAE;IAE7B,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,CAAC,6CAA6C;IAC1E,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC"}

package/dist/agent/scm/issue-actions.d.ts

@@ -0,0 +1,41 @@
+import type { RepoCapability } from "../access/repo-capabilities.js";
+import { type PrFetchFn } from "./pr.js";
+import type { EntityActionAdapter } from "../channels/entity-actions.js";
+import type { CreatedTicket, TicketCreateAdapter, TicketDraft } from "../channels/ticket-create.js";
+import { type RetryPolicy } from "../channels/rate-limit-retry.js";
+/** `owner/repo#123` → `{ repo: "owner/repo", number: 123 }`. Throws on any other shape — a
+ *  malformed entity id must never silently target the wrong issue. */
+export declare function parseGithubEntityId(id: string): {
+    repo: string;
+    number: number;
+};
+export interface GithubActionOpts {
+    readonly fetchFn?: PrFetchFn;
+    readonly apiBase?: string;
+    readonly resolveToken?: (repo: string) => Promise<string>;
+    /**
+     * Named capability sets the CALLING scope's binding opted this repo into (OPE-1024). The caller
+     * resolves them (it holds the ctx); this module never guesses. Absent ⇒ the default ticket-action
+     * job set, unchanged.
+     */
+    readonly capabilities?: readonly RepoCapability[];
+    /** Tightens or drives the 429 backoff (OPE-1253) — a test injects a stub `sleep`; omitted takes
+     *  the shared defaults from `channels/rate-limit-retry.ts`. */
+    readonly retry?: RetryPolicy;
+}
+/** set_state: `PATCH /issues/{number}` — GitHub's `state` is exactly "open" | "closed" (no free
+ *  transition names, unlike Jira/Linear's per-team states — see this file's header). */
+export declare function setGithubIssueState(entityId: string, state: string, opts?: GithubActionOpts): Promise<string>;
+/** assign: `POST /issues/{number}/assignees` — ADDS `assignee` as a login (GitHub's multi-
+ *  assignee model; never replaces the existing set). */
+export declare function assignGithubIssue(entityId: string, assignee: string, opts?: GithubActionOpts): Promise<string>;
+/** add_label: `POST /issues/{number}/labels` — ADDS `label` (never replaces the existing set). */
+export declare function addGithubIssueLabel(entityId: string, label: string, opts?: GithubActionOpts): Promise<string>;
+export declare const githubEntityAdapter: EntityActionAdapter;
+/** create_ticket's GitHub backend: file an issue on `repo` ("owner/repo"). Returns the new item as
+ *  a neutral EntityRef ("owner/repo#123") so add_label/assign/set_state can act on it with no
+ *  translation step. */
+export declare function createGithubIssue(repo: string, draft: TicketDraft, opts?: GithubActionOpts): Promise<CreatedTicket>;
+/** The registered create adapter (channels/ticket-create.ts registers this at its module load). */
+export declare const githubTicketCreateAdapter: TicketCreateAdapter;
+//# sourceMappingURL=issue-actions.d.ts.map

package/dist/agent/scm/issue-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-actions.d.ts","sourceRoot":"","sources":["../../../agent/scm/issue-actions.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAEvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAExF;sEACsE;AACtE,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAIhF;AAyBD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD;mEAC+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;CAC9B;AA6BD;wFACwF;AACxF,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvH;AAED;wDACwD;AACxD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxH;AAED,kGAAkG;AAClG,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvH;AA8BD,eAAO,MAAM,mBAAmB,EAAE,mBAOjC,CAAC;AAiBF;;wBAEwB;AACxB,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CA6B7H;AAYD,mGAAmG;AACnG,eAAO,MAAM,yBAAyB,EAAE,mBAKvC,CAAC"}

package/dist/agent/scm/issue-actions.js

@@ -0,0 +1,173 @@
+// GitHub ticket-action mutations — the Issues-REST sibling of pr.ts/pr-status.ts. Backs the
+// neutral entity-actions verbs (OPE-39: set_state/assign/add_label) for platform "github". GitHub
+// treats a PR as an issue for state/assignees/labels (the same `PATCH/POST /issues/{number}`
+// endpoints work on both — GitHub's own API model), so ONE set of functions covers issues and
+// PRs; the entity id carries which it is only as `owner/repo#number`, resolved here.
+//
+// CREDENTIAL: a GitHub App installation token minted with {@link ISSUE_WRITE_PERMISSIONS}
+// (`issues:write` + `metadata:read` — narrower than the PR-open write set: this plane can't touch
+// contents or PR metadata even if the token leaked), falling back to `GITHUB_TOKEN` — mirrors
+// pr-status.ts's resolveReadToken / pr-open.ts's resolveWriteToken, its own copy per that file's
+// stated precedent ("tools/ and approvals/ each own their copy of this 8-liner").
+//
+// SEMANTICS ARE ADDITIVE, mirroring Linear's issueAddLabel: `assign` POSTs to /assignees (adds,
+// GitHub's own multi-assignee model — never replaces the existing set) and `add_label` POSTs to
+// /labels (adds). `set_state` is the one REPLACING call (open/closed is a single field, not a set).
+//
+// AUTHZ: `checkAccess` enforces the SAME per-channel repo grant checkout_repo/open_pull_request/
+// check_pr_status already enforce (access/request.ts resolveAccessFor + scm/provider.ts
+// repoAllowed) — a GitHub-specific access dimension the neutral entity-actions core has no opinion
+// on, so it lives here, not in entity-actions.ts.
+import { getGitHubApp, repoAllowed } from "./provider.js";
+import { resolveAccessFor } from "../access/request.js";
+import { ISSUE_WRITE_PERMISSIONS, expandMintPermissions } from "./mint.js";
+import { prApiHeaders } from "./pr.js";
+import { currentTurnGithubTarget } from "../identity/binding.js";
+import { withRetryAfterLoose } from "../channels/rate-limit-retry.js";
+/** `owner/repo#123` → `{ repo: "owner/repo", number: 123 }`. Throws on any other shape — a
+ *  malformed entity id must never silently target the wrong issue. */
+export function parseGithubEntityId(id) {
+    const m = /^([^/#]+\/[^/#]+)#(\d+)$/.exec(id);
+    if (!m)
+        throw new Error(`invalid GitHub entity id "${id}" — expected "owner/repo#123".`);
+    return { repo: m[1], number: Number(m[2]) };
+}
+/** Resolve a WRITE-scoped GitHub credential for one repo — {@link ISSUE_WRITE_PERMISSIONS} via the
+ *  GitHub App, falling back to a `GITHUB_TOKEN` PAT. Mirrors pr-status.ts's resolveReadToken /
+ *  pr-open.ts's resolveWriteToken, issue-scoped instead of contents/PR-scoped. */
+async function resolveIssueWriteToken(repo, app = getGitHubApp(), capabilities = []) {
+    if (app) {
+        // THE DERIVATION (OPE-1024): the ticket-action job set is the DEFAULT; the binding's named
+        // capability sets expand it. No capability ⇒ `expandMintPermissions` returns
+        // ISSUE_WRITE_PERMISSIONS unchanged, which is byte-for-byte the body this call sent before.
+        // `pr-admin` is what adds `pull_requests: write` here — OPE-1021's filed 403 on a PULL REQUEST.
+        const { tokens, ungranted } = await app.tokensForRepos([repo], expandMintPermissions(ISSUE_WRITE_PERMISSIONS, capabilities));
+        if (!ungranted.length)
+            return tokens.get(repo.slice(0, repo.indexOf("/"))).token;
+    }
+    const pat = process.env.GITHUB_TOKEN;
+    if (!pat) {
+        throw new Error("no GitHub credential: configure the GitHub App (OE_GITHUB_APP_*) or set GITHUB_TOKEN.");
+    }
+    return pat;
+}
+/** Common plumbing every verb below shares: parse the entity id, mint/resolve the write token,
+ *  and refuse loudly on a non-2xx. `path`/`method`/`body` are per-verb; the caller supplies the
+ *  parsed `{repo, number}` back to the caller for its own message. `operation` is the vendor route
+ *  name `withRetryAfterLoose`'s `RateLimitExhaustedError` reports (OPE-1253) — distinct per verb, so an
+ *  exhausted retry says which one it was. */
+async function callIssueApi(repo, number, operation, path, method, body, opts) {
+    const fetchFn = opts.fetchFn ?? globalThis.fetch;
+    const apiBase = opts.apiBase ?? "https://api.github.com";
+    const token = await (opts.resolveToken ?? ((r) => resolveIssueWriteToken(r, getGitHubApp(), opts.capabilities ?? [])))(repo);
+    const res = await withRetryAfterLoose(() => fetchFn(`${apiBase}${path}`, { method, headers: prApiHeaders(token), body: JSON.stringify(body) }), {
+        ...opts.retry,
+        surface: "github",
+        operation,
+    });
+    if (!res.ok) {
+        throw new Error(`GitHub issue action failed for ${repo}#${number}: ${res.status} ${await res.text()}`);
+    }
+}
+/** set_state: `PATCH /issues/{number}` — GitHub's `state` is exactly "open" | "closed" (no free
+ *  transition names, unlike Jira/Linear's per-team states — see this file's header). */
+export async function setGithubIssueState(entityId, state, opts = {}) {
+    const { repo, number } = parseGithubEntityId(entityId);
+    const normalized = state.trim().toLowerCase();
+    if (normalized !== "open" && normalized !== "closed") {
+        throw new Error(`GitHub: state must be "open" or "closed" (got "${state}").`);
+    }
+    await callIssueApi(repo, number, "issues.update", `/repos/${repo}/issues/${number}`, "PATCH", { state: normalized }, opts);
+    return `GitHub ${repo}#${number} state set to "${normalized}".`;
+}
+/** assign: `POST /issues/{number}/assignees` — ADDS `assignee` as a login (GitHub's multi-
+ *  assignee model; never replaces the existing set). */
+export async function assignGithubIssue(entityId, assignee, opts = {}) {
+    const { repo, number } = parseGithubEntityId(entityId);
+    await callIssueApi(repo, number, "issues.assignees.add", `/repos/${repo}/issues/${number}/assignees`, "POST", { assignees: [assignee] }, opts);
+    return `GitHub ${repo}#${number} assigned to ${assignee}.`;
+}
+/** add_label: `POST /issues/{number}/labels` — ADDS `label` (never replaces the existing set). */
+export async function addGithubIssueLabel(entityId, label, opts = {}) {
+    const { repo, number } = parseGithubEntityId(entityId);
+    await callIssueApi(repo, number, "issues.labels.add", `/repos/${repo}/issues/${number}/labels`, "POST", { labels: [label] }, opts);
+    return `Label "${label}" added to GitHub ${repo}#${number}.`;
+}
+/** The per-channel repo grant checkout_repo / open_pull_request / check_pr_status all enforce —
+ *  fail-closed: a repo the channel isn't granted is refused, regardless of what the workspace's
+ *  GitHub App installation covers. Shared by the entity verbs (which parse the repo out of an
+ *  `owner/repo#n` entity id) and by create (whose destination IS the repo). */
+function requireRepoGrant(ctx, repo) {
+    const access = resolveAccessFor(ctx);
+    if (!repoAllowed(repo, access.repos)) {
+        throw new Error(`repo "${repo}" is not granted to this channel. Allowed: ${access.repos.length ? access.repos.join(", ") : "(none)"}. ` +
+            `Grant it via a bundle's repos (see agent/access/bundles.ts).`);
+    }
+}
+/** PROPOSE-time authz beyond the topology gate, for the entity-mutation verbs. */
+function checkGithubAccess(ctx, entityId) {
+    requireRepoGrant(ctx, parseGithubEntityId(entityId).repo);
+}
+/** The registered adapter (entity-actions.ts registers this at its module load). */
+/** The named capability sets THIS scope's binding opted the entity's repo into (OPE-1024). Reads
+ *  the resolved access, exactly as {@link requireRepoGrant} reads its repo list — so a capability
+ *  can only ever come from a binding that already grants the repo. */
+function githubCapabilitiesFor(ctx, entityId) {
+    const { repo } = parseGithubEntityId(entityId);
+    return resolveAccessFor(ctx).repoCapabilities[repo] ?? [];
+}
+export const githubEntityAdapter = {
+    platform: "github",
+    checkAccess: checkGithubAccess,
+    capabilitiesFor: githubCapabilitiesFor,
+    setState: (id, value, _organizationId, capabilities) => setGithubIssueState(id, value, { capabilities: capabilities ?? [] }),
+    assign: (id, value, _organizationId, capabilities) => assignGithubIssue(id, value, { capabilities: capabilities ?? [] }),
+    addLabel: (id, value, _organizationId, capabilities) => addGithubIssueLabel(id, value, { capabilities: capabilities ?? [] }),
+};
+/** create_ticket's GitHub backend: file an issue on `repo` ("owner/repo"). Returns the new item as
+ *  a neutral EntityRef ("owner/repo#123") so add_label/assign/set_state can act on it with no
+ *  translation step. */
+export async function createGithubIssue(repo, draft, opts = {}) {
+    if (!/^[^/#\s]+\/[^/#\s]+$/.test(repo)) {
+        throw new Error(`GitHub: invalid repo "${repo}" — expected "owner/repo".`);
+    }
+    const fetchFn = opts.fetchFn ?? globalThis.fetch;
+    const apiBase = opts.apiBase ?? "https://api.github.com";
+    const token = await (opts.resolveToken ?? ((r) => resolveIssueWriteToken(r, getGitHubApp(), opts.capabilities ?? [])))(repo);
+    const res = await withRetryAfterLoose(() => fetchFn(`${apiBase}/repos/${repo}/issues`, {
+        method: "POST",
+        headers: prApiHeaders(token),
+        body: JSON.stringify({ title: draft.title, body: draft.body }),
+    }), { ...opts.retry, surface: "github", operation: "issues.create" });
+    if (!res.ok) {
+        throw new Error(`GitHub issue creation failed for ${repo}: ${res.status} ${await res.text()}`);
+    }
+    const created = (await res.json());
+    if (typeof created.number !== "number") {
+        throw new Error(`GitHub: issue creation on ${repo} returned no issue number — unexpected API response.`);
+    }
+    const id = `${repo}#${created.number}`;
+    return {
+        ref: { platform: "github", id },
+        ...(typeof created.html_url === "string" ? { url: created.html_url } : {}),
+        summary: `Filed GitHub issue ${id}: "${draft.title}".`,
+    };
+}
+/** This turn's default repo: the delivery the wake is anchored to, else — when the channel grants
+ *  exactly ONE concrete repo — that repo. A wildcard grant ("owner/*") is never expanded into a
+ *  guess; the caller is asked for `target` instead. */
+function defaultGithubRepo(ctx) {
+    const t = currentTurnGithubTarget(ctx);
+    if (t)
+        return `${t.owner}/${t.repo}`;
+    const repos = resolveAccessFor(ctx).repos.filter((r) => !r.includes("*"));
+    return repos.length === 1 ? repos[0] : undefined;
+}
+/** The registered create adapter (channels/ticket-create.ts registers this at its module load). */
+export const githubTicketCreateAdapter = {
+    platform: "github",
+    checkAccess: (ctx, target) => requireRepoGrant(ctx, target),
+    defaultTarget: defaultGithubRepo,
+    create: (target, draft) => createGithubIssue(target, draft),
+};
+//# sourceMappingURL=issue-actions.js.map